Write Down Your Passwords

joeykiller writes "Microsoft's senior program manager for security policy, Jesper Johansson, presents a provocative but interesting view on password policy: He claims that prohibiting users from writing down their passwords is bad for security. His main point is that if users are prohibited from writing down their passwords, they will use the same easy to guess password everywhere." From the article: "Since not all systems allow good passwords, I am going to pick a really crappy one, use it everywhere and never change it...If I write them down and then protect the piece of paper--or whatever it is I wrote them down on--there is nothing wrong with that. That allows us to remember more passwords and better passwords."

Comments

Pseudo-Written Password

[fembots]

Seriously though, instead of writing down the password, why not using what's already written on the hardware?

For example, I'm only reading Slashdot from this particular computer, and I'm using a IBM E94 monitor, and there is this Sellotape dispenser on my desk with 1531 written on it. So my Slashdot password can be easily remembered as IBM!1531@E94#, or simply ibm1531e94 for those systems that cannot accept special characters.

See? it's so easy to remember a long and good password, and nobody's going to find out how many items you use and how you combine them to make up your password.

The good password requiremnt is not helped by the fact that users are also required to change it every xx days, so not only you need to remember a strange password, you have to remember a different one every couple of days.

There a joke about the increasing frequency that a user is required to change his password nowdays, eventually crackers just need to keep on trying the same password and the system will change to match it.

Re:Pseudo-Written Password

[Scruffeh]

I think the bigger point here is that most people don't care about passwords. They see them as necessary but annoying which is why they use easy to remember things. It's also silly to say writing down passwords is bad or good. People are always going to use different systems which may or may not work well for someone else. I rotate my passwords and do not write them down, another person my just find this annoying. It's all subjective IMHO

Re:Pseudo-Written Password

[LordSnooty]

But what happens if someone moves the Sellotape? And more obviously, what if someone cracks on to your method? The password is right in front of them!

Actually it's not too bad because it requires physical access. At my famous Educational Establishment, there's been a recent spate of hackers using weak passwords to gain access - all from off campus. Make it strong and keep it written down somewhere secure, and you're pretty much safe from the majority of abuses. Keep it hidden innocuously in a book or a file of boring documents, rather like a file in a cake.

Re:Pseudo-Written Password

[Anonymous Coward]

If I have 10 items on my desk with various serial numbers or part numbers on them, and you KNOW FOR A FACT (of course you won't) that I'm using 4 of them, that's still 10!/(10-4)! combinations, or 5040 possibilities. Furthermore, there's the possibility that I added characters in between each item, each one increasing complexity by 62 (assuming ONLY alphanumerics). So in a bad example, with only 10 numbers to choose from, and your having a good deal of knowledge about choices, it is INCREDIBLY unlikely that you'll successfully guess the password before the system locks you out (essentially what a local attack will be limited by anyway). If you grab a copy of the hash somehow (which generally indicates another security problem in itself), your attempts can be rather easily be foiled by character substitutions (password -> p4$5W0rd), each possible one adding another order of complexity to the problem, increading the permutations by at least a factor of 2. Given 3 substitution choices per letter (there will usually be many more than that), 'password' becomes 3^8, or 6561 TIMES more complex.

In short, if this is true, the passwords really, really sucked.

Re:Pseudo-Written Password

[Em Ellel]

Everyone I know at work with a lot of passwords uses (password protected) software (like pins) to store all of their passwords...

In the end, it is probably one of the better ways , although I always wondered that since now there is a potentially weak password protecting MANY possibly strong passwords, do the strong passwords matter? A simple keylogger will give access to ALL of your passwords in seconds.

-Em

Re:Pseudo-Written Password

[Em Ellel]

On a more practical note, back in a day when I backpacked through europe I wanted to have a backup of important data to take with me, in case I lose my passport/bank cards/etc. However being a paranoid freak I did not want to write the numbers down on paper in plain-text, as I would be doubly exposed - I could loose my wallet or I can loose my notebook.

So to resolve this issue I wrote the information using a simple rot-n algorithm with random keys. I wrote down all numbers (including rot-n keys, which looked just like the rest of the data) in my notebook and knew that if I had to use them, it would take me a little time but I could work it out, and if I were to loose the notebook, I could be pretty sure that noone would bother trying to make sense of a bunch of numbers written on the back cover - most likely it will be just tossed.

Obscurity combined with physical security makes things severely more difficult for a casual snooper. In the end it is a game of making the cost of figuring it out to be more that the desire to do so. Writing down key data, such as passwords, with a little obfuscation goes a long way.

-Em

Re:Pseudo-Written Password

[ginotech]

if someone has that kind of access to your computer, you're screwed anyway.

Re:Pseudo-Written Password

[KinkifyTheNation]

Or use a sentence and remove the spaces.

thispasswordwillnotbebruteforced

for example. The only weakness I can think of is that it may or may not be easier for someone to guess it.

Re:Pseudo-Written Password

[Erik Fish]

If they take the Sellotape then you just set the building on fire.

Re:Pseudo-Written Password

[JustOK]

Yah, I might pay a dollar to see what happens when some over eager DHS agent sees it when you come back... "Oh, just rambling about 'Europe', huh? Meet any interesting people? What's all these numbers? What specific countries did you go to? Do you have proof of where you stayed in each of these countries?"

Re:Pseudo-Written Password

[ChatHuant]

A better approach to that is take a phrase and change it like so

iLikeFi$he$Bec@useTheyreSoDelicio$

That doesn't add much to your password's security, you know; your changes aren't random enough, especially since "leet" ortography is so prevalent. There are dictionary attack programs that use expanded dictionaries, using also words with the obvious replacements (I/L -> 1, e -> 3 and so on).

Re:Pseudo-Written Password

[spacecowboy420]

IMHO, an even better way is to pick a pattern on your keyboard and alternate your shift key. If you look at this password: o0i9u8&TR% it may look impossible to remember, but if you were to actually type it, it becomes surpisingly simple to remember. Once you know it, it is even difficult to tell someone your password, but easy as hell to remember when typing on a keyboard - just remember the pattern.

Re:Pseudo-Written Password

[jkosturko]

I use a similar technique, using a dollar bill. Take the serial number of a dollar bill and choose an offset between 1 and 4. Type in each character of the serial number number, pressing the shift key for every character that is a multiple of the offset (every third character for example) This way, you have the password "written down," but it is stored in an inconspicuous manner that will not be recognized or comprimized if you lose your wallet. Obviously, don't lose/spend that bill :)

Re:Pseudo-Written Password

[Mattcelt]

In short, if this is true, the passwords really, really sucked.

Not really. What it means is that users generally really, really suck at picking good passwords.

In order for Mr. Johansson's idea to be truly effective, three things need to happen:
1) the IT department much choose strong passwords for the users. They must NOT allow the users to choose the passwords themselves.
2) there must be an incredibly explicit policy regarding the protection of the media on which the passwords are stored and accessed. The policy must provide stiff penalties for failure to comply, and periodic checks need to be made to ensure compliance.
3) the users need to be educated on the relevant security practices so they know why it is so important to follow the letter of the policy and not circumvent any part of it.

Failure to do any of these will compromise the success of the strategy.

Re:Pseudo-Written Password

[gengee]

Yes; This is in our corporate information security policies, along with the suggestion that users use memorable song lyrics as the source pass phrase. Most users like that system, as it becomes fun to think up a new password.

14ckwbwtdbwb = Fourteen cannibal kings / wondering blindly what the dinner bell will bring

For a root system password, you may want an even longer password, both for cryptographic security where cryptographic systems support > 8 characters, and more importantly to discourage the use of the root system account by administrators when tools like sudo make its use unnecessary.

ItastD,DIgtiop,lttuatt,wyesok? = I turned and said to Dan, "Dan I guess this is our prime / like they tell us all the time / were you expecting some other kind?"

It's difficult to forget that password, but even in the event you do forget it, there's a strong possibility you'll remember enough to Google-up the answer. And I guarantee administrators will more frequently use (rules-driven, command-logged) sudo when the alternative is a 35-character root password.

Re:Pseudo-Written Password

[nebs555]

yeah but if you had been pickpocketed by albanian cryptography experts... you'd be buggered

So Pen&Paper's the new replacement for Passpor

[team99parody]

Now we know what's replacing Microsoft Passport in Longhorn - pen&paper!

Bruce Schneier agrees

[alanw]

From Bruce Schneier's Crypto-Gram, May 15 2001, and then updated in a news.com article, December 9, 2004.

You can't memorize good enough passwords any more, so don't bother. For high-security Web sites such as banks, create long random passwords and write them down. Guard them as you would your cash: i.e., store them in your wallet, etc. Never reuse a password for something you care about. (It's fine to have a single password for low-security sites, such as for newspaper archive access.) Assume that all PINs can be easily broken and plan accordingly. Never type a password you care about, such as for a bank account, into a non-SSL encrypted page. If your bank makes it possible to do that, complain to them. When they tell you that it is OK, don't believe them; they're wrong.

Re:Bruce Schneier agrees

[team99parody]

Seems better to keep the long-hard passwords stored in an encrypted file protected by one good password that you remember.

Re:Bruce Schneier agrees

[l3prador]

The "guard them as you would your cash" idea sounds good and is good to a certain extent, however, when someone has stolen your cash, you can generally tell it's gone. A password can be stolen without anything being missing.

Re:Bruce Schneier agrees

[loqi]

KDE's wallet manager handles this rather nicely.

Re:Bruce Schneier agrees

[Mavakoy]

Or use a shorthand system i.e.

main login: ML7
mainframe access: I12

To me, these would tell me _exactly_ what the passwords were, but to a passer by, they are meaningless.

Re:Bruce Schneier agrees

[Ann Elk]

PasswordSafe is basically a GUI wrapped around an encrypted file such as you describe. Unfortunately, it's Win32 only, but there are a few portable solutions available.

Re:Bruce Schneier agrees

[bizard]

which is exactly what systems like Keychain Access, Password Wallet (or Password Wallet), Keywallet etc. are for.

Re:Bruce Schneier agrees

[Cutriss]

All these people are mentioning Password Manager, but I use Keyring for PalmOS (formerly "GNU Keyring"). This way, I can bring the .PDB database with me in my handheld if I would like to take my passwords on the go, and running the app on a client machine isn't hard since there are a variety of Palm emulators out there for a variety of platforms.

So, you have an app that, by virtue of being on a portable emulated platform, is OS-portable as well.

Re:Bruce Schneier agrees

[Anonymous Coward]

As does OS X's Keychain.

Re:Bruce Schneier agrees

[ymgve]

Nobody has yet mentioned the strongest reason why this is dangerous: Keyloggers. A malicious hacker captures your master password as you enter it, and suddenly every password you have is compromised.

Re:Bruce Schneier agrees

[Penguinshit]

One password to rule them all
One password to find them
One password to bring them all
And in the darkness bind them.

Microsoft hard at work for security

[yagu]

"Since not all systems allow good passwords, I am going to pick a really crappy one, use it everywhere and never change it...If I write them down and then protect the piece of paper--or whatever it is I wrote them down on--there is nothing wrong with that. That allows us to remember more passwords and better passwords."

That would lead me to believe you'd have an environment where any discovered piece of paper on which there is some non-indigenous word written would be a candidate for plugging in as password attempts. This is just plain silly.... passwords written down would be one of the first things a social-engineering hack may try to leverage. I'm not a fan of draconian policies wrapped around impossible rules to manage security, but this "recommendation" flies in the face of reason.

Re:Microsoft hard at work for security

[Cornflake917]

If you read the quote which is in your post. He says "If I write them down AND THEN PROTECT the piece of paper..."

For example, the company I work for has strict policies for protecting passwords. We must keep our computer passwords in locked cabinets or we will face minor to moderate penalties.

Re:Microsoft hard at work for security

[Lord Kano]

I'm not a fan of draconian policies wrapped around impossible rules to manage security, but this "recommendation" flies in the face of reason.

A piece of paper kept in the wallet is better for security than the same 7 letter password getting reused.

We can talk about how things should be in an "ideal" world or we can deal with how things are in this one.

In an ideal world, passwords wouldn't be necessary because everyone would be honest.

LK

Re:Microsoft hard at work for security

[yagu]

I chose the quote from the summary because it worked best for what I wanted to point out. I did read the article (I always do, or I won't post against it)...

No biggy. I agree with your point we haven't found any scientific solution for morons yet, but that's sort of my point. If we let (as a policy) people just write passwords down, that little slice of moron-dom is the part that always bites us in the rear.

I know the article talked about securing the scrap of paper on which the password is written stowed, and secure, but my experience has been that doesn't happen. And, when combined with the policy that passwords be written down (he almost states they must be written down -- the exposure is greatly increased.

I'm not proposing any rebuttal or solution, I've always found the more oppressive a regime, the more determined hackers are to find a way in. I've been approached many times by the security organizations where I've worked to help them with their policies (I'm pretty good at hacking) and I've always declined -- I find it a difficult universe to exist in where no matter how hard you try, there are always people out there who break what you make.

Security in computers is a losing battle. It's an extension of our social makeup and there'll always be good guys and bad guys and there'll always be breaches. I just think what the article proposes is yet another proposal, and it adds little to overall real security.

By the way, I don't think this is at all a first, seeing a post modded +5 from a poster who hasn't read the article... I've seen a number of what are fairly obvious examples of that. Used to get my dander up, too, but I've come to accept sometimes the poster may have enough credible and useful to add to the discussion without having to read the article (though, not always :-)). And, again, for the record -- I did read the article.

Good feedback.

And I'll keep it under my keyboard...

[beorach]

with my bank name and account number next to it..

Re:And I'll keep it under my keyboard...

[nukem996]

You'd be surpised about how many people do that.

Re:And I'll keep it under my keyboard...

[dodald]

I have a single post it note under my keyboard that reads "9uL1i613".

Re:And I'll keep it under my keyboard...

[justforaday]

I have a single post it note under my keyboard that reads "9uL1i613".

mine says "password"

Re:And I'll keep it under my keyboard...

[camkind]

mine says "This side down"

Ok.

[cmburns69]

Ok, here they are:

Slashdot password: 12345
Personal site password: 12345
Bank account password: 12345

Now my password is even more secure! Yay!

Re:Ok.

[fembots]

Now my password is even more secure!

So true, by open-sourcing your password, you don't need to worry about security anymore.

Re:Ok.

[ClownsScareMe]

This joke is sooooo obvious. I though of it, I just didn't post it.

One Word:

[DrunkenTerror]

Tattoos.

Re:One Word:

[Durinthal]

Particularly in a private region. That way no geek would ever have to worry about someone else seeing it!

Re:One Word:

[fbform]

Particularly in a private region.

That's not how one does private key encryption.

Wow...

[MrByte420]

I've got the same combonation on my luggage!
(sorry sorry sorry!)

Riddle Me This

[the0ther]

We use physical keys to start our cars and to unlock our homes. Why don't we handle this stuff by using a similar strategy. Say a USB dongle that you need to start your computer? I've seen a few implementations of this theme, and I even believe MS threatened to do just this. Is this because the regular (l)users out there want their computer to work like their toaster does?

Really?

[aftk2]

What would be the problem with using one really strong password everywhere? Rather than many strong (or semi-strong) passwords that have to be written down, or one really weak password? Why wouldn't a person choose one good password, and only one, and keep it?

Maybe it's because people really just don't think they're that important. It'll probably take serious problems to change people's minds (like a theft of identity, or fraudulent charges, etc...)

And while we're on the subject of passwords, can we please get rid of those "change your passwords EVERY THIRTY DAYS!" systems? God...those have probably done more to propagate the phenomenon of writing passwords down than anything else.

Re:Really?

[vidarlo]

What would be the problem with using one really strong password everywhere? Rather than many strong (or semi-strong) passwords that have to be written down, or one really weak password? Why wouldn't a person choose one good password, and only one, and keep it?

Because ONE security breach would compromise all services? Yes, that sounds right. Also a single malicious administrator could emtpy your bank accounts, take your ID, book a few flights and so?

Do you trust the admins of slashdot enough? There has been breaches in past, there will be in future.

Re:Really?

[Nugget]

If you use the same password everywhere then CmdrTaco can log in to your bank account.

Login credentials are often stored unencrypted on the server side, leaving your password open for compromise by any legitimate admin of that site or anyone who manages to hack into it.

Do you want to trust your single password that you use to all sites to the least secure of all the crappy web boards you've got an account on?

Re:Really?

[GlacierDragon]

And while we're on the subject of passwords, can we please get rid of those "change your passwords EVERY THIRTY DAYS!" systems?

Amen!

I have to try to remember a *lot* of different passwords for work. If they unified the logins on these tools, it would help tremendously. You can try to have the passwords sync up, but the reset time frames on them are all offset. I had to change my Corporate password 2 weeks ago, my windows password one week ago, and my network password on Friday. As a result, I've typed in the wrong network password first try almost every time today.

Another frustration is the 100% numeric password for voicemail. It used to change every month. I--and many others--communicate primarily with email. This translated into having to change the password every time we got a voicemail before we can listen to it. It appears that they have changed the reset time length to several months now. Probably because they were tired of resetting passwords for everyone all the time.

Re:Really?

[baadger]

If all websites started MD5'ing passwords before they were transmitted to the server then this would become completely ineffective for the attack mentioned in grandparent.

Think about it.

Makes perfect sense

[Audent]

If someone's hacking in from outside you want as good a password as possible... That's my fear, not someone sitting at my desk and logging on as me.

Peter Gutmann said the same thing: you fear the hacker, not the guy stealing your PC.

http://computerworld.co.nz/news.nsf/nl/3F25D67E479 80786CC256E6C007EE7D2

Re:I'll buy that piece of paper with some chocolat

[Fulcrum of Evil]

My password vault happens to be Firefox, though.

How do you get your passwords out?

Problem is portability

[seanscottrogers]

Writing down passwords and storing them in a secure location isn't the issue, it is portability. Most passwords these days need to go with you wherever you are, at home, the office, on travel. If your password is too complicated to remember, then it would have to be stored somewhere on your person. That's the security risk.

Secure your passwords

[kjfitz]

I've never understood the whole "don't write down your password" warning. I carry a wallet full of credit card numbers that I probably care just as much to keep private. Those numbers are "written down."

What has to be done is make sure users are educated to PROTECT their passwords. The problem comes when the password is stored on a post-it note under the keyboard.

Common sense...

BTW, I always add a stray character at the beginning of my passwords when I write them down so even if someone gets the paper I wrote them down on they won't know my password.

Re:Secure your passwords

[WasteOfAmmo]

BTW, I always add a stray character at the beginning of my passwords when I write them down so even if someone gets the paper I wrote them down on they won't know my password.

I have no idea why more people have not posted similar ideas. For years I have written down many of the numerous passwords that I have. But I also "encrypt" my passwords as I write then down. The "encryption" method can be as simple as the parent suggests or using rot1 or rot25, adding/subtracting X from each number in the password, or including "known to you" bogus letters ("I hereby state that I shall never use the letters E and R in my real passwords") and use these to seed your passwords.

There are many simple ways to "write your passwords down" without actually putting them on the paper. Use anagrams and pass phrases. Write the answers down where the passwords are the questions or the reverse.

Be creative. Chances are if someone finds your magic list and thinks "Hey, these are his/her passwords! I 0wn3 them!" that once they try 1 or 2 of them as written and they fail they will discard the list as being old or garbage.

Merlin.

Re:Secure your passwords

[tsotha]

Be creative. Chances are if someone finds your magic list and thinks "Hey, these are his/her passwords! I 0wn3 them!" that once they try 1 or 2 of them as written and they fail they will discard the list as being old or garbage.

Agreed. Sure, some crypto whiz will cut through that clutter in a day or two, but that's probably not the guy who'll lift your wallet at a ball game.

One thing I wish security systems had was some kind of "tripwire" password, i.e. the account is locked if anyone ever tries it. That way you could put the tripwire at the top of the list so if it ever did get stolen the theif would lock himself out permanently before you ever knew your wallet was gone.

So, I'm probably not typical, but...

[IANAAC]

I use a password app on my PDA (a Zaurus), but most people have cell phones. There must be a little java applet around that does the same thing. If not, there's a great opportunity there, I would think.

Re:So, I'm probably not typical, but...

[Concerned Onlooker]

Web Confidential on my Treo600 works great. It also has a desktop counterpart. (Don't forget your daily backups). That way you can have a strong and different password for everything if you like. You only need to memorize one strong password for opening the Web Confidential file and all your passwords are always with you. Easy, easy, easy.

Re:So, I'm probably not typical, but...

[kwalker]

I just got one for my cell phone called MobileSafe. It was $6 from Handango and downloaded directly to my phone. That way I always have my account numbers, CC numbers, login info, and general notes encrypted with 168-bit 3DES (IIRC) on my phone protected by my master password. It's already saved my bacon more than once.

The only down-side is that I can't sync it with anything at home, but I generally don't have to update it very often, so when I do, I also write down the passwords in an encrypted text file on my home machine.

True story

[HaeMaker]

I'm a SysAdmin and at one place I worked, I noticed someone had written 'aaaaa' on their monitor. They wern't at their desk at the time, so I sat down, hit ctrl-alt-del and typed 'aaaaa' into the password field...

Re:True story

[sconeu]

I refuse to play your chinese food mindgames!

Re:True story

[gregfortune]

Heh, I've got a password on a post it note attached to my monitor. It's something like P43F^ss2Bn. I always wonder how many times people try it.

Exactly right. . .

[Sialagogue]

This is the exact reason that I write all my passwords on post-it notes and stick them to my monitor.

I have a 21-inch tube monitor and it weighs like 80 pounds, so nobody could even get it out the door much less steal it, so my passwords are going nowhere.

Re:So Pen&Paper's the new replacement for Pass

[coop0030]

Maybe it's the new trend.

Maybe pen&paper AD&D will be cool again!

Re:Passwords suck: simple solution:

[bmongar]

Though they can't steal your fingerprint they can steal your fingerprint metric. It all becomes bits at some point and if they have those bits they can buypass having your finger.

Re:So Pen&Paper's the new replacement for Pass

[DaltonRS]

And of course, they(M$) will introduce the following security initiative when pen and paper security protocols show evidence of security lapses. White-Out.

Re:Passwords suck: simple solution:

[cmburns69]

The problem with this suggestion is that if your fingerprint (or some other bio-metric info) is stolen or duplicated, you can't change it. How would you like a genius hacker to have permanent access to all of your data for life?

With a password, at least you can change it if it is compromised.

Authentication methods can all be broken down into the following categories:
1) Something you know (such as a password).
2) Something you have (such as a keycard).
3) Something you are (such as a fingerprint).

High security requires 2 or 3 of these things. However, most things are good enough with only 1 of the three..

Password Safe is the answer

[windowpain]

It's by crypto genius Bruce Schneier, it uses Blowfish, it's open source and if you want that extra measure of security you can compile it yourself. It's for Windows but there are Unix/Linux versions too.

Password Safe

Re:Password Safe is the answer

[RayMarron]

CrypBox is really handy if you have a Palm device - you can carry your password database with you AND have access to it on the desktop.

Re:Password Safe is the answer

[eddeye]

It's by crypto genius Bruce Schneier, it uses Blowfish

A few things to keep in mind:

• Schneier handed this project off to others several years ago. His involvement since appears to be minimal. While he wrote the initial version, that code may have long since been sent to the bitbucket in the sky.
• Schneier's crypto credentials are well established, but how is his programming knowledge, especially in regards to security? I don't know of any large open projects he's worked on that give us an indication of this.
• AES and 3-DES are more reliable than Blowfish, having received orders of magnitude more attention from cryptanalysts. Besides which, "uses Blowfish" is a long way from "uses Blowfish correctly with proper handling of the key material and plaintext at every point in its lifecycle".

Bruce is a cool guy, and Password Safe may be great, but I wouldn't trust it soley on his reputation.

Re:Password Safe is the answer

[ronys]

Actually, PasswordSafe is actively maintained on SourceForge: http://passwordsafe.sourceforge.net/

You don't need to trust Schneier's rep, as the sources are available...

As to the Crypto, AES is currently much less reviewed than Blowfish, as it'smuch newer and 3DES, while reliable, is relatively SLOW...

Note: I'm the current project admin.

Re:I'll buy that piece of paper with some chocolat

[nacturation]

Of course, there's Scheier's Password Safe, which is now a SourceForge project. See: http://www.schneier.com/passsafe.html. Works for me... I carry the encrypted file around on USB flash and who cares if I lose it... barring quantum computers, nobody's going to be breaking it within my lifetime.

Re:Passwords suck: simple solution:

[xAXISx]

You misspelled right wing scare tactic.

Re:So Pen&Paper's the new replacement for Pass

[irm]

I've always written down my passwords. You just have make sure to keep them on the top of the Mountain of Despair, beyond the River of Doom. Total security!

My Solution

[3ryon]

I use a small PINS database stored on a USB flash drive on my keychain. Instead of launching the application when I need a password I launch a batch file that detects if the drive is plugged in, if so it copies the password file to my profile and launches it (if I'm using either my home or work computer). If the drive isn't plugged in it uses the local copy. If I make an update it copies it back to the USB drive.

The master copy is on my keyring, but my home and work computers have copies. I've been doing this for a year and I highly recommend the solution. I can now use random passwords.

Everything you ever wanted to know about passwords

[John Seminal]

#1) The hackers have huge dictionaries that can crack just about any word, in any language, and with any added numbers, like compaq002 or 01compaq01. Second, they have custom dictionaries that can take 2 or 3 words and put them together in logical ways (like people think). These are all easily cracked. Picking a password by splitting the words of items on your desk and adding them back together is not smart. Comp05HP is not a good password.

#2) The best passwords are illogical. Something like k8iWq3xy. Mixing in letters in and numbers, not based on any words, is a good start. If your program recognizes upper and lower case, mixing that can help too.

#3) The best, very best log in tool for security I saw was a small clock a friend was given from his company. It had some funky algorithm on it, and it displayed a 14 alphanumeric code. When my friend logged in, he had to enter this code, which changed ever 1 minute. This was in addition to his username and password.

#4) People will sniff your network. Nothing is bulletproof. Finding passwords sent is easy. If it comes as clear text, you are screwed off the bat. This defeats #1 and #2, but not #3, because #3 is based on an algorithm that changes every 1 minute.

#5) Set up a policy that only allows 2 attempts to log in, and after 2 failed attempts, it locks out that IP and MAC address for 30 minutes. This will be a major pain when you try and log in and make a mistake. It won't really stop hackers, just the ones with slow/bad proxies. Maybe 1 of the 500 proxies the hacker is using is not as anonyomous as they believe. As for your own use, take a book with you when you believe you might have to log in remotley, just in case you make a mistake. You need something to blow those 20 minutes.

#6) Never, ever log in root from a remote location. Have a crippled account to log into from remote locations. Expect this account to get cracked. Limit the damage. If you must, have 2 computer systems at home. One secured off line, and the other on line. Hell, toss in a third computer connected to the web based on via a serial cable and dump all the logging on that computer. The hacker/cracker can't edit the logging files on that second PC.

#7) When using a computer, always assume the key strokes are being logged. When you get home, change your password for that account.

#8) After you have done all these things, you will still get hacked. Call the FBI. Call your congressman. Lets bomb another country to releave our collective mutual stress.

Re:Passwords are useless.

[loqi]

Let's see... assuming lower- and upper-case letters and numbers are the only allowed components of a password, even a machine capable of one trillion password checks per second would take about 22,337,120,292,586,187,942 years to run through all the possible twenty-character passwords.

So yes, your statement is true, but the brute-force computer you're theorizing doesn't exist, and probably won't for a long, long time.

Not as portable as paper

[winkydink]

Anything that requires me to have access to a specific type of hardware (PDA) or a specific operating system isn't going to be a lot of help if you're on the road without your gear or your gear gets stolen and you need access now.

Just do something trivial like rot-5 the 5th character of each password if you're concerned about somebody getting access. That would discourage most people from trying.

Re:Passwords suck: simple solution:

[Mr. Slippery]

start using fingerprint scans, the only way someone can steal your finger print is by lifting it from something you've touched

Which is quite easy.

But you don't even need to do that - some scanners can be fooled into accepting the latent print you leave on it. D'oh!

An authentication token that when used leaves behind all the information you need to construct a conterfeit - this is not something I want to rely on.

Biometrics is a fundamentally flawed scheme. A biometric is just a token that you can't replace (a scar on your finger? too bad), repudiate if stolen (I can lift your prints but you can't change them without pain), or use to separate priviledges (difficult to use a different thumbprint at the bank, at the library, and to open your car, unless you have interesting anatomy).

As for passwords, yeah, I've gotten to the point of having to write them down. I used to use only a few passwords - my login and root password, one common for low security sites, one shared one for a few sites I cared more about, and my on-line banking. But as sites put various non-sensical restrictions on password selection ("your password must contain two digits", "your password must not use any non-alphanumeric characters", etcetera), I've had to start writing them down.

"Something you are" reduces to "something you have". "Something you know", as you have to remember more and more things to deal with dozens of systems, reduces to "something you have" (that piece of paper with all the password written on it). It's all about the authentication tokens.

No!

[RoverDaddy]

Why put the list in cyberspace at all? That's the beauty of paper, nobody online can steal a sheet of paper sitting in your home/office/dorm/loft/cave.

Re:No!

[FirstTimeCaller]

Why put the list in cyberspace at all? That's the beauty of paper, nobody online can steal a sheet of paper sitting in your home/office/dorm/loft/cave.

But I thought you said not to put it on your machine at all!?!?! So what the heck is it doing under your home directory? :-)

I can just see this...

[Em Ellel]

For example, I'm only reading Slashdot from this particular computer, and I'm using a IBM E94 monitor, and there is this Sellotape dispenser on my desk with 1531 written on it. So my Slashdot password can be easily remembered as IBM!1531@E94#, or simply ibm1531e94 for those systems that cannot accept special characters.

I can just see the following request to helpdesk:

Please reset my password as someone borrowed my Sellotape dispenser and I can no longer log in.

-Em

What an insightful article!

[craXORjack]

I sure hope that Microsoft gets a patent on this new business process of password management because that will encourage them to continue innovating.

...Oh, sorry. I thought we were still doing the sarcasm thing.

Steganography

[CustomDesigned]

When I write down passwords, I use some form of steganography. For example, one of my earlier systems was to add a fictictious address to my address book, with the password encoded within the address using a mnemonic mapping scheme.

I'll share a commonly used mnemonic mapping for numbers. It maps consonants to digits:

0 - 's', 'z' (think 'zero' and hissing like snakes)
1 - 't', 'd' (1 looks kind of like t)
2 - 'n' (n has two legs)
3 - 'm' (m has three legs)
4 - 'r' (four ends with r)
5 - 'l' (L is latin for fifty)
6 - 'j', 'g' (soft g, like upside down 6)
7 - 'k', 'g' (hard g, k and 7 have diagonals)
8 - 'f', 'ph' (cursive f like 8)
9 - 'p', 'b'

Hard c goes with k, soft c with s, etc. So say you wanted to remember your bike combination of (rolls random number with python...) 3254. You construct a phrase with any vowels and spacing desired with the consonants m,n,l,r. For instance, "mine lore" comes to my mind, and I envision Tolkein dwarves chatting up their favorite topic. If needed, you would then write a paragraph about dwarves and mine lore in Lord of the Rings in your notebook.

Almost, but not quite--here's what I do.

[istartedi]

I stego my passwords on a small card that I keep with me. Someone can get the card and they don't know what the password is for, and even if they did, they don't know what's the password and what's just a "junk character".

Nonsense

[Roadkills-R-Us]

There are plenty of ways to do this. For instance, you can keep the passwords on (picked at random) page 57 of a red notebook that stays locked in your drawer when you're not around, and is only out of the drawer when it's in use. You can leave clues to yourself what they mean.

For instance:

mama: no dates

The actual password, not written down, is "n0datez!" The machine this is for is the largest system you work on (big mama).

If using random strings, try to make it look like serial numbers; again the place or account to use this for should be hinted at (to you), not stated.

There are many, many ways to do this and be very secure. I once left a set of passwords and hints out in plain sight on purpose, just to see if anyone would recognize and try to crack them. They were never cracked, and I'm reasonably certain nobody even tried. They had no idea what they were seeing.

Re:Everything you ever wanted to know about passwo

[Draoi]

#6a) If you really must, must log in remotely (as root or anyone else, you must always use SSH - no exceptions! Always assume you're network is being sniffed. See (2) above.

Re:So Pen&Paper's the new replacement for Pass

[PakProtector]

I should expect that kind of talk coming from a young, low uid person like yourself. You kids don't know how good you have it these days. Fancy computer graphics and a machine to keep track of details for you, letting you have your 'action' in 'real time.' Back in my day, we had cardboard cutouts, if we were lucky! Most of us used hand made lead figures that we had to paint by hand! And it could take hours just to do one massive battle because we had to do everything ourselves! In the snow! In our parent's basements! Pssh. You young people these days. I don't want your opinion until your UID is in the lower 50% of the population. PSssh. Kids. Think they know everything. In my day, we were lucky if we knew nothing! You were lucky just to not be a negative container of knowledge, sucking it out of other people until everyone knew nothing. Pssh. Kids.

Re:Don't treat it like cash

[Amoeba]

So if Jackson is on the $20 bill, what do 5 Jacksons make?

The world's most dysfunctional family?

Re:Everything you ever wanted to know about passwo

[Anonymous Coward]

Wow, that's got to be one of the most random collections of stupid/excessive/ineffective advice that I've ever seen rated +5.

Just to pick one example, #7 (assume keyloggers, change your password when you get home): what if your home computer has a keylogger on it? Uh, oh, better go to Starbucks and change your password from their network. Wait a minute, somebody might packet-sniffing it. Oh, no, there's no way out, we're doomed!

Your paranoia is way overblown anyway. I've been an active network/web user for 20 years, and nobody's ever stolen one of my passwords or hijacked an account of mine. People have broken into my house and car and stolen stuff, though.

Re:The worst Slashdot password

[kakos]

Most systems don't allow empty passwords.

Re:this guy is thier chief advisor?

[wk633]

It's impossible to FORCE good passwords.

1) P4$$w0rd is a really bad password.
2) The same password for your bank and for warezRus.com is a bad idea.

Forcing people to change their passwords all the time encourages bad passwords and passwords on stickys.

Regular password changes are:
a) because you think someone is brue forcing them (so fix that problem, changing the password part way through the brute force sequence doesn't buy you anything.
b) because you think it has been compromised (if it has, it's too late).

Not likely.

[Evanisincontrol]

Maybe it's just me, but it seems that the liklihood of someone cracking that method is very unlikely.

As you said, physical access is required. (which makes things MUCH more difficult) However, even if physical access WASN'T required, I don't think some hacker would suddenly say to himself, "AH HA! I bet this user is combining the serial number of his roller-chair and product number of his processor to create his password! Let me just try these numbers..."

There is a VERY large combination of passwords available from product/serial/model numbers on various items that reside in a typical office. Even if a hacker somehow broke into Joe Blow's apartment and spent twenty minutes writing down all of Joe's stapler model numbers, he likely wouldn't get them all, and definitely wouldn't need to run a program (remotely) to try all the possible combinations. (Especially given that the password might consist of half a dozen different product numbers!)

All in all, the odds of someone breaking this password aren't likely. If someone was determined enough to go through all afore-mentioned garbage at all, whatever he's getting at must be pretty valuable... and would probably be better protected than just by an arbitrary password.

Re:Passwords suck: simple solution:

[quelrat]

I think that a fingerprint counts more as "2) Something you have."

Security risks of biometrics.

Liar.

[apparently]

So my Slashdot password can be easily remembered as IBM!1531@E94# Tried that, and got: "Danger, Will Robinson! You didn't log in! You apparently put in the wrong password, or the wrong nickname. Either try again, or have your password mailed to you if you forgot your password." Please advise.

Don't misunderestimate people ;-)

[Venner]

Why put the list in cyberspace at all? That's the beauty of paper, nobody online can steal a sheet of paper sitting in your home/office/dorm/loft/cave.

Not necessarily :) I used to know someone who had a webcam in their office. It was one of those geeky "things to do" at the time. He had controls to pan & zoom, control the a small light, etc, on his website.

One day, I zoomed in on a piece of paper on the corner of his desk. Some rotation & sharpening in photoshop* revealed an IP and the word "gizzards8524". I telnetted** to the IP, tried his usual nickname and that word as the password and bingo - I was in.

He was quite startled when a he got a console chat invitation from...himself. :)

*as opposed to hollywood's ideas of image restoration that boggle the mind and break the laws of physics.

**ssh wasn't popular yet.

Re:STEGNAOGRAPHY is the answer

[mrchaotica]

I've got a system better than a biometric USB key: I use an app called "Keyring" on my Palm, and store my passwords in that.

PasswordSafe

[ronys]

Actually, Bruce Schneier wrote exactly such an application, and put in on SourceForge a while ago, where it is now currently maintained:
PasswordSafe

Note: I'm the project's current admin.

Re:I'll buy that piece of paper with some chocolat

[Autobahn]

barring quantum computers, nobody's going to be breaking it within my lifetime.

Or research breakthroughs - nobody has yet proved that one-way functions exist, and it's entirely possible that some genius could figure out a fast factoring algorithm tomorrow and make your crypto worthless. Not likely, but a possibility worth considering.

How I write my passwords down:

[stfvon007]

I write down my passwords, but I do it in an encrypted form. Using a pattern I know, I will write down the password in a scambled form, and insert other letters as well. Anyone looking at the written password would only be able to narrow down the password to about 60 trillion possible combinations. With me however knowing the pattern to look for, and im be able to enter it easily.