9 ms·

How a password changed my life

97 points by caruana 12y ago

bnejad 12y ago
Well, congratulations.
desireco42 12y ago
This is beautiful story. I started reading not expecting anything that good. All best.
kbar13 12y ago
So now, I just need to look at any of your social media posts to figure out your password? Thanks!
- Pwntastic 12y ago
  You just have to figure out his most important personal goal that shows up on social media around the last week of the month, when AD starts warning him to change his password
akerl_ 12y ago
Congrats on remembering your passwords, but this is a terrible way to generate them. Phrases that are relevant to you or your life are the second thing that somebody making a wordlist is going to aim for, after "password" and "letmein" and friends.
- Someone1234 12y ago
  I have a word list in front of me (2000 "short" and 10,000 "long" lists), "Forgive@h3r" "Quit@smoking4ever" "Save4trip@thailand" and none of his other passwords are listed on it. The way those passwords are constructed don't make them common enough to appear on most word lists and it would be very difficult for someone (who knows you or not) to guess them. Now, dates of birth, or other common profile information is commonly misused in passwords and that is guessable. But that isn't what the article was about and wasn't in their examples. I think the article rebuffs your post before you even posted it. So unless you can explain better how what the author is doing is insecure (and I highly doubt you can) your criticism seems misplaced.
  - liveoneggs 12y ago
    I think it's clear that passwords should be VERY DIFFICULT for you to remember so that you have to reset them constantly and/or keep them in some kind of "vault" so you copy them into your clipboard all the time and accidentally paste them into chat rooms.
  - dubcanada 12y ago
    Are you a password cracker? Do you have a password cracker database in front of you? Forgive is a word. @ is a commonly used symbol h3r is her with vowel replaced with number (very very common). Quit is a word Smoking is a word Ever is a word For replaced with number (also very common) @ common symbol Tbh the best password he could have written would probably have been a sentence like I really should forgive my ex wife who I broke up with on May 23rd @ 8pm! https://xkcd.com/936/ https://xkcd.com/936/
    - saileshr 12y ago
      Recent research seems to show that xkcd suggestion is not as safe as one would think see (https://www.ted.com/talks/lorrie_faith_cranor_what_s_wrong_with_your_pa_w0rd https://www.ted.com/talks/lorrie_faith_cranor_what_s_wrong_w...)
      - dubcanada 12y ago
        Alright then try words written in latin & random characters from different types of alphabets. ѣд学한☏ Seems pretty secure, but it's not over 8 characters... If UTF8 was better supported, you could do something like phone, snowman, snowman, pile of poo, phone. That's fairly easy to remember and next to impossible to guess.
        itsybitsycoder 12y ago
        Great, now how do I use that password to log onto a mobile site from my phone? None of those characters are on my phone keyboard. Am I supposed to save them in a text file? That doesn't seem very secure.
TimWolla 12y ago
God, i hate those "change your password at least every X days" policies. A good password does not become weak after some time.
- anExcitedBeast 12y ago
  No, but people often use the same password for different services. Changing passwords regularly can cut off attacker access in the event of an undetected compromise.
  - TimWolla 12y ago
    Well, those people would probably simple cycle through their passwords, or append an increasing counter. So regular changes do not protect the security, but annoys people that are using generated passwords that are completely unique for each and every service.
    - UweSchmidt 12y ago
      Increasing the counter at the end is obviously weak when you find that "password46" is not working anymore so you try "...47". However if someone steals a whole password database with a million passwords, chances are they just automate the login attempts and subsequent nefarious actions. They might not try to figure out anyone's naive password scheme if they get thousands of successful logins the easy way!? I'm saying this because I've heard your reasoning before, and of course I've been staring at the keyboard when trying to change one of my passwords, wondering just how clever I need to be right there.
- Liesmith 12y ago
  I disagree. I am always hearing about how this or that service got compromised and stored passwords in plaintext or something, and now all those passwords are in the wild. I write really hard to crack passwords (funny little poems I made up myself) and I still could get screwed because my bank stored it in an unsafe way, and now some russian dude knows my password is "I am so þirsty,5/but þe walls are unbroken.7/Where is Cool-Aid Man?5" Thus, I find myself writing new poems all the time. Which is actually great because they are fun to make and easy to remember. But yeah if I still used that one (something I wrote in 2008) I'd be screwed. There's no way that's safe now. What really drives me insane are services that limit the number of characters you can have for your password. Holy criminy that's dumb.
Liesmith 12y ago
these are really weak passwords. I write poems that I made up myself. In middle english. I use the letter thorn sometimes.
lstamour 12y ago
Just test your password strength first against https://passfault.appspot.com https://passfault.appspot.com It might be more useful to use a long sentence passphrase for Windows/Exchange purposes.
- Kequc 12y ago
  Is your password secure? Type it into this box to find out.
  - Someone1234 12y ago
    Indeed. That site doesn't even pretend to be secure! There are versions of that site which do everything in Javascript so your password is never sent to the server. That is also insecure but at least they pretend that it is not. This site is designed to post your password up to the server and even works on HTTP (as opposed to enforcing HTTPS only). So you've just shared your password, IP address, and browser information with a completely anonymous site! PS - I think this site is DESIGNED to be Javascript only but the implementation is bad, so the password is in fact sent to their server (which generates an "Internal server error" by the way).
    - lstamour 12y ago
      To be clear, that's a demo site that's worked for me in the past to preview the software. You can download it here: https://github.com/c-a-m/passfault https://github.com/c-a-m/passfault And the project itself is affiliated with OWASP.
anoxic 12y ago
Cheerful and unexpected from a password article :-)
ricket 12y ago
I have used this technique to help me memorize company goals and also to connect codenames with their version numbers. I hated when someone would mention "Julio" and I'd have to ask "uh that's version 4.2 right?", or vice versa. "Julio4.2" is a decent start to a password if you add another word or two to it.
joeframbach 12y ago
I used to work for one of those companies. My monthly passwords were January2007! February2007! March2007! April2007! Looking back, I could have improved myself. Kudos for the inspiration!
PeterWhittaker 12y ago
Awesome. Possibly the best hack I've ever read. (Sure, I'm a security guy, and part of me agrees with some of the other comments. Sure, I'm a tech geek, and I've seen and read about some wicked cool hardhacks, unexpected softhacks, and their ilk, and even some good life hacks. But this is awesome. An arguably silly security policy sought to control a small aspect of his work-life and he gamed the spit out of it to take total control of his life, change things up, get stuff done. Best hack ever.)
spain 12y ago
Very cute story!
jordigh 12y ago
These are called "affirmations" by self-help books: https://en.wikipedia.org/wiki/Affirmative_prayer#Self-help https://en.wikipedia.org/wiki/Affirmative_prayer#Self-help http://www.self-help-and-self-development.com/affirmations.html http://www.self-help-and-self-development.com/affirmations.h...
throwaway12516 12y ago
This hit very close to home. My (former) best friend and business partner stole a ton of money from me and our business, and I'm about to declare personal bankruptcy, right after my kid was born. My password is some variation of how much of an asshole he is. But it's not helping. In fact, it's causing me to constantly dwell on it, painfully re-living our conversations, and thinking what I could've done differently to prevent it from happening. Logically I understand that I need to forgive him and let it go, but I'm not able to do it. I'm going to change my password to an affirmation that I forgive him. I think it will be a good start.
- olegious 12y ago
  That sucks, I was once in a situation where I held a grudge against a person for a very long time, to the point where I thought about them and what they did almost every waking moment. It made it really hard to move on with my life. What did it for me was forgiving the person in my own mind, truly forgiving them. It didn't happen overnight but it made all the difference in the world. Later on I bumped into learntoforgive.com and found that their methodology was exactly what I intuitively did to forgive in my case, I took notes on their process, hopefully they'll help you: https://docs.google.com/document/d/13w3d4a-e460yQV2y48iUVmByKC0wTkwxr00W-UxkI4U/edit?usp=sharing https://docs.google.com/document/d/13w3d4a-e460yQV2y48iUVmBy...
lsh123 12y ago
NLP in action :)
imjk 12y ago
For those interested in these types of things, Love Yourself Like Your Life Depends on It is a great quick read that builds on the same principle: http://www.amazon.com/Love-Yourself-Like-Your-Depends-ebook/dp/B0086BX8UE/ref=sr_1_1?ie=UTF8&qid=1405016447&sr=8-1 http://www.amazon.com/Love-Yourself-Like-Your-Depends-ebook/...
chiph 12y ago
Find a cat? Cats find you.
drinchev 12y ago
I'm with a password "Quit smoking" for a second week now and nothing happens ( it's my screen saver password - just sayin' :D ). I enter it for 5-6 times a day. What's next?
bryon 12y ago
I really expected this story to be about the pain of having a password stolen or something. What a great surprise and great story. Thank you
cyphunk 12y ago
^^^ goes and changes word list for jack the ripper
a3_nm 12y ago
I find this quite weird. OK, my password are meaningless sequences of random characters, so maybe it makes things different; but I don't remember passwords as strings, I remember them as gestures. For most passwords I would have to imagine myself typing them to reconstitute their written or spoken form (which can sometimes be tricky if you have to enter them on an unfamiliar device or using an unfamiliar layout). So I'm confused why after a few days you would still remember what the password means when you type it in.

97 points by caruana 12y ago

bnejad 12y ago

Well, congratulations.

desireco42 12y ago

This is beautiful story. I started reading not expecting anything that good. All best.

kbar13 12y ago

So now, I just need to look at any of your social media posts to figure out your password? Thanks!

Pwntastic 12y ago
You just have to figure out his most important personal goal that shows up on social media around the last week of the month, when AD starts warning him to change his password

akerl_ 12y ago

Congrats on remembering your passwords, but this is a terrible way to generate them. Phrases that are relevant to you or your life are the second thing that somebody making a wordlist is going to aim for, after "password" and "letmein" and friends.

Someone1234 12y ago
I have a word list in front of me (2000 "short" and 10,000 "long" lists), "Forgive@h3r" "Quit@smoking4ever" "Save4trip@thailand" and none of his other passwords are listed on it. The way those passwords are constructed don't make them common enough to appear on most word lists and it would be very difficult for someone (who knows you or not) to guess them. Now, dates of birth, or other common profile information is commonly misused in passwords and that is guessable. But that isn't what the article was about and wasn't in their examples. I think the article rebuffs your post before you even posted it. So unless you can explain better how what the author is doing is insecure (and I highly doubt you can) your criticism seems misplaced.
- liveoneggs 12y ago
  I think it's clear that passwords should be VERY DIFFICULT for you to remember so that you have to reset them constantly and/or keep them in some kind of "vault" so you copy them into your clipboard all the time and accidentally paste them into chat rooms.
- dubcanada 12y ago
  Are you a password cracker? Do you have a password cracker database in front of you? Forgive is a word. @ is a commonly used symbol h3r is her with vowel replaced with number (very very common). Quit is a word Smoking is a word Ever is a word For replaced with number (also very common) @ common symbol Tbh the best password he could have written would probably have been a sentence like I really should forgive my ex wife who I broke up with on May 23rd @ 8pm! https://xkcd.com/936/ https://xkcd.com/936/
  - saileshr 12y ago
    Recent research seems to show that xkcd suggestion is not as safe as one would think see (https://www.ted.com/talks/lorrie_faith_cranor_what_s_wrong_with_your_pa_w0rd https://www.ted.com/talks/lorrie_faith_cranor_what_s_wrong_w...)
    - dubcanada 12y ago
      Alright then try words written in latin & random characters from different types of alphabets. ѣд学한☏ Seems pretty secure, but it's not over 8 characters... If UTF8 was better supported, you could do something like phone, snowman, snowman, pile of poo, phone. That's fairly easy to remember and next to impossible to guess.
      - itsybitsycoder 12y ago
        Great, now how do I use that password to log onto a mobile site from my phone? None of those characters are on my phone keyboard. Am I supposed to save them in a text file? That doesn't seem very secure.

TimWolla 12y ago

God, i hate those "change your password at least every X days" policies. A good password does not become weak after some time.

anExcitedBeast 12y ago
No, but people often use the same password for different services. Changing passwords regularly can cut off attacker access in the event of an undetected compromise.
- TimWolla 12y ago
  Well, those people would probably simple cycle through their passwords, or append an increasing counter. So regular changes do not protect the security, but annoys people that are using generated passwords that are completely unique for each and every service.
  - UweSchmidt 12y ago
    Increasing the counter at the end is obviously weak when you find that "password46" is not working anymore so you try "...47". However if someone steals a whole password database with a million passwords, chances are they just automate the login attempts and subsequent nefarious actions. They might not try to figure out anyone's naive password scheme if they get thousands of successful logins the easy way!? I'm saying this because I've heard your reasoning before, and of course I've been staring at the keyboard when trying to change one of my passwords, wondering just how clever I need to be right there.
Liesmith 12y ago
I disagree. I am always hearing about how this or that service got compromised and stored passwords in plaintext or something, and now all those passwords are in the wild. I write really hard to crack passwords (funny little poems I made up myself) and I still could get screwed because my bank stored it in an unsafe way, and now some russian dude knows my password is "I am so þirsty,5/but þe walls are unbroken.7/Where is Cool-Aid Man?5" Thus, I find myself writing new poems all the time. Which is actually great because they are fun to make and easy to remember. But yeah if I still used that one (something I wrote in 2008) I'd be screwed. There's no way that's safe now. What really drives me insane are services that limit the number of characters you can have for your password. Holy criminy that's dumb.

Liesmith 12y ago

these are really weak passwords. I write poems that I made up myself. In middle english. I use the letter thorn sometimes.

lstamour 12y ago

Just test your password strength first against https://passfault.appspot.com https://passfault.appspot.com It might be more useful to use a long sentence passphrase for Windows/Exchange purposes.

Kequc 12y ago
Is your password secure? Type it into this box to find out.
- Someone1234 12y ago
  Indeed. That site doesn't even pretend to be secure! There are versions of that site which do everything in Javascript so your password is never sent to the server. That is also insecure but at least they pretend that it is not. This site is designed to post your password up to the server and even works on HTTP (as opposed to enforcing HTTPS only). So you've just shared your password, IP address, and browser information with a completely anonymous site! PS - I think this site is DESIGNED to be Javascript only but the implementation is bad, so the password is in fact sent to their server (which generates an "Internal server error" by the way).
  - lstamour 12y ago
    To be clear, that's a demo site that's worked for me in the past to preview the software. You can download it here: https://github.com/c-a-m/passfault https://github.com/c-a-m/passfault And the project itself is affiliated with OWASP.

anoxic 12y ago

Cheerful and unexpected from a password article :-)

ricket 12y ago

I have used this technique to help me memorize company goals and also to connect codenames with their version numbers. I hated when someone would mention "Julio" and I'd have to ask "uh that's version 4.2 right?", or vice versa. "Julio4.2" is a decent start to a password if you add another word or two to it.

joeframbach 12y ago

I used to work for one of those companies. My monthly passwords were January2007! February2007! March2007! April2007! Looking back, I could have improved myself. Kudos for the inspiration!

PeterWhittaker 12y ago

Awesome. Possibly the best hack I've ever read. (Sure, I'm a security guy, and part of me agrees with some of the other comments. Sure, I'm a tech geek, and I've seen and read about some wicked cool hardhacks, unexpected softhacks, and their ilk, and even some good life hacks. But this is awesome. An arguably silly security policy sought to control a small aspect of his work-life and he gamed the spit out of it to take total control of his life, change things up, get stuff done. Best hack ever.)

spain 12y ago

Very cute story!

jordigh 12y ago

These are called "affirmations" by self-help books: https://en.wikipedia.org/wiki/Affirmative_prayer#Self-help https://en.wikipedia.org/wiki/Affirmative_prayer#Self-help http://www.self-help-and-self-development.com/affirmations.html http://www.self-help-and-self-development.com/affirmations.h...

throwaway12516 12y ago

This hit very close to home. My (former) best friend and business partner stole a ton of money from me and our business, and I'm about to declare personal bankruptcy, right after my kid was born. My password is some variation of how much of an asshole he is. But it's not helping. In fact, it's causing me to constantly dwell on it, painfully re-living our conversations, and thinking what I could've done differently to prevent it from happening. Logically I understand that I need to forgive him and let it go, but I'm not able to do it. I'm going to change my password to an affirmation that I forgive him. I think it will be a good start.

olegious 12y ago
That sucks, I was once in a situation where I held a grudge against a person for a very long time, to the point where I thought about them and what they did almost every waking moment. It made it really hard to move on with my life. What did it for me was forgiving the person in my own mind, truly forgiving them. It didn't happen overnight but it made all the difference in the world. Later on I bumped into learntoforgive.com and found that their methodology was exactly what I intuitively did to forgive in my case, I took notes on their process, hopefully they'll help you: https://docs.google.com/document/d/13w3d4a-e460yQV2y48iUVmByKC0wTkwxr00W-UxkI4U/edit?usp=sharing https://docs.google.com/document/d/13w3d4a-e460yQV2y48iUVmBy...

lsh123 12y ago

NLP in action :)

imjk 12y ago

For those interested in these types of things, Love Yourself Like Your Life Depends on It is a great quick read that builds on the same principle: http://www.amazon.com/Love-Yourself-Like-Your-Depends-ebook/dp/B0086BX8UE/ref=sr_1_1?ie=UTF8&qid=1405016447&sr=8-1 http://www.amazon.com/Love-Yourself-Like-Your-Depends-ebook/...

chiph 12y ago

Find a cat? Cats find you.

drinchev 12y ago

I'm with a password "Quit smoking" for a second week now and nothing happens ( it's my screen saver password - just sayin' :D ). I enter it for 5-6 times a day. What's next?

bryon 12y ago

I really expected this story to be about the pain of having a password stolen or something. What a great surprise and great story. Thank you

cyphunk 12y ago

^^^ goes and changes word list for jack the ripper

a3_nm 12y ago

I find this quite weird. OK, my password are meaningless sequences of random characters, so maybe it makes things different; but I don't remember passwords as strings, I remember them as gestures. For most passwords I would have to imagine myself typing them to reconstitute their written or spoken form (which can sometimes be tricky if you have to enter them on an unfamiliar device or using an unfamiliar layout). So I'm confused why after a few days you would still remember what the password means when you type it in.