. . . or you could read xkcd

Story: Checking Password Complexity with John the RipperTotal Replies: 17
Author Content
lcafiero

Aug 24, 2011
2:30 PM EDT
http://xkcd.com/936/

. . . and cut out the John the Ripper middleman.
dinotrac

Aug 24, 2011
3:25 PM EDT
@icafiero --

Not only that, but we make them change often enough that people write them down.

Cool.
patrokov

Aug 24, 2011
9:55 PM EDT
dinotrac,

I understand needing to change your password often if you're always logging in from public places, where someone could see/video you typing it in. And I can see needing to change your password if your account has undergone a large number of failed attempts in a relatively short time.

The stupid rules that many businesses implement, "You must change your password every 30 days AND you cannot reuse the same password within 14 times.." simply drive us to write down our passwords as you suggest. I hate these security "theater" nazis.
dinotrac

Aug 24, 2011
10:16 PM EDT
@patrokov -

Yup.
tuxchick

Aug 24, 2011
10:38 PM EDT
I always write down my passwords. Duh. How else can normal people without photographic memories keep track of their logins? Dumbest advice of all time is "Don't write down your passwords." Bruce Schneier says write down your passwords. http://www.schneier.com/blog/archives/2005/06/write_down_you...
mbaehrlxer

Aug 24, 2011
11:56 PM EDT
the nice thing about the xkcd suggestion is that you can pick a password like:
Linus Torvalds wrote:My name is Linus Torvalds, and i pronounce Linux as "leenuuks".
with punctuation and all, it's not only easy to remember and hard to crack but also save to write down because no one will guess that this is meant to be a password.

if someone sees that piece of paper you can say: oh, that's just some of my favorite quotes.

greetings, eMBee.
lcafiero

Aug 25, 2011
4:58 PM EDT
patrokov -

At the newspaper for which I work, I have to change my work e-mail password every month. Every month this causes me to ask the IT person to reset my e-mail password because I never remember it. Why? Because I'm not allowed to write it down. They get huffy when I ask them to reset it, and I always respond that if I could write it down, we wouldn't be having these problems. Security theater nazis indeed.
mbaehrlxer

Aug 25, 2011
10:36 PM EDT
have you tried alternating between two passwords? most systems can only compare your new password to the last one previously used because that's what you type in first before you change it. so they can easily be fooled by changing back the previous password on the next change.

of course there are those draconian systems that remember your last 5 or 10 passwords, if you got one of those you are stuck.

does the system compare similarities much? put a number in the password and increment it on each change or even combine the two: password1, alternate2, password3, alternate4...

if that is not enough, try adding month names in an obscure language, the zodiac or even chinese years animals, periodic table or anything else you can look up to remind you.

greetings, eMBee.
lcafiero

Aug 25, 2011
10:49 PM EDT
I'm going to use CorrectHorseBatteryStaple from now on.
helios

Aug 26, 2011
2:03 PM EDT
Or....

ourITpoliciesarewrittenbytehterminallymoronic
jdixon

Aug 26, 2011
2:44 PM EDT
Damn, another stupid password. This one's for xyz.

Of course, that doesn't work if they require a number, but it could be easily modified.
patrokov

Aug 28, 2011
1:08 PM EDT
@mbaehrlxer,

Unfortunately, my university's system remember the last 14 passwords you've used. And it won't accept consecutively numbered passwords. Luckily, I've found a few workarounds. You can safely prepend numbers, ie. 11password, 22password, etc. Or you can increment a number in the middle of the password. Of course I hate it when I get locked out of my account BECAUSE I enter my old password three times.

To make things even more ridiculous, they make us change our voicemail passwords every year, and in 8 years, it hasn't ever let me repeat a password. Really. Who's hacking into our voicemail system?
lcafiero

Aug 28, 2011
1:17 PM EDT
patrokov wrote:To make things even more ridiculous, they make us change our voicemail passwords every year, and in 8 years, it hasn't ever let me repeat a password. Really. Who's hacking into our voicemail system?


News of the World? Rupert Murdoch? :-)

/me has been waiting for a long time to make this observation. Thanks, patrokov.
patrokov

Aug 28, 2011
3:10 PM EDT
And what's Mr. Murdoch doing once he's hacked in? Deleting all our old voicemail that no one knows how to purge? Resetting our greetings to, "All your bases are belong to us. If you are a zerg, please press 1; Space Marines press 2..."
lcafiero

Aug 28, 2011
3:13 PM EDT
Your guess is as good as mine, patrokov.
jdixon

Aug 28, 2011
3:18 PM EDT
> To make things even more ridiculous, they make us change our voicemail passwords every year,

The company I work for is rolling out a system which will require us to change our voice mail password every month. :(
mbaehrlxer

Aug 28, 2011
9:53 PM EDT
request that voicemails be forwarded to your email with an mp3 attachment, asterisk can do that! or just stop using voicemail alltogether.

greetings, eMBee.
jdixon

Aug 29, 2011
6:47 AM EDT
> request that voicemails be forwarded to your email with an mp3 attachment,

They'll be doing that too. But as a wav file. Disk space apparently isn't high on their priority list. And not using voice mail isn't an option for my job.

Posting in this forum is limited to members of the group: [ForumMods, SITEADMINS, MEMBERS.]

Becoming a member of LXer is easy and free. Join Us!