Write your passwords down

http://blog.jgc.org/2010/12/write-your-passwords-down.html

by duck • 16 years ago

116 120 16 years ago

blog.jgc.org

I use Bruce Schneier's password safe: http://www.schneier.com/passsafe.html

_b8r0• 16 years ago

This is and isn't bad advice. Writing your passwords down and storing them in your wallet isn't necessarily a good idea. You may be able to secure your wallet, but there may be somewhere better to secure it (such as a house safe).

Rather than writing the passwords down, use a decent tool like 1password (http://agilewebsolutions.com/onepassword) or Keepass (http://keepass.info/).

joshkaufman2• 16 years ago

This looks like a good way to generate the passwords you put into 1password or another similar password tool. If the tool fails, you can regenerate the passwords if you need to.

MikeCapone• 16 years ago

1Password has a random password generator. That's what I use.

Legion• 16 years ago

Keepass is brilliant and supported on Linux, Mac, and Windows.

I have one super-strong password that I've memorized that encrypts my KeePass database, and then I use Keepass to generate and store random passwords for me.

snes• 16 years ago

No one mentioned Lastpass?

It has a multifactor grid authentication, which along with a user defined password, makes it secure enough for me.

When I started using it, I changed most of my passwords to be 100 characters long. But many sites had a maximum 20 characters or equivalent rule.

stevelosh• 16 years ago

Use 1Password, make sure your passphrase for that is long enough to be secure.

Write that passphrase down and put it in a safety deposit box if you want people to be able to retrieve them after you die.

jdludlow• 16 years ago

Back in 2005, I did something similar for a while after this [1] was posted to /. Eventually it became too annoying, and I switched to Password Safe and then to 1Password. Both are, in all ways, better than that slip of paper.

[1] http://ask.slashdot.org/comments.pl?sid=152097&cid=12762...

cliveholloway• 16 years ago

In related news, when I'm on a non essential site that requires a password, forces a weird restriction ("Your password must contain at least one number and one non word character) and won't let me save it in Firefox, I just copy the password, log out, bookmark the login page and then add #password to the URL and bookmark that as the new login page.

Then, come login, I can just copy the password from the URL.

mikeryan• 16 years ago

Its funny I worked for a startup that got acquired by Comcast, and eventually we started having to follow the Comcast security policy which made us change domain passwords every month with requirements around using strange characters etc.

I'd say about 50% of the people ended up with their current password on a post-it on their monitor or desk.

nowarninglabel2• 16 years ago

Yes, this same thing happens on the ship I work on in the summers. There are about 300 people, and about half have to reset their password when they come on board. There is the arbitrary 8 character, at least 1 #, at least 1 special character, at least 1 capital, can't match a dictionary word, and can't be close to the previous password. Also can't contain their name. Try explaining that to 150 people over and over again...it is so painful to watch some people try half a dozen, even a dozen times and still not get a password that will work, and then the vast majority will either write it down in a public place, share it, or forget it.

I'd based on the available data that could have just as much security, without all the user hassle, if we just require long passwords, no other requirement. Can you see how much easier it is to just say, your password has to be 16 characters or longer. Just think of a passphrase. For instance: IWa1kmydogonSaturdays Easy to remember, and I would argue, though would want to try to provide some evidence, that this would be just as, if not more secure than 8 characters with ridiculous requirements.

gjm11• 16 years ago

> if we just require long passwords, no other requirement

... then I bet lots of users will choose passwords like "passwordpasswordpassword".

Dove• 16 years ago

> just require long passwords, no other requirement.

I particularly liked the suggestion (elsewhere) to set passwords to a random combination of three dictionary words. It's hard to remember 7Gw$kW_ws, but I bet I could come up with a meaning for "dog shower flange".

cafard• 16 years ago

Easy to remember, not so easy to type into a password box. Or maybe for you it is easy, but it wouldn't be for me.

brettnak• 16 years ago

I did support for a hospital a while back. The favored ( by faculty, not IT ) strategy there was a sticky note on the back of an ID badge. My guess would be that this is common practice anywhere where people carry ID badges.

ErrantX4• 16 years ago

Yep, this is common practice.

I do a lot of pen testing, and one of the easiest ways to get access to important things is figure out a way to go into the IT department under some premise. Passwords galore, the rest is just memory :)

(this is, sadly, only a slight exaggeration)

verdant• 16 years ago

I loathe policies about expiring passwords because it breeds insecurity in the manner you mention. However, my company has this same policy, not because its been evaluated as being a good policy, but because our SOX audits require it.

Another reason to grumble over SOX.

kirinkalia• 16 years ago

I wouldn't store passwords in my wallet either and find this system far too cumbersome. I think if you're really concerned about security, you should never "remember" your password on any site -- see story about stupid criminal who stole a Washington Post reporter's laptop and posted photo of himself on the reporter's son's Facebook page: http://blog.washingtonpost.com/story-lab/2010/12/post_4.html (the security of the teen's FB page isn't getting the same play as the stupid criminal angle).

corin_4• 16 years ago

Personally I don't see any reason for having them completely randomly generated.

'thIs1smyp4ssw0rd19%2' isn't any less secure than another 20 character password that includes lower+upper case letters, numbers and special characters.

Obviously, if you do something like 'c0r1np4ssw0rd" then it may get to the stage where enough people do that for crackers to expect it (maybe it already is, but as long as you follow his third and fourth rules ("Use mixed-case, numbers and special characters" and "Use passwords of at least 12 characters") you really should be fine, and you'll have an easier time memorising them.

(I can remember multiple 20+ character passwords that would be very difficult to crack, and have no need to write them down.)

jakehow• 16 years ago

The problem with this approach is that you can only remember a few passwords like this, which means that you are going to reuse passwords on multiple sites. One site compromise can compromise multiple accounts for you.

corin_4• 16 years ago

I don't have any problem remembering them personally (then again, I still remember root passwords I used when I was thirteen and they were completely random characters).

Sites like HN and Reddit I'm happy to use the same password (I'd be minorly annoyed, but realistically I wouldn't be that fussed if I lost control of either account, I can either recover it or even create a new one), but any site where someone finding my password could cause a problem has its own password, and I can remember them all.

Occasionally I forget which password goes with which site, but not often - actually I find it harder to remember which username/email goes with each site.

lukeschlather2• 16 years ago

That's not quite true. When we're talking about the security of a password, we're talking about how long it's going to take someone to crack a possibly salted hash (Gawker's weren't) of your password. When attempting to crack a hash, the attacker begins with dictionary words, then with leetspeak permutations of dictionary words, then starts adding random numbers in with random words.

It's hard to say in what order specifically they're going to try it, but generally speaking, they go from fewer bits to higher bits. thIs 1s my p4ssw0rd - that's not quite as many bits as you think it is. That's 4 permutations of dictionary words. That password probably hits the requirement of 80 bits, but it is less secure than other 20 character passwords. thIs1smyp4ssw0rd is going to be tried in its various permutations fairly early on in the cracking, and tacking on a few extra characters, while an order of magnitude increase in compute time, is not outside the realm of possibility.

jockc• 16 years ago

Yes, but what if he used "thIs 1s n0t my p4ssw0rd". Wouldn't that cause the cracking program to burst into flames?

corin_4• 16 years ago

Realistically if you take into account the possibility of using up to four works, with some but not all vowels replaced with numbers, a mixture of upper/lower, and some other random numbers and special characters in an undisclosed place... that creates such a huge number of possibilities that it might as well not be dictionary based from the cracker's point of view.

DanI-S• 16 years ago

Although this method may be great for you, it doesn't seem worth it to me.

Having your passwords hacked or guessed is bad because it's a hassle, and it can lead to you losing time and money.

This method of password generation/storage is also a hassle, and definitely leads to losing time (which may translate to money).

I find it far easier to come up with a reasonably long and complex 'base' password, then tag an extra bit to the end depending on which site you're accessing. Since our memory is strongly context dependent, it's easy to remember the extra little bit for the site you're currently on.

joshkaufman2• 16 years ago

An easy way to create your own...

Copy this empty table: http://pastebin.com/tzbd7FCt Fill it with this random password generator: https://www.grc.com/passwords.htm

Be sure to use a fixed-width font.

tudorachim• 16 years ago

From the random generator's website: "Every one is completely random (maximum entropy) without any pattern, and the cryptographically-strong pseudo random number generator we use guarantees that no similar strings will ever be produced again."

Interesting guarantee for a random number generator to provide...

tghw2• 16 years ago

Obligatory: http://search.dilbert.com/comic/Random%20Number%20Generator

sukuriant• 16 years ago

It might be true random numbers as opposed to pseudo-random numbers. Likely created in a similar way to http://random.org

flogic2• 16 years ago

While I'm reasonably sure they're on the level, getting my random numbers from a source not under my control is worrying.

raineri• 16 years ago

Here is a python script to generate the table: http://pastebin.com/UiLi61Yg

aquinn• 16 years ago

I read a story on HN a while back about a guy who used an algorithm to generate his passwords. Don't have the link but something like combining easy to remember bits of personal information. e.g mother's name, kids birthday, maybe changing the case of these. Also adding something site specific like the last three letters of the url backwards. It's easy to remember passwords this way but if one gets out they're all vulnerable if someone looks closely.

ali0012• 16 years ago

I think that a better solution is to use pwdhash. Check it out here:

http://pwdhash.com

It's a browser extension for Chrome and for Firefox that seamlessly hashes the concatenation of your master password and the domain name of the site you're logging into. This produces a different password for each site, and requires you to remember only your master password.

The extensions were created by Blake Ross (big name in the firefox community), as well as Collin Jackson and Dan Boneh who are highly regarded security experts at Stanford.

Also, if you're interested, I've created a command line utility for Mac OS X that exposes the same functionality: https://github.com/ali01/pwdhash.py

crocowhile5• 16 years ago

The most commonly used hashers are pwdhash, supergenpass and magicpassword. Given that they all use hashing algorithms, none of them will result in a password using special characters, which is not optimal.

tghw2• 16 years ago

Optimal? No. More than sufficient? Yes. You can use all numbers in your password, so long as it's long enough (and the website actually uses all of them).

ali0012• 16 years ago

Actually, that's not true. Look at the encoding section of the PwdHash USENIX paper. PwdHash returns an ASCII representation (not a hex or base64 encoded string) of the hashed domain name + master password. PwdHash also applies a number of constraints to the returned hash to ensure that the special characters that it does use are legal at most websites.

A typical PwdHash password, with domain name google.com and master password "LetMeIn+123456?" looks like this:

6+LYoE/C0wP8dGPoO

Try it yourself at the pwdhash website.

dchest• 16 years ago

Just yesterday I wrote a Chrome extension with the same idea. Algorithm is:

    password = base64(pbkdf2(secret, username@url))

Where PBKDF2 uses SHA-256 and 5000 iterations.

You can get it here: https://chrome.google.com/webstore/detail/hegbhhpocfhlnjmemk...

Website version: http://sellme.ru/p2

Source: https://github.com/dchest/cryptopass/

samuel• 16 years ago

So you have a paper on your wallet, which can be used to obtain every password you use, using an intricate and very specific "algorithm".

Then you publish the fact itself and the algorithm in your blog(real name), which, besides, doesn't depend on a passphrase (which could turn your method in a sort of dual factor authenticator).

The paper could be photocopied and returned to your wallet and you'd never know.

Please, don't talk me about how many bits of entropy your passwords have. They aren't secure.

lukeschlather2• 16 years ago

Why do you believe he gave you the real algorithm?

sophacles• 16 years ago

Access to the piece of paper severely reduces the attack space, even if it isn't "go diagonal from (letter2, letter3) of domain name". Heck, it is not much different if it is a trivial transform on the characters themselves. Anything that a person could easily do (making the thing convenient enough to actually use) is not going significantly alter the number of permutations. Of course, this is making a big assumption that a targeted attack will go after the paper rather than say, the keyboard (which is generally much less secure than a wallet.).

However, this being said, it is much more secure against untargeted attacks than the standard "i have an algorithms in my head" or "i use the same password" approach a lot of people use.

Abid2• 16 years ago

I always have a question come to mind whenever I read these kinds of guidelines: what percentage of computer users have ever had their passwords compromised?

I'm guessing there's no real way to gauge this because I've never seen a study nor heard anyone else touting one and yet, complex password protection guidelines are always being recommended. Why?

xlevus• 16 years ago

I have no idea about the percentages. But I've been hit twice. One by a leak from a sizable gaming website, and the other time by gawker. Neither time I gave a shit because thankfully I was smart about my passwords.

There's always a risk, it's not expensive to defend against, so why not?

Abid2• 16 years ago

Those are interesting examples because you didn't lose the passwords, those websites did. So stuffing your password in your wallet, or making sure they were 12 characters long wouldn't do any good.

crocowhile5• 16 years ago

> (I have a second copy of that sheet left with a friend in an envelope)

I love jgc but here he's making the same mistake most people make when they speak about security: assuming all readers have the same need for security and run the same risks. They don't. There is no point for my mom to adopt this system, it's way overkilled for her. (I think there's no point for me either).

One needs to explain to users two things: the first is that there is a big difference between being A target and being THE target. If you are just A target, picking one password for each website you subscribe to is more than enough. If you are THE target, then people will get to you, no matter how secure you think you are.

jgrahamc2• 16 years ago

I somewhat agree, but when mass hacks occur it opens people with poor passwords up to hackers because they've got all the time in the world to see whose accounts they can get into.

BTW Do you use the same password on your Gawker account elsewhere?

msg• 16 years ago

I usually have two passwords: A stupid one that I only use on stupid sites, and a good one that I use on crucial ones (Gmail, Amazon, bank). There's no relationship between the good and bad passwords, so I feel more confident that I'll be unaffected by data breaches.

I checked the torrent and I guess I never made a Gawker account.

crocowhile5• 16 years ago

As long as the password is unique, it doesn't even matter. Sure, it should be unique yet not revealimg a pattern ("goofy" is ok, "gawker" is not) but there is no need for the user to pass crypto 101.

This for those 1.5m that were just A target; Nick Denton, OTH, was THE target and it was just matter of time for him to get pwned.

>BTW Do you use the same password on your Gawker account elsewhere?

I had to check the other day. I opened that account to leave one comment on lifehacker (that was never approved, actually) and then forgot about it. Turns out the password was safe enough but my mistake there was to use an email address I cared about.

Now I have a less important email address and a supergenpass for everything, except gmail/facebook/dropbox and the other things I care about, for which I have better passwords.

agraddy2• 16 years ago

I like that giving the paper to a friend provides an easy way for a friend to be able to access his accounts in case of a tragedy.

jasonjei• 16 years ago

It's an interesting concept because passwords could be infinitely more secure if everything adopted a two-factor authentication system with something physical that you carried around like an RSA SecurID. Unfortunately, even that system risks being compromised, and like the sheet of paper, highly inconvenient.

But on the other hand, your garage door works with a rolling keY too, and you're also SOL if you lose your opener (unless you, ironically, have a keypad).

kgo2• 16 years ago

I did some consulting work at a big pharma company. And they solved the whole problem of someone stealing (or more likely losing) a RSA key by keeping all the keys at the helpdesk!

You just called up, said you need the ID, and they read you the number over the phone...

Me: "Hi I'm XXX and I need the RSA key for COMPANY X."

Helpdesk: "Okay... It's on the board here somewhere... Found it... It's down to the last bar. Let me wait until it flips... Okay. Six bars... 643332."

Me: "Thanks a million."

s2r2• 16 years ago

http://en.wikipedia.org/wiki/Shamirs_Secret_Sharing

Write parts of your password down in several places, collect some of them (say, 8 of 10) to reconstruct it (completely!) if you've forgotten it; let someone who finds your wallet with one part of it know nothing.

jcromartie• 16 years ago

I wrote a quick Ruby script that prints out a tabula recta for passwords. Enjoy!

https://gist.github.com/745446

klochner• 16 years ago

My policy:

   - lame passwords for sites I don't care about (e.g., 'insecure')
   - the same password for sites with semi-sensitive information (e.g., facebook)
   - unique passwords for bank accounts, servers, etc.

So I try to strike a balance between difficulty in remembering & security.

techbio2• 16 years ago

Thanks for spelling that out entirely clearly.

kanru• 16 years ago

If once one of your password leaked, all sites with the secure level are unsafe then.

bigiain• 16 years ago

The thing that's bitten me on the ass a few times with that strategy is failing to upgrade sites from "I don't care about" status.

I'll use the 'insecure' password to drop a comment on an interesting discussion on a site I've just found - like, say HackerNews or Twitter, then two years later I'm still participating in the community there, and it _could_ have still had the password I used that time to comment on a ValleyWag story. All of a sudden I _do_ care a bit about any reputation I might have. I was fortunate this time not to have any sites I cared about still using the same old password Gawker leaked (mainly 'cause I'd learned that lesson when my twitterstream started spamming acai berry sites when PerlMonks exposed my low-grade password back then.)

I think Schenier's right - the world isn't a place where "remembering passwords" works any more. We need too many of them and we don't have enough control over how other people store them.

A password safe with a strong passphrase backed up by somethig like dropbox or zumodrive is probably a minimum sensible approach now. Some care is needed with the devices you access that password safe on, and awareness of how software like browsers or your OS caches and stores any passwords it sees you use. Even with a properly secured password safe, a fair number of my logins are probably hosed if I lose my laptop... Firefox, Chrome Safari, Mail.app, Twitter clients, IM clients, IRC programs, FTP programs - all of them store credentials for me, _mostly_ in Mac OS X's keychain, but not in a "reliable enough way" to be considered "secure" if the physical hardware is in someone else's possession.

techbio2• 16 years ago

Post-IT pswds.

DenisM• 16 years ago

Write them down to a file, and encrypt the file with a single passphrase. You only need to remember one thing.

There are many tools that let you do that on your mobile phone of choice, including my own http://memengo.com which has a benefit of also including the online backup feature in case you lose your phone.

silversmith• 16 years ago

Mobile phones get lost. Pieces of paper too. Online services die off. And then, you might want to log in from your mates computer. For me, the only usable password generation methods are those that fit in my mind.

ankimal• 16 years ago

What happens when you lose your laptop or netbook or whatever handy device you use to browse the web? Are you then leaving it to the OS login screen to protect everything? I d rather have passwords I remember in my head. If I forget often, I click the reset button/forgot your password. Whats more, I generally visit important places more often than unimportant ones, so I wont forget my important passwords. Also, start using sites like mint.com. Instead of logging into your bank account, log into mint to check balance and expenditures.

Lets face it, none of this is every gonna keep you totally out of trouble. If you re so paranoid (aka my security professor at school), shut all your online accounts down.

jhuckestein• 16 years ago

I like the direction, but the obvious caveat are websites or weird legacy systems that don't allow you to have certain characters in your password or otherwise restrict it.

And then there's the whole trouble of sites that require a username that you need to remember and that is usually restricted in ridiculous ways.

giberson• 16 years ago

I employ what I like to call "Personal Hashing". Think of it like the human version of md5. I've come up with an easy to remember, easy to compute (work done in my head), hashing system that I use to generate passwords for all my accounts. The power of this method is that it generates strong passwords, and is easy to remember.

Take for example, and this is just a sample not my own personal hash formula, the following mechanism:

key = username

1) r = rot2(key)

2) password = vowelreplace(r) [a4,e3,i1,o0,u_]

In this example, I apply a rotation of 2 letters to the input key, then replace the vowels in the result with numbers.

A sample use case might be for an amazon account.

Username: johnsmith

Password Key: johnsmith

Password Phase 1 (rot2): lqjpuokvj

Password Phase 2 (vowelreplace): lqjp_0kvj

We are quite capable of remembering simple formulas which we can use to generate our own passwords on demand. What's best is the formula exists in our heads, and can never be discovered laying around.

Sapient2• 16 years ago

I may be missing something, but doesn't this give you the same password for all accounts with the username johnsmith?

sigil• 16 years ago

I generate a new random but semi-pronounceable password for every account using apg (http://www.adel.nursat.kz/apg/), then store it in one of several gpg-encrypted, replicated master password files.

The first few times I use a newly generated password, I have to look it up in a master file. It's weird how quickly semi-pronounceable nonsense + some symbols get stuck in your head though.

16s6• 16 years ago

I've been doing this:

echo -n "A long sentence I can recall. site_name" | sha1sum

I use the sha1sum from that as my password.

site_name may be hackernews, slashdot, home, etc. I can break them in half (20 chars) or quarters (10 chars) if the site can't accept a 40 char password. Also I can add a period on the end if the site requires special chars. These are strong passwords and unique for each site. Works great on Windows Linux and Macs. All I need to do is recall my sentence (with proper punctuation).

zcid• 16 years ago

While my method isn't as secure as your most likely is, I prefer a simpler algorithm based upon the site name. I can perform my algorithm in my head and enter a password quickly and without having to refer to a terminal or another program.

Btw, do you ever worry that your command history might be accessed to discover your passwords?

16s6• 16 years ago

I use an app I wrote to do the sha1 so the sentence is not hanging around in bash history, but I do rely on the cmd prompt at times on computers at my house. Here's a screeshot of the app: http://i.imgur.com/tz255.png

No one but me uses it. So it's bare bones.

crux_• 16 years ago

Not to be snarky, but isn't your master password now sitting there, plaintext, in your command-line history? (Worse: when you accidentally do this in a terminal that's remoted somewhere.)

16s6• 16 years ago

See my reply below. I seldom do it in a terminal and when I do only on my home machines. The command above is for explanation. If I showed you my app without that explanation, it wouldn't be the same.

mirkules• 16 years ago

There are also a number of apps for both android and iphone that will give you sha/md5 sums. The downside is you have to carry your phone and have enough batteries.

matclayton• 16 years ago

This reduces the search space massively though as we now know you only use 0-f as characters, probably brings it closer to being brute forceable for the sites don't accept 40chars! And dont have rate limits.

16s6• 16 years ago

16^20 = 1,208,925,819,614,629,174,706,176

The very best GPU crackers do about 1 billion guesses a second. Good luck.

Jach2• 16 years ago

Your approach is great, I think I'll use it too.

My current method for secure passwords on sites that have a max around 8 or 12 or so is to think of some song lyrics I know, pick n words, camel-case them, l33+-translate a couple letters, and add shift+numeral special characters to either side.

16s6• 16 years ago

Thanks. You can cut and paste the passwords. Write an app like I did or if you trust others, download one. I like it because it's portable (no secret encryption crap) and easy to recall. Also, if one site is compromised, like gawker, and they happen to crack the password, they won't be able to use it anywhere else and won't know what your secret sentence(s) are.

Edit: One other neat thing about this approach is that you can honestly say that you don't know what the password is (if you are ever asked). You know how to create it, but you have no idea what it is. That may matter in some situations.

dekz• 16 years ago

echo -n "A long sentence I can recall. site_name" | openssl dgst -sha1

For those with openssl.

maw• 16 years ago

I don't write my passwords down, but I do use reminders in a code of sorts.

An example: I have an account with the bank Bancomer. In Spanish, "comer" means to eat, so I refer to it as "eßenbanque". (I know it's "essen"; nobody likely to find my list would recognize the ß, though; it would be mistaken for a B.) If my password were "l4rryb1rd" (it's not) I might render it as "oiseaulázaro", just enough of a reminder, while still misleading.

This scheme might not work so well in, say, Brussels, but here in Monolingüilandia I think it's reasonable, although I do wonder from time to time just how sound it really is.

pavel_lishin• 16 years ago

I use something vaguely similar for my passwords, but with Russian instead of spanish/german.

Fun fact: the password based on Russian transliteration that looks NOTHING like any English word I've seen (imagine "cexuqakr3") trips the linux "too close to dictionary word!" warning while a less secure password that's based on two english words (imagine "bellykitten13") doesn't.

paulshort• 16 years ago

This password would be really hard to crack.

T#!$ p@$$w0rd w0uld &e re@lly #@rd t0 cr@ck.

T#!$p@$$w0rdw0uld&ere@lly#@rdt0cr@ck

The passwords for my important stuff look much like the above. Just write a sentence that's easy to remember, replace letters with the special characters they look like and blend it all together. Works a treat.

Sapient2• 16 years ago

With some Markov chain generators and leetification, not as hard as you think.

techiferous• 16 years ago

I consider this the geek equivalent of using "password" or "123456". It is so common for tech people to do this. The real security here is the length of the password, not the special characters.

teralaser• 16 years ago

Here is another reason to write your passwords down: At my workplace there was a programmer. One day he had a heart attack, and was put into a 3 week artifiscal coma. When he woke again, he could not remember any passwords. Everything was a pain. To this day, his website ends the day, he had the attack.

brown9-2• 16 years ago

I think what you have here is more an argument for making sure there are redundancies in who has access to your vital systems.

Not so sure how my loved ones would feel about my employer asking to go through my personal effects if I was in a coma.

goldenthunder• 16 years ago

Another good way store passwords is to memorize a simple algorithm based on the topic of your password.

Example: - last 3 letters - a static symbol (let's use %) - @ if it's online / & if it's not - 3rd 1st 4th letter of topic in Capital-lower-Capital format - follow with a short string to increase length and stump bruteforces (lets use gold158)

So my password for hackernews would be: - ews - % - @ - ChK - gold158

ews%@ChKgold158

I'm no security expert, but that seems to be pretty secure and it will be different for each password. You won't ever be in trouble if you forget a password and it doesn't require you to carry around written passwords. If you scramble it a little better than I did in my example, it will look random and no one will try to "reverse engineer" your algorithm. (So when someone needs your password temporarily, you can tell them)

naner• 16 years ago

Anyone else try to log into John's HN account just to make sure he didn't make a very bad mistake (by posting the actual sheet he uses)?

FrankBlack• 16 years ago

I'll get my mom on this right away. :)

rapind• 16 years ago

I use a great little tool called PasswordMaker that I actually found in the comments of a thread here a long time ago. Here's a brief summary: http://blog.rapin.com/better-authentication-password-managem...

sullof• 16 years ago

I think that using password schemes is bad. Because in order to be useful, the method needs to be fast, simple and replicable. Suppose that someone creates a fake website in order to grab one of your smart passwords. If he understands that you use a method, he will try to deconstruct the method based on the fact that his website surely is included in some manner in the password itself. Also, since many people who use these methods tend to divulge them to the community, there isn't even a need to create a fake website to understand your passwords. The only solution that really works is to use a password manager. My favorite obviously is Passpack, because I am a co-founder, but regardless of which software you choose the important thing is that you use it. My advice is not to relay on any clever schemes because you may be in for a bad surprise.

devinfoley• 16 years ago

"Write them down and keep them in your wallet because you are good at securing your wallet."

I'm having a very difficult time articulating just how horrible this idea is. Now if somebody compromises your password list, by either finding or stealing your wallet, they also get all of your personal and banking information as well!

There is a reason that the government advises people not to carry their Social Security cards in their wallet (http://ssa-custhelp.ssa.gov/app/answers/detail/a_id/446/~/ca...).

I use Wallet, a password manager/generator that's available for OS X and iOS, supports encryption, and syncs between devices automatically. I use a different random, strong password for all of my accounts, and it's easier to manage than keeping lists of passwords. Works for me.

desigooner• 16 years ago

for something easy to use, I use character names from foreign films and texts, modified with a certain character replacement and displacement..

Write your passwords down

Related Stories