This advice is the "how to make the safest password possible" advice. In general, Schneier focuses not just on "maximum security", but also the security/utilit

This advice is the "how to make the safest password possible" advice. In general, Schneier focuses not just on "maximum security", but also the security/utility trade-off. Individual passwords for every site are probably overkill for many sites. For sites where no money is involved, you may as well share a password. If someone who knows my facebook password can access my slashdot account or my arstechnica account, that's not world-ending. Similarly, if someone has my Bank of America password, I'm just as screwed as if they knew my Amazon password or my PayPal password, so if they were the same, it wouldn't matter much (they not in my case). I think the easiest way to generate a secure and memorable password is through transformations. For instance, if we reverse my name (Zachary), use symbols for the As and a 4 for the H, we get Yr@4c@z (no, this is not my password anywhere). Similarly, if you go one letter at a time from parent's names, you get something like JEolhinzaanbatehatnh (which could similarly take a letter->number or letter->symbol transformation). You get a secure password, and all you need to remember is the transformation algorithm. - My parents' names are not Johnathan and Elizabeth, this is an example only.