4 ms·

A few years ago Steve Gibson talked about "The end of clever" on his podcast. Essentially that we've (now quite awhile ago) passed the point where a clever pass

A few years ago Steve Gibson talked about "The end of clever" on his podcast. Essentially that we've (now quite awhile ago) passed the point where a clever password was sufficient to protect you. All the database leaks have shown that many people aren't nearly as clever as they think they are. I'm not sure if Passkeys are going to prove out as a good solution, so for the moment I am inclined to say your best bet is a good password manager and long, random passwords.

spacedcowboy 3y ago
I don’t know about that. Clever still works for me I think, it’s just a matter of password length. One trick I still use today is to take the first letter of every word in a sequence I knew, and still substitute numbers and capitals. There are a lot of poems, and soliloquies in Shakespeare’s works, and opening lines of a book, etc. etc. Basically anything where you only need to remember something you already know, and where the “hint” can be something like “J12” for the first two lines of Jabberwocky. A decade or so ago, because I had to learn it for a school recital and know the poem backwards, I used Jabberwocky: Tbatstdgag1tw! - according to security.org’s password-strength-checker [1] that will take a computer 200,000,000 years to crack, presumably on average. I use a longer one today, and I skip words too, and some words I use 2 letters from - a similar string of characters to my current password is estimated at a trillion years. At one point, I was using the first 2 lines of “Sea Fever” by Masefield, but that got too long to type - ImgdttsattlsatsaaIaiatsatstshb … If you’re interested, that’s 2 septillion years. I don’t need to be that secure :) [1]: https://www.security.org/how-secure-is-my-password/ https://www.security.org/how-secure-is-my-password/
- ZydgQPiAtglF7N 3y ago
  Similarly, I use lyrics of songs I know well enough to be able to sing the words correctly, but are obscure enough that most people won't know them. Jut use the first letter of each word, and if you forget, you can hum along with it while typing. As an example, the chorus of the classic CCR song 'Have you ever seen the rain' (don't use this one) will give you a easy to remember 15 char password: Iwkhyestrcdoasd. And if you forget its easy to make a simple hint (something like 'Fogerty'). My advice, don't use the chorus - a 2nd or third verse you remember is better (and often longer). And google the lyrics before you make the password, just to check that you've been singing the right words all these years.
  - Tagbert 3y ago
    There’s a bathroom on the right ;)
    - gedy 3y ago
      Dad? Haha
- bawolff 3y ago
  > according to security.org’s password-strength-checker [1] that will take a computer 200,000,000 years to crack These types of things are very misleading. It is rare for a password to be bruteforced in general, it is unusual for the attacker to have the hashes of the actual site for an offline attack. Hopefully if the dev is competent there is rate limiting for an online attack. If the dev is competent they are hashing with argon2, pbkdf2, bcrypt etc tgat slows things down. Anyways - 95% of password based attacks are using the same password in multiple places with one of the other sites getting hacked (someone's probably going to point out exceptions, and they do exist). Unless your password is absolutely terrible, the threat is not lack of password complexity but lack of password uniqueness. Just to put it in perspective - 2FA is usually a six digit number, and that is considered secure since there are rate limits, and the user cannot reuse the key on multiple site. The security.org site says that can be cracked in 25 microseconds. There is obviously more to it then that since 2FA codes last more than 25 microseconds.
  - spacedcowboy 3y ago
    I should have clarified that I’m talking about my login and iCloud passwords here. For websites, I always use hide-my-email (hey, I wrote the client-side code for it) and a safari-suggested unique password for exactly the reason you mention. I do share those two (different) passwords around the machines I own, (ie: all login passwords are the same, and the iCloud password is shared of course) but I don’t see that as extending my risk at all. All of those machines are under my control for the login, and I know how well Apple secure the iCloud one.
- benjifri 3y ago
  Those estimates don't mean anything with quantum computing on the rise...
- midjji 3y ago
  A better way to tell if your password is secure is to download a gpu dictionary password cracker, and add in a couple of the big leaked password dictionaries, get at least the big ones so you have a few billion passwords and run it for a few hours. It will crack millions of clever passwords like just like that, and the only result is making someone like me wonder how can 7 people come up with the exact same seemingly unintelligible string that long.
- lolinder 3y ago
  > I used Jabberwocky: Tbatstdgag1tw! - according to security.org’s password-strength-checker [1] that will take a computer 200,000,000 years to crack, presumably on average Or much less time because it's already been leaked three times according to haveibeenpwned.com, so it'll already be in a bunch of rainbow tables. This is why clever isn't enough: not because you can't design one that's resilient to brute force attacks but because password reuse is the #1 threat to the password-oriented security model and you can't come up with hundreds of sufficiently strong clever passwords.
  - spacedcowboy 3y ago
    I think you missed the “10 years ago” bit. And you replied after I posted above that these are login passwords, used only on machines I own. I use unique passwords and hide-my-email on systems I don’t control, for exactly that reason.
    - lolinder 3y ago
      I definitely missed that these were login passwords!
bruce511 3y ago
Clever is fine, if long enough, but it doesn't scale. The problem is not that i need a clever password, it's that I need 100 of them. Given that problem I either reuse my clever one everywhere, or have a formula based on it, and the domain. In this age of scale, a password manager generating long random passwords is not "good to do", it's absolutely a requirement. Now all you need is one long, clever, resilient password to access the password manager.
- kevin_thibedeau 3y ago
  > In this age of scale, a password manager generating long random passwords is not "good to do", it's absolutely a requirement. One day there will be an exploit for your password manager.
  - Dylan16807 3y ago
    Any computer can get infected with a password stealer. As long as the password manager isn't significantly increasing the risk, then there's no problem.
  - ryandrake 3y ago
    All my passwords are “password” and I just use 2 factor auth for security.
    - bawolff 3y ago
      This is pretty risky given how lax sone places are with allowing customer service to be talked into removing 2fa.
      - 8organicbits 3y ago
        I've seen platforms that don't rate limit 2fa guesses. A six digit OTP has only a million possible values. Guessing once per second it only takes a couple days to guess. This is also why a platform should never confirm that a password is correct when 2FA is enabled, only confirm if both have been solved.

spacedcowboy 3y ago

I don’t know about that. Clever still works for me I think, it’s just a matter of password length. One trick I still use today is to take the first letter of every word in a sequence I knew, and still substitute numbers and capitals. There are a lot of poems, and soliloquies in Shakespeare’s works, and opening lines of a book, etc. etc. Basically anything where you only need to remember something you already know, and where the “hint” can be something like “J12” for the first two lines of Jabberwocky. A decade or so ago, because I had to learn it for a school recital and know the poem backwards, I used Jabberwocky: Tbatstdgag1tw! - according to security.org’s password-strength-checker [1] that will take a computer 200,000,000 years to crack, presumably on average. I use a longer one today, and I skip words too, and some words I use 2 letters from - a similar string of characters to my current password is estimated at a trillion years. At one point, I was using the first 2 lines of “Sea Fever” by Masefield, but that got too long to type - ImgdttsattlsatsaaIaiatsatstshb … If you’re interested, that’s 2 septillion years. I don’t need to be that secure :) [1]: https://www.security.org/how-secure-is-my-password/ https://www.security.org/how-secure-is-my-password/

ZydgQPiAtglF7N 3y ago
Similarly, I use lyrics of songs I know well enough to be able to sing the words correctly, but are obscure enough that most people won't know them. Jut use the first letter of each word, and if you forget, you can hum along with it while typing. As an example, the chorus of the classic CCR song 'Have you ever seen the rain' (don't use this one) will give you a easy to remember 15 char password: Iwkhyestrcdoasd. And if you forget its easy to make a simple hint (something like 'Fogerty'). My advice, don't use the chorus - a 2nd or third verse you remember is better (and often longer). And google the lyrics before you make the password, just to check that you've been singing the right words all these years.
- Tagbert 3y ago
  There’s a bathroom on the right ;)
  - gedy 3y ago
    Dad? Haha
bawolff 3y ago
> according to security.org’s password-strength-checker [1] that will take a computer 200,000,000 years to crack These types of things are very misleading. It is rare for a password to be bruteforced in general, it is unusual for the attacker to have the hashes of the actual site for an offline attack. Hopefully if the dev is competent there is rate limiting for an online attack. If the dev is competent they are hashing with argon2, pbkdf2, bcrypt etc tgat slows things down. Anyways - 95% of password based attacks are using the same password in multiple places with one of the other sites getting hacked (someone's probably going to point out exceptions, and they do exist). Unless your password is absolutely terrible, the threat is not lack of password complexity but lack of password uniqueness. Just to put it in perspective - 2FA is usually a six digit number, and that is considered secure since there are rate limits, and the user cannot reuse the key on multiple site. The security.org site says that can be cracked in 25 microseconds. There is obviously more to it then that since 2FA codes last more than 25 microseconds.
- spacedcowboy 3y ago
  I should have clarified that I’m talking about my login and iCloud passwords here. For websites, I always use hide-my-email (hey, I wrote the client-side code for it) and a safari-suggested unique password for exactly the reason you mention. I do share those two (different) passwords around the machines I own, (ie: all login passwords are the same, and the iCloud password is shared of course) but I don’t see that as extending my risk at all. All of those machines are under my control for the login, and I know how well Apple secure the iCloud one.
benjifri 3y ago
Those estimates don't mean anything with quantum computing on the rise...
midjji 3y ago
A better way to tell if your password is secure is to download a gpu dictionary password cracker, and add in a couple of the big leaked password dictionaries, get at least the big ones so you have a few billion passwords and run it for a few hours. It will crack millions of clever passwords like just like that, and the only result is making someone like me wonder how can 7 people come up with the exact same seemingly unintelligible string that long.
lolinder 3y ago
> I used Jabberwocky: Tbatstdgag1tw! - according to security.org’s password-strength-checker [1] that will take a computer 200,000,000 years to crack, presumably on average Or much less time because it's already been leaked three times according to haveibeenpwned.com, so it'll already be in a bunch of rainbow tables. This is why clever isn't enough: not because you can't design one that's resilient to brute force attacks but because password reuse is the #1 threat to the password-oriented security model and you can't come up with hundreds of sufficiently strong clever passwords.
- spacedcowboy 3y ago
  I think you missed the “10 years ago” bit. And you replied after I posted above that these are login passwords, used only on machines I own. I use unique passwords and hide-my-email on systems I don’t control, for exactly that reason.
  - lolinder 3y ago
    I definitely missed that these were login passwords!

bruce511 3y ago

Clever is fine, if long enough, but it doesn't scale. The problem is not that i need a clever password, it's that I need 100 of them. Given that problem I either reuse my clever one everywhere, or have a formula based on it, and the domain. In this age of scale, a password manager generating long random passwords is not "good to do", it's absolutely a requirement. Now all you need is one long, clever, resilient password to access the password manager.

kevin_thibedeau 3y ago
> In this age of scale, a password manager generating long random passwords is not "good to do", it's absolutely a requirement. One day there will be an exploit for your password manager.
- Dylan16807 3y ago
  Any computer can get infected with a password stealer. As long as the password manager isn't significantly increasing the risk, then there's no problem.
- ryandrake 3y ago
  All my passwords are “password” and I just use 2 factor auth for security.
  - bawolff 3y ago
    This is pretty risky given how lax sone places are with allowing customer service to be talked into removing 2fa.
    - 8organicbits 3y ago
      I've seen platforms that don't rate limit 2fa guesses. A six digit OTP has only a million possible values. Guessing once per second it only takes a couple days to guess. This is also why a platform should never confirm that a password is correct when 2FA is enabled, only confirm if both have been solved.