5 ms·

I always liked the 1Password word passwords… you select the number of words and it generates each word in upper OR lowercase, and connect them with symbols or n

by calgoo 2y ago

I always liked the 1Password word passwords… you select the number of words and it generates each word in upper OR lowercase, and connect them with symbols or numbers. Easy to memorize, and better then keepass or others that use more fixed formats: same characters between words and words are just in title format where the first letter is upper case and rest is lowercase.

nneonneo 2y ago
The extra randomness really only buys you a couple extra bits of entropy, but makes it more annoying to remember which format your password is in. It’s much more effective (entropy-wise and memory-wise) to tack on an extra word.
the_snooze 2y ago
I always make that the default in my 1Password instances. If the threats we're trying to protect against are mainly 1) weak passwords and 2) password reuse, then there's still room there for human-friendly readable passwords. I don't see much marginal benefit of generating something like cnC*i8Npc2J7zWRYFfsy (the common default template across password managers) over teo-PRETENDS4cognac.
jorvi 2y ago
The problem is that many sites still use archaic password rules. 1Password should by default just always capitalize one word, and add “1” at the end of the memorable password. Since the words are separated by “-“ or “.”, you already hit the “at least one symbol” rule.
- dark-star 2y ago
  I especially like sites that disallow pasting into password fields.... Yes, that is apparently a thing, especially for banking or finance related sites (from my experience)
  - yojo 2y ago
    For a while, the login for TreasuryDirect (the gov site for buying US bonds) disabled paste and typing! It required you to click out your password on an onscreen keyboard. I pity the folks who don’t know how to use dev tools.
    - commandersaki 2y ago
      Good on 'em for doing a complete 180 on that. Bank of Melbourne has stated that using a Password Manager is a violation of their Terms of Service (as people have complained about the non-pasteable/autofill fields).
      - magnetowasright 2y ago
        Last time I had the sincere displeasure of having to use bank of Melbourne, their password rules included that you couldn't have repeated letters, so if you were trying to use a passphrase like correct-horse-battery-staple it would not allow the double r in correct or double t in battery. The rest of their password rules were abhorrent like all financial institutions but that one in particular irritated me to no end.
    - nytesky 2y ago
      You buried the lead there: A required on-screen keyboard with RANDOM GENERATED LAYOUT.
      - jakub_g 2y ago
        For whomever is interested, IIRC, this requirement of random layout came up in late 2000/early 2010 due to: - keyloggers (safer to click instead of type instead -> on-screen keyboard then) - but then it turned out Internet Explorer had a bug which allowed attackers to read the mouse click events' X/Y coordinates in other windows which then could be mapped to the on-screen keyboard digits if the layout is predictable
      - brokenmachine 2y ago
- extraduder_ire 2y ago
  I was presently surprised by the password requirements when I created a bugzilla account just the other day. - Password must be at least 12 characters long. - And the password must also contain either of the following: - A phrase containing at least four unique words of three characters or longer - or password contains at least 3 of the following qualities: - uppercase letters - lowercase letters - numbers - punctuation characters - or more than 12 characters I went with the phrase option.
  - jorvi 2y ago
    I’ve seen minimums of 8 and 12, and maximums as low as 20. AgileBits obviously has done a lot more profiling, but it would be nice if they developed a universal password formula that was still memorable. So with words, “-“ separator (or maybe “.” separator?), maximum length 18, one whole word capitalized, random single digit at the end or beginning. That way you keep maximum entropy, keep it readable, whilst fitting within the rules of “all” sites. Although within 5-10 years I see passkeys having largely taken over, especially because mom and pop won’t be able to forget those, and they won’t be able to forget their fingerprint or face either.
  - jszymborski 2y ago
    Not sure why people are re-inventing the wheel here. Just use zxcvbn[0] to determine password strength, and reject passwords if it falls below an unacceptable minimum. Because you can compute it client-side, you can give real-time feedback. [0] https://github.com/dropbox/zxcvbn https://github.com/dropbox/zxcvbn
- jrmann100 2y ago
  Totally agree! My strategy is to use no word separators, and add the same sequence (dash, number, letter) at the end of every password. Here's the generator I built if you want to try it yourself: https://home.jrmann.com/utilities/godango.html https://home.jrmann.com/utilities/godango.html
al_borland 2y ago
I’ve been using 1Password since 2008 and didn’t even know this was an option. It defaulted to complete randomness and I always just left it there. Typically not an issue, but it is annoying on the rare occasion I need to type something. I’ll have to consider this when making new accounts in the future, or updating old ones.
hk1337 2y ago
I liked the previous password generation in Keychain when you chose memorable password. It would be two words with a couple of numbers and/or symbols in between. That option isn't available anymore though. I use 1Password to store it though and have since 1Password 7, maybe sooner.

by calgoo 2y ago

nneonneo 2y ago

The extra randomness really only buys you a couple extra bits of entropy, but makes it more annoying to remember which format your password is in. It’s much more effective (entropy-wise and memory-wise) to tack on an extra word.

the_snooze 2y ago

I always make that the default in my 1Password instances. If the threats we're trying to protect against are mainly 1) weak passwords and 2) password reuse, then there's still room there for human-friendly readable passwords. I don't see much marginal benefit of generating something like cnC*i8Npc2J7zWRYFfsy (the common default template across password managers) over teo-PRETENDS4cognac.

jorvi 2y ago

The problem is that many sites still use archaic password rules. 1Password should by default just always capitalize one word, and add “1” at the end of the memorable password. Since the words are separated by “-“ or “.”, you already hit the “at least one symbol” rule.

dark-star 2y ago
I especially like sites that disallow pasting into password fields.... Yes, that is apparently a thing, especially for banking or finance related sites (from my experience)
- yojo 2y ago
  For a while, the login for TreasuryDirect (the gov site for buying US bonds) disabled paste and typing! It required you to click out your password on an onscreen keyboard. I pity the folks who don’t know how to use dev tools.
  - commandersaki 2y ago
    Good on 'em for doing a complete 180 on that. Bank of Melbourne has stated that using a Password Manager is a violation of their Terms of Service (as people have complained about the non-pasteable/autofill fields).
    - magnetowasright 2y ago
      Last time I had the sincere displeasure of having to use bank of Melbourne, their password rules included that you couldn't have repeated letters, so if you were trying to use a passphrase like correct-horse-battery-staple it would not allow the double r in correct or double t in battery. The rest of their password rules were abhorrent like all financial institutions but that one in particular irritated me to no end.
  - nytesky 2y ago
    You buried the lead there: A required on-screen keyboard with RANDOM GENERATED LAYOUT.
    - jakub_g 2y ago
      For whomever is interested, IIRC, this requirement of random layout came up in late 2000/early 2010 due to: - keyloggers (safer to click instead of type instead -> on-screen keyboard then) - but then it turned out Internet Explorer had a bug which allowed attackers to read the mouse click events' X/Y coordinates in other windows which then could be mapped to the on-screen keyboard digits if the layout is predictable
    - brokenmachine 2y ago
extraduder_ire 2y ago
I was presently surprised by the password requirements when I created a bugzilla account just the other day. - Password must be at least 12 characters long. - And the password must also contain either of the following: - A phrase containing at least four unique words of three characters or longer - or password contains at least 3 of the following qualities: - uppercase letters - lowercase letters - numbers - punctuation characters - or more than 12 characters I went with the phrase option.
- jorvi 2y ago
  I’ve seen minimums of 8 and 12, and maximums as low as 20. AgileBits obviously has done a lot more profiling, but it would be nice if they developed a universal password formula that was still memorable. So with words, “-“ separator (or maybe “.” separator?), maximum length 18, one whole word capitalized, random single digit at the end or beginning. That way you keep maximum entropy, keep it readable, whilst fitting within the rules of “all” sites. Although within 5-10 years I see passkeys having largely taken over, especially because mom and pop won’t be able to forget those, and they won’t be able to forget their fingerprint or face either.
- jszymborski 2y ago
  Not sure why people are re-inventing the wheel here. Just use zxcvbn[0] to determine password strength, and reject passwords if it falls below an unacceptable minimum. Because you can compute it client-side, you can give real-time feedback. [0] https://github.com/dropbox/zxcvbn https://github.com/dropbox/zxcvbn
jrmann100 2y ago
Totally agree! My strategy is to use no word separators, and add the same sequence (dash, number, letter) at the end of every password. Here's the generator I built if you want to try it yourself: https://home.jrmann.com/utilities/godango.html https://home.jrmann.com/utilities/godango.html

al_borland 2y ago

I’ve been using 1Password since 2008 and didn’t even know this was an option. It defaulted to complete randomness and I always just left it there. Typically not an issue, but it is annoying on the rare occasion I need to type something. I’ll have to consider this when making new accounts in the future, or updating old ones.

hk1337 2y ago

I liked the previous password generation in Keychain when you chose memorable password. It would be two words with a couple of numbers and/or symbols in between. That option isn't available anymore though. I use 1Password to store it though and have since 1Password 7, maybe sooner.