I used to use the same password for everything (it was at least a really random password with fake words). Then I found out that I should have different passwords for different sites cause some developers have no clue about security and store things in plaintext or just let themselves get hacked (jk). So I came up with a solution that is easy to remember yet (I think) has high enough entropy. Let me explain.
I take a made up series of characters (in my case it's something I can say like a word but it's fake) and numbers (optionally punctuation if the site requires it, although lately I just put it in because it's hard to remember which site requires it) and use that as the basis for all my passwords. Sounds insecure? Well, I then add a 'salt' of sorts. I add the name of the site to my password. I won't say where but it could be at the start, middle, or end. I use camel case (e.g. camelCase) so I can satisfy the upper case requirement. Finally, if I know the site expires passwords monthly, I add the month in some format. Usually these sites need high security so the extra characters help with password strength.
Overall, the average entropy is very high. 2e23 is roughly the number of possibilities (upper/lower + number + 1 special char). That's assuming average of 5 characters per site. Here's why I think this is the best balance between rememberability and strength.
- You still only have to remember one password for all your sites. Except it's more of a password pattern
- If you use all the character types, you can always remember your password because of this pattern (there's some exceptions I'll get into below*)
- You see the name of the site when you log in, which is a part of your password
- You know the month you're in (hopefully)
- You type the pattern so often that it's muscle memory basically. For me, I just think about the site's name and it comes out and enter, I'm in!
- Length. Average length is very long by nature of combining two 'words': the site's name and your special password
- To add to the length point, if you take your regular 8 character password you've been using (e.g. Horses1!), join it with the site's name, you have now a very strong password; i.e. you're beefing up your existing password strength without much effort
- You have all character classes. Usually we chose the most obvious places for the special character classes (e.g. Horses1!), defeating the purpose of having them in the first place. Basically it doesn't raise entropy much because the rules are obvious. But the site's name throws this off. Because the rules don't work, they're back to good ol' brute force (until they get wind of this pattern)
- You get to choose a fake word that isn't in most dictionaries that password crackers use, even if they use the extended cut. That basically means they're back to brute force again.
Conclusion: https://xkcd.com/936/. We all remember XKCD's comic on password strength. He contrasts the hard to remember "troubador" with the easy to remember "correct horse battery staple". But what if you can have the best of both worlds? Passwords that computers can't beat but easy enough to remember so that humans will actually use it. If we can't remember it, it doesn't matter what entropy it is. And because of this problem, humans have always chosen a password that can be beat. Choosing and remembering a very complex password is good but all it takes is one site to have lousy security, e.g. not salting or even encrypting their passwords! Basically, we're salting it for them, by adding their site's name.
Thoughts? Do you think I'm full of shit and I've missed something? I'd love to hear it. This is years and years of thought that went into this final creation. Some people at my work have started using it. I know we have password managers but try logging in to your mobile device or TV.
*This is why it pisses me off to no degree when sites REFUSE to let you set a password greater than 8 characters. Why? Are you still running Windows 92? As in the year 92? If someone can explain why that is a security requirement. It throws a huge wrench in my password scheme. I've even just completely boycotted the company's products because I can't sign up with them. Or other stupid rules like no two identical characters in a row.
EDIT: I'll add some more parameters here because we'll then be saying nothing is secure unless you have CIA-level security or something. How secure is this for regular people who cares about their security? Also, password managers are not sufficient because they are not always supported on mobile. Randomly generated passwords have the same flaw because typing them into mobile (or another computer that didn't save that password) is frustrating and people will just end up using smaller, easier to remember passwords. Also, don't assume these people are have the patience to do that. We're just talking about regular people here having to do with security issues.