Password Algorithms
penguindreams.org
Password Algorithms
1–10 of 114 posts
Re: Password Algorithms
#2> Your algorithm should always generate complex passwords. Try to include at least one number, one capital letter and one special character.
This is one of the big problems with an algorithm. You'll eventually come across a site that -- for whatever reason -- doesn't allow that particular special character (or has a length restriction, or something else that makes your algorithm break). Now what do you do?
I use a password manager and generate 30-ish character long passwords, and I still occasionally run into sites that tell me it's too long. No big deal, I just generate one at the max length they support, save it, and move on. It literally makes no difference to me, other than I scoff at the ineptitude of the people that built the site and have to click a couple more times to get a new shorter password.
Re: Password Algorithms
#3How is measured the entropy of a password in https://xkcd.com/936/ is a good hint on why this could be dangerous. Passwords should be strong even if you know/deduce how they are generated, specially if the input data is something as generic as the site domain. Trying intuitive/easy to perform algorithms could be a different kind of "dictionary" attack. How complicated look a password from the point of view of a brute force attack is not the only factor that make them safe for any kind of automated attack.
Having a spreadsheet matching sites and algorithms may be another weak spot depending on how it is stored. Password managers usually keeps metadata about sites, not just the password, and it is stored encrypted.
Re: Password Algorithms
#4Yes, a password algorithm is better than using the same password over and over, but a password manager is better still, and while initially less convenient it's eventually more convenient (since with a password algorithm one must rotate all passwords on the terms of the shortest-lived key, and one must use the intersection of all password rules — which may not even be possible).
For that reason, I think that a secure password manager (e.g. password-store, KeePass or Password Safe, not something like LastPass) is generally preferable.
Re: Password Algorithms
#5Yes, a password algorithm is better than using the same password over and over, but a password manager is better still, and while initially less convenient it's eventually more convenient (since with a password algorithm one must rotate all passwords on the terms of the shortest-lived key, and one must use the intersection of all password rules — which may not even be possible). For that reason, I think that a secure…
> not something like LastPass
Why? Friends have found LastPass to be pretty reliable and user friendly so far.
Re: Password Algorithms
#6The author recommends using a password algorithm that you can mentally process and then storing the results in a password manager. If you're going to store them why not let the password manager generate the pass for you?
Re: Password Algorithms
#7> Your algorithm should always generate complex passwords. Try to include at least one number, one capital letter and one special character. This is one of the big problems with an algorithm. You'll eventually come across a site that -- for whatever reason -- doesn't allow that particular special character (or has a length restriction, or something else that makes your algorithm break). Now what do you do? I use a pa…
> I use a password manager and generate 30-ish character long passwords
Do note that you don't need anything more than 22 random mixed-case letters & digits: 26 lower-case letters plus 26 upper-case letters plus ten digits is 62, and 62²² ≈ 2¹²⁸.
Completely agree re. the ineptitude of the developers of sites that try to limit one to less than that.
Re: Password Algorithms
#8> Your algorithm should always generate complex passwords. Try to include at least one number, one capital letter and one special character. This is one of the big problems with an algorithm. You'll eventually come across a site that -- for whatever reason -- doesn't allow that particular special character (or has a length restriction, or something else that makes your algorithm break). Now what do you do? I use a pa…
> I use a password manager and generate 30-ish character long passwords Do note that you don't need anything more than 22 random mixed-case letters & digits: 26 lower-case letters plus 26 upper-case letters plus ten digits is 62, and 62²² ≈ 2¹²⁸. Completely agree re. the ineptitude of the developers of sites that try to limit one to less than that.
diceware.com
Re: Password Algorithms
#9> Your algorithm should always generate complex passwords. Try to include at least one number, one capital letter and one special character. This is one of the big problems with an algorithm. You'll eventually come across a site that -- for whatever reason -- doesn't allow that particular special character (or has a length restriction, or something else that makes your algorithm break). Now what do you do? I use a pa…
* Your password must be between 7 and 20 characters
* Your password must contain
* At least one number
* At least one upper-case letter
* At least one symbol from this list (!@#$%*)
* Your password must be changed every 30 days
Re: Password Algorithms
#10Yes, a password algorithm is better than using the same password over and over, but a password manager is better still, and while initially less convenient it's eventually more convenient (since with a password algorithm one must rotate all passwords on the terms of the shortest-lived key, and one must use the intersection of all password rules — which may not even be possible). For that reason, I think that a secure…
> not something like LastPass Why? Friends have found LastPass to be pretty reliable and user friendly so far.
Among other things, they apparently use webpage encryption (their technology page indicates that AES is implemented in JavaScript for their website), which means that they have the ability to target any user at any point in time.
Also, they're proprietary software. Password security is too important to entrust to proprietary software.