Let’s talk passwords. You should have a different password for every site and service, over 16 character long, without any words, or common misspellings, using capital, lowercase, number and special characters throughout. MyPassword1! is terrible. Q#$bnks)lPoVzz7e? is better. Good luck remembering them all, also change them all every 30 days, so here are my secrets.
1: write your password down somewhere, and obfuscate it. If an attacker has physical access to your desk, your password probably isn’t going to help much.
2: We honestly don’t expect you to follow those passwords rules. I suggest breaking your passwords down into 3 security zones. First zone, bullshit accounts. Go ahead and share this one. Use it for everything that does not have access to your money or PII (Personally Identifiable Information). Second zone, secure accounts, use this password for your money and PII accounts, only use it on trusted sites.Third, reset accounts. Any account that can reset and unlock your other accounts should have a very strong and unique password, and 2FA.
Big industry secret, your passwords can get scraped pretty easily today, 2FA is the barest level of actual security you can get. Set it up. I know it’s a pain, but it’s really all we’ve got right now.
Or, just use a password manager and simplify your life. Reusing any password is bad practice, even if the account doesn’t seem important. Every account really should have a randomly generated unique password. A password manager solves all of these problems.
Unless its something like Bitwarden where you can use it even if they go offline, can take an encrypted or unencrypted backup of your local passwords/accounts, and are FOSS so you can easily self-host your own version if anything happens where you want to cut ties (thanks Vaultwarden!). They’re an awesome company and one I highly suggest supporting with a paid account
Have . and ; and / in the middle of your passwords. If a site is compromised and email + passwords are taken, these are usually stored in a csv file. If someone attempts to delimit the csv data, these characters can split you password into multiple cells.
Good luck remembering them all, also change them all every 30 days, so here are my secrets.
Password expiry hasn’t been considered best practice for a long time (must be at least a decade now?) largely because of the other points you mentioned; it leads to weak easily memorable passwords written somewhere easily accessible. Even when it was considered good 30 days would have been an unusually short time.
Current advice is to change passwords whenever there’s a chance it’s been compromised, not on a schedule.
Yeah, no. Computers don’t care if a password is complex or not. It can’t read “words”. That complexity stuff was introduced because humans think like humans, and wanted to force people to use words not easily found in a dictionary. Security is about password length, so +@#£h&1g/?!:h&£( is equally as vulnerable to a brute force attack as abcdefgh1234567 because of how modern encryption works, it I length that counts.
It is good advice to use a formula to build memorable passwords. I like a simple sentence you can type them without thinking about, as this also won’t appear in a dictionary (avoid famous movie quotes, use something meaningful to you).
Fact is complex passwords created a new security risk; the written down password. Also, frequent forced password changes made it worse. Most businesses only ask staff to change passwords every 3 to 6 months these days. And web sites.never asks you to change your password.
The dirty (not so secret) secret is that, the biggest risk to security is not how complex your password is, but how easy it is to trick people into just giving away access to their accounts.
These days MFA is what makes logon credentials safer and passkeys are slowly proving that passwords themselves are not worth it for most systems.
tl;dr - complex passwords are a throwback and not better than long memorable ones like 1Verycrappycode!
As long as your phone is secure, and the manager only stores data locally, I’d say yes. I would still encourage you to have any “reset capable” accounts secured with a strong password and 2FA that is not in your PW manager.
As with all things IT, there is a tradeoff between comfort/usability and security.
F = Fog, A = Apple, C = Cat, E = Egg, B = Boy, O = Off, O = Off, K = Kite
Next, you need a number if you didn’t use one in your alphabet.
Facebook is 8 letters long so I might use 8. Or only letters repeated once. Or maybe you use the whole URL. Up to you, but you do it the same way for every site. You create a patter that you follow and can remember, rather than remembering every password.
Need a symbol? Assign that to the top level domain. In my example, .com = # .edu = ? .org = * etc
Put it all together and my example password would be “8FogAppleCatEggBoyOffOffKite#”.
A password for google.com might be ‘6GolfOffOffGolfLogEgg#’.
Obviously, you don’t have to do it this exact way with the alphabet, number, and symbol. The idea is that you create a set of rules that you remember and follow. If you write down “A = Apple B = Boy…” and someone finds it, it won’t be instantly obvious that it is meant for passwords.
IT, more specifically user support.
Let’s talk passwords. You should have a different password for every site and service, over 16 character long, without any words, or common misspellings, using capital, lowercase, number and special characters throughout. MyPassword1! is terrible. Q#$bnks)lPoVzz7e? is better. Good luck remembering them all, also change them all every 30 days, so here are my secrets.
1: write your password down somewhere, and obfuscate it. If an attacker has physical access to your desk, your password probably isn’t going to help much. 2: We honestly don’t expect you to follow those passwords rules. I suggest breaking your passwords down into 3 security zones. First zone, bullshit accounts. Go ahead and share this one. Use it for everything that does not have access to your money or PII (Personally Identifiable Information). Second zone, secure accounts, use this password for your money and PII accounts, only use it on trusted sites.Third, reset accounts. Any account that can reset and unlock your other accounts should have a very strong and unique password, and 2FA.
Big industry secret, your passwords can get scraped pretty easily today, 2FA is the barest level of actual security you can get. Set it up. I know it’s a pain, but it’s really all we’ve got right now.
Or, just use a password manager and simplify your life. Reusing any password is bad practice, even if the account doesn’t seem important. Every account really should have a randomly generated unique password. A password manager solves all of these problems.
REMEMBER TO USE A LOCALLY HOSTED ONE, THE CLOUD IS SOMEONE ELSES’ COMPUTER!
Unless its something like Bitwarden where you can use it even if they go offline, can take an encrypted or unencrypted backup of your local passwords/accounts, and are FOSS so you can easily self-host your own version if anything happens where you want to cut ties (thanks Vaultwarden!). They’re an awesome company and one I highly suggest supporting with a paid account
Have . and ; and / in the middle of your passwords. If a site is compromised and email + passwords are taken, these are usually stored in a csv file. If someone attempts to delimit the csv data, these characters can split you password into multiple cells.
Anyone with the barest of skills will have escaped any of these characters.
True. But it will eliminate a percentage of the script kiddies.
Password expiry hasn’t been considered best practice for a long time (must be at least a decade now?) largely because of the other points you mentioned; it leads to weak easily memorable passwords written somewhere easily accessible. Even when it was considered good 30 days would have been an unusually short time.
Current advice is to change passwords whenever there’s a chance it’s been compromised, not on a schedule.
Yeah, no. Computers don’t care if a password is complex or not. It can’t read “words”. That complexity stuff was introduced because humans think like humans, and wanted to force people to use words not easily found in a dictionary. Security is about password length, so +@#£h&1g/?!:h&£( is equally as vulnerable to a brute force attack as abcdefgh1234567 because of how modern encryption works, it I length that counts.
It is good advice to use a formula to build memorable passwords. I like a simple sentence you can type them without thinking about, as this also won’t appear in a dictionary (avoid famous movie quotes, use something meaningful to you).
Fact is complex passwords created a new security risk; the written down password. Also, frequent forced password changes made it worse. Most businesses only ask staff to change passwords every 3 to 6 months these days. And web sites.never asks you to change your password.
The dirty (not so secret) secret is that, the biggest risk to security is not how complex your password is, but how easy it is to trick people into just giving away access to their accounts.
These days MFA is what makes logon credentials safer and passkeys are slowly proving that passwords themselves are not worth it for most systems.
tl;dr - complex passwords are a throwback and not better than long memorable ones like 1Verycrappycode!
Is using a password manager for your phone recommended or no?
As long as your phone is secure, and the manager only stores data locally, I’d say yes. I would still encourage you to have any “reset capable” accounts secured with a strong password and 2FA that is not in your PW manager.
As with all things IT, there is a tradeoff between comfort/usability and security.
Is there one password manager that is better than another? Thanks for answering.
Bitwarden is free and easy to use. They also encrypt more metadata to prevent the kind of breach that lastpass recently had (see https://community.bitwarden.com/t/lastpass-breach-and-implications-for-bitwarden/47214).
This is a method I heard once for remembering random passwords that I thought was clever.
Create your own alphabet of words (or random characters). A is for Apple, B is for Boy, C is for Cat…etc.
For every letter in the URL, you use the word from your alphabet. Ex:
www.facebook.com
F = Fog, A = Apple, C = Cat, E = Egg, B = Boy, O = Off, O = Off, K = Kite
Next, you need a number if you didn’t use one in your alphabet.
Facebook is 8 letters long so I might use 8. Or only letters repeated once. Or maybe you use the whole URL. Up to you, but you do it the same way for every site. You create a patter that you follow and can remember, rather than remembering every password.
Need a symbol? Assign that to the top level domain. In my example, .com = # .edu = ? .org = * etc
Put it all together and my example password would be “8FogAppleCatEggBoyOffOffKite#”.
A password for google.com might be ‘6GolfOffOffGolfLogEgg#’.
Obviously, you don’t have to do it this exact way with the alphabet, number, and symbol. The idea is that you create a set of rules that you remember and follow. If you write down “A = Apple B = Boy…” and someone finds it, it won’t be instantly obvious that it is meant for passwords.
This is terrible. If someone gets a couple of your passwords it’s pretty easy to work out the patterns and gain access to your other accounts.
Don’t complicate it. Use a password manager. I know none of my passwords and that’s how it should be.