Became Hot Network Question
    Tweeted twitter.com/StackSecurity/status/1166002491936452608
4 added 353 characters in body
source | link

I received an invitation for an IT security fair (https://www.it-sa.de/en).

They additionally delivered a password "Kryptonizer". That is a little card to hang on your keychain with the following (example values, my translation):

It is often too easy for hackers to acquire personal information. The reason: Passwords that we can easily remember aren't cryptic. They are often common names or words like "Snowden" or "Admin". This card tries to fix this by making easy to remember passwords crpytic.

Input   Start  ABC  DEF  GHI  JKL  MNO  PQRS  TUV  WXYZ
Output  4uR=?  x    1    F    3    Y    i     #    9

Original version in german:

Hintergrund: Passwort-Hackern wird der Zugang zu persönlichen Daten im Internet häufig viel zu leicht gemacht. Der Grund liegt auf der Hand: Passwörter, die wir uns merken können, sind meistens nicht besonders kryptisch, sondern orientieren sich an gängigen Namen oder Wörtern wie "Snowden" oder "Admin".

Everything from the output is random for every single card (66 different characters to choose from). Now we have to choose an "easy" password (they recommend at least 8 characters):

Input:  HELLOWORLD
Output: 4uR=?F133Y9Yi31

They also recommend to use this card for only one password and change it, if you lose the card.

Is this password scheme good? It comes from a big security fair with many experts.

My novice guess is, that you have a reduced entropy because of only 8 different characters (+ 1 start sequence), but as long as your card stays unknown, the attacker can't exploit this fact.

I received an invitation for an IT security fair (https://www.it-sa.de/en).

They additionally delivered a password "Kryptonizer". That is a little card to hang on your keychain with the following (example values, my translation):

It is often too easy for hackers to acquire personal information. The reason: Passwords that we can easily remember aren't cryptic. They are often common names or words like "Snowden" or "Admin". This card tries to fix this by making easy to remember passwords crpytic.

Input   Start  ABC  DEF  GHI  JKL  MNO  PQRS  TUV  WXYZ
Output  4uR=?  x    1    F    3    Y    i     #    9

Everything from the output is random for every single card (66 different characters to choose from). Now we have to choose an "easy" password (they recommend at least 8 characters):

Input:  HELLOWORLD
Output: 4uR=?F133Y9Yi31

They also recommend to use this card for only one password and change it, if you lose the card.

Is this password scheme good? It comes from a big security fair with many experts.

My novice guess is, that you have a reduced entropy because of only 8 different characters (+ 1 start sequence), but as long as your card stays unknown, the attacker can't exploit this fact.

I received an invitation for an IT security fair (https://www.it-sa.de/en).

They additionally delivered a password "Kryptonizer". That is a little card to hang on your keychain with the following (example values, my translation):

It is often too easy for hackers to acquire personal information. The reason: Passwords that we can easily remember aren't cryptic. They are often common names or words like "Snowden" or "Admin". This card tries to fix this by making easy to remember passwords crpytic.

Input   Start  ABC  DEF  GHI  JKL  MNO  PQRS  TUV  WXYZ
Output  4uR=?  x    1    F    3    Y    i     #    9

Original version in german:

Hintergrund: Passwort-Hackern wird der Zugang zu persönlichen Daten im Internet häufig viel zu leicht gemacht. Der Grund liegt auf der Hand: Passwörter, die wir uns merken können, sind meistens nicht besonders kryptisch, sondern orientieren sich an gängigen Namen oder Wörtern wie "Snowden" oder "Admin".

Everything from the output is random for every single card (66 different characters to choose from). Now we have to choose an "easy" password (they recommend at least 8 characters):

Input:  HELLOWORLD
Output: 4uR=?F133Y9Yi31

They also recommend to use this card for only one password and change it, if you lose the card.

Is this password scheme good? It comes from a big security fair with many experts.

My novice guess is, that you have a reduced entropy because of only 8 different characters (+ 1 start sequence), but as long as your card stays unknown, the attacker can't exploit this fact.

3 deleted 53 characters in body
source | link

I received an invitation for an IT security fair (https://www.it-sa.de/en).

They additionally delivered a password "Kryptonizer". That is a little card to hang on your bunch of keyskeychain with the following (example values, my translation):

Input   Start  ABC  DEF  GHI  JKL  MNO  PQRS  TUV  WXYZ
Output  4uR=?  x    1    F    3    Y    i     #    9

It is often too easy for hackers to acquire personal information. The reason: Passwords that we can easily remember aren't cryptic. They are often common names or words like "Snowden" or "Admin". This card tries to fix this by making easy to remember passwords crpytic.

Input   Start  ABC  DEF  GHI  JKL  MNO  PQRS  TUV  WXYZ
Output  4uR=?  x    1    F    3    Y    i     #    9

Everything from the output is random for every single card (66 different characters to choose from). Now we have to choose an "easy" password (they recommend at least 8 characters):

Input:  HELLOWORLD
Output: 4uR=?F133Y9Yi31

They also recommend to use this card for only one password and change it, if you lose the card.

Is this password scheme good? It comes from a big security fair with many experts.

My novice guess is, that you have a reduced entropy because of only 8 different characters (+ 1 start sequence), but as long as your card stays unknown, the attacker can't exploit this fact.

Background: To cite the card (translated by me) "It is often too easy for hackers to acquire personal information. The reason: Passwords that we can easily remember aren't cryptic. They are often common names or words like "Snowden" or "Admin"", this card tries to fix this by making easy to remember passwords crpytic.

I received an invitation for an IT security fair (https://www.it-sa.de/en).

They additionally delivered a password "Kryptonizer". That is a little card to hang on your bunch of keys with the following (example values):

Input   Start  ABC  DEF  GHI  JKL  MNO  PQRS  TUV  WXYZ
Output  4uR=?  x    1    F    3    Y    i     #    9

Everything from the output is random for every single card (66 different characters to choose from). Now we have to choose an "easy" password (they recommend at least 8 characters):

Input:  HELLOWORLD
Output: 4uR=?F133Y9Yi31

They also recommend to use this card for only one password and change it, if you lose the card.

Is this password scheme good? It comes from a big security fair with many experts.

My novice guess is, that you have a reduced entropy because of only 8 different characters (+ 1 start sequence), but as long as your card stays unknown, the attacker can't exploit this fact.

Background: To cite the card (translated by me) "It is often too easy for hackers to acquire personal information. The reason: Passwords that we can easily remember aren't cryptic. They are often common names or words like "Snowden" or "Admin"", this card tries to fix this by making easy to remember passwords crpytic.

I received an invitation for an IT security fair (https://www.it-sa.de/en).

They additionally delivered a password "Kryptonizer". That is a little card to hang on your keychain with the following (example values, my translation):

It is often too easy for hackers to acquire personal information. The reason: Passwords that we can easily remember aren't cryptic. They are often common names or words like "Snowden" or "Admin". This card tries to fix this by making easy to remember passwords crpytic.

Input   Start  ABC  DEF  GHI  JKL  MNO  PQRS  TUV  WXYZ
Output  4uR=?  x    1    F    3    Y    i     #    9

Everything from the output is random for every single card (66 different characters to choose from). Now we have to choose an "easy" password (they recommend at least 8 characters):

Input:  HELLOWORLD
Output: 4uR=?F133Y9Yi31

They also recommend to use this card for only one password and change it, if you lose the card.

Is this password scheme good? It comes from a big security fair with many experts.

My novice guess is, that you have a reduced entropy because of only 8 different characters (+ 1 start sequence), but as long as your card stays unknown, the attacker can't exploit this fact.

2 added 323 characters in body
source | link

I received an invitation for an IT security fair (https://www.it-sa.de/en).

They additionally delivered a password "Kryptonizer". That is a little card to hang on your bunch of keys with the following (example values):

Input   Start  ABC  DEF  GHI  JKL  MNO  PQRS  TUV  WXYZ
Output  4uR=?  x    1    F    3    Y    i     #    9

Everything from the output is random for every single card (66 different characters to choose from). Now we have to choose an "easy" password (they recommend at least 8 characters):

Input:  HELLOWORLD
Output: 4uR=?F133Y9Yi31

They also recommend to use this card for only one password and change it, if you lose the card.

Is this password scheme good? It comes from a big security fair with many experts.

My novice guess is, that you have a reduced entropy because of only 8 different characters (+ 1 start sequence), but as long as your card stays unknown, the attacker can't exploit this fact.

Background: To cite the card (translated by me) "It is often too easy for hackers to acquire personal information. The reason: Passwords that we can easily remember aren't cryptic. They are often common names or words like "Snowden" or "Admin"", this card tries to fix this by making easy to remember passwords crpytic.

I received an invitation for an IT security fair (https://www.it-sa.de/en).

They additionally delivered a password "Kryptonizer". That is a little card to hang on your bunch of keys with the following (example values):

Input   Start  ABC  DEF  GHI  JKL  MNO  PQRS  TUV  WXYZ
Output  4uR=?  x    1    F    3    Y    i     #    9

Everything from the output is random for every single card (66 different characters to choose from). Now we have to choose an "easy" password (they recommend at least 8 characters):

Input:  HELLOWORLD
Output: 4uR=?F133Y9Yi31

They also recommend to use this card for only one password and change it, if you lose the card.

Is this password scheme good? It comes from a big security fair with many experts.

My novice guess is, that you have a reduced entropy because of only 8 different characters (+ 1 start sequence), but as long as your card stays unknown, the attacker can't exploit this fact.

I received an invitation for an IT security fair (https://www.it-sa.de/en).

They additionally delivered a password "Kryptonizer". That is a little card to hang on your bunch of keys with the following (example values):

Input   Start  ABC  DEF  GHI  JKL  MNO  PQRS  TUV  WXYZ
Output  4uR=?  x    1    F    3    Y    i     #    9

Everything from the output is random for every single card (66 different characters to choose from). Now we have to choose an "easy" password (they recommend at least 8 characters):

Input:  HELLOWORLD
Output: 4uR=?F133Y9Yi31

They also recommend to use this card for only one password and change it, if you lose the card.

Is this password scheme good? It comes from a big security fair with many experts.

My novice guess is, that you have a reduced entropy because of only 8 different characters (+ 1 start sequence), but as long as your card stays unknown, the attacker can't exploit this fact.

Background: To cite the card (translated by me) "It is often too easy for hackers to acquire personal information. The reason: Passwords that we can easily remember aren't cryptic. They are often common names or words like "Snowden" or "Admin"", this card tries to fix this by making easy to remember passwords crpytic.

1
source | link