Ask HN: Tips for generating easy to remember but difficult to crack passwords | Hacker News Reader

Ask HN: Tips for generating easy to remember but difficult to crack passwords

5 pointsthe-mitr19 comments

What strategies you use to create new passwords. At times I have to help several people (who are not tech savvy) to create login/password for different services. What tips would you give to such people to create passwords which are easy to remember but difficult to crack?

View on HN

Back in the days before shared password manager systems were a thing I was asked by an auditor how we shared the passwords for all our servers and services. I simply told them that we wrote them down on pieces of paper and locked them in our safe. They replied that all they needed to do then was to break into the safe to get access to our machines. That was when my colleague replied "Sure, you could do that - but you'd be wasting your time as the safe is in the server room, so you'd already have physical access to the servers"

If someone can't handle a password manager then writing down a longer more complex password and locking it in drawer is still better than picking a simpler password.

These days, password managers such as 1Password are easy enough to use even for non-tech-savvy people.

Other than that, although the process can become tedious when applied manually to a multitude of passwords, diceware helps with generating easy-to-remember passwords:

https://diceware.dmuth.org/

https://blog.1password.com/toward-better-master-passwords/

You probably still want to keep a secure record of those somewhere, which is where password managers come in handy again.

I have 3 base passwords --- easy, moderate and difficult.

Easy is for junk I don't really care about. Moderate is for stuff I do care about but doesn't contain any personal info. Difficult is for things that involve personal info.

Here is the fun part --- I have a 4th category called "critical" for extra security. In these cases, I combine the difficult base with one of the other two and then add a special context character at the end to indicate type. For example, with banking/money related stuff, I'll add [$]. Also, the easy password can be spelled either forwards or backwards.

All together, I have about 40 different passwords that I use but I really only remember the 3 bases. Even when I am not sure, I can usually guess the correct one within 3 tries based on context --- the objective being to avoid getting locked out.

For example, if it is a banking website, I know from the context that it ends with "$" and it contains the "difficult" base.

Obviously not perfect but where security is concerned, nothing ever is.

I used to have a very similar "system", until I locked myself out of an external hdd which I had veracrypt-ed with a super extra secure combination.

After a few months without using that hdd I forgot the password, but because I knew the basic bits that formed the password I generated all the possible permutations and brute-forced my way back. :D

The third time that happened I just decided to save the password on bitwarden...

There is no rule that says you can't back up your passwords too.

For backup, I create a file with shorthand clues up made up of the first letter of each base password. For example s..h..

Even if someone finds this, they still have a lot of work to do.

Why memorize passwords? Put them on a password manager, either a third-party one or the ones built into Chrome/Firefox/Safari/macOS/Windows. They often have passkey support too.

I would pick a word or name, and for each letter of the given word you create a sentences beginning with each letter. It doesn't need to make sense, you just need to make it easy to remember. Bonus point by adding a number (like a year date related to the word/name) and by separating each word with a special character.

For example : Alice Amendment%Liability%Indicates%Cute%Energy2006

I use to explain my strategy to friends and over time I've changed from words to short phrases. What I do is to have passwords divided in two parts: one constant, one variable The constant part is a phrase I can easily remember and the variable part is a reference to the usage of the password, so for example:

- ILikeDarkChocolateGmail

- ILikeDarkChocolateApple

- ILikeDarkChocolateWhatever

and so on.

https://xkcd.com/936/

Or https://xkcd.com/538/

Highly vulnerable to dictionary attacks though. Toss a punctuation in there at least.

Not convinced TBH.

If the words are chosen randomly from a large dictionary, it should be fine.

See https://security.stackexchange.com/questions/62832/is-the-of...

Use password manager, generate long ass random passwords, never have to remember them

Or just four words with a symbol. Most password managers can create this pattern. Very handy if you ever need to retype a password.

Pure length. Write whole phrases.

Have a messy desk, and use objects on the desk.

And never clean your desk!

The point of the password is that it’s easy to remember so you can clean up and you’ll never forget your pencilgummousepaper password.

the-mitr19860504@hackernews

How good does it look?

Reply on news.ycombinator.com