8 ms·
Strong, Unique and Memorable Passwords: a Creative Approach
- dlsym 12y agocorrect_horse_battery_staple Relevant XKCD: https://xkcd.com/936/ https://xkcd.com/936/
- norswap 12y agoThe main issue I have is password that I don't use often at all. I usually can't remember them, or if I can, I cannot associate between password and website.
- sehrope 12y ago> The main issue I have is password that I don't use often at all. I usually can't remember them, or if I can, I cannot associate between password and website. Yet another reason I love using a password manager[1]. Besides letting you have unique passwords for everything (which is a must), it solves the "What the heck was the password for XZY?" issue when you haven't logged into XYZ in 6 months. People really should just use a password manager. Yes it's a pain some times (mainly using mobile) but that's just something you live with. The rest of the time though it's way better than trying to remember silly thing like "Capitalize the second letter of each word" or "Replace the last letter with a digit that denotes the number of words in the phrase"[2]. Long passwords are a solved problem and the solution is not reinventing the Caesar cipher, it's to have a single long diceware password and use a password manager for the rest. Oh and enable two-factor auth everywhere that allows it and vote with your wallet to choose businesses that do. For example, if your bank doesn't support it, find a new bank. [1]: I suggest KeePassX: https://www.keepassx.org/ https://www.keepassx.org/ [2]: The article suggests things like this to make sure your password unique/dictionary proof. Forget that and just use the password manager directly.
- higherpurpose 12y agoWhat if there is some bug that resets your Keepass/Lastpass keys? Don't you worry about something catastrophic like that could happen? Because then you'd lose access to all websites, right? Or do you rely on the fact that if you lose them, you can recover say your main e-mail password through another e-mail, and then you can recover all the other passwords with your main e-mail?
- Adirael 12y agoYou should keep incremental backups of the password database. I have four backups of my 1Password database: * Dropbox (which lets me recover a deleted file up to 30 days) * Time Machine * BackBlaze * Monthly HDD clone
- reedlaw 12y agoI also like KeePassX but its major flaw is not being able to sync or merge databases. That has led me to consider using password-store[1]. Has anyone found a way to overcome the sync problem with KeePassX? 1. http://www.zx2c4.com/projects/password-store/ http://www.zx2c4.com/projects/password-store/
- mikegioia 12y agoI store the keypass database in dropbox so that my phone and other computers can all access the same db. if you're worried about the security of that you can even take it 1 step further and add a keyfile to your login requirements. you could just store the keyfile outside of dropbox on the devices.
- crashandburn4 12y agoI remember reading some articles on hacker news that seemed to imply that this wasn't the best approach[1]. Possibly the modifications (not sure about the adding of capitals but maybe the number) might make this a solution that is more stable but I guarantee that as soon as some cracker (e.g. Yiannis Chrysanthou) reads this article they're gonna modify the methods given to take account of most of the simple versions of this technique (as in the ones published here). [1] http://arstechnica.com/security/2013/08/thereisnofatebutwhatwemake-turbo-charged-cracking-comes-to-long-passwords/ http://arstechnica.com/security/2013/08/thereisnofatebutwhat...
- reedlaw 12y agoThe problem with this method is that the example phrase, "No one knocks off old Tony", yields 3,580,000 Google results. All attackers would have to do is apply a few simplistic substitutions on common phrases. Any phrase easily found online or in print doesn't make a good passphrase.
- pelario 12y agoThat is not very precise. Given a certain length (6 words in the example), how many "common phrases" (above the threshold in you example) exists? How many "simplistic substitutions" exists? I would say that the search space is not as small as you are suggesting, even though I agree that the transformation of the example is quite simple, allowing a dictionary attack. There is a famous example of a technique that takes only the first letter from each word of the phrase. edit: "Schneider scheme" https://www.schneier.com/essay-246.html https://www.schneier.com/essay-246.html " My advice is to take a sentence and turn it into a password. Something like "This little piggy went to market" might become "tlpWENT2m". That nine-character password won't be in anyone's dictionary. Of course, don't use this one, because I've written about it. Choose your own sentence -- something personal."
- danbruc 12y agoThere is a famous example of a technique that takes only the first letter from each word of the phrase. That is the problem - people trying to break passwords use the exact same techniques. Compiling a list of ten million famous phrases is not hard. Generating a hundred commonly used variants of them is also easy. And checking one billion hashed passwords - MD5, SHA1 or SHA256 for example - takes less than one second on a current GPU.
- reedlaw 12y agoYou'd be surprised at how quickly common phrases are compromised. According to [1], a 6 word phrase, "it was the best of times", albeit unmodified, was broken in 4 seconds. A less common phrase, "You stay classy San Diego", was never compromised. So there may be some security in a combination of common phrases and modifier patterns, but I would say it's not enough for highly sensitive accounts. 1. http://www.reddit.com/r/Bitcoin/comments/1ndsxi/a_test_of_brainwallet_passphrases/ http://www.reddit.com/r/Bitcoin/comments/1ndsxi/a_test_of_br...
- ss64 12y agoA memorable password is almost certainly not going to be unique, lines from a book or a movie are very likely to be in cracking dictionaries. Simple transformations adding underscores or numbers at the end are well known techniques. There are no shortcuts to creating genuinely high entropy passwords http://ss64.com/docs/security.html http://ss64.com/docs/security.html
- chrisyeah 12y agoInstead of well known lines one could use his own story with some figures, combined with a fictive word. For example: tree_eating_5surlap_on_bear (with "surlap" as the fictive word) Somewhere you just (try to) draw a tree with a mouth, which is eating 5 question marks (representing the fictive word), standing on a bear. However, I personally prefer mixed incoherent characters and numbers.
- acron0 12y agoI use a combination of a master password (12 chars, only known to me, not written down) and a seed to generate gibberish passwords for websites. In most cases, the seed is the service or website it's for ("netflix", "reddit.com"). So, in the case of "netflix" my app gave me "qnQTs0-QO-9osX-me4)M". The benefit being that the passwords aren't stored anywhere, and I can retrieve them by simply visiting my web app. (I didn't just leak my Netflix password, btw ;)
- hucker 12y agoInteresting.. I hope the generator function is non reversible? I.e., if you know the password ("qnQTs0-QO-9osX-me4)M" in this case) and your policy, could you find the master password?
- icebraining 12y agoYou can use a cryptographic hash on it. It's how SuperGenPass works: http://supergenpass.com/ http://supergenpass.com/ (Personally, I use an homegrown script that runs outside the browser, but does something similar)
- mhaymo 12y agoAm I wrong to be turned off by the fact it uses MD5? Still far more secure than anything I could do in my head I suppose.
- nicwolff 12y agoYeah. I wrote the password-hash generator that SuperGenPass and most others credit as their inspiration, and I moved mine http://angel.net/~nic/passwd.current.html http://angel.net/~nic/passwd.current.html on to SHA-1 years ago.
- mhaymo 12y agoWas thinking about this as an alternative to existing password managers. The advantage is as you say your passwords aren't stored anywhere, even in encrypted form, and can be retrieved as long as you remember the master key and algorithm, but the disadvantage is that you're essentially sharing a poorly-salted hash of your master password with every service you log in to. I'm going to go for a password manager for now, simply based on my perception that they're widely used by people who know more about security than I do.
- deleted 12y ago[deleted]
- coloncapitald 12y agoI didn't find this method very convenient. What I have been doing for years is remember one single password which would meet the password requirements of most websites. For e.g. &<asterisk>I87yuU This is 8 characters long, has upper-case and lower-case letters, numbers and symbols (Also if you try typing on the keyboard, it is actually a pattern). I can remember one such password. Now, I have a formula for any website or app for which requires me to create credentials. This formula will help me add website specific information to the password. Say the website is news.ycombinator.com, I will use second and third letters of ycombinator which is 'co' and increment both by 1 to make them 'dp' and add this somewhere in the password, which makes it &<asterisk>dpI87yuU Now, obviously unless someone knows my encryption technique, even if they get to know password of one of my accounts, they can never know the others. P.S. I feel I have gone too far to explain this. Please don't hack my Paypal.
- chrisBob 12y agoI have used something like that before too, but it worries me. If I found that password here I would immediately notice that the last two characters stand out, and see the pattern.
- danbruc 12y agoNo_one_knocks_off_old_Ton6 is probably not a strong password. See for example this article [1] to get an idea of what can be broken - "qeadzcwrsfxv1331", "allineedislove" and "momof3g8kids" are among them. [1] https://www.schneier.com/blog/archives/2013/06/a_really_good_a.html https://www.schneier.com/blog/archives/2013/06/a_really_good...
- onoj 12y agoTwo cents worth: Write a poem. spend some time. make it relevant, make it rhyme. Do not put it anywhere digital. use stanzas of it !without spaces! as a password.
- mhaymo 12y agoExceptionally long passwords can be difficult to type accurately. Probably most on HN are good typists, but still I find entering long passwords error-prone and frustrating.
- Pxtl 12y agoHonestly, I just want to be rid of all these accounts. Either use an oAuth provider or give me some kind of fast e-mail based auth (like a "reset my password" thing without actually going through the process of resetting the password - just log me in when I click the link in my e-mail).
- chrisBob 12y agoPart of the problem is that everything wants a strong password, but probably doesn't need it. Your bank, paypal, amazon... passwords should be strong ones, and probably unique. The passwords for random message boards you don't have a stake in might as well be password123 unless the account somehow links to something sensitive. For me, part of securing important logins was sorting out the useless ones. That means your HN password probably shouldn't be N0_one_knocks_of_old_TonyHN either. Its just not worth it.
- icebraining 12y agoWhy? If you use a password manager, the cost is minimal.
- chrisBob 12y agoA password manager is the exception. I used to discount the idea of a password manager, but now carrying a smartphone all of the time, and a tablet most of the time a password manager makes more sense. The comment is more targeted at people who are conscious of the issue of password reuse, but continue to use the same password, or slight variations on different services. Similarly I don't think now is a good time to update passwords from password1! to passworkd3$.
- wodzu 12y agoI thought I will share my idea of unique, memorably passwords. I have a custom in-head hash function that I use to create a unique password for every single website where I have an account. It works as follow, let's assume this is the domain we try to generate the password for: www.example.com The hash process: 1 - take first letter, move 2 in alphabet, capitalize - 2 places after e in alphabte is g ("abcdefg"), capitalize - G 2 - calculate number of words in domain, x2 = 7x2=14 3 - use standard salt - eg. tlpWENT2m 4 - take last letter - e That leads to a password: G14tlpWENT2me Which is both easy to remember and allows you to have a unique hashed password for every website around. Have fun with discovering your own hashing method.
- AliAdams 12y agoHow does this work with cross-product passwords where the login can be used across multiple web apps?
- wodzu 12y agoUsually with cross-product applications you have some central domain that stands behind all of them. Just use that central domain. Eg. gmail, calendar, etc. are all behind google.
- deleted 12y ago[deleted]
- username42 12y agoI have a paper sheet full of complicated passwords on the wall near my computer. The access to my flat is protected by a very good physical key.
- dwaltrip 12y agoMy current strategy is described below. I have been using it for about a year. It provides strong, unique, secure passwords with no memorization: I use passwordchart.com (I am planning to create my own improved version at some point). It requires a generator phrase to create a "password chart", which is simply a mapping from each alphanumeric character to a different 1-3 character alphanumeric string. You then type in an easy to remember password, and it maps that to a far more secure password using the generated chart. I use the same chart (with a backup printed in my wallet), and apply the same methodology for every service I use to create my easy-to-remember password. I read the "how it works" page and it seems pretty secure to me. For all my password needs I only have to remember two things: the generator phrase and the method for making the easy to remember password. There is also little counter party risk (passwordchart.com doesn't know where the passwords are used, it would be hard to change the chart without me noticing, and I have a backup). I love not having to think hard when signing up for something new. In 5 seconds, I have an easy to fetch, secure, unique password for any service. The only real concern is over the shoulder snooping, but I just ask people not too look.
- keehun 12y agoI would love to read this article but look: https://www.dropbox.com/s/82c9bxlrmsmj3bt/Photo%20Apr%2011%2C%2010%2024%2015.png https://www.dropbox.com/s/82c9bxlrmsmj3bt/Photo%20Apr%2011%2... Are you serious?
- yaddayadda 12y agoI have three base passwords that were randomly generated, one has lots of funky symbols, capitalization variety, numbers, etc. the other two are more simple. I've used these so long that I couldn't write them down, it's all muscle memory at this point. For example: "h*0A$23d!W", "Eg4mRk4", "PdurMca" Based on the site and their password requirements I pick one of the three base passwords. I then algorithmically modify the password based on the site's url. For example, the first and last letter of the main portion of the url. Thus, using the medium password for hackernews and gmail I end up with "yEg4mRk4r" and "gEg4mRk4l", respectively.
- mudil 12y agoGreat approach: base word and a URL modifier. Memorable and different for every site. I use the same. I even have a one page site (http://passmix.com http://passmix.com) that teaches people the same approach.
- AliAdams 12y agoThe worst situation is where the site prevents submission of a password containing certain characters or limits password length, ruining any carefully chosen or algorithmically generated passwords.