Security guys would say: Security by obscurity. But I like the approach
Write your passwords down (2010)
71–80 of 196 posts
Re: Write your passwords down (2010)
#72I did this for a while (with a different algorithm for picking the password off of the table). It gets inconvenient when a site makes you change your password.
Re: Write your passwords down (2010)
#73I'm using an algorithmically generated password. It's long, secure, and I need not remember it. I use random batter-horse-staple-whatever passwords (my own variety of casing and spacing) only in the most important things, like bank or government account and I write them down.
Re: Write your passwords down (2010)
#74Algorithmically generated passwords for different sites was a mind-blower. There are so many differentiation algorithms that are trivially runnable in your head. If most sites are salting and hashing passwords correctly (this is 2023...), then that drastically decreases your compromised credential blast radius. -- And it makes me sad that "store your passwords on dead-tree paper" became GOTO. It has serious weaknesse…
> If most sites are salting and hashing passwords correctly Wouldn't it have to be "if all sites are salting and hashing passwords correctly "? I suspect most "differentiation algorithms that are trivially runnable in your head" would be easily cracked with a couple examples.
I'd hazard no, because 'at scale'.
You could mechanical turk puzzle them trivially, but the realistic threat model is tens of thousands of credentials, tried against high value login prompts.
Re: Write your passwords down (2010)
#75I find it surprising this article doesn't mention password managers, though some comments do. They were already in widespread use in 2010.
> They were already in widespread use in 2010. I'm interested in knowing the stats of this, but 1Password's first release was mid-2006. I know personally I started using 1Password in late 2008, 2009. But I'd argue even then that they were not "widespread" then and even now are not entirely widespread. (Unless you count Cloud Keychain). Arguably I think the more security conscious were using them, but even now, after…
I remember a colleague telling me about this, he used one late 2007. I thought "what unneccessary complexity, I store them encrypted with vim, much better". I know better now.
Re: Write your passwords down (2010)
#76Question for security experts: Is this really that much more secure than a local only password manager, like KeePass? It is fun, but the inconvenience of it feels like its not worth the benefits.
Also, wallets are commonly lost and stolen. And houses burn down and are burglarized. Unless you plan on keeping your passwords in a fireproof safe, which isn’t exactly convenient—especially in our modern mobile world. In 2010, when this article was written, far fewer people did this much computing from a smartphone.
My laptop, phone, ISP, banking, medical & KeePass passwords are written on paper in a fireproof safe.. I also keep offline backups of my KeePass database.
Re: Write your passwords down (2010)
#77There is a slightly more powerful approach developed by Steve Gibson (from the security now podcast) called "Off the Grid" if anyone is interested. It has a few more features baked in and a nice generator to play with. I highly recommend giving it a look.
Re: Write your passwords down (2010)
#78Don't use fancy combinations. Word phrases are even more random and much easier to remember. E.G. "touch-some-grass" is rander longer than any recommended minimum and hardly could be connected to any website.
For anyone looking for a dictionary for diceware passwords (or passphrases, or whatever you call them), I have one available over here[1] with over 23000 words with a minimum of 3 characters.
[1] https://git.sr.ht/~jamesponddotco/acopw-go/tree/trunk/item/w...
Re: Write your passwords down (2010)
#79Earlier quoted context omitted.
There's an xkxd for this: https://xkcd.com/936/ And yet our infrastructure demands so obscure passwords I keep forgetting them all the time.
There's an understated bonus to "correct horse battery staple" passwords — they're easier to type on iPhone and Android keyboards. So besides being of questionable security benefits, 0bScur3 passwords also bonk that advantage of nice-long-easy-to-remember passwords.
Or on a PS5, Nintendo Switch, and whatnot. So much easier to type and remember.
Re: Write your passwords down (2010)
#80Another reason for using a password manager is the fact of keyboard-related attacks getting more widespread. Case in point: A Practical Deep Learning-Based Acoustic Side
Channel Attack on Keyboards (https://arxiv.org/pdf/2308.01074.pdf)