LastPass users are once again being warned about stolen personal data, though this time the breach happened through one of the company’s outside partners.
What composition though? I’ve got well over 100 that are 20+ characters including special characters. I can’t believe this is possible without use of words or something easily guessed.
I do have a few passwords I keep to myself, and even with my method of taking the first letter from a key phrase or set of song lyrics and switching most to leet speak, I still don’t think I could possibly remember more than a dozen reliably.
You can actually generate high entropy passphrases by chaining random words together. You just need to make sure the phrases are actually random and not just whatever comes to your head at the moment.
Naturally, words help with memorization, but memorizing hundreds of these is impractical at best, especially because long-term memory for infrequently used accounts is subject to “bit rot”.
How many characters are we talking, though? I’ve had passwords as limiting as 16 characters for some services (unfortunately)… that seems small to me for generating real randomness with passphrases.
That said, fair enough, but as someone who has administered a network before, I would never, ever want my users relying on their brain… the security from a pass manager is practically going to be way better than the standard practices of an average user without one. IMO.
The entropy stems from the words, not characters. With random words and no repetition, you have C(n, k) combinationsP(n, k) permutations (or n^k with repetition), where n is your dictionary size and k is the number of words you chain together. These passwords tend to be longer, but not by much. A big enough dictionary can yield some pretty high entropy with only a few words.
I’ve had passwords as limiting as 16 characters for some services (unfortunately)…
16 characters is hardly enough for random characters unless you include Unicode (which rarely works for those same services that usually have shitty implementations).
Not much can be done there, sadly. You’re lucky if they even hash their passwords anyway - you’ll probably just get your password emailed to you if you click “forgot password” like it’s 2003.
I would never, ever want my users relying on their brain…
I never would either. People should just use a password manager. I was just mentioning an alternative that generated more memorable passphrases, but I wouldn’t advocate for it over random high-entropy strings saved in a password manager.
Sure if it’s possible for you then it must be possible for everyone 😐. I’m sure that this will work for my ass. It’s not like I know from experience that I will forget anything of importance if I don’t write it down.
I keep a journal and a commonplace book (and a self hosted password manager) to remember anything of importance for no reason at all, silly me should have just remembered it. I just need to pull myself up by my bootstraps and stop being lazy duh.
You can do it. That’s my point. Yes it takes time. Yes it takes patience. Yes it takes practice.
Your brain is an incredible machine capable of so many things, much more by far than a computer.
Computers are chunks of silicon. They do basic addition. They just do it so much quicker is all.
Yours is superior. Keep it exercised.
I do keep a cheat sheet of clues. Things that I write to remind me of the actual phrase, but I rarely need it. Make a point to memorize 10 a week. Custom photo screensavers (I use jpeg Saver 5.3 by Goat 1000) are great for flash cards. I find writing it out to be the best way to learn, but reading is my second, and listening is third (but rather poor considering I lose focus and miss bits). Try to learn how you learn best and exploit that. I used to have an old braintest that was incredibly accurate. It would tell you whether you were more inclined for audio or visual learning. It also defined your brains inclination to be left hemispheric or right hemispheric in its dominance. It was called brainworks. I think it ran on windows 95. For sure Windows 98SE.
Honestly, a lot of the ones I ended up needing to lookup or reset were the ones that are restricted with a maximum length and I cant use an entire phrase. That just jambs up my plumbing, if you know what I mean.
I can’t tell if you are self deluded or really are an interesting case. I do question using a screensaver to help memorise a password rather than a password manager.
Hey, don’t use a password manager like KeePass, because brain is the only safe place to store passwords. In order to do that, WRITE THEM ON FLASH CARDS to memorize them and then THROW THEM AWAY
A paper notebook is basically the same fundamental as a password manager but with a different tradeoff. You trade cryptographic security for a reliance on physical security. Its probably a great option for a lot of older people who only log into things from home. But its just a password manager. An analogue one.
Flashcards are dumb for this. If you are going to write it down, just secure it. Don’t have them out all the time to try to memorise it. Jese. The worst of both.
Write clues to your passphrase, not the actual passphrase.
I spend a fair amount of time making my username and password.
I choose something that I’m going to remember.
As an example, I was asked to attend a meeting to check out a point maker, a box that bombards objects with photons to collect the reflections, generating a 3d point cloud model that can be measured in cad. This particular one was fairly awful. Bottom of the barrel effort. The salesman was a complete slob, he was late, he took forever to set it up and had much difficulty getting it to actually work. When it did, it measured a 12.75" brick at 14.5". I knew right away it was shit.
They forced us to create an new account on the laptop with the software as it was too advanced and proprietary (pukes) for me to run it on my cad workstation. So, my password begrudgingly became a stylized derivation of “This Guys Balls Smell Like Cheese”. I still remember that password to this day 12 years later.
Not only that, but when we would have the guy out to troubleshoot, I would sometimes have to log in for him to repeat our steps. The salesman was always impressed with my typing speed and ability to remember my password. He probably never even knew my password was a total insult at him. My clue for the pass phrase was “Lynard Skynard”.
That is actually quite effective, though I would likely spell out the 35 and allow sylization to create numerics.
You can likely now remember that phrase “My-brain-isnt-made-for-35c” forever if you just reinforce the memory from time to time. Creating an absurd image in your head or even using a real image to associate is another good way of remembering something. For this, I would leave myself a clue of ‘I thought 36 was OK’.
Maybe not for everything though.
Look, the amount of negativity I’m generating for myself just trying to encourage a simple alternative and self reliance is really irking me. I’ve used this method for twenty years or so, and found it to be extremely effective. Consider it a door. Use it if you want. It is possible. You are better and smarter than a machine or software. Last post about it.
All good with me. Feel free to PM (DM?) Me with reasoning and if there’s research you’re aware of that supports. I admit I know too little.
I had a phrase that was the first letter of the title books on my shelf from left to right. I don’t use it anymore but I still remember it.
Last point. Many of us have hundreds of passwords because you need a password to log into everything. Even a dog walker portal is some software platform making you setup an account. I think that’s gone way too far requiring a login for everything. I want to buy, for example, some yogurt cultures from a fermentation store. Not setup an account become best friends.
I probably have around 100 accounts that I’d need to remember the passwords to, that’s not possible while keeping them actually decent and unique.
It is possible. I have 78 unique passphrases. You only need to train your brain and not turn it over to a machine.
What composition though? I’ve got well over 100 that are 20+ characters including special characters. I can’t believe this is possible without use of words or something easily guessed.
I do have a few passwords I keep to myself, and even with my method of taking the first letter from a key phrase or set of song lyrics and switching most to leet speak, I still don’t think I could possibly remember more than a dozen reliably.
You can actually generate high entropy passphrases by chaining random words together. You just need to make sure the phrases are actually random and not just whatever comes to your head at the moment.
Naturally, words help with memorization, but memorizing hundreds of these is impractical at best, especially because long-term memory for infrequently used accounts is subject to “bit rot”.
How many characters are we talking, though? I’ve had passwords as limiting as 16 characters for some services (unfortunately)… that seems small to me for generating real randomness with passphrases.
That said, fair enough, but as someone who has administered a network before, I would never, ever want my users relying on their brain… the security from a pass manager is practically going to be way better than the standard practices of an average user without one. IMO.
But hey, color me impressed, honestly.
The entropy stems from the words, not characters. With random words and no repetition, you have
C(n, k)combinationsP(n, k)permutations (orn^kwith repetition), wherenis your dictionary size andkis the number of words you chain together. These passwords tend to be longer, but not by much. A big enough dictionary can yield some pretty high entropy with only a few words.16 characters is hardly enough for random characters unless you include Unicode (which rarely works for those same services that usually have shitty implementations).
Not much can be done there, sadly. You’re lucky if they even hash their passwords anyway - you’ll probably just get your password emailed to you if you click “forgot password” like it’s 2003.
I never would either. People should just use a password manager. I was just mentioning an alternative that generated more memorable passphrases, but I wouldn’t advocate for it over random high-entropy strings saved in a password manager.
Yeah, I was particularly irked by that 16 limit I encountered the other day.
And I stand corrected, then, and color me impressed. I’ll look into doing this for those passwords I need to remember, like masters.
I also should correct myself - it’s not
C(n, k), it’sP(n, k)(which isn! / (n-k)!). It’s been a minute since I took a statistics class lol.In any case, it’s a lot of entropy with just a few words.
Sure if it’s possible for you then it must be possible for everyone 😐. I’m sure that this will work for my ass. It’s not like I know from experience that I will forget anything of importance if I don’t write it down.
I keep a journal and a commonplace book (and a self hosted password manager) to remember anything of importance for no reason at all, silly me should have just remembered it. I just need to pull myself up by my bootstraps and stop being lazy duh.
You can do it. That’s my point. Yes it takes time. Yes it takes patience. Yes it takes practice. Your brain is an incredible machine capable of so many things, much more by far than a computer. Computers are chunks of silicon. They do basic addition. They just do it so much quicker is all. Yours is superior. Keep it exercised.
I do keep a cheat sheet of clues. Things that I write to remind me of the actual phrase, but I rarely need it. Make a point to memorize 10 a week. Custom photo screensavers (I use jpeg Saver 5.3 by Goat 1000) are great for flash cards. I find writing it out to be the best way to learn, but reading is my second, and listening is third (but rather poor considering I lose focus and miss bits). Try to learn how you learn best and exploit that. I used to have an old braintest that was incredibly accurate. It would tell you whether you were more inclined for audio or visual learning. It also defined your brains inclination to be left hemispheric or right hemispheric in its dominance. It was called brainworks. I think it ran on windows 95. For sure Windows 98SE.
Honestly, a lot of the ones I ended up needing to lookup or reset were the ones that are restricted with a maximum length and I cant use an entire phrase. That just jambs up my plumbing, if you know what I mean.
I can’t tell if you are self deluded or really are an interesting case. I do question using a screensaver to help memorise a password rather than a password manager.
Flashcards. Write down your credentials and memorize them. Throw them away willy nilly when you’re done.
Hey, don’t use a password manager like KeePass, because brain is the only safe place to store passwords. In order to do that, WRITE THEM ON FLASH CARDS to memorize them and then THROW THEM AWAY
Tell me it was a joke
Flashcards are your brains friend. They are no joke.
A paper notebook is basically the same fundamental as a password manager but with a different tradeoff. You trade cryptographic security for a reliance on physical security. Its probably a great option for a lot of older people who only log into things from home. But its just a password manager. An analogue one.
Flashcards are dumb for this. If you are going to write it down, just secure it. Don’t have them out all the time to try to memorise it. Jese. The worst of both.
Writing down your password is breaking the very first rule ever made about passwords. A cliche. Only appears in fiction
Write clues to your passphrase, not the actual passphrase. I spend a fair amount of time making my username and password. I choose something that I’m going to remember.
As an example, I was asked to attend a meeting to check out a point maker, a box that bombards objects with photons to collect the reflections, generating a 3d point cloud model that can be measured in cad. This particular one was fairly awful. Bottom of the barrel effort. The salesman was a complete slob, he was late, he took forever to set it up and had much difficulty getting it to actually work. When it did, it measured a 12.75" brick at 14.5". I knew right away it was shit.
They forced us to create an new account on the laptop with the software as it was too advanced and proprietary (pukes) for me to run it on my cad workstation. So, my password begrudgingly became a stylized derivation of “This Guys Balls Smell Like Cheese”. I still remember that password to this day 12 years later.
Not only that, but when we would have the guy out to troubleshoot, I would sometimes have to log in for him to repeat our steps. The salesman was always impressed with my typing speed and ability to remember my password. He probably never even knew my password was a total insult at him. My clue for the pass phrase was “Lynard Skynard”.
You should try KeePass or VaultWarden. A new account is just a few clicks away. You can do the mind tricks with the main password.
You offering to pay?
They are free…
That would work, if I had like ten or twenty of them to remember.
No amount of studying is gonna make me remember almost a hundred strings of 24 random characters, and what string goes to what account
It was supposed to be joke 😔
Damn, I see that now. The heat wave is making me stupid, my brain isn’t made for 35C
That’s your new password friend! For everything! “My-brain-isnt-made-for-35c” I solved internet security. /s
That is actually quite effective, though I would likely spell out the 35 and allow sylization to create numerics.
You can likely now remember that phrase “My-brain-isnt-made-for-35c” forever if you just reinforce the memory from time to time. Creating an absurd image in your head or even using a real image to associate is another good way of remembering something. For this, I would leave myself a clue of ‘I thought 36 was OK’.
Maybe not for everything though.
Look, the amount of negativity I’m generating for myself just trying to encourage a simple alternative and self reliance is really irking me. I’ve used this method for twenty years or so, and found it to be extremely effective. Consider it a door. Use it if you want. It is possible. You are better and smarter than a machine or software. Last post about it.
All good with me. Feel free to PM (DM?) Me with reasoning and if there’s research you’re aware of that supports. I admit I know too little.
I had a phrase that was the first letter of the title books on my shelf from left to right. I don’t use it anymore but I still remember it.
Last point. Many of us have hundreds of passwords because you need a password to log into everything. Even a dog walker portal is some software platform making you setup an account. I think that’s gone way too far requiring a login for everything. I want to buy, for example, some yogurt cultures from a fermentation store. Not setup an account become best friends.
Don’t use random characters. Use absurd phrases that mean something to you.