1

It seems to be generally accepted the same password should not be used for different sites or devices. How different should passwords be? For example +_^gum<JW1 and +_^gum<JW2 are very similar. Does it matter what the passwords are used for, for example having two e-mail accounts with similar passwords may be poor security but would having an e-mail account and encrypted USB device with similar passwords be better? What if two or more passwords follow a pattern or relation? For example applesorangesbannansand pottatoescarrotsturnips

I have read that all passwords should be random. This is ideal but not feasible.

  1. It is most difficult to remember and password managers may not be a viable option (for example password to memory stick you carry with you).
  2. It has been stated that computers should not be used to create random passwords.
  3. Some devices it's very hard to type long complex passwords in, such as smartphones.
  • 1
    If you're using password1, you should change it to password2... It's amazing how common the use of password1 is... Seriously, the change must be such that it can't be guessed by people who know you. And 2-3 characters is not a password change, in reality, humans have a bad habit of creating patterns and a little knowledge about them shows their habitual patterns. – Fiasco Labs Dec 16 '15 at 7:39
  • +_^gum<JW1 and +_^gum<JW2 are identical on one of the server where the password checking is historicaly truncated to 8 chars before hashing. Hence on these historical servers +_^gum<J is also working, with the 4096 variants you can imagine with a standard qwerty keyboard. – dan Dec 16 '15 at 7:48
10

I have red that all passwords should be random. This is ideal but not feasible.

Why not?

1)It is most difficult to remember and password managers may not be a viable option (for example password to memory stick you carry with you).

Why isn't it feasible? I do it all the time.

2)It has been stated that computers should not be used to create random passwords.

Where is this stated? This is blatantly false.

3)Some devices it's very hard to type long complex passwords in, such as smartphones.

Smartphones have password manager apps as well. They allow you to copy and paste passwords stored in them.

  • 1) You remember random passwords all the time? – Celeritas Apr 22 '14 at 8:58
  • 1
    @Celeritas Password managers..... – Ayrx Apr 22 '14 at 8:58
  • 1
  • 3
    1. You should not generated passwords ONLINE. This doesn't mean that you shouldn't generate passwords locally on your computer.... 2. Yes, it's called keepass and dropbox. – Ayrx Apr 22 '14 at 9:04
  • 1
    Normally you'd create the database (for e.g. KeePass) on a computer and use it on a smartphone. And if you have your smartphone with your password database, and you don't have a keyfob, and you can't install things...then you can still open up your password manager on your phone and type it into the computer. – Ben Dec 16 '15 at 4:47
1

If you use a discernible pattern to create your password, then if one site you use gets its passwords leaked, crackers can throw that pattern into a rule for their tools. The next time a different site you care about has its hash table leaked, your password pattern might be part of the attack. It's not difficult to try all numbers in place of the 1 at the end of your first example. And 3 common fruit/vegetable names will probably fall relatively quickly as well. Now you can use 5-6 common randomly chosen words for great security, but many websites won't accept anything that long, and nobody really wants to memorize dozens of those, so you're better off just using a password manager.

1

Your passwords should be as different as necessary to avoid your worst enemy to guess any of them with any previous knowledge. This worst enemy might be a robot built to guess passwords and feed with hints.

  1. Write down 2 of your passwords.
  2. Ask yourself: is it clear that these 2 passwords will work on the same account?
  3. Act.
0

See http://www.explainxkcd.com/wiki/index.php/936:_Password_Strength And https://tech.dropbox.com/2012/04/zxcvbn-realistic-password-strength-estimation/

When you use 4 or 5 (for you) easy to remember random words, all lowercase, 25-30 characters, you're very safe. The only catch is that some websites will not accept this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.