Outside the Beltway

The free high-resolution photo of water, liquid, white, glass, drink, bottle, research, glass bottle, mineral water, product, laboratory, test, experiment, many, chemical, lab, medical, chemistry, filled, drinking water, pharmaceutical, bottled water, microbiology, test tube, distilled beverage, drinkware, analyze, pharmacology, test mixer , taken with an NIKON D5100 03/06 2017 The picture taken with 24.0mm, f/8.0s, 1/100s, ISO 250
CC0 Public Domain image via PxHere

Make Your Password So Hard to Guess That Even You Can’t Remember It

All you have to do is make up unique password for each site based on randomly chosen details of an incredibly complex story associated with the first letter of the site.

James Joyner
24

Comments

Computer Password Security

Rafael Lugana, CEO of something called Open-Xchange, helpfully explains “How to remember all your passwords and keep them safe.”

ne method is to base them on the first letter of each account. For example, your Facebook password would correspond to (F), which could mean “favorite film.” If your favorite film is Star Wars, you might then pick your favorite character: Han Solo. Then, your password could be Solo, plus some combination of numbers and symbols that isn’t related to any of your personal data but instead has a hidden personal meaning—for example, you first saw Star Wars on your 7th birthday, which was in 1983, at your Uncle John’s house. So the password for Facebook is now Solo7_1983@johns. Not a foolproof system, because the most dedicated hacker can crack any password, but it’s much better than using variations on the same password for all accounts.

So, all you have to do is make up unique password for each site based on randomly chosen details of an incredibly complex story associated with the first letter of the site? What could possibly go wrong?

Categories

Tags

,

24 responses to “Make Your Password So Hard to Guess That Even You Can’t Remember It”

  1. Doug Mataconis Avatar
    Doug Mataconis

    As someone who has walked into a room forgetting why he went in there, this does not seem like an ideal solution.

    More seriously, I have recently started using LastPass, which allows you to store web passwords locally and encrypted. Thanks to it, I have been able to finally get over the rather obvious problem of using similar passwords for different websites.

  2. C. Clavin Avatar
    C. Clavin

    http://xkcd.com/936/

  3. KM Avatar
    KM

    @C. Clavin:

    Aww you beat me to it!! one of my favs and so useful too….

    I have this on my wall at work – ever since I put it up, there have been no password resets required in my building. IT now forwards it along with remote pw reset requests; they’re had few repeat offenders since.

  4. Ron Beasley Avatar
    Ron Beasley

    My bank recently forced me to change my password to something that is so complex it’s impossible to remember. Fortunately I have Norton identity safe which remembers it for me.

  5. Liberal Capitalist Avatar
    Liberal Capitalist

    I use jibberish that is done via a pattern on my keyboard.

    I have no idea what my password is… but I can duplicate that pattern when I need it.

    Need to change it? shift the pattern over one.

    Yeah… I know. who cares.

    ps… this is fun… forth of July thieves being caught red handed:

    http://gawker.com/florida-beachgoer-hilariously-confronts-two-women-steal-1600961473

  6. Stonetools Avatar
    Stonetools

    Also recommend XKCD. One commenter discussing the method said that several months after he read the comic he still remembered “correct horse battery staple “.
    If you can’t use a password manager XKCD Is the way to go.

  7. grumpy realist Avatar
    grumpy realist

    Another reason to learn many languages….mush together an Japanese word and a Latin word with a number between them and you’re golden.

  8. Pinky Avatar
    Pinky

    You’re the last person who should ever be able to figure out your password. You’re far more likely to access the sites that interest you, in detectable patterns. You have all of your own personal information. You think like you – all someone has to do is to be able to think like you, and they can harvest all your information. You’re much better off not knowing your passwords. Whenever possible, you should randomize your passwords, and never write them down or record them in any commercially-available software in any form.

  9. Mikey Avatar
    Mikey

    @C. Clavin: I’d love to do that, but when I try…

    “Password does not meet complexity requirements. Reason: contains dictionary words.”

    grrrrrrrrr….

  10. Tyrell Avatar
    Tyrell

    I have a four page data base of all my different passwords. Some sites will take anything while others require a complicated combination of letters and numbers. If my 8 year old computer goes out, I am in trouble. I need a back up.

  11. Ron Beasley Avatar
    Ron Beasley

    @Tyrell: Me too, I have it on a USB thumb drive that I only plug in when I need it.

  12. Tyrell Avatar
    Tyrell

    @Ron Beasley: Thumb drive: I have thought about it, but I have left my thumb drive everywhere, but luckily have always found it.

  13. beth Avatar
    beth

    @Ron Beasley: my husband and I realized we needed a list of passwords since we each access different important websites in our life – I pay the bills and regularly use the bank and credit card websites: he does the retirement plan and investments for example. We wrote them all down and stuck them in one of the hundreds of books in our office. Sure enough we forgot which book we put them in! We’re working on a better system.

  14. Matt Bernius Avatar
    Matt Bernius

    @C. Clavin & @KM:
    Agreed. Ever since that XKCD post I’ve been using pass phrases. It’s still a pain when you are expected to add numbers to it, but they work much better and are much more secure.

    That said, Mobile increasingly creates a problem as pass phrases (not to mention passwords) continue to be designed for physical keyboards.

    Biometrics provide a better option, but still have yet to be fully embraced.

  15. Ebenezer_Arvigenius Avatar
    Ebenezer_Arvigenius

    Seems to be a very specialist kind of idiocy. At a company I worked once the IT department decided that everyone has to set a password on the computer triggering on inactivity > 180 sec. The password should be at least 8 chars, Cap/No-Cap and contain symbols and numbers. I’m pretty sure it cut output in the department by at least 20% for the few poor fools who actually complied. The rest removed any passwords apart from login.

    Moral: Obtuse security increases risk.

  16. Matt Avatar
    Matt

    @Ron Beasley: I keep my passwords encrypted on an USB stick. The password for the stick is easy for me to remember and I keep the stick in a fire resistant safe that’s hidden when I’m gone.

    Yeah it makes life harder if I need to access some stuff outside of my house but those are usually low security passwords anyway.

  17. Pinky Avatar
    Pinky

    I have an address book. Paper.

  18. rudderpedals Avatar
    rudderpedals

    Your puny sheets of paper are no match for those of us chipped with implants, and carrying scissors.

  19. DrDaveT Avatar
    DrDaveT

    @Liberal Capitalist:

    I use jibberish that is done via a pattern on my keyboard.

    I had good luck with that until I ran into a keyboard with a different layout. Ouch. Tablets and smartphones just make things worse, for that.

  20. Boyd Avatar
    Boyd

    1) Like Doug, I recommend using a password manager, such as LastPass or RoboForm (which has served me well for many years on desktop, phone and tablet).

    2) Pass phrases have the highest level of entropy when constructed correctly. See Diceware.

    3) As many of you know, I’m retired from the Navy. Since then, I’ve worked as a software engineer, and now as a software development manager, I can find my way around a computer pretty well. But even I was stunned when the Defense Finance and Accounting Service applied DoD rules to their passwords last year. Imagine a 75-year-old computer-phobe trying to follow these requirements for access to the web site for his pension (the only way you can get most of the information you need about your pension, including your 1099R for filing your income taxes):

    – Passwords must be at least 15 characters long.

    – Passwords must contain a mix of upper case letters, lower case letters, numbers, and special characters (minimum of two characters from each of the four categories).

    – When a password is changed, users cannot use personal information such as names, telephone numbers, account names, or dictionary words.

    – Passwords must expire after 60 days. (!)

    – Users must not be able to reuse any of their previous 10 passwords.

    – Passwords must differ from the previous password by at least four characters when a password is changed.

    Wonder of wonders, DFAS lowered the requirements to be more in line with banking industry standards this year.

  21. Luke Avatar
    Luke

    What could go possibly wrong? Maybe that fact that I will forget it or when I would like to change it every half a year it will not be possible. No technique of creating strong passwords is safe when you have more accounts. I have about 180 of them and it is impossible to manage passwords without a decent password manager. I use Sticky Password and there are also others like mentioned before. Without it, I can not imagine the password life.

  22. Steven L. Taylor Avatar
    Steven L. Taylor

    I use a system not unlike the one described in this post. I forget my exact passwords all the time.

  23. Matt Bernius Avatar
    Matt Bernius

    @Steven L. Taylor:
    Like XKCD suggests, pass-phrases — all the cool kids are using them.

  24. James Joyner Avatar
    James Joyner

    @Steven L. Taylor: @Matt Bernius: I posted the xkcd password strength cartoon three years back when it first came out. Very few sites actually allow you to use “correcthorsebatterystaple.” First, it’s too long for many sites. Second, almost all of them require a capital letter, a number, and a symbol. Third, many require you to constantly change passwords.

Latest Posts