for something easy to use, I use character names from foreign films and texts, modified with a certain character replacement and displacement..
Write your passwords down
121–125 of 125 posts
Re: Write your passwords down
#122Earlier quoted context omitted.
You mentioned adding a period for special characters but what do you do for passwords that require capitalization?
I suppose you could get that with base64 encoding rather than a hex digest. Something like: echo -n 'Secret sentence Sitename' | openssl sha1 -binary | openssl base64
Good idea. Lot's more space too when compared to hex encoding. I added it to my app: http://imgur.com/EcqZ1
Re: Write your passwords down
#123Earlier quoted context omitted.
This guy picks that upper limit based on the idea that an attacker can't hit the webserver more than 100 times a minute, which makes me question how much he knows about crypto. He doesn't take into account someone who has access to the password hashes. So assume they've got something lame like SHA-1 hashes, even on commodity hardware you're talking about 100,000 hashes a second. Now you're at 2.5 years. Setup a simpl…
Use bcrypt, and chose a work function that's as high as you want. It's pretty trivial to ensure that given certain hardware, it will take a certain amount of time to hash a password. Never Never NEVER use SHA-1 or MD5 for hashing your passwords, those algorithms are designed to be fast. Anyway, the technique is called "Diceware", and you can pretty easily calculate how much entropy you're getting with it. (and assumi…
That is good developer advice. But from the perspective of a user there is no harm in assuming the website your using stores your password as unsalted sha1 and go from there.
Re: Write your passwords down
#124Earlier quoted context omitted.
I somewhat agree, but when mass hacks occur it opens people with poor passwords up to hackers because they've got all the time in the world to see whose accounts they can get into. BTW Do you use the same password on your Gawker account elsewhere?
As long as the password is unique, it doesn't even matter. Sure, it should be unique yet not revealimg a pattern ("goofy" is ok, "gawker" is not) but there is no need for the user to pass crypto 101. This for those 1.5m that were just A target; Nick Denton, OTH, was THE target and it was just matter of time for him to get pwned. >BTW Do you use the same password on your Gawker account elsewhere? I had to check the ot…
Nevertheless, your Gawker password was crackable with JtR.
Re: Write your passwords down
#125This is and isn't bad advice. Writing your passwords down and storing them in your wallet isn't necessarily a good idea. You may be able to secure your wallet, but there may be somewhere better to secure it (such as a house safe). Rather than writing the passwords down, use a decent tool like 1password ( http://agilewebsolutions.com/onepassword ) or Keepass ( http://keepass.info/ ).
No one mentioned Lastpass?
It has a multifactor grid authentication, which along with a user defined password, makes it secure enough for me.
When I started using it, I changed most of my passwords to be 100 characters long. But many sites had a maximum 20 characters or equivalent rule.