I would like to have your point of view about something I found on internet.

The goal here is to help people to use stronger passwords, it's not perfect, but I believe that asking people to use passwords like "4*k#j56$Nbq!\l;)" is too much, but using "MyName1979NameOfDog" is too weak. So, let's try to find something a bit better, in the middle.

I am not the author of this "idea" ! Here is it :

  1. Choose the first letter of each word of a sentence (and use a capital in the beginning and a point at the end)
  2. Write down the first and the last letter of the website/application
  3. Choose a favorite number

Example : "Life was like a box of chocolates you never know what you're gonna get facebook 42." = "Lwlabocynkwyggfk42."

If "crackers/hackers/whatever" find the "rule", they might have access to everything else... Remember that the goal is to help people to have a better password not the perfect one.

Do you think it will be a bit harder to find it by the usual "hacking techniques" ?

Let's try to find something useful together ! :)

  • 1
    Unfortunately, the idea you describe is already covered in popular hash cracking rulesets. – forest Nov 24 '18 at 3:08
  • 2
    "Let's try to find something useful": easy. Password. Manager. – Ben Nov 24 '18 at 3:35
  • Like I said in the other comment, first, thanks for your reply! And then, about the "hash cracking rulesets", if people create their own personal sentence and they choose their own order (number first, then the first-last letter's website name and the first letter's of sentence's word), does it make a bit harder ? Of course it will never be as good as a very strong password generated by a password manager, but the goal is just to improve a bit the strength of the password. About the password manager, check out the other comment, I do appreciate though! – MrAkiTek Nov 24 '18 at 5:36
  • Welcome to the site. This is a Q&A site and not a discussion site. This really doesn't have a question, and it has been asked a few times here before. Patterns are fine until the cleartext password leaks, and then hackers can get into every site the user used the pattern on. Randomly generated passwords stored by a password manager is easiest to use and most secure. – schroeder Nov 24 '18 at 14:40

The only way you can make people choose strong password is to not let them choose a password.

Instead, encourage the user to use password manager, let the password manager generates their passwords, and never reuse passwords. The passwords generated by these generators are usually random strings that looks like censored curse words and aren't memorable, but it doesn't really matter because you never have to remember or type them.

Then tell them to use a human-friendly password generator for their password manager's master password, which is the only password that they'll ever have to memorize.

This reduces the problem to securing that master password generator in way that are also human friendly and secure. IMO, the best way to do this is the Diceware passphrase scheme using EFF's wordlist. It's provably secure (2**77 strength with 6-words passphrase using standard-size diceware wordlist) and quantifably secure because the password are randomly generated rather than chosen by the user, and it is easy to type and memorize (they are just common english words).

  • Thanks for your answer (I learned about this Diceware), I appreciate! The only problem I see with password managers is that people is usually lazy. So when they try to connect from their phone (open another app to get the password from the password app, and copy/paste), or friend's computer (open the website of the cloud-based password manager) or any other place different than their own computer (in which they have everything setup for easy use).In those cases, they will be lazy, and they will use basic password.The idea behind this post is to step up a bit the way they create their password. – MrAkiTek Nov 24 '18 at 5:29
  • 1
    @MrAkiTek Exactly, people are lazy, that's why they should use password manager. In recent versions of Android, for example, using password manager is a lot easier than typing passwords due to Autofill service; you just tap the fill button and you're done. I don't think the open in friend's computer situation happens that frequently to justify not using a password manager, but if you happen to need to do that often then you can just lookup your password in your mobile and use Diceware to make it easy to type on said computer. – Lie Ryan Nov 24 '18 at 6:14
  • Thank you very much for your time, I truly appreciate your clarification. :-) I will take a look on it ! – MrAkiTek Nov 24 '18 at 6:37

Not the answer you're looking for? Browse other questions tagged or ask your own question.