Devise Your Own Passwords

I started to use a password manager about 3 years ago..... and I don't know how I could have done with out it.

because at the time I used the same password or slightly variant of. And when my email was jacked, that ramped up my security.

And now I'm nearing 100 items that need PW protection, all PW different. to varing degrees.

You were the victim of PW theft? Ugh. That does rather encourage one to take PW protection seriously.

I'm married to an IT guy -- he was IT director for a state agency until a few years ago -- and HE certainly takes security seriously. Probably time I asked him what he uses to create passwords and to store them safely.

I was on vacation, had my smart phone on me, and suddenly I started to get emails and sending from all over. I contacted Yahoo. which informed me that it all originated from Romania.

I felt violated...... and this prompted me to put every thing to the next level.

That was the comic that inspired the password system I described in the other thread.

(Crosslink for those who may not be watching both threads: http://cr4.globalspec.com/comment/1121029/Re-Buying-Secure-Passwords)

I start my passwords with the same 9. A mix of characters when ran thru one of the these password strength apps it comes up very strong. And remmember them. Then each time I need a password I use them and add to it. Just taking notation on what I added to it and whom or what for. If some one finds the notes on passwords all they have is the last characters. The rest is in my head.

That may not be as cleverly original, I had worked with a guy back in the 80's that did it similarly, only instead of a prefix, he did it as a suffix...

What compounded his error, is that he bragged about it....

He was gone one day,.... and had to get into his computer..... I was able to get in with in (3) try's, (I was allowed 5 before it locked your out)

You knew the suffix or knew the guy well enough to guess the suffix. Back in the 80's people used proper names or phrases. Many of which were short and uncomplicated.

I knew the guy well enough and took a shot at it.....

He mentioned what he does with his password with the suffix.

He loved bear hunting and talked about it quite a bit.... So I took a stab at it.... Considering we had to update our passwords every (3) months,

I did (2) things, first I started with how long (Months) we had it implemented it, and divided it by 4, this gave me an approximate basis.

So I typed in "bear14", nothing "bear15", nothing, "bear16" I'm in.

When he returned, I informed him we needed to get on his computer (because he didn't follow procedures and back-up his files and deleted them on his computer) and to change his password, because it only took me three try's to access his computer.

So he changed it, to "bear17".

Ended up that a meeting was called, because I figured pretty close to what passwords the people used, which amounted to referencing cars, hobbies or girlfriends..., depending on where they put their priority in.

btw, this was the late 80's.

Big difference between using a word that means something to you and 9 random characters.

I saw a good tip on our company intranet about setting up answers to security questions that are often associated with secure accounts. Instead of answering with an actual name of your favorite pet or mother's maiden name, use a mix of numbers, special characters and letters in your response as if you were entering a password.

So using 'tcmtech123' as a password for everything I have is not good?

Cripes that's gonna make remembering things a lot harder.

Sharia law has its valid applications. A few chopped hands, well publicized, could put a stop to most cybercrime.

How do you chop off a cyber-bot's hands? Does it even have hands?

'Following the money' does not help unless all you're interested in is the low-level schlubs at the base of the money-laundering step. (Not all of them even know they're part of a money laundering scheme, they may have just answered one of those 'process checks and work from home' ads.)

And the chopped hand thing only really works if an amputee is immediately considered to be a thief who got caught. It's not just the loss of the hand, under Sharia law, the loss is also a 'branding for life,' which means that someone who loses a hand on the battlefield is treated like a common criminal when they get home to the caliphate, and a child with a birth defect has the stigma of being a 'thief' before he can even walk. (Assuming the child isn't simply left in the desert to be 'returned to God.'

Picking and choosing which laws to enforce when leads to a nation not under Rule of Law, but under Heel of Tyrants. You like a body of law, you should live under ALL of it, not just the parts that benefit you. You only like part of a body of law, then use whatever means the society has set up to change and amend the laws until they all work. It's not an easy job, but keeping a society together, whether it be a knitting club, a city, or a nation, never is.

Passwords? Don't use them. Use a phrase.

Fundamentally, you have to as what you're protecting against. Overwhelmingly that's not an individual trying to guess your password from their knowledge of you but organised crime in many forms using password tables or cracked stolen hashes. What you want is something, as Drew K above observes, that is easy for us to remember but very hard for computers to guess.

This sort of thing:

My birthday isn't the 26^th September.

Honestly? >210Lbs, no kidding.

I /hate/ the Armadillo Sunshine band….

Yvonne makes me smile :-) see?

Boo! HaHaHa!…. Just kidding grandma xx

<sigh> 6:15, Monday & already 75% knackered :-(

The other observation is that using longish, memorable passphrases gives you a good idea of the security of the end system. The 46 character one may be a tad long for most of us but if a system won't let you do more than 12 characters, or won't let you use spaces or ampersands then it tells you one of two things: they haven't read a paper on IT security in the last 20 years; or their software is too old to cope. Either way, you can't trust that company to look after your data.

None of which deals with the proliferation of passwords issue but personally I don't use companies that insist that you set up an account online to do business with them. It just spreads the risk. If you do have to use one I use a one-hit password that I don't care about forgetting & also make sure the account is deleted.

I use a different password for each site. Strong ones (I hope) for important sites, simple ones for incidental sites. So it is not only remembering passwords, but also which one is used. There are dozens of them. It is impossible for me to remember them all so I have to keep a list of them in a document file with a password to open it.

My basic security is a simple 'boot' password to get into the computer, then another one to get into Windows.

Right or wrong I rely on my Windows password programme to recall passwords automatically when I go to the site.

This sounds risky, but no-one has access to my computer except me.

Am I unwittingly exposed to a serious risk - and if so - how am I at fault and what steps should I take to protect myself?

A boy name T. Tao is working on these for the rest of his lifetime.

I have ever forgotten windows password, too. and finally this Windows password recovery tool helped me. you can take a try with it to reset Windows Password. wish you good luck.

Read more:

How to recover Windows 8.1 password