Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Write your passwords down

blog.jgc.org

Post reply on HN
Print view View original

81–90 of 125 posts

Re: Write your passwords down

#81

Post by silversmith »

DenisM wrote: post #45

Write them down to a file, and encrypt the file with a single passphrase. You only need to remember one thing. There are many tools that let you do that on your mobile phone of choice, including my own http://memengo.com which has a benefit of also including the online backup feature in case you lose your phone.

Mobile phones get lost. Pieces of paper too. Online services die off. And then, you might want to log in from your mates computer. For me, the only usable password generation methods are those that fit in my mind.

Re: Write your passwords down

#82

Post by Legion »

_b8r0 wrote: post #3

This is and isn't bad advice. Writing your passwords down and storing them in your wallet isn't necessarily a good idea. You may be able to secure your wallet, but there may be somewhere better to secure it (such as a house safe). Rather than writing the passwords down, use a decent tool like 1password ( http://agilewebsolutions.com/onepassword ) or Keepass ( http://keepass.info/ ).

Keepass is brilliant and supported on Linux, Mac, and Windows.

I have one super-strong password that I've memorized that encrypts my KeePass database, and then I use Keepass to generate and store random passwords for me.

Re: Write your passwords down

#83

Post by goldenthunder »

Another good way store passwords is to memorize a simple algorithm based on the topic of your password.

Example: - last 3 letters - a static symbol (let's use %) - @ if it's online / & if it's not - 3rd 1st 4th letter of topic in Capital-lower-Capital format - follow with a short string to increase length and stump bruteforces (lets use gold158)

So my password for hackernews would be: - ews - % - @ - ChK - gold158

ews%@ChKgold158

I'm no security expert, but that seems to be pretty secure and it will be different for each password. You won't ever be in trouble if you forget a password and it doesn't require you to carry around written passwords. If you scramble it a little better than I did in my example, it will look random and no one will try to "reverse engineer" your algorithm. (So when someone needs your password temporarily, you can tell them)

Re: Write your passwords down

#84

Post by brown9-2 »

teralaser wrote: post #78

Here is another reason to write your passwords down: At my workplace there was a programmer. One day he had a heart attack, and was put into a 3 week artifiscal coma. When he woke again, he could not remember any passwords. Everything was a pain. To this day, his website ends the day, he had the attack.

I think what you have here is more an argument for making sure there are redundancies in who has access to your vital systems.

Not so sure how my loved ones would feel about my employer asking to go through my personal effects if I was in a coma.

Re: Write your passwords down

#85

Post by mirkules »

16s wrote: post #60

I've been doing this: echo -n "A long sentence I can recall. site_name" | sha1sum I use the sha1sum from that as my password. site_name may be hackernews, slashdot, home, etc. I can break them in half (20 chars) or quarters (10 chars) if the site can't accept a 40 char password. Also I can add a period on the end if the site requires special chars. These are strong passwords and unique for each site. Works great on W…

There are also a number of apps for both android and iphone that will give you sha/md5 sums. The downside is you have to carry your phone and have enough batteries.

Re: Write your passwords down

#88

Post by cafard »

nowarninglabel wrote: post #19
mikeryan wrote: post #7

Its funny I worked for a startup that got acquired by Comcast, and eventually we started having to follow the Comcast security policy which made us change domain passwords every month with requirements around using strange characters etc. I'd say about 50% of the people ended up with their current password on a post-it on their monitor or desk.

Yes, this same thing happens on the ship I work on in the summers. There are about 300 people, and about half have to reset their password when they come on board. There is the arbitrary 8 character, at least 1 #, at least 1 special character, at least 1 capital, can't match a dictionary word, and can't be close to the previous password. Also can't contain their name. Try explaining that to 150 people over and over a…

Easy to remember, not so easy to type into a password box. Or maybe for you it is easy, but it wouldn't be for me.

Re: Write your passwords down

#89

Post by raineri »

flogic wrote: post #55
joshkaufman wrote: post #13

An easy way to create your own... Copy this empty table: http://pastebin.com/tzbd7FCt Fill it with this random password generator: https://www.grc.com/passwords.htm Be sure to use a fixed-width font.

While I'm reasonably sure they're on the level, getting my random numbers from a source not under my control is worrying.

Here is a python script to generate the table: http://pastebin.com/UiLi61Yg

Re: Write your passwords down

#90

Post by [deleted] »

16s wrote: post #60

I've been doing this: echo -n "A long sentence I can recall. site_name" | sha1sum I use the sha1sum from that as my password. site_name may be hackernews, slashdot, home, etc. I can break them in half (20 chars) or quarters (10 chars) if the site can't accept a 40 char password. Also I can add a period on the end if the site requires special chars. These are strong passwords and unique for each site. Works great on W…

[deleted]
Post reply on HN