Hot answers tagged

10

Don't generate one, make your own memorable one! This site will allow you to test it's strength against multiple criteria.


8

On Unix systems PAM, or Pluggable Authentication Module is a nice administrative tool that comes with a crack library that you can test passwords against. After doing some recent security work, I know that Government standards usually have these guidelines when it comes to a password: Minimum Length of 14 characters At least 2 special characters At least ...


8

There is a discussion here that you could adapt for your purposes. @Echo Off Setlocal EnableDelayedExpansion Set _RNDLength=8 Set _Alphanumeric=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 Set _Str=%_Alphanumeric%987654321 :_LenLoop IF NOT "%_Str:~18%"=="" SET _Str=%_Str:~9%& SET /A _Len+=9& GOTO :_LenLoop SET _tmp=%_Str:~9,1% SET ...


6

Bruce Schneier has a nice article on it, based on what a company has have to be common practice in people choice of passwords. EDIT: Oh, to generate password. You can use tools such as KeePass or Password Safe to auto generate and store different good password for your logins. See this question for more information.


6

Probably. It's random, it could come out as password1! Or more accurately, Yes, they're secure. They're not truly pseudorandom (Or at least, any good generator, like you'd find in a proper password management application), but follow rules designed to create passwords that aren't random, but very hard to guess. Password cracking is a known, predictable ...


6

You might want to check out the pwgen application. I know it to be available in the Ubuntu, Fedora, Debian and Suse repositories. From the man page: The pwgen program generates passwords which are designed to be easily memorized by humans, while being as secure as possible. Human-memorable passwords are never going to be as secure as ...


6

From SuperGenPass patched for Google Chrome : Unfortunately, in Google Chrome, SuperGenPass chokes on some pages. I do not blame Chrome for that: it’s for security reasons. I’ve patched the basic version of SuperGenPass so that it can now work on those pages. I am not sure that it fixes everything for everybody but I hope it makes your ...


5

Keepass have a portable version, and is ported for mobiles (and many other devices): keepassj2me for S60. And you could keep your database on dropbox for easy access


5

Personally what I try to do for passwords is first think of a relatively long memorable phrase and perform the following transformation on it: Include all unambiguous punctuation and the first letter of each word Perform German-style capitalisation (first word and all nouns / names as capitals), or the inverse... Replace some words or letters with digits, ...


5

grc.com has a nice page where you can get strong passwords.


4

Wikipedia has a nice summary on this topic Common password practice Password policies often include advice on proper password management such as: never sharing a computer account never using the same password for more than one account never telling a password to anyone, including people who claim to be from customer service or security never writing down ...


4

Try 'gpw'. It produces passwords such as these: ubsonsin morimplo demenump esselymn kidentst anenterg essonsuf iesssssi bestruss tnestese Description: Trigraph Password Generator This package generates pronounceable passwords. It uses the statistics of three-letter combinations (trigraphs) taken from whatever dictionaries you feed it. Thus ...


3

When security is a major factor, I always include some high ASCII characters. For example, 154 is Ü. Not only do these characters greatly increase the amount of time required for a brute force attack, but most attacks don't even scan that character range and are sometimes not even capable of it. Also, the obvious: Longer is more secure. Mix lower and ...


3

With the proliferation of keyloggers and phishing attacks, it may behove your organization to consider alternatives to "strong" passwords. See Bruce Schneier's blog about the paper Do Strong Web Passwords Accomplish Anything? I would strongly suggest using two-factor authentication. Between footballs, SecureID, and Yubikey, it is very easy and relatively ...


3

I don't know what platform you're on, but Mac OS X has a tool like this built into the Accounts settings: It can also estimate how strong any password is, and it has lots of Type and Length options. As for other platforms, or generic things, a bit of Googling has led me to these: http://www.goodpassword.com/ http://strongpasswordgenerator.com/ And ...


3

There's lots of generators for this kind of thing, but really there's a couple methods I use to come up with something like this - master passwords. Combine several old passwords. You probably have muscle memory from typing them, the hardest part is remembering the order :-). Write a perl, shell, ruby, etc one-liner script. Something like: perl -e '/...


3

I have a password matrix that I use. I have it printed and tapped on the back of a business card. I use this matrix to generate my passwords. I have a very set algorithm that I use based on the sensitivity of the data I'm trying to protect. Only I know my algorithms. I may have something simple like SuperUser's account password be just the top row. A bank ...


2

I like Passwordsafe for keeping track of passwords. My suggestions: Encourage pass phrases, not words. A nonsense phrase made up of 3-4 words is easier to remember than 8 garbled characters. Set a reasonable maximum lifetime. From 3 to 6 months. Do not rely on 1337 speak to protect a password. Brute force dictionary attackers such as Crack have been ...


2

For personal stuff I use For important things; GMail, Web Host, Online Banking - a different 16-bit randomly generated (A-Za-z0-9) stored in a KeePass DB on DropBox encrypted with a complex but easily remembered passphrase. Perhaps a bit overzealous but it's not much extra hassle. For common, less important things - forums, non-money related accounts etc, ...


2

I'm the author of the random password generating site http://passwordcreator.org. Here is what I learned in the process of creating that site about creating secure random passwords: Random Source Most random number generators on computers are psuedorandom. They are based on algorithms and not appropriate for generating passwords. They are generally ...


2

The discussion at Diceware is an interesting read. For creating high value passwords and passphrases, the technique of a dictionary like diceware's and a good randomizer such as a handful of dice is a pretty good choice. Personally, I use PasswordSafe locked by a strong passphrase generated by the diceware technique. I let PasswordSafe generate every ...


2

rem 16 stings pwd setlocal ENABLEEXTENSIONS ENABLEDELAYEDEXPANSION set alfanum=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 set pwd= FOR /L %%b IN (0, 1, 16) DO ( SET /A rnd_num=!RANDOM! * 62 / 32768 + 1 for /F %%c in ('echo %%alfanum:~!rnd_num!^,1%%') do set pwd=!pwd!%%c ) echo pwd=%pwd%


2

I understand your question because I add a prefix to my email address to track down spam, e.g. I sign in to Amazon with handle+amazon@gmail.com where handle is my email username. Your question goes somewhat in the same direction. If you want to go forward with your idea, use a reasonably strong master password like F_D_W_Y#00 and simply add the name of the ...


2

It won't work. Schemes that change the password frequently require accounting for clock slippage between the user (or his device) and the server. Otherwise, if it's close to a time boundary (and, in many cases, not that close), a user will often get the wrong password. Also, policies typically need to be enforced. For example, if a password is "used up", ...


2

GNU screen uses GNU crypt C library (wikipedia, manual) with DES encryption and a random salt comprised of 2 random uppercase alphabetic characters. So, let's use mkpasswd from whois package that relies on the same library: sudo apt-get install whois Then generate the encrypted password: (echo -n "password "; mkpasswd -m des -S SO "test") >> ~/....


1

Cross-Platform: Using PERL There's a PERL password generator that works for Windows, *nix, OS X, etc. Usage: genpass [-OPTIONS] LENGTH -s, --symbols Exclude symbol characters. -n, --numbers Exclude number characters. -u, --uppercase Exclude uppercase characters. -l, --lowercase Exclude lowercase characters. On Windows, it can be ...


1

The SecurityStats site has a page where you can try your password fu It gives you guidelines on better passwords too. Microsoft also has a similar Password checker page Another similar Password Meter Google support suggestions -- Choosing a password and security question However, I have never liked the security question angle Good read on the Google ...


1

Clipperz (http://www.clipperz.com/) is a good online solution for password management. Their system not only allows for you to store the username and password, but also other information relating to the system the password is used for (e.g. the support phone number for an online store). They also have an offline read only version, so that you can use still ...


1

As far as strength against brute force cracking goes, the best thing to do is increase the length and the number of possible combinations increase exponentially (literally). Of course, it's still a good idea to introduce some random characters and symbols to make dictionary attacks more difficult. Or maybe use a couple of words from different languages - ...



Only top voted, non community-wiki answers of a minimum length are eligible