I accept that nothing can be better than a truly random password.
I also know that it is A Bad Thing to use any personal information in a password.
However, given that it is difficult to get people to use proper password practises, and given that people remember personal information, even the most obscure, is it (practically, not theoretically) acceptable to use a password which combines obscure personal information which one can be reasonably certain is unknown to/undefinable by others?
To stress, I don't think we need discuss the theory of strong passwords.
If someone is over a certain age, the have a huge store of life memories and can choose from obscure items.
I can remember:
- the 'phone number of an elderly aunt who died decades ago. We, most of us, have dozens of relatives, friends, neighbours, from days gone by.
- the license plate of a car which my father drove when I was 8 or so (and which he, himself, could not remember when I mentioned it recently). How many cars have I, family, friends, neighbours, had over the years?
- a university professor's name
- a long defunct bookshop
- a pub I haven't been within a hundred miles of in decades, and didn't frequent much, but was near to a place of significance to me
- a train station, in a foreign country, where I once had a delicious snack
- the post/zip code of a place to which I wrote actual letters, back in the day
I could go on and on.
For someone who can't/won't use a password generator (and we all know enough of them), this is better than
correct horse battery staple.
Is it "good enough"? If someone refuses to use a password generator, should I urge them to try thinking of personal and unrelated info, which they are sure that no one other person would know and no one would remember.