Tap, tap, tap, pause... “hmph”. Tap, tap, tap, pause... "grmph". [Ten minutes pass.] Tap, tap, tap, pause... “Hellfire.” Tap, tap, tap, pause... “Crap.” [Ten more minutes.] Tap, tap, tap, pause... “<multiple expletives deleted>.” Tap, tap, tap, pause... loud splat sound as the yellow-stickies pad impacts the far office wall. The cats, sensing trouble, have left the room. Is this the sound of: Trying to book a flight to somewhere attractive using points? Multi-threaded software being debugged? An attempt to write WSDL by hand? Solving a really nasty Myst-series puzzle? None of the above. Those sounds would be me trying to pick a new Sun LDAP password that meets the incredibly-stiff requirements of our new (SarbOx-driven, they say) security policy. The dictionary they check includes variant spellings of the names of little towns in the Lebanese mountains! I asked Lauren: “How am I going to remember this?” She said: “Go pick up that that yellow-stickies pad you threw across the room, write it down on one, and put it somewhere safe. Bruce Schneier says that’s OK.” While I generally approve of forcing people to avoid easily-stolen passwords, I do worry a little that these hard-to-guess things can also be hard to type, and perhaps thus vulnerable to prying eyes. But anyhow, if you were thinking of writing a program to guess anyone’s password here at Sun, well forget about it. [Update: I got a bunch of suggestions on how to deal with this, some of them good.]
Key Patterns · Dave Shea writes:
I’ve taken to using key patterns instead of memorable characters for my passwords, and it really works. Simple example:
se4dr5ft6
Check out the keys used to type that. Through in a Shift modifier every second or third letter, and you've got something:
sE4Dr%fT6
Plausible, but it strikes me that if I were a bad guy, it wouldn’t be that hard to write code to try that approach to password-guessing.
Jacek Kopecky writes “you wrote about secure passwords not only being hard to remember, but also hard to type. when creating a password I choose random keys that *are* easy to write - alternating the fingers and trying it out.”
Passphrases · John Hart and Rudi Gens write with what I think is the right answer: passphrases. I have all the ssh-agent machinery in place so that I can log into, and copy data between, all the different systems I use, without ever typing a password. But the first time I log in, I have to type a really long passphrase which nobody will ever guess; it’s a line of poetry I wrote while an angst-ridden teenager.
Of course, this doesn’t work if your security setup, like some I could name, stupidly forces you to use short passwords. In which case, you could do as Henry Albert Sebastopol Queen Victoria Crun suggests, and “generate an obscure password and save it in an encrypted text file using a passphrase... gpg is pretty handy for that.”
Bill de hÓra writes to point at Diceware, which generates passphrases for you.
And Ben Hutchings points to pwgen(1); hmm, it’s not there on
OS X.
C++?!?! ·
Steve Loughran suggests using “a
C++ function call from the past”: ::Point(hDC,0,0);.
Steve, you’re a sick, twisted individual. But you know, it might work.
I’d actually use perl, it has more special characters anyhow.
That Old Sweet Song · Dave Megginson has another really good idea: “To generate passwords that won't appear in a dictionary, pick a line from a song or poem you know well and make a password out of the first letter of every word.” If you use “/” for line breaks and put in a comma or two, this ought to get past the most paranoid password-quality software.
