131–140 of 299 posts
Example generated phrase: "married greatly snake battle" These phrases would be easier to remember if they made grammatical sense. Like Chomsky's famous "colorless green ideas sleep furiously" - the words relate to each other grammatically, even though it makes no sense. Imagine memorizing "married greatly snake battle" vs "married snakes battle greatly." I think the latter is easier.
Not a good idea, sadly. In fact I'd go so far to say this is a really bad suggestion ; because it gives a false sense of security. There is potentially a lot less entropy in this password than "Tr0ub4d0r&3", assuming the hacker is smart enough to realise he can trivially test combinations of dictionary words in very short amount of time. (EDIT: I'm way out of touch with this; it's not as trivial as perhaps I figured.…
You can add equivalent entropy just by adding a few random special characters, a number, and a letter.
Personally, I prefer to type my passwords until I remember them. Therefore, my metric is "easy to type and hard to guess." If it's easy to type, I remember it via muscle memory, which is unbelievably better than trying to remember abstract symbols.
I prefer using a program like Password Safe ( http://passwordsafe.sourceforge.net/ ), and use a safe password that's a long sentence (with punctuation). Then I can use arbitrarily long and complex passwords for all my accounts, and not have to worry about memorizing them individually. The password safe can even be synced across computers using Dropbox.
A lot of comments here seem to be missing the point. The main point is to use passwords that give you the most "bang for the buck" in the sense of adding the most bits of entropy for the least difficulty of remembering. Adding an extra number, or punctuation, or certain numbers of repetitions generally adds only a little bit of entropy for a significant cost in additional challenge to your memory. Our minds are well…
I make less typing mistakes with shorter, complicated passwords. Long passwords are typing-error prone. With mobile devices, it gets worse, as typing is really painful.
It is a good point, though, that for frequently typed passwords on a good keyboard, you can engage your muscle memory. That allows you to type short passwords very quickly, and even remember passwords with your fingers that you've lost from your conscious memory!
Phrase: Three Rings for the Elven-kings under the sky, Seven for the Dwarf-lords in their halls of stone
Password: 3RftE-kuts,7ftD-lithos
Easy to remember and highly secure. I have been using this method for years.
Bonus example: Four score and seven years ago our fathers brought forth on this continent, a new nation, conceived in Liberty
4sasyaofbfotc,ann,ciL
Less secure then the last example but still strong. Especially if you use uncommon strings like the words to a song by a local band or a phrase from the newspaper or an unpopular book. That way even an attack targeting this method will take a long long time.
Put this in your .bashrc: function rpass() { strings /dev/urandom | grep -o '[[:alnum:]\/!@#$%^&*() ,.,{}]' | head -n $1 | tr -d '\n'; echo } Then run $ rpass 16 and get a 16 character random password with a fairly high entropy. Then just use a service like LastPass or a solution like KeePassX or even a single GPG-encrypted file to store your passwords. Problem solved. Passwords are evil. Most of them should be treat…
Earlier quoted context omitted.
Don't forget sites that require: "your password MUST contain at least one number, one uppercase letter, and one of the following characters: !, @, #, or $, but not %, ^, &, or *". I slap my forehead at how counterproductive these requirements are.
This is why, for my lab's password changer, the requirement for short passwords is simply that it must have one upper, one lower, one digit, and one none-of-the-above (and be at least 8 characters). If you have a long password (at least 16 characters), all other requirements are waived so that you can use passphrases.
I've been using phrases and sentences as passwords for a while, and I've found that there are 2 main problems; 1) A lot of sites, still in this day and age, have max password lengths, so I still have a lot of short passwords. Usually this is bank sites and the like. 2) Password entry fields are often very short visually, and with a long password getting lost is much easier. I find I have to type them over A LOT. The…
These are the real issues with this. Banks seem to be borderline idiots when it comes to password security: case-insensitive, no spaces, 20-character max, small choice of "special characters". These are from Amex, who's password requirements sadly were even worse a few months ago. With crappy password requirements, it's impossible to use decent passphrases. Getting locked out of your account for 3 failed attempts at…
Your favorite book is almost certainly chosen from the 129 million books that Google knows about: http://www.fastcompany.com/1678254/how-many-books-are-there-...
That gives you 27 bits of entropy.
The average book length is probably not over 400 pages. An average page probably doesn't have over 25 sentences on it. So the whole book contains only ten thousand sentences.
That gives you 14 more bits of entropy.
The total is 41 bits of entropy. This is one-eighth as secure as a 4-gram composed of random words from a corpus of 2k, if we measure strictly by entropy.
The situation is actually much worse, though: your favorite book is probably a popular book. So the number of bits of entropy provided by the choice of book might be a lot smaller than 27. I would guess that it's perhaps 10.
And many of those 129 million books are not very different. They contain quotes from other books, reprinted short stories, folk tales, set phrases, and so on.
In practice I think it might be difficult to mount a password-guessing attack using the Google Books corpus, because it's hard to get access to that corpus. The Project Gutenberg corpus would not be so hard.
A lot of comments here seem to be missing the point. The main point is to use passwords that give you the most "bang for the buck" in the sense of adding the most bits of entropy for the least difficulty of remembering. Adding an extra number, or punctuation, or certain numbers of repetitions generally adds only a little bit of entropy for a significant cost in additional challenge to your memory. Our minds are well…
The best part is that any automated attack would have to deal with ringtone popups.
This is how I come up with passwords; I find a phrase that I can remember without too much trouble then I use the first letter of each word to make a password. Phrase: Three Rings for the Elven-kings under the sky, Seven for the Dwarf-lords in their halls of stone Password: 3RftE-kuts,7ftD-lithos Easy to remember and highly secure. I have been using this method for years. Bonus example: Four score and seven years ago…