Passwords: Using 3 Random Words Is a Really Bad Idea (2017)
1–10 of 87 posts
Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)
#2i hate this kind of pedantry. it just has to be better than what people currently use, which is stuff like password1, or 123456. yes, in an ideal world we would all use password managers, but that hasn't happened yet, either.
Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)
#3The simple answer here is to use non-word words. A sample might be:
eggscellent frantillion scrofulon
Ok. I'm skewing to the letter 'L' - but they don't have to know that.
Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)
#4I feel like the real take-away from this article is that MD5 is broken, something we've all known for ages.
An application using a memory-hard algorithm like bcrypt would yield the same results, but without the hassle of retraining all users to use longer passwords.
Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)
#5The ONE thing stopping me from using a password manager is fear that I'll lose the master password. How do I get over this fear?
Another thing is for example Chrome's built in password manager. If I make a bunch of accounts with these passwords, do I NEED Chrome to ever be able to log in to these accounts?
Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)
#6I'm not sure how this made it to the front page. It mashes up several things about passwords, some of which are dangerous, some of which are smart. It acknowledges the strength of a system like diceware. Then it concludes 'Don't use words in passwords. Ever.' while failing to distinguish between passphases based on words (like diceware generates) and having a password that is "benisgreat".
Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)
#7The ONE thing stopping me from using a password manager is fear that I'll lose the master password. How do I get over this fear? Another thing is for example Chrome's built in password manager. If I make a bunch of accounts with these passwords, do I NEED Chrome to ever be able to log in to these accounts?
Use a password manager! The transition takes some time/effort, but once you have one fully set up (I adore 1password) it's both easier and far more secure than any scheme you keep in your head.
Re: losing access - a 1password family plan allows your family members to recover your account. Or just write your master password down on paper and store it somewhere secure - like a safe or safety deposit box.
Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)
#8[deleted]
Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)
#9The simple answer here is to use non-word words. A sample might be: eggscellent frantillion scrofulon Ok. I'm skewing to the letter 'L' - but they don't have to know that.
You can also, add irregular punctuation & capitalization, throw in some numbers within words, include words from other languages that you know or look up. Or use near words of other languages.
I have always thought of "3 random words" as a starting point for randomizing a password not literal advice to follow.
Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)
#10The ONE thing stopping me from using a password manager is fear that I'll lose the master password. How do I get over this fear? Another thing is for example Chrome's built in password manager. If I make a bunch of accounts with these passwords, do I NEED Chrome to ever be able to log in to these accounts?
Export your passwords on occasion & store somewhere safe is one method.
You can export passwords in Chrome. Type chrome://settings/passwords into the URL & click the 3 icon settings to the right of Saved Passwords.
Another option is to test the forgot password of your chosen password manager. See what options are & how comfortable they make you.