43

I have a lot of accounts and until some time ago I used an universal password for all of them. Right now I have a different password for every account depending on the website name that I am logging in. I use a pattern and the difference between patterns is the website domain name.

I dont want to store my password in some kind of password manager. I just want to have a pattern in mind and compose the password depending of it (and a piece of paper hidden somewhere safe in the house in case I am really dumb and I forget the pattern).

  1. Could you suggest me some good patterns? So I can get one or a mix of them to make a better pattern for my passwords.

  2. Is there any better way to store passwords but still access them if you need to log from another computer/device?(I dont really trust password managers)

Improve this question
18
  • 39
    What specifically about password managers do you not trust? If you clarify that, we might be able to either ease your concern or suggest an approach that means the particular issue is not a significant concern.
    – user
    Oct 29, 2015 at 14:22
  • 6
    I wish there was an answer that wasn't so draconian. I have maybe 5 accounts anywhere that I actually care about and I've memorized their unique passwords. I have about 5000 random accounts that I have the username for (in my email history), but can't remember the password so I just reset it every time. Then, I have about 50 accounts that I use occasionally. It would be extremely convenient to know a "formula" for those sites. I just want to run faster than the other guy when being chased by a bear.
    – Zach Mierzejewski
    Oct 29, 2015 at 16:27
  • 8
    Cristi, consider that password managers are written specifically to manage passwords in a secure fashion. It's a purpose-made tool for a very specific job. This actually greatly reduces complexity, which in turn lowers the probability of an error creeping in. (Sure it can still happen, but it becomes less likely the less the software aims to do.)
    – user
    Oct 29, 2015 at 17:37
  • 2
    If you're worried about how it's made, grab the source for PasswordSafe or another open-source manager and make it yourself.
    – Jon Hanna
    Oct 30, 2015 at 10:12
  • 5
    @detly You can't create a good rule for a bad system. If the regulation you have to follow is bad (in the way you described it), you cannot "fix" it by using a "good" pattern.
    – Stephane
    Oct 30, 2015 at 11:01

10 Answers 10

Reset to default
86

None. Use a password manager application to generate long, random password for each site.

Make sure you are not using your master password (or a derivation of your master password) anywhere else.

If you do not trust online or commercial password managers, then use one that is open source and works with local files.

Edit: For reference, Bruce Schneier has published in 2014 a rather complete (and very readable) blog post as to why using any kind of pattern for generating passwords is a bad idea.

Improve this answer
33
  • 6
    That blog post is still somewhat controversial. Schneier ignores the equivalence of the relationship between word and dictionary and between character and alphabet. Consider each character or word as a number up to the limit contained in either alphabet or dictionary, then form a password as a sequence of these numbers. Weak passwords simply choose too few elements from too small a set (or common subset).
    – DeveloperInDevelopment
    Oct 29, 2015 at 16:51
  • 10
    @ott - No. Its a long random password. Random = no pattern.
    – n00b
    Oct 29, 2015 at 20:37
  • 15
    I'm unconvinced what the blog post says about the XCKD post - as the post assumes the hacker knows your pattern, and it's still more secure.
    – Tim
    Oct 29, 2015 at 21:41
  • 6
    @CortAmmon: I used to think that way about open source. Then Heartbleed happened.
    – Kevin
    Oct 30, 2015 at 1:17
  • 6
    Bruce's recommendation is odd.He eschews passphrases, but supports abbreviated passphrases.
    – Paul Draper
    Oct 30, 2015 at 6:22
40

If you don't trust password managers, you don't have to store the entire password in the password manager.

You can split your password into an easy to remember part that you remember (this could be the same for all websites if you wanted) and a unique long and random password in the password manager.

If somehow someone was able to access your password manager, they will still not have the part of the password that you remember in your head.

Improve this answer
9
  • 3
    "easy to remember part that you remember" -- or even a quite hard-to-remember part, that you put some effort into memorising. Since it's the same for all your passwords, you only have to remember one thing (plus one more thing: the password manager's password) and you use it every day. 10-20 random characters isn't necessarily "easy to remember", but for passwords I use every day I can manage it, and as a very safe lower bound requires >2^50 guesses to crack by brute force.
    – Steve Jessop
    Oct 30, 2015 at 11:57
  • Well, "easier to rememeber" is relative. It will be easier than the very long random letters/numbers/symbols part that you will store in the password manager, but given that you now only have two passwords to remember (one for the password manager, and one you resuse and add to the password from the password manager), it could be "harder to remember" than if you had to remember a lot of passwords without using a password manager.
    – JonnyWizz
    Oct 30, 2015 at 12:26
  • 1
    Please keep in mind that (too) many sites are restricting the number of characters in your password and/or the set of characters to choose from (frightening examples can be seen here. This might conflict with the proposed scheme: You either have to choose a very short and/or simple common part or probably deviate from your scheme (and have the complete password for certain sites saved in the manager software).
    – Dubu
    Oct 30, 2015 at 15:27
  • 2
    A disadvantage of this would be that if a password leaked, because someone stored it in plain text, the remembered part is compromised.. (Which is a problem if the random part was shortened to allow the remembered part to be appended, due to length restrictions, etc...)
    – Gert van den Berg
    Oct 31, 2015 at 12:00
  • 1
    @GertvandenBerg, but how would they know that you are using a scheme that splits the password?
    – JonnyWizz
    Oct 31, 2015 at 12:54
9

Random generation is the only pattern you want -- you can even use dice (Wikipedia), or for shorter random strings of letters (Wikipedia again).

If you don't want to forget them, and don't trust a password manager write them down! (Schneier.com). I would consider some form of obfuscation here so that a casual thief stealing your wallet can't just log in to your paypal account (for example), even though this is hard to do well.

Improve this answer
6
  • 2
    By simple obfuscation, you can simply "shift" the passwords down 2 or 3, so that you see the wrong password next to the username e.g. paste.ubuntu.com/13005200
    – Tim
    Oct 30, 2015 at 1:31
  • 1
    @Tim, that would work, other ideas might be swapping the case of letters (perhaps only in a subset of the password) if a random alphanumeric string is used.
    – Chris H
    Oct 30, 2015 at 6:58
  • 1
    Yeah, another good one. I personally am careful about changing the password itself - like writing it backwards because I find myself forgetting occasionally... I have a password manager in reality.
    – Tim
    Oct 30, 2015 at 10:58
  • 1
    @Tim me too (or rather I'm fighting with KeePass2/KeeFox on linux)
    – Chris H
    Oct 30, 2015 at 11:20
  • @Tim Though trying each password in the database with each account in the database would probably be the first thing an attacker would try. That or just using the database as a wordlist against stolen hashes.
    – Blacklight Shining
    Oct 30, 2015 at 22:53
7

1) If you don't trust online password managers, you can use offline managers like keepass2, but you'll have to get your file accessible anywere and the breach would be there. If you really don't want to trust password managers... learn your passwords.

2) There are several types of pattern which can be used to generate passwords. They are not always safe, so generated one are better. An article has been publicated on this subject on NakedSecurity here, they present different possible patterns.

Improve this answer
1
  • 3
    The accessibility of the password file does not matter. It can be completely public, because it is encrypted. The weak link is trusting the computer on which you enter the master password to decrypt it.
    – Aleksandr Dubinsky
    Oct 30, 2015 at 10:27
7

I would like to refer you to this XKCD:

enter image description here

If you add e.g. a site name to the end of a password like that (and please don't use "correcthorsebatterystaple" now), it would be very secure.

What really matters is the length. So, if it's long and easy to remember, that is perfect.

A suggestion if you have trouble with password managers: store the password manager file on something like Dropbox. That way you can access it from anywhere, and it's still safe.

Improve this answer
23
  • 11
    Patterns can weaken your passwords in (at least) two different ways: the worst patterns make your individual passwords easier to crack, whereas an identifiable pattern (simple or otherwise) will make subsequent passwords easier to crack after the first. This strategy avoids falling into the first trap, but unless you also change the 4-word base, falls victim to the second. Assume at least one of your passwords on a minor site has been cracked already - "correcthorsebatterystaplebank" may be secure, but what if the hacker already has "correcthorsebatterystaplestackexchange"?
    – DeveloperInDevelopment
    Oct 29, 2015 at 19:35
  • 2
    Well as safe as Dropbox is...
    – Tim
    Oct 30, 2015 at 1:32
  • 2
    @Tim It doesn't matter how safe Dropbox is since it's a password manager encrypted file.
    – Tomas
    Oct 30, 2015 at 3:28
  • 2
    @AleksandrDubinsky please don't exagerate, I assume you are from the USA or UK where trillion means 1,000,000,000,000. This means that even should password hashing only take 1 operation this would need a 1THz processing capability. Assuming most non state-funded cracking is done by bot-nets this would equate to 200 bot 2-core CPU's running at 2.5 GHz (averages from Steam hardware survey). Not impossible but it is costly. But this was assuming 1 instruction per hash, it gets extremely costly when using for example BCrypt with 2^12 rounds which seems to be used a lot. But sure, more is better.
    – Selenog
    Oct 30, 2015 at 11:59
  • 3
    @Selenog Your hardware knowledge is lacking. A GPU can do 8,000 operations per clock cycle, but that's beside the point. Typical hashes are cracked at hundreds of billions attempts per second. ASICs can do orders of magnitude better--bitcoin rigs can do 8 trillion SHA1 hashes per second on much less electricity. Nation states have surely built similar ASICs for password cracking. You're right that bcrypt or at least using multiple rounds is much better. I did use the word "sometimes." But today, fast/weak hashing is used quite often.
    – Aleksandr Dubinsky
    Oct 30, 2015 at 17:57
6

You can use a hash-based password generation strategy. You combine a master password with the site name (and its complexity requirements) to generate a password unique to the site.

It has some advantages and disadvantages compared to a password manager:

  • There is no encrypted database that you can lose / get stolen and attacked
  • You need to remember the settings used to make the approach work for sites with different complexity requirements
  • A poor implementation, like taking 8 characters from a md5 hash can reduce the keyspace significantly.
  • Cases where you are forced to change your password are hard to handle

There are a few tools that can be used:

  • normal hashing functions (You should avoid this) e.g. The example presented here (That post also have the strengths and weaknesses of the approach)
  • Tools to automate the process, like supergenpass (MD5 based by default which is not ideal, a slower hash makes recovering you master password trickier if a generated password + the sitename is known to an attacker) (Although you should probably have a master password that is long and random enough that it is hard to brute-force) (Other exist, such as Master Password, see below)

(Via Matty: Master Password seems to use a much better way to generate passwords than any of the others mention previously)

Improve this answer
8
  • 1
    Some of the other examples include plevyak.com/dpg.html (Likely based on a better hash, but something intentionally slow like bcrypt, PBKDF2 or scrypt would still have its advantages)
    – Gert van den Berg
    Oct 29, 2015 at 16:02
  • This is an interesting approach. Its big advantage is you don't need to keep track of a file (and worry about losing it). However, it's not more secure. If, previously, an attacker would need to get hold of the file to start cracking, now he only needs to get hold of one of your passwords.
    – Aleksandr Dubinsky
    Oct 30, 2015 at 10:46
  • For the sites where they keep making you pick a new password (hence, site name), you can write it down in a plaintext file or notebook. The strategy will still work (if the master password is sufficiently secure).
    – Aleksandr Dubinsky
    Oct 30, 2015 at 10:55
  • Oh, also you're not wedded to a single app, since there's no file format to worry about. Hash generators are available even as Javascript pages.
    – Aleksandr Dubinsky
    Oct 30, 2015 at 11:03
  • 1
    I realized the gotcha. You can't change the master password (without changing all the passwords).
    – Aleksandr Dubinsky
    Nov 3, 2015 at 20:46
6

Use a Password Card.
Here is one example:

With a password card, you pick a starting point and a path for where to go from there (up, down, left, right, diagonals, or some combination) and remember that. (Or, multiple starting points and paths per password.) You don't have to trust software password managers because the paper card is your password manager, and the hash at the bottom is the "master password." You still have to keep track of some information (starting point and path) separate from the manager, so even if you lose your wallet the passwords aren't gone with it.

Improve this answer
1
  • from their website, "Enjoy your new feeling of safety and peace of mind... :-)". Sounds like the definition of security theater.
    – NH.
    Nov 28, 2017 at 23:28
3

I think "Off The Grid" (https://www.grc.com/offthegrid.htm) might meet your requirements. It's based on a randomly generated grid and a method based on the domain name to generate the password from that. The pages on that site describe the "standard" way of using the grid, but there are also suggestions about how you could tweak it, so even if someone got hold of your grid and knew the "standard" method, they still wouldn't be able to work out your passwords.

Improve this answer
0

I like to use popular quotes from movies. I take the first letter of each word and turn each into a different capital letter, lower case letter, symbol or number and try to use 4 of each and keep them different.

'What' ain't no country I ever heard of, do they speak English in 'what'?

becomes "W@4c!3%7D^S9Iw?". I like to tag on a small series of symbols and letters I can remember if its too short. like 456 with shift held every other one. "W@4c!3%7D^S9Iw?$5^"

Improve this answer
4
  • 6
    I can't imagine that this would be much better than using the quote itself. That wouldn't be so bad if you picked sentences at random from a collection of works, but since you're using popular quotes…
    – Blacklight Shining
    Oct 30, 2015 at 23:00
  • It also doesn't solve the problem of remembering different passwords for different sites...
    – Gert van den Berg
    Nov 4, 2015 at 7:25
  • To me it was a bit like a memory palace. Instead of a associating a room with something to remember, I associate the movie and the quote with a server or website. It helped me remember longer and stronger passwords and what they were for.
    – Ken Brockert
    Nov 5, 2015 at 14:11
  • I believe this technique is now in password crackers...
    – NH.
    Nov 28, 2017 at 23:29
0

What I would do is use a complex base string for the password like AdasfbkSDUn7657AJDadadsag and then for the website , which I am creating the password for, I would append it's name to the begining. If remembering the password seems daunting (which should be , use an offline password manager).

Example password for - www.website.com

web_AdasfbkSDUn7657AJDadadsag
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .