How many passwords do you have?

[Greenpete]

Hi!
I wrote an article about creating passwords on my blog today.
I wanted to share a way of remembering a different password for every online account we may have, like BCUK!
The small amount of feedback I have had already suggests that it might not be for everyone but then it might work for you.
I hope it does!
Peter
http://www.greenpete.co.uk/?p=343

 

[Toddy]

It's a good idea Pete, and sometimes folks do need details like this reminding.
I'm inclined to stick to a small pool of passwords and seem to work with that but if anyone really knows me chooses to try to hack, I suppose they could manage Only the bank ones are different.
Might need to think about this a bit more......

Cheers,
Toddy

 

[gregorach]

Password management is a real pain. It's even worse for me - I develop online systems for a living, so in addition to all my own passwords, I have about a bazillion others for various systems at work...

Your system is an interesting one, but it has its flaws. Given just one correct password based on this system, I can then work out all the others. So, if I could entice you to register on a site of my own devising, or if I could obtain any one of your existing passwords (there are many, many ways to do this), then you're wide open. In this respect, it's not actually much better than just using the same password everywhere.

The approach I use is to have one "low-level" password I use for non-sensitive systems (like here). Where possible, I don't leave sensitive information lying around - so, for example, I delete my credit card details from Amazon every time I use them. (Such information is at risk even if your passwords are secure - someone might steal / hack their database.) I then have a series of other, more secure passwords I use for more sensitive systems.

There really is no good solution - passwords just aren't very secure. And lets not even talk about the so-called "secure personal information" so many banks seem to think is an acceptable security approach...

 

[loz.]

Hi Pete,

I didnt mail to your blog - but i'd also suggest mixing up your case in passwords,

eg from your example

10YabEcReam66

from

10yabecream66


personally though i dont use memorable words alone i tend to make up my own mnemonics eg

"always let me in as im the admin"

almiaita

althoug i'd change to

@lm1@1tA






regards

Laurence
Unix Sysadmin - Aerlingus ( for now till O'Leary buys us out )

 

[leon-1]

I used to use something that was memorable to me, but since working for a large company with a large IT Network that changed, now I have a tendency to use a word in l33t combined with a specific number and variable case for letters, never less than 12 digits in length.

The words are more or less random, the number combination can be situated anywhere in the l33t formatted word and can be upto eight digits in length. Effectively my passwords look like a load of gobbledy-gook.

 

[loz.]

This still a bushcraft forum ? LOL


As well as passowrds though i'd also implement some kind of access control such as ACL's on routers /switches etc -

and tcpwrappers on servers.

that way admin type connections eg ssh ( not application traffic ) are allowable only from certain ips, mac address etc...


ok back to work !


Laurence

 

[dwardo]

I work as an infrastrucutre engineer so i have oooodles of the bloody things The best thing i find to remember them is to use pass phrases as opposed to words and capitalise/numeric them such as

"I Hate Fekin Passwords1"
"I Have The Memory of a Gold Fish"

They sound daft but yer less likely to foget them and there is little chance of a dictionary attack on them

 

[Greenpete]

Wow! A very interesting response! I have read through the above and will have to go through them again tonight and really study some of them.
gregorach; I have thought about this and you are right, and I have been trying to work out how to overcome this problem.
Hopefully this kind of thread will bring to light many things and some may lead to the answer!?
I too use low and high level passwords, and in fact I see this system of mine as a mid level one, because to crack one of these passwords with no idea of my system would be, I think, difficult but as gregorach said it has it's flaws.
Banks tend to use a complicated and very unmemorable system (which probably means that people have to write them down!) for protection, that basically means 'key loggers' would not be effective in harvesting passwords.
Thanks for your responses.
Pete

 

[dommyracer]

I have a lot of passwords to remember as well, real PITA.

I tend to use low level and high level passwords as well - high level ones are seemingly random but I make sure I log into systems often so I don't forget them.

 

[Greenpete]

As gregorach has said there is a flaw in this system!
If anyone was to get hold of just one of your passwords they could work out how you created the password and then apply that to any other accounts they knew you had…. unlikely? Either way, not good!
So the next thing is to try ‘word association’.
Lets take ebay again. The first thing that comes to my mind is ebay-b ( e baby) so there you already have another word to use as your variable that has little to do with the original.
With ‘word association’ it is your own mind and the way that it thinks that gives you the variable.
I realise this is starting to get complicated but it’s just a thought.
There are two interactive word association websites that I have played around with that I found fun;
http://www.wordassociation.org/search/
http://www.eat.rl.ac.uk/
I would love to hear any ideas people have.