Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was thinking recently about password security. My goal is to have mostly random passwords, that are different for each site. But you also should be able to remember them (or re-generate them) without the help of any notes or the like. If I use really random passwords (generated by a password-generator), I can remember only a few. Many fewer than the number of web accounts I have. Simpler passwords often are easier to guess.

I thought that a compromise might be some easy to learn rules and some secret master-password, to generate a password from the name of the site. Say you have a password for ebay and amazon. This method should generate two different passwords, for 'ebay' and 'amazon'. But I should also be able to do the process in my head, without support from software or even paper and pencil. Commonly used passwords I will remember directly. But ones seldom used, and forgotten, could be reconstructed with such a method. Does anyone know about such a method?

EDIT: The thing I ask for should improve security, by making different passwords for each site/machine/program, but also keep all of them memorable. A password-safe is nice, but you are even more likely to forget the site passwords, and if you lose your store or it is damaged you have a problem. Also ALL the passwords can be compromised at once! And in the end, my local password-safe is not at hand, if I'm at the machine of a friend.

share|improve this question
    
Very similar to this question. –  sdanelson Dec 19 '10 at 17:39
1  
No, that is a method to generate one password. But using the same password all the time is no option, and different password even generated with one the referenced methods are very hard to remember. Do you remember a password on a website, you didn't visit the last two years? –  Mnementh Dec 19 '10 at 17:50
    
The technique described by Yann Esposito and John would work great, if only there were a hash function that one can compute without a computer?. –  David Cary Aug 10 '12 at 17:29

9 Answers 9

I have a two sided answer to this -

You can do this, and a commonly stated method includes a section based on the website and a section based on time. You can make a password like blahblahebay2010 and this would probably be recoverable if you thought about it in a couple of years time. Does what you want.

However I would not advise it - you should not use a system which means your password can be worked out. Okay, you may not be a big target - but maybe someone will want to break your passwords...so if there is an algorithm you use based on the website then you dramatically lower the strength of the password. Instead, use something like Password Safe to store all your passwords (which can be very long, complex, unmemorable etc) and just remember the one strong password to protect them.

share|improve this answer
    
Normal password generators use also an algorithm to generate the password. Can such a generation method not be made more secure, through inclusion of some secret/master-password that bases the generation? I don't think master-password + site-specific + year is enough, but wouldn't some sort of hash-function on the combination of the three work? –  Mnementh Dec 19 '10 at 19:07
    
@Mnementh It's more around the complexity level you can do in your head in order to remember it a year or two later. You just couldn't use anything near as complex as the password generator tools. With tools like Password Safe in existence it just makes a lot of sense to avoid the risk of never being able to remember your password and losing access in years to come. –  Rory Alsop Dec 19 '10 at 21:34
    
That's why I ask for a method to reproduce the password. I can forget the password, but have a method to get it back. :-) –  Mnementh Dec 19 '10 at 21:51

I don't recommend doing something like this but for kicks and giggles here is one method.

Password = Concatenate((C - length(y) - length(x)), PascalCase(x), repeat(".", (length(y) % 2)+1))

Where:

C = number constant > 3 digits
y = the significant text of the url for the site
x = word you associate with the site

Example:

C = 1234
y = security.stackexchange
x = obscurity

Password = Concatenate((1234 - 22 - 9), "Obscurity", ".")

Password = 1203Obscurity.

Obvious weakness is that you have to remember a word that you would associate with the site. And before anyone comments on it in my example I am not saying that security.se is obscure. I am pointing out that Obscurity != Security. And no I don't use this for my passwords.

share|improve this answer

Intriguing question. Here's a new, hopefully better, brainstorm. Caveat emptor.

Generate two good tough random passwords that you commit to memory.

Take the letters of the site name in sequence. If the letter it a vowel, use the corresponding letter from the first password. If a consonant, use the corresponding letter from the second password.

E.g. suppose your passwords are (from apg) hicIrfyic9 and FritwoivAuv0. For the site stackexchange, the first two letters are a consonant, so you use the "Fr" from the second password. Next is a vowel, so you use "c" from the first password. Keep going and you get "FrctwfivA9".

If you really are worried about someone finding several of your passwords and figuring out the pattern, you could add some method to rotate each of the passwords circularly first or something, or shift them thru the alphabet, or whatever, but it is easily possible to get too paranoid and confused....

You would be able to code this up on your regular machines for convenience, having it prompt you for the underlying passwords, but still be able to use it on kiosks, more slowly, from memory. I'm not convinced this general idea is worth the hassle, but perhaps for some circumstances.

share|improve this answer
1  
That only obscures a otherwise easy to guess password. Seems not very secure to me. –  Mnementh Dec 19 '10 at 21:05
    
@Mnementh Hmmm. Yeah - I agree. I replaced my answer with a hopefully better one. –  nealmcb Dec 20 '10 at 6:45
    
Hmm, that seems better. +1 –  Mnementh Dec 20 '10 at 8:41
1  
One good thing about this method is that it looks completely random, so unless someone had you as their specific target it would be very unlikely to be cracked. –  Annan Nov 30 '12 at 16:31

From a "wetware" perspective, here's an interesting book you may like to read:

The Memory Book

It's one of the classic books on memory training. I've read it a few times now, and find the techniques to be very effective. It stands to reason that if you can train your memory to a sufficient level, you can use whatever passwords you'd like without difficulty. (This, at least, seems to work for me.)

The book includes a chapter on memorizing random strings of characters (or at least, the version on my shelf does), so it could be very helpful.

Also, personally I find the NATO phonetic alphabet helpful as well. For some reason, I just find "Alpha" easier to remember than "A" (for example).

I hope that's helpful.

share|improve this answer

Why execute an algorithm to derive site-specific passwords in your head, or remember all passwords, when you can use a simple javascript to do that?

This is off-topic if you really want to compute stuff in your head, but I'll propose it anyway:

For my passwords I use a customised javascript similar to the one available here: http://www.supergenpass.com

The general idea is that you create a webpage with a script or use the mobile version of the page above - not the bookmarklet (see discussion below).

The script would accept two parameters: a master password and the url of a website (in the case of the bookrmarklet it gets the url automatically).

Then it performs some crypto computations based on those parameters (basically creates and hash, eg base64-md5, on the concatination of the master password and the url, and does that 10x times or as many times you want) and outputs a site-specific, high-entropy, long password which you copy and paste in your form field.

You don't even need to see it or ever remember your passwords, and they are not stored anywhere like in a password safe, instead they are generated in-time. You just remember your master password and you are done.

I don't even know what password I use for each site, and I'm quite happy with that.

share|improve this answer
2  
Note this discussion of how much security you actaually get from supergenpass: akibjorklund.com/2009/supergenpass-is-not-that-secure –  nealmcb May 22 '11 at 23:01
    
I'm aware of the page you mention, but hey, I didn't say I use supergenpass, I use my own version, usually without a bookmarklet. But the theoretical risk is very small: One has to target specifically supergenpass to gather anything, also noscript mitigates most of the theoretical attacks because bookmarklet code is trusted. –  john May 22 '11 at 23:09
    
@john, I don't see why your version would be fundamentally better; seems like it will still be vulnerable to the same attacks. Sounds like you are relying upon security through obscurity. Maybe you won't get attacked, because no one will care about you, so maybe this is perfectly fine for your own use -- but I wouldn't recommend it to others as a great solution. –  D.W. May 23 '11 at 0:17
    
@D.W. Yes I agree that it's security through obscurity if you use bookmarklets, that's why I don't use them. The point of my answer was that you can do something smart without relying on remembering passwords or schemes, just calculating in-time. I will edit the answer to remove references to bookmarklets. –  john May 23 '11 at 0:25
    
@D.W. Edited the answer, hope it's better now. I still believe it's a great solution to the everyday password usage problem, if you create the password on a separate page and copy-paste it. –  john May 23 '11 at 0:29

use a tabula recta which combines a simple algorithm that only use know with a physical token that only you have to make passwords as long as you want.

share|improve this answer

If you just want different passwords for the various sites, then just append the site name to a common "base" password. E.g. you remember the base "7g93hrew9" and then your passwords will be 7g93hrew9ebay, 7g93hrew9amazon,...

Of course this is not satisfactory. This example is meant to show what you actually want: you do not want "different" passwords, you want passwords such that knowing several of them does not allow guessing the password for another site. Cryptographically, you want your password generator to be a pseudorandom function which takes as input the site name, and outputs the site-specific password.

There is some empirical evidence that it is not feasible to build a PRF which a human can (reasonably) compute in his head. Indeed, if you look at cryptographic hash functions, the very fast ones (MD4, MD5...) have been broken, the less fast (SHA-1) has been somewhat weakened, and the strong ones (SHA-256) are slower. Looking at the number of elementary operations, you can see a kind of cut-off around 1000 ops for hashing a small block. A similar cutoff is observed in the SHA-3 competition. It looks like there is a minimum amount of work that must be performed to achieve security, and that amount is at least a few hundreds of operations, which is too much for an average human brain.

Therefore I fear that there is no good answer to your question.

share|improve this answer

You could use one weak password encrypted using the site URL as a PSK. You could duplicate the encryption easily, but any attackers would have a very hard time getting your password, because they would have to first crack however the login encrypts your password and then bruteforce the PSK of the encryption they would get once they had decrypted. It would take an incredibly long time.

share|improve this answer

An interesting tool you might want to check out (I believe it's open source) is: http://identify.so

share|improve this answer
    
This doesn't answer the question: it's not an "in your head" method. –  Mark Jun 9 at 5:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.