Tag Info

Hot answers tagged

10

Don't generate one, make your own memorable one! This site will allow you to test it's strength against multiple criteria.


8

On Unix systems PAM, or Pluggable Authentication Module is a nice administrative tool that comes with a crack library that you can test passwords against. After doing some recent security work, I know that Government standards usually have these guidelines when it comes to a password: Minimum Length of 14 characters At least 2 special characters At least ...


7

There is a discussion here that you could adapt for your purposes. @Echo Off Setlocal EnableDelayedExpansion Set _RNDLength=8 Set _Alphanumeric=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 Set _Str=%_Alphanumeric%987654321 :_LenLoop IF NOT "%_Str:~18%"=="" SET _Str=%_Str:~9%& SET /A _Len+=9& GOTO :_LenLoop SET _tmp=%_Str:~9,1% SET ...


6

Bruce Schneier has a nice article on it, based on what a company has have to be common practice in people choice of passwords. EDIT: Oh, to generate password. You can use tools such as KeePass or Password Safe to auto generate and store different good password for your logins. See this question for more information.


6

From SuperGenPass patched for Google Chrome : Unfortunately, in Google Chrome, SuperGenPass chokes on some pages. I do not blame Chrome for that: it’s for security reasons. I’ve patched the basic version of SuperGenPass so that it can now work on those pages. I am not sure that it fixes everything for everybody but I hope it makes your ...


6

You might want to check out the pwgen application. I know it to be available in the Ubuntu, Fedora, Debian and Suse repositories. From the man page: The pwgen program generates passwords which are designed to be easily memorized by humans, while being as secure as possible. Human-memorable passwords are never going to be as secure as ...


5

Probably. It's random, it could come out as password1! Or more accurately, Yes, they're secure. They're not truly pseudorandom (Or at least, any good generator, like you'd find in a proper password management application), but follow rules designed to create passwords that aren't random, but very hard to guess. Password cracking is a known, predictable ...


5

Personally what I try to do for passwords is first think of a relatively long memorable phrase and perform the following transformation on it: Include all unambiguous punctuation and the first letter of each word Perform German-style capitalisation (first word and all nouns / names as capitals), or the inverse... Replace some words or letters with digits, ...


5

grc.com has a nice page where you can get strong passwords.


5

Keepass have a portable version, and is ported for mobiles (and many other devices): keepassj2me for S60. And you could keep your database on dropbox for easy access


4

Wikipedia has a nice summary on this topic Common password practice Password policies often include advice on proper password management such as: never sharing a computer account never using the same password for more than one account never telling a password to anyone, including people who claim to be from customer service or security never writing down ...


3

There's lots of generators for this kind of thing, but really there's a couple methods I use to come up with something like this - master passwords. Combine several old passwords. You probably have muscle memory from typing them, the hardest part is remembering the order :-). Write a perl, shell, ruby, etc one-liner script. Something like: perl -e ...


3

With the proliferation of keyloggers and phishing attacks, it may behove your organization to consider alternatives to "strong" passwords. See Bruce Schneier's blog about the paper Do Strong Web Passwords Accomplish Anything? I would strongly suggest using two-factor authentication. Between footballs, SecureID, and Yubikey, it is very easy and relatively ...


3

Try 'gpw'. It produces passwords such as these: ubsonsin morimplo demenump esselymn kidentst anenterg essonsuf iesssssi bestruss tnestese Description: Trigraph Password Generator This package generates pronounceable passwords. It uses the statistics of three-letter combinations (trigraphs) taken from whatever dictionaries you feed it. Thus ...


3

When security is a major factor, I always include some high ASCII characters. For example, 154 is Ü. Not only do these characters greatly increase the amount of time required for a brute force attack, but most attacks don't even scan that character range and are sometimes not even capable of it. Also, the obvious: Longer is more secure. Mix lower and ...


3

I have a password matrix that I use. I have it printed and tapped on the back of a business card. I use this matrix to generate my passwords. I have a very set algorithm that I use based on the sensitivity of the data I'm trying to protect. Only I know my algorithms. I may have something simple like SuperUser's account password be just the top row. A bank ...


2

It won't work. Schemes that change the password frequently require accounting for clock slippage between the user (or his device) and the server. Otherwise, if it's close to a time boundary (and, in many cases, not that close), a user will often get the wrong password. Also, policies typically need to be enforced. For example, if a password is "used up", ...


2

The discussion at Diceware is an interesting read. For creating high value passwords and passphrases, the technique of a dictionary like diceware's and a good randomizer such as a handful of dice is a pretty good choice. Personally, I use PasswordSafe locked by a strong passphrase generated by the diceware technique. I let PasswordSafe generate every ...


2

I understand your question because I add a prefix to my email address to track down spam, e.g. I sign in to Amazon with handle+amazon@gmail.com where handle is my email username. Your question goes somewhat in the same direction. If you want to go forward with your idea, use a reasonably strong master password like F_D_W_Y#00 and simply add the name of the ...


2

For personal stuff I use For important things; GMail, Web Host, Online Banking - a different 16-bit randomly generated (A-Za-z0-9) stored in a KeePass DB on DropBox encrypted with a complex but easily remembered passphrase. Perhaps a bit overzealous but it's not much extra hassle. For common, less important things - forums, non-money related accounts etc, ...


2

I don't know what platform you're on, but Mac OS X has a tool like this built into the Accounts settings: It can also estimate how strong any password is, and it has lots of Type and Length options. As for other platforms, or generic things, a bit of Googling has led me to these: http://www.goodpassword.com/ http://strongpasswordgenerator.com/ And ...


2

I like Passwordsafe for keeping track of passwords. My suggestions: Encourage pass phrases, not words. A nonsense phrase made up of 3-4 words is easier to remember than 8 garbled characters. Set a reasonable maximum lifetime. From 3 to 6 months. Do not rely on 1337 speak to protect a password. Brute force dictionary attackers such as Crack have been ...


1

On Friday I had to change my password at my client site. The rules they have are ridiculous. They are all the standard ones about must have uppercase, punctuation, minimum length, etc as well as. The first character cannot be punctuation character. No dictionary words. The same character cannot be used twice. The problem is that they are so complex it is ...


1

I would think that a human friendly password is more succeptable to a dictionary attack. I'd try to creat as strong and secure a password as you can remember.


1

You need to choose a "sensible" frequency for how often they should be changed. Too quickly and people will degenerate into <old_password>+<number> (or something similar), so slowly and you increase the risk of the password being compromised. It might be worth investigating whether there's a rule you can set up to guard against this. Equally you ...


1

You could have something like a password generator like SuperGenPass. So they could have a weak password but the string generated would be extremely strong. But that would be more for website logins. Other options would be: Use 1337 speak in passwords. Use phases with punctuation e.g. This, is a very very long password! Join the ...


1

Short version: The admin part of me says 12-16 character passwords with both lower and upper-case letters and numbers. Also should have a random text part that's not in any dictionary. Should be sufficient to prevent network-based brute-force attacks. As a user I like passwords that are easy to remember, even though they might be long (16 characters and ...


1

This site outlines the guidelines well, and will allow you to test it's security. I think coming up with your own will be more memorable then a generated one as well.


1

Most anwsers here go straight to suggesting policies. Which does answer the question so that's good. But in my opinion you need to ask yourself this first: how important is the information you are protecting? For instance, the password policy for the department of defence to secure confidential information will proably be quite different from the policy ...



Only top voted, non community-wiki answers of a minimum length are eligible