Time to change your password?

This is a fascinating read. Things I have wondered about included the number of possible combinations in a password and this answered it...


So, maybe it's time for me to update my passwords.... and keep a new list of them.... How long should a password be?

Unfortunately, if you are trying to guard against offline attacks, the required length and number of passwords becomes impossible to manage with an ordinary human memory. You can try to use passwords that you "calculate" based on a combination of words and numbers that you remember (the last letters of the names of your seven cousins listed in reverse alphabetical order interspersed with the digits of your social security number adding 7 mod 8 to each digit for example), but with every internet shopping site requiring a password you will quickly find the algorithms as hard to remember as the passwords.
Using an encrypted  password generator/database on a flash drive may be the only practical solution. Keypass works well for this. Then you only have to remember one long and difficult passphrase or calculated password, and keep the drive nearby.

SteveStrummerUK


 
That's an interesting read Herb.
 
I have a mixture of 12 and 14 character passwords; and one 10 character password (which I've just upgraded to 14).
 
Thinking about it, I might even lengthen the 12's to 14's which, using my own little 'code' should still be easy to remember.
 
 
 
 

bapulovesmooch   ?
 
 
 

Beagle

SteveStrummerUK


 
That's an interesting read Herb.
 
I have a mixture of 12 and 14 character passwords; and one 10 character password (which I've just upgraded to 14).
 
Thinking about it, I might even lengthen the 12's to 14's which, using my own little 'code' should still be easy to remember.
 
 
 
 

bapulovesmooch   ?
 
 
 

You left out numbers and specal characters.

Length is what matters, not special characters. Requirements to include punctuation and numbers are annoying and not particularly effective, except that they slow down dictionary attacks by a few minutes.

Think about it: if a string contains a single uppercase letter, there are 26 possible values. If that one-character string can contain either upper- or lowercase letters, that doubles the number of possible values to 52. But if we make it a 2-character string, there are now 676 possible values even with just uppercase characters. Doubling the length of the password has a much greater impact than doubling the number of possible characters.

If you want a strong password, use long phrases that are easy to remember. Don't worry about special characters, don't bother substituting "4" for "A" and "1" for "L". That just makes it awkward to type and does not make the password significantly more secure. Instead, string several words together that aren't in the dictionary, such as "bapu", "becan" and "eadg".

bapu


OK, I've got my new password:

bapulurvesbecanwidstraummynjonbouy

sniff....
 
 
I didn't even get honorable mention AGAIN!!!

slartabartfast


Unfortunately, if you are trying to guard against offline attacks, the required length and number of passwords becomes impossible to manage with an ordinary human memory. You can try to use passwords that you "calculate" based on a combination of words and numbers that you remember (the last letters of the names of your seven cousins listed in reverse alphabetical order interspersed with the digits of your social security number adding 7 mod 8 to each digit for example), but with every internet shopping site requiring a password you will quickly find the algorithms as hard to remember as the passwords.
Using an encrypted  password generator/database on a flash drive may be the only practical solution. Keypass works well for this. Then you only have to remember one long and difficult passphrase or calculated password, and keep the drive nearby.

I've used KeePass for a couple years - very nice.  I especially like their "entropy" calculator which will create a random passcode based on typing and mouse movements - 256 bits if you like.


If you want to learn some interesting stuff about creating passwords, check out this page at Gibson Research: https://www.grc.com/haystack.htm. 

bapu

Beagle

SteveStrummerUK



That's an interesting read Herb.

I have a mixture of 12 and 14 character passwords; and one 10 character password (which I've just upgraded to 14).

Thinking about it, I might even lengthen the 12's to 14's which, using my own little 'code' should still be easy to remember.

bapulovesmooch   ?

You left out numbers and specal characters.

Maybe bapulovesmooch2 would work (personally I see two special characters already in there, right?).

SteveStrummerUK

Russell.Whaley

I've used KeePass for a couple years... 

 That's useless Russell, it's only seven characters long.