3 ms·
I take a layered approach. One password for all the stuff that isn't really important like sites I visit a few times and then leave. One password for sites I
by mixmax 18y ago
I take a layered approach.
One password for all the stuff that isn't really important like sites I visit a few times and then leave.
One password for sites I trust and use on a regular basis, but where a compromised password isn't the end of the world. HN is in this category.
Seperate and strong passwords for stuff that matters, like netbanking, gmail, etc. To remember these I have a system set up so that the passwords are similar in a non-trivial way, like [first words of sentence][number I remember]. One password derived from this could be tqbfjotld!1249057, easily derived from "the quick brown fox jumps over the lazy dog!", and 1249057 which is the serial number for the motor in my boat. This way I only have to remember a phrase and a number I already know for entering secure sites.
Using this system I don't have to rely on potential unsafe software, or writing down passwords that may be compromised.
- jff 18y agoSeconded with gusto. I've got the one password that I used on all my low-priority stuff--Slashdot, throwaway mail services, etc. It's a terrible password, but at 9 letters it at least has some length and it actually may last against a dictionary attack. Gmail, my university mail account, and other next-tier things get a stronger password, but still easy to type. The rather more strict requirements of my school's CS and CE computer systems mean that I have to have complex passwords which change frequently. As such, I have a few that are based on phrases with numbers interspersed (the canonical example, I believe, is "Don't have a cow, man" which becomes something like "d0n'tHac,m" which has the added bonus of looking like "don't hack 'em"). When the policy requires me to change, I can either swap in one of my other extra-strong passwords or, if it remembers previous passwords and I'm stuck, I can just add a number at the end. My job uses a CryptoCard for most things, but I use a randomly-generated Kerberos password for mail. When it changes, I write it down and stick it in my wallet until I have it memorized, then destroy the paper. TL;DR: Assign different services to "tiers" and use a different password for each tier, with increasing complexity of passwords corresponding to increasing importance of services.
- 3pt14159 18y agoSame here. I've written up my methods here, which are similar in spirit, but not the same in execution. Basic level password example: "pi975315703" -> alpha-numeric, easy to remember because I have typed it a billion times. Medium strength: "C0caC0la1s<3pt14159" -> Coca Cola (upper case because it is a company) is not as good as pie always use 0 for o and 1 for i. High Strength: "9T&11E:ttttttttteeeeeeeeeee+pi975315703" -> all I have to remember is "nine 't's and eleven 'e's plus weak password" but someone trying to hack it with a hash table or whatever would be significantly slowed. Max strength (where life or my job hangs in the balance): get university text book and ruler, goto page 314 hold ruler along 3rd column of paragraph text, read each letter downwards write on bottom left corner of page in very light pencil "3X5%" "WdeAdehaeeadyej.dR35Tyismdy+3X&5%:xxx%%%%%+pi97531570" -> I think you should get the idea here. I'm also super paranoid about key loggers. One of my friends did this to the whole school when I was 16, so ever since then I have never entered high or max on a public computer, just in case. All told I think I have about 35 active passwords that I can easily remember (or obtain in the textbook one).