-1

Say I'm only allowed to use 20 characters per password for multiple accounts on multiple websites, with no special characters (!@#,.; etc) allowed (alphabet and numbers only). What is the most effective way to go about password this? Should I use some programming language to randomly generate 20-character phrases for every account I have? Then how would I go about storing these? How about two-factor authorization? There are so many options and I don't know what to do.

Some of the websites I'm using:

  1. Google (covers YouTube, StackExchange, CodeCademy, etc.)
  2. Twitter
  3. some foruming website
  4. PayPal
  5. CoinBase
  6. Stockfuse (stock market game, not an actual investor)
  7. GitHub
  8. Remind
  9. Autodesk
  10. Apple (iOS? iTunes? ¯\_(ツ)_/¯)
  11. Adobe
  12. Patreon
  13. Steam

All of the websites listed above have access to 1. my mobile and 2. my email, but those options aren't important if somebody has my password. If I want to change my passwords so they're not all the same, how should I go about doing so, and most importantly, where should I store that information?

closed as unclear what you're asking by techraf, S.L. Barth, WhiteWinterWolf, Steffen Ullrich, Anders Sep 4 '16 at 15:04

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    As an engineer I have to balk at your use of the undefined term "effective" which could mean many things. Do you need passwords that are easy to remember? Hard to guess? Easy to type? Reminds you of your deceased son? – John Wu Sep 2 '16 at 22:36
  • Welcome on Security.SE. "There are so many options and I don't know what to do.": try to divide your issue into smaller chunks, do not ask (yourself and on this site) all your questions in a bundle but handle each question individually and search if there is already an appropriate answer for it. For instance: What's the most effective type of password?, How to store it?, etc. If you find no answer, then create a new question for this individual issue :). – WhiteWinterWolf Sep 3 '16 at 7:04
  • 1
    password manager with randomly generated passwords – schroeder Sep 3 '16 at 10:17
1

Passwords are about entropy, or the amount of randomness. More entropy will increase the password strength and thus reduces the chance an attacker will guess the password. Alphanums are known to have little entropy, but length can make up for this. In fact, large passwords are preferred over tiny (complex) passwords as it increases the possible outcomes exponentially with every character.

Why should you care? Because 20 alphanums is not much to go with. The advice; use a password manager capable of generating random alphanum passwords of length 20. If you do this for every service, you don't have much to worry about.

  • How should I go about storing this information? Can I make it a TXT file on an external hard drive? Viruses on my PC are very rare, but can they access a drive that doesn't host the OS? Should it be multiple files instead of just one? Or should I physically write it down? – JoshuaS3 Sep 2 '16 at 22:37
  • 1
    You should use a password manager. For example keepass.info – Yorick de Wid Sep 2 '16 at 22:38
  • A 160 bit domain cannot be scanned in hours. If it were so, 128 bit encryption would be broken by brute force in minutes, and 256 bit encryption could be brute forced in months. – Luis Casillas Sep 2 '16 at 22:38
  • @LuisCasillas I have my facts wrong, ty – Yorick de Wid Sep 2 '16 at 22:48
  • @LuisCasillas If a keyspace of 2^160 could be scanned in hours, a 256 bit key could absolutely not be brute forced in months. Likewise a 128 bit key could be cracked in on the order of milliseconds. – forest Mar 1 '18 at 4:43
1

Use a password manager. Some articles:

Say I'm only allowed to use 20 characters per password for multiple accounts on multiple websites, with no special characters (!@#,.; etc) allowed (alphabet and numbers only). What is the most effective way to go about password this? Should I use some programming language to randomly generate 20-character phrases for every account I have?

First of all, password managers offer random password generation, a feature that you might get wrong if you tried to write it on your own. (You can't use a regular random number generator, you need a specialized cryptographic one.)

Other than that, we can answer your question with math. If you're choosing at random, out of 26 uppercase letters, 26 lowercase and 10 digits, that's log2(62) = 6 bits per character. Which means that a 20 character random alphanumeric password would have 120 bits of entropy.

This is similar to the strength of many encryption algorithms (e.g., AES-128, where the "128" the size of the key in bits), so such a password would be good as an encryption password. But it is arguably overkill just for a website login password. A 14 character random alphanumeric password, with 80 bits of entropy, should be plenty.

How about two-factor authorization?

It makes the login process much more secure, at the cost of a bit of convenience. Your call.

  • I'd definitely go for two-factor for those sites dealing with stuff important to you (like money)... – Matija Nalis Sep 3 '16 at 12:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.