Speak Friend and Enter – Do people use movie passwords? (2018)

Similarly, I use lyrics of songs I know well enough to be able to sing the words correctly, but are obscure enough that most people won't know them. Jut use the first letter of each word, and if you forget, you can hum along with it while typing.

As an example, the chorus of the classic CCR song 'Have you ever seen the rain' (don't use this one) will give you a easy to remember 15 char password: Iwkhyestrcdoasd. And if you forget its easy to make a simple hint (something like 'Fogerty').

My advice, don't use the chorus - a 2nd or third verse you remember is better (and often longer). And google the lyrics before you make the password, just to check that you've been singing the right words all these years.

> according to security.org’s password-strength-checker [1] that will take a computer 200,000,000 years to crack

These types of things are very misleading. It is rare for a password to be bruteforced in general, it is unusual for the attacker to have the hashes of the actual site for an offline attack. Hopefully if the dev is competent there is rate limiting for an online attack. If the dev is competent they are hashing with argon2, pbkdf2, bcrypt etc tgat slows things down.

Anyways - 95% of password based attacks are using the same password in multiple places with one of the other sites getting hacked (someone's probably going to point out exceptions, and they do exist). Unless your password is absolutely terrible, the threat is not lack of password complexity but lack of password uniqueness.

Just to put it in perspective - 2FA is usually a six digit number, and that is considered secure since there are rate limits, and the user cannot reuse the key on multiple site. The security.org site says that can be cracked in 25 microseconds. There is obviously more to it then that since 2FA codes last more than 25 microseconds.

Those estimates don't mean anything with quantum computing on the rise...

A better way to tell if your password is secure is to download a gpu dictionary password cracker, and add in a couple of the big leaked password dictionaries, get at least the big ones so you have a few billion passwords and run it for a few hours. It will crack millions of clever passwords like just like that, and the only result is making someone like me wonder how can 7 people come up with the exact same seemingly unintelligible string that long.

> I used Jabberwocky: Tbatstdgag1tw! - according to security.org’s password-strength-checker [1] that will take a computer 200,000,000 years to crack, presumably on average

Or much less time because it's already been leaked three times according to haveibeenpwned.com, so it'll already be in a bunch of rainbow tables.

This is why clever isn't enough: not because you can't design one that's resilient to brute force attacks but because password reuse is the #1 threat to the password-oriented security model and you can't come up with hundreds of sufficiently strong clever passwords.

> In this age of scale, a password manager generating long random passwords is not "good to do", it's absolutely a requirement.

One day there will be an exploit for your password manager.

And even if you use a clever password you might be giving it to someone who has never heard of password hashing/salting etc (but I'm sure they "care about your privacy")

Hence why I prefer "not great/not bad" passwords to sites that wouldn't have a significant impact on my privacy

"Hackers" got it from actual password usage, rather than the other way around.

CPE1704TKS*

I'm with you. The fact that Joshua is not the number one on this list really speaks to my age.

In my youth, Joshua was a password I used a lot, and only dropped it because I felt it was, like, too obvious.

Another one I used, especially when numbers became mandatory was Turk182. But that reference is from a seriously obscure mid 80s movie (of the same name.) I'm guessing precisely nobody here has heard of it :)

Who flew? Who knew? Turk182

I would hope so. UW CSE had fun names for every computer on their network, though my knowledge is dated to 2016.

Humuhumunukunukuapuaa was eventually renamed because anytime you had to type it really sucked.

My university has machines named "data" and "lore", I personally use scifi transportation on my machines (enterprise, firefly, stargate, galactica).

Mid-80s, the Stanford TOPS-20 campus timesharing system had machines named Hamlet, Othello, Lear, and Macbeth which users called The Tragedies. The system administrators did NOT like that.

Names from Tolkien, movies, and tv got popular as workstations got deployed. Initially we thought the management had unclenched but learned that end users picked the names as these were machines deployed by individual research groups.

This has me wondering. When I was in school about 2 decades ago they were using names of Greek or Roman gods for servers. Part of me wonders if many campuses even have many servers worth naming now, since all the services I used at that time have now been outsourced to Google or Microsoft long ago. I’m guessing there must still be a few servers in a rack even in a cloud-centric school, but the days of connecting to like “hermes.university.edu” to get email/FTP/web hosting must be gone basically everywhere by now.

good one!

Why would someone remove this? What a delightful page. Now it’s just nothing.