I could use a password manager, but I don't like relying on another entity than myself to store my passwords, and it would screw me over if I find myself on the internet in a new location without the database. So I want to use the correct horse battery staple method for my passwords (don't tell anyone,) and memorise all of them. But I'm not sure how I can remember which password is for which service. How can I mnemonically link each password to the particular service?
The point of xkcd-style passwords is that: humans think in stories. A password of that kind can be remembered because the user will build a kind of "story" involving all the words in the password as elements of the story.
Along these lines, you should include the service name as part of the story. If your "correct horse" password is for Amazon, then you may remember the story as "a book about famous 'smart horses', including one who could correctly (and famously) recognize staples and batteries". Or something else. The story needs not make sense when written down; it is personal to the user.
Another completely different method to remember passwords is to type them often. This is memory in the fingers (that is, in the part of the brain that controls the fingers), and it works well.
Yet another point is that if you are on the other side of the Internet but still want to access your passwords, then you are about to type your password on some machine. So:
Either this is your own laptop, then why don't you have a copy of your passwords, encrypted with a strong master password ? That's something I do (this is safe if the master password is strong, and you apply some care on the decryption, e.g. deactivating swap space and doing the decryption in a RAM-based filesystem).
Or you are about to type your password in a third-party machine, e.g. in some "Internet café", and well, you should not. Really. Because such a machine could have a key logger.
How do you memorize each passphrase ? Probably it's the same way that's shown on the xkcd link you provided: by creating some context where those words could be used, or creating some mental image.
You just need to include the service on it. Perhaps not literally the service name, since it might just create some strange picture. But you can easily adapt.
For example, if your email password is correct horse battery staple, you can imagine that the horse is writing the "battery staple" on some envelope.
I'm assuming you're facing either issue:
- How to remember a different credential for each site
- How to reuse credentials in ways that don't compromise your security too much, and how to know which credential to use where
To be honest, I as a security usability specialist do reuse passwords. Nobody can cope. That's normal and that's nothing to be ashamed of. There are a couple of tricks that can be useful to avoid losing access to your important accounts.
First, you should identify your most valuable assets. Always have a unique password for email and payment accounts. Your payment accounts (PayPal, banking..) are obviously valuable because they can make you poorer. Still, your email accounts are the most critical you have. If I steal your main email account I can learn on which other services you have accounts on and I can reset your password everywhere (through the lost password form)! There's an example of a guy who lost a very precious Twitter name because of getting his email account compromised.
Second, if you find a password manager you can use, get one. If you don't trust the big commercial companies with your data, consider open-source password managers.
Third, do you need to remember passwords to sites you barely ever connect to and you assign little value to? So long as a (rarely-used) site allows you to easily reset your password, you can put this to your advantage to reduce the number of passwords you need to remember. There are sites for which I only use the reset password and forget it immediately.
Finally, you can start grouping accounts by whatever semantics they have, so you can drastically reduce your number of passwords. A couple of criteria could be:
- Do these accounts serve the same purpose to you? E,g, accounts where you can book/order things of the same type (without having your credit card attached)?
- Are they attached to the same stakeholder/assets? Think different accounts in the same company (often they require you to handle 2 or 3 accounts because they can't properly handle Single-Sign On...)
- Does the compromise of one lead to the compromise of the other? For instance if I can impersonate you on a specific service is that enough to hurt your assets on another service, e.g. OSN accounts with links to one another?
Hope it helps.
I've recently read a blog post from Sophos Security where they link to a study about how to remember complex passphrases which are not dictionary words, using spaced repetition - I think the same can be applied to passwords based on dictionary words.
The idea is to learn a passphrase over a period of time where it becomes more complex, rather than trying to remember it from the first time.
My suggestion, use that and words in different languages :).
I'm not sure the general perceived opinion of this method, but here's what I do. In the
correct horse battery staple example, my method is to add the website I'm browsing on to that. Suppose I were using a stackexchange account instead of my google account, my password would be something like:
correct horse battery staple stackexchange
More specifically, I add a rather large phrase (not just random words) as the first part, so in the classic Portal way, I could make these:
the cake is a lie stackexchange
The cake is a lie stackexchang3
The C4K3 is @ lie stackexchange
The key to remembering them is I always have the same first phrase where possible (I'm looking at you, microsoft), but vary the end to something tailored to the website I'm browsing.
Of course, if you prefer not to do that, as others have said: get a password manager.
Here is another way to memorize passwords that aren't predictable, no matter how much someone knows about you:
From this article:
It turns out, coming up with a good passphrase by just thinking of one is incredibly hard, and if your adversary really is capable of one trillion guesses per second, you’ll probably do a bad job of it. If you use an entirely random sequence of characters it might be very secure, but it’s also agonizing to memorize (and honestly, a waste of brain power).
But luckily this usability/security trade-off doesn’t have to exist. There is a method for generating passphrases that are both impossible for even the most powerful attackers to guess, yet very possible for humans to memorize. The method is called Diceware, and it’s based on some simple math.
...then it goes on to describe a simple method to do the XKCD thing but with some true randomness behind it.