51–60 of 296 posts
Related story: For some weird reason, I memorized the serial key for a very popular software (I must be fifteen then). Even today, I can recite the 25-letter key without a hitch. And I have used its first ten letters as a password to one of my accounts. Guess what? The password has been used 4000+ times before [1]. It's hard to digest the fact that there are at least a thousand people in the world who did the same th…
Speaking of good passwords, I wrote a passphrase generator once that I still use to this day. You can have a copy of it if you’d like. The README explains all there is to know about it but feel free to ask any questions anyone might have. https://github.com/ctsrc/Pgen
1. Make up a short nonsense word (so it's pronounceable).
2. Pick 3 numbers.
3. Make up another short nonsense word.
4. Concat them with hyphens, capitalising the first letter.
So let's go with...
Terp-745-mula
Mang-288-pung
1. Heaps 'o entropy. Need more? Just make longer words.
2. Crucially: really easy to type on an iOS keyboard. You often start with caps on by default, and the dash-number-dash sequence in the middle only requires one use of the symbol shift key.
3. And, of course, fairly memorable.
I still use 1Password and the vast majority of my passwords are 16 characters of truly random nonsense, but for those times that you want a memorable password that you'll actually type quite a bit, this is gold.
---
And now I await the inevitable teardown of this method ... what did I miss? :-)
Advantage over a password manager? - sometimes I have to document what the password is in offline technical notes or a password vault for the customer, and doing it this way lets me kill two birds with one stone.
Related story: For some weird reason, I memorized the serial key for a very popular software (I must be fifteen then). Even today, I can recite the 25-letter key without a hitch. And I have used its first ten letters as a password to one of my accounts. Guess what? The password has been used 4000+ times before [1]. It's hard to digest the fact that there are at least a thousand people in the world who did the same th…
Is your password "fckgw rhqq2"?
I've seen the above but for some reason mine was more prevalent in my region. Common enough that even my friends could recite it.
This is using the zhuyin keyboard which most likely means Taiwanese users since Taiwan is probably the sole user of the zhuyin keyboard. Typing that out on a zhuyin keyboard gets you: ㄨㄛˇㄉㄜ˙ㄇㄧˋㄇㄚˇ In Pinyin that is wo3 de mi4ma3 Or in English "my password"
However, I am concerned at how the OP got the string in the first place, that he compared to HaveIBeenPwned? Is he storing his user's passwords in plain text in his back end database, and decided to run them all against the service?? That in and of itself is a security red flag.
This is using the zhuyin keyboard which most likely means Taiwanese users since Taiwan is probably the sole user of the zhuyin keyboard. Typing that out on a zhuyin keyboard gets you: ㄨㄛˇㄉㄜ˙ㄇㄧˋㄇㄚˇ In Pinyin that is wo3 de mi4ma3 Or in English "my password"
Some sites are throwaway (example: they force a sign-up). Don't assume all weak passwords used are not conscious decisions. Entropy is too precious to give up to throwaway sites of uncertain backend security.
Here's a few I made with `pwgen`, get it while it's hot:
aiPh9toh_ti{XeS(a=a9ohCheeV`o8pu8woh3Epu
ahth6AiT6xahaiw:ie1li`xeeF0ohf!ikeih4Joh
zah6cusohNei6feithain4aeH5uul5coh/nap0ea
uet7ed"ohhooquoosh3ooh8ZeeY+iepeg0eewena
UuNg'aes:i!Quohp0eiGh1ibieghe&o9eiSh7ac9
aexu0Vio3eitheiV=aiweo$ng@u3Seidoo-phoV1Earlier quoted context omitted.
It's a pretty well-known leaked key. And then you said exactly what part of it you used. Not the smartest move. It's like saying "My password is the first 10 characters of a really popular book about wizards" and expecting no one to figure it out.
I didn't know the well-known part. Besides, I was assuming that this was only of the multiple, multiple keys. But, it's funny how popular it is, and that so many had a reason to memorize it.
Then consider that this is Hacker News, and how many of those 5,000 have both the skills and motivation to exploit the information you've provided.
Never give out "hints" about your password. Not its contents, not its exact length, the physical location in which you store a copy, nothing.