8 Tips for Choosing A Secure and Strong Passwords | Pwgen CLI Tool

i think xkcd has a better idea for strong passwords: http://xkcd.com/936/

greetings, eMBee.

I love that particular cartoon.

There is one good piece of advice in the piece:

Long passwords.

I like using whole sentences. Make life hard for attackers, easy for the poor folks who have to remember.

All that other stuff is helpful -- numbers, symbols, etc, but.... ultimately, easy for people and hard for computers beats everything else.

I'll add one thing to Dino's advice: tabling.

For critical servers, I use a sentence or slogan which is humorously reminiscent of the hostname (and, considering my humor, this means it usually means absolutely nothing to anyone else). After CamelCasing the word-edges and imposing case-variation and h@xx0r!ng, I set up the result in rows...

NowIs TheTi meFor AllGo

..and read it out in columns.

NTmA ohel weel IToG siro

The result is not something that can be memorized, but it can be regenerated. Typically, this password is used for a connection which will move to key-based auth, so the password being cumbersome matters less. The original cleartext can be jotted down somewhere, maybe along with conversion hints (table geometry and caps-period) but it's not gonna be figured out, not even by somebody who's read this post.

Long passwords don't work, for one simple reason: most websites don't allow you to use passwords greater than a certain number of characters (frequently 12). They also require you to use symbols, numbers, etc., and of course the rules are different for every single website. The only solution is to keep all your passwords written on a piece of paper or saved in a text file, because there's no way in heck that anyone can remember ~50-100 different passwords. The password situation these days is a giant mess.

> The only solution is to keep all your passwords written on a piece of paper or saved in a text file, because there's no way in heck that anyone can remember ~50-100 different passwords.

KeePassX or any of a number of other password handlers. You remember one password, they store the rest for you in an encrypted database.

KDEWallet has worked for me for 10+ years, over various desktop Environments.

KDEwallet has never worked for me, mainly because it only works with KDE apps. Konqueror hasn't been a viable web browser in ages.

Moreover, the bigger problem is that these solutions only work if you only use one computer. If you have several like me, it all falls apart.

> Moreover, the bigger problem is that these solutions only work if you only use one computer. If you have several like me, it all falls apart.

Carry the encrypted database on a USB drive.

@Khamul, ever heard of copy and paste. I've always used it that way, I've never used the integration, it makes you too dependent on a particular way of doing things