What is your way to create good passwords that can actually be remembered?

Question

What are the methodologies which can be used to generate "human" good quality password?

They have to ensure a good strength and also easy to remember for a human being.

Answer 1

I used to take four random words, substitute some of the letters for numbers, and append four numbers plus a special character. The problem was, that was a bit difficult to remember - now, I have take my favourite line from the book I was reading the previous month and do a similar substitution plus some capitalisation changes, e.g:

"A human head rises up from a swamp of sleep" (number9dream, David Mitchell) becomes "Ahum4nH34dR1s3sUpfR0mASw4mpOfSl33p!"

It has acceptable entropy and the computational complexity of a brute-force search means that such an attack is impractical.

Answer 2

Two more points:

a. Along with all other methods, one more way to increase entropy:

Go beyond just (plain) English.

If we combine (seed) words from more that one language the password guessing/search area immediately becomes HUGE. And that would certainly confuse people writing password guessing rules.

Then again that would require having a broader field of thinking than the "bad guys". Perhaps it comes down to "our" intellect against "theirs". Perhaps, the broader thinking should be:

Go beyond just CS methods.

So, what other such ways can we think to outsmart password guessing?

b. One point not seen mentioned so far: Thinking from the administrator's side, let's not forget that any password generation rules may also have to adhere to the password policy of your organization. E.g. I have difficulty thinking how the method words-separated-by-spaces (using uncommon words!) could be easily implemented and enforced in an enterprise environment (OK, parsers, dictionaries etc. but you get the idea...)

And how about educating and convincing users to use this or any other method...?

Answer 3

First reccomendation is something like lastpass or keepass, but I know those aren't always practical and my less technically savvy friends certainly don't want to "complicate things any more" so I have found that a substitution cipher works fairly efficiently and allows for easy remembrance of your password while making it very unlikely for it to be guessed or easily hacked.

I put an example out there http://levii.com/cipher.php ... I use at least a 4 letter key word (so "BANK" for my bank "WORK" for my work) which I don't bother changing -- I keep the card in my wallet and print a new one up every couple of months when its time to change the password. (note: this is not the actual app I use to generate my cards, but is conceptually the same)

Answer 4

If English is not your mother tongue, you are lucky. I would suggest using a passphrase that uses a combination of English words with words from your native language or languages. Such a password will be quite difficult to guess.

Of course you should choose a passphrase that can be remembered easily by you. I am not a big fan of creating too complex passwords, just remember that the password should not be easily guessable and should not be listed in a dictionary.

I also recommend not to have a single password for all your accounts. I maintain a small pool of passwords (this will come with practice). Your net banking password should not be reused for your eBay or monster.com account. Once I clicked on forgot password link of a job site and they sent me my password in plaintext. Basically you cannot trust every random website out there!

Answer 5

Let you choose a verse from your favorite song in the history or just in this period of time.

Take a random sentence, make some CamEl cAse permutation, you can even use a script kiddie charset substitution to m4k3 1t l00k1ng so CoMpl3X and difficult to guess.

Ideally, you write an English sentence, like: this morning I am so blue. Actually your password can be: Th1S M0rn1Ng I 4M s0 Blu3.

Easy to remember and after some input also easy to type.

Answer 6

My way is in no way unbreakable, primarily because it relies on security through obscurity, but it is better than password reuse and doesn't rely on keeping much remembered. I xor a repetition of the url of the site in question with a long password of my choosing. In this way, you only remember one password yet a compromise of one site's password store doesn't compromise your other logins. This has potential for infinite variation. You could do the url followed by the ip address, the url reversed, the url translated to spanish, etc, etc.

Answer 7

I have a long password I use which I can type in from memory each time which I created by remembering a specific zig-zag path across the keyboard, one which passes through letters, numbers, and symbols, and then tapping out the keys that make up that path in the rhythm of a drum pattern from a favorite post-dubstep track of mine, shifting some of the characters according to where the snares are in that drum pattern.

This is a different 'path' to what I use, but you can see how complex a password this technique gets you, and with a little bit of practise it's quite memorable:

\]={-p)o9I8u&y6T5r$e3W2q

Then for different applications I'll I will usually add at the end my old Hotmail password I came up with when I was 11, or my date of birth backwards, or something like that that I can remember easily.

Answer 8

My way is to change some letters with similar numbers and every new word start with uppercase.

for example: Th1sIsGreatPassw0rd!

i=1,

0=o

and at the and '!' or something else.