Good Passwords

Don’t worry too much re some Russians stole 1.2 billion passwords. Internet security expert Bruce Schneier says, “This story is getting squrrelier and squrrelier. Yes, security companies love to hype the threat to sell their products and services. But this goes further: single-handedly trying to create a panic, and then profiting off that panic.”

Also at the bottom of the linked report, read Bruce’s good recommendations about choosing passwords. It’s good, but we should use a different password for each site, and how do you remember the sentence you used for each site?

I use passwords based on Steve Gibson’s haystack idea:

“Which of the following two passwords is stronger,
more secure, and more difficult to crack?

D0g…………………

PrXyc.N(n4k77#L!eVdAfp9

“You probably suspect this is a trick question, but the answer is: Despite the fact that the first password is HUGELY easier to remember and use, it is also the stronger of the two! In fact, since it is one character longer and contains uppercase, lowercase, a number and special characters, that first password would take an attacker approximately 95 times longer to find by searching than the second impossible-to-remember-or-type password!”

For the first three characters of every one of your passwords, just use your initials but with one initial capital and one lower case, and replacing one with a number. Like for initials ABC use 1Bc (for all your passwords), then add two symbols repeated four times, like 1Bc$#$#$#$#.

All of my passwords look like that and they’re all very secure passwords.

I use this idea, but use a very simple, very easily remembered rule that changes the repeated characters and the number of times they are repeated, based on the name and length of that specific website’s name.

If you could receive PGP encrypted email, I’d tell you my rule exactly. But you can figure out your own rule that is both very easy to remember and very secure and different for every website.