Chose a nonsense phrase from some popucluture thing or whatever, and add in or replace some letters with numbers and symbols.
Something like kRyptoni4n!muGgl342r0nin is easy to remember, and not being brute forced anytime soon.
It's a guessable password + guessable ruleset. You've introduced far less entropy than you've imagined. If you want to have protection against attacks and use your technique, you have to come up with a ruleset you (1) don't see in the documentation (2) that's computationally unreasonable.
For instance, combine multiple languages. Strawberry Octopus Sundae, which is pretty memorable, can become FragolaOctopusEisbecher combining Italian, English and German. And with that we just went O(N^3) where N is dictionary size (actually more than that because you've got a wide choice of latin scripted language).
That gives you far more protection then say sTr4b33ry+0ct0pu5!5und43. You aren't fooling a GeForce RTX 4090 with those tricks.
That's an example I just came up with though. There's lots of things like that. But really run a cracker. Try it out.
That's ok, isn't it?
Using something like a 20 character password following that formula is going to be fine for most people - it isn't going to be brute forced before someone gets an alert that passwords are compromised and can change it.
It's a much better solution IMO than using something entirely random and writing it down, or using something like LastPass.
This response isn't for you par se, I just don't want people to go off and think they're protected with beyonceMadonna because they read it on hacker news.
Put your needles in the biggest haystacks you can find, not the rarefied air of celebrities.
Also don't think you're protected with "old" names like GreenDayEminem. Using older celebrity lists to preference forgotten or abandoned accounts is another common technique. Sometimes you're just a stepping stone and not the target.
Find a bigger crowd to get lost in. For instance, say an address + phone number of a place you remember that's not yours. 419FSt#201 is an old friend and 8184093100 is a friend I had in childhood. Those are two big crowds. Phone numbers have way more structure than you probably think but it's still a fairly big haystack.
That's the thing though, I'm talking about combining pop culture words in a way that they are not in any list.
beyonceMadonna is quite a bit different from `b3Y0nm-Ad0nn\ac3`
That's using two words from pop culture, merged together with numerous substitutions. It's easy to generate, easy to remember, and won't be in any lists, and shouldn't be bruteforced (well, I'd increase it to at least 20 from 16) in the time a breach is reported and a reasonable window for changing a password after being notified.
I do agree with everything you've said though.
Password guessing and cracking is part of my job. GP is right: the advice is absolutely terrible. Your example looks good but the secret sauce is the way by which you create it. Maybe it's just leetspeak for something a million fans know, in which case it would be in my dictionary by virtue of downloading Wikipedia and other cracked password lists and the leetspeakify rules will find it in a matter of hours or days for a typical leaked hash (this looks like a domain admin password we might find on a workstation they logged into).
Eyeballing mGgl3etc., it doesn't look like something you'd find in anyone else's password, which makes it unpredictable, which makes my job hard and your account safe. But you can't determine a password's strength from the generator's output (only if it's terrible) so idk.
Also memorize, if possible, a few other important things like your bank password, or rely on 2FA for that, e.g.: we have a system where you log in with a reader for your card itself, so your password being stolen and your chip+pin being stolen is a risk I accept. If someone is after me specifically enough to get physical things out of my pocket, I'm not confident about resisting a rubber hose for that password / they can also install a keylogger.
For generating a password, it just needs enough entropy if you calculate log(pool^elements)/log(2):
- pick 6 actually random words (like in the xkcd) from a 7776-word dictionary like diceware, or some other combination that gets you at least 72 bits of randomness (so here it is log(7776^6)/log(2)),
- or use a much shorter but slightly harder to remember set of random characters (a-z, A-Z, 0-9 would need 13 characters. If you don't want to bother with shift at all but include a few (10) symbols that don't need shift, add one character.
Depending on the password manager, it would strengthen with a KDF, but that depends on details and remembering just a handful of 72+ bits of randomness should be attainable for most people if they use it regularly (at least once or twice a month after the memorization phase).
I should really find a canonical source for this so I don't have to write this up every time. Not sure if Schneier has this somewhere but I looked at e.g. the Wikipedia on password strength (a source people would trust) and it's less explicit and also contained a pretty bad mistake for more than a year not so long ago...
OTOH, people in the old days used to memorize a lot of phone numbers, so remembering things is not as hard as you might think.
Sure, the example I gave was more complex, but I was specifically referring to the "We recommend choosing a word or phrase that means something to you, and then adding one or two numbers or symbols, like "!" or "+"." being terrible advice.
It's not great advice, but they are on the right track.
> Password guessing and cracking is part of my job
Same here.
> GP is right: the advice is absolutely terrible.
It was just worded badly.
> Maybe it's just leetspeak for something a million fans know, in which case it would be in my dictionary by virtue of downloading Wikipedia and other cracked password lists and the leetspeakify rules will find it in a matter of hours or days for a typical leaked hash (this looks like a domain admin password we might find on a workstation they logged into).
Sure, there are tons of domain specific dictionaries, but that's really more useful for people that are targeting an individual and know something about them, or are just going to go through every dictionary they can. Most attackers are not doing that.
And besides, it's not about ensuring the password can never be cracked, that's not a great goal considering the compromise it would take - the goal is to delay brute forcing enough so that you can change passwords after you have an alert that a site has been breached.
Crying boomer here ... forgot where I put my tissue again.
Look at the 3 words I modified..
kryptonian, muggle and the last was '47 ronin'.
Alternate case, make some substitutions for letters with numbers/symbols, add in additional numbers/symbols, and you'jj have something that isn't trivial to bruteforce.
Once you know the core words you are using, you only have to memorize the substitutions you have made, which is much easier.