Skip to main content
added 495 characters in body
Source Link

If you're really crazy, buy a USB bar code reader and make your bank password a couple of bar code numbers. I guess you might need several codes per password, however, as these devices (IIRC) only read numbers. 7025943875928759843758924759834759843725098347527465243785942365674382568347567345454735276567543356728578535 is an all right password, huh? Scan the bar codes for your bank and you're in.

If you're really crazy, buy a USB bar code reader and make your bank password a couple of bar code numbers. I guess you might need several codes per password, however, as these devices (IIRC) only read numbers. 7025943875928759843758924759834759843725098347527465243785942365674382568347567345454735276567543356728578535 is an all right password, huh? Scan the bar codes for your bank and you're in.

Source Link

If you want to remember your passwords, you either have to work your muscle memory, or you will have to choose some easy to remember passwords. However, Easy to remember is also easy to guess. And the "mental strain" of remembering 3-4-5 passwords of a reasonable length with characters from all the different classes (upper; lower; numbers; symbols; even UTF-8 combinations (oh yeah, try having ALT+4099 in your password)), it's not worth the effort for the average user.

So, what we usually do is reuse or write down our passwords. Reuse of passwords (your #2) will, as you say, possibly compromise all accounts associated with it. People actually seem to understand this and usually reuse passwords only over accounts that protect low value data.

Writing down passwords, however: I claim that writing down passwords is not a problem if done securely. The difference here is writing your bank password on the back of the OTP generator or on a post-it note on your monitor, or if you hide the passwords in your wallet. Of course, you can't use GæµRA­♣$6(◘F0z03*╬ as your Facebook password and keep it in a safe. That's bad usability.

I don't like the algorithm either. It's some percentage "security by obscurity" in there, so however unlikely, if someone finds your pattern you're screwed. Say you're a high value target (I know, you might not be, but you might have some of that glorious money) and use the pattern on somedisposablemessageboard.com and somepaywallnewspaper.co.uk, two pages that might just have had a password leak. If your attacker is somewhat "cognitively capable", he might just find your pattern and try BaAnk$taticPa$$word (made up of "Bank", "Anna" and "$taticPa$$word"), which is your banking password.

Password managers are a storage facility that you trust to keep your passwords for you. As an example, LastPass works with a plugin for easy authentication. This way, you enter the master password (which should be hard to guess, but it'll be your only password, you can stand that) once per browser session (IIRC) and keep downloading passwords from LastPass to your service. There's another problem here, for the particularly paranoid. You enter your master password on your keyboard into your browser, meaning that it is stored memory and may (theoretically at least) be read by a trojan. Also, keyloggers may ignite upon your arrival at LastPass.com, collecting your password. Both get the key to the castle.

(Technical fun fact: LastPass passwords are encrypted with a key generated from your master password using 500 iterations of PBKDF2, a key derivation function. 500 iterations are half the absolute minimum for such use specified in the PBKDF documentation, and may not stand brute force if the stored encrypted passwords are leaked.)

So, what the hell should you do if you can't even enter your password on the keyboard? Stop worrying, write down your passwords and put them in your wallet. Do not write Facebook: ¤#V&W#V&, Bank: AybyB%¤YB¤, Porn: &%HB&4syby, etc. You can remember which is which..

If you're a spy for the CIA, I suggest an external device with a screen to keep your passwords. It should not be another mobile phone, but a dumbed-down device. It should, however, not show anyone the passwords and never transfer them in clear. It would work something like this:

Facebook: Gimme your password, Anna's PC.

Anna's PC: Hang on, I've got that cool external device!

Facebook: Yo, Anna. Authenticate by making your device calculate this challenge using our shared secret (the password) and a hash function (or KDF)!

Anna's auth device: HASH = KDF(Salt, (secret + challenge), Iterations (10000000)

Anna's PC: Hey FB. Response to challenge is boogaboogawhatever89646y7547645

Facebook: Wow, I got HASH = boogaboogawhatever89646y7547645 too! Why, you must be Anna!

(Facebook gate opens)