{"id":42,"date":"2014-04-11T04:18:41","date_gmt":"2014-04-11T04:18:41","guid":{"rendered":"http:\/\/jonoforbes.com\/blog\/?p=42"},"modified":"2014-04-11T04:18:41","modified_gmt":"2014-04-11T04:18:41","slug":"write-really-good-passwords-avoid-the-collective-security-freakout","status":"publish","type":"post","link":"https:\/\/jonoforbes.com\/blog\/write-really-good-passwords-avoid-the-collective-security-freakout\/","title":{"rendered":"Write really good passwords; avoid the collective security freakout"},"content":{"rendered":"

With the Internet collectively freaking out about the Heartbleed bug<\/a>\u00a0(a major Internet-wide security hole that could mean various passwords (and other information) have been nabbed off of “secure” servers)\u00a0this week, I though I’d share a password system I use to have a unique password per site \/ account that I can easily remember:<\/p>\n

    \n
  1. Pick a base.<\/strong> \u00a0This is what most people think of as their one password to use for everything. \u00a0Say mine’s “dogemanguy”.<\/li>\n
  2. Make it better.<\/strong> \u00a0You should include numbers, symbols, and upper case letters in your password, and not use dictionary words. \u00a0So my “dogemanguy” password can become “D0g3M4nG0i!!” (those 0’s are zero’s, not an upper-case o’s). \u00a0This password should pretty much max out any “how good’s your password?” test.<\/li>\n
  3. The important part — mix it up per site.<\/strong> \u00a0So here’s the trick I’m talking about, and why I’m personally not worried about the Heartbleed bug. \u00a0Take the name of the site you’re creating the password for, and intersperse the letters of that name into your base from step 2. \u00a0So if my step 2 base is “D0g3M4nGoi!!” and I’m making a password for “Facebook”, I would take the first letter of each, then the second letter of each, and so on, and get “DF0agc3eMb4onoGkoi!!” \u00a0Again, that’s comprised of every other letter of each, like so:\u00a0“D<\/strong>F0<\/strong>ag<\/strong>c3<\/strong>eM<\/strong>b4<\/strong>on<\/strong>oG<\/strong>k0i!!<\/strong>” and\u00a0“DF<\/strong>0a<\/strong>gc<\/strong>3e<\/strong>Mb<\/strong>4o<\/strong>no<\/strong>Gk<\/strong>0i!!”<\/li>\n
  4. One step further: Don’t literally use the site name.<\/strong>\u00a0 The big shortcoming of step 3 is that,\u00a0if someone gets your (for example) Facebook password and notices the phrase “Facebook” sprawled throughout it, they could figure out the system and guess that you might have “Gmail” sprawled through that service’s password (especially if this method becomes more common). \u00a0One solution here is to have a system where you keep a list of matches, like “Facebook -> Mom’s maiden name,” and then you use that matched term as the phrase you’re interspersing into your base password, rather than literally “Facebook” (or whichever site name). \u00a0The big important note if you’re going to keep a master list somewhere is to\u00a0never ever write down your passwords ever, or even parts of them.<\/strong>\u00a0 The point of this whole system is that your brain is the cipher and only you should be able to untangle the mess of your new passwords. \u00a0That’s why I write “Mom’s maiden name” rather than (for example) “TheAwesome”. \u00a0So if I forgot my Facebook password, I would look at my matches list, see that Facebook is matched with mom’s maiden name, know in my brain that it’s “TheAwesome”, and end up with the final, ridiculous, and ridiculously secure password “DT0hgeeAMw4ensGo0mie!!<\/strong>” (“D<\/strong>T0<\/strong>hg<\/strong>ee<\/strong>AM<\/strong>w4<\/strong>en<\/strong>sG<\/strong>o0<\/strong>mi<\/strong>e!!<\/strong>” + “DT<\/strong>0h<\/strong>ge<\/strong>eA<\/strong>Mw<\/strong>4e<\/strong>ns<\/strong>Go<\/strong>0m<\/strong>ie<\/strong>!!”<\/li>\n<\/ol>\n

    You end up with a password that you can “easily” remember or reconstruct using these rules, looks like total gibberish, is likely completely unique in this website’s passwords database (protecting you from hacker methods like using a Rainbow Table<\/a> to reverse-engineer your password if it’s based on common words), and moreover is completely unique in your password repertoire, so if somebody gets your Facebook password, they only<\/em> have your Facebook password. \u00a0Much better than using one password for everything.<\/p>\n

    This solution comes down firmly (but not absurdly so) on the security side of the security-vs-convenience spectrum. \u00a0Yes, it’s a lot more complicated than just having a single easy to remember word that you use as your password for every site, but it’s also much, much more secure. \u00a0At the end of the day, especially this week, I’m very happy to be on the secure side of the spectrum.<\/p>\n","protected":false},"excerpt":{"rendered":"

    With the Internet collectively freaking out about the Heartbleed bug\u00a0(a major Internet-wide security hole that could mean various passwords (and other information) have been nabbed off of “secure” servers)\u00a0this week, I though I’d share a password system I use to have a unique password per site \/ account that I can easily remember: Pick a … Continue reading Write really good passwords; avoid the collective security freakout<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","_links_to":"","_links_to_target":""},"categories":[8],"tags":[],"class_list":["post-42","post","type-post","status-publish","format-standard","hentry","category-nerd-tips"],"_links":{"self":[{"href":"https:\/\/jonoforbes.com\/blog\/wp-json\/wp\/v2\/posts\/42","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jonoforbes.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jonoforbes.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jonoforbes.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jonoforbes.com\/blog\/wp-json\/wp\/v2\/comments?post=42"}],"version-history":[{"count":2,"href":"https:\/\/jonoforbes.com\/blog\/wp-json\/wp\/v2\/posts\/42\/revisions"}],"predecessor-version":[{"id":44,"href":"https:\/\/jonoforbes.com\/blog\/wp-json\/wp\/v2\/posts\/42\/revisions\/44"}],"wp:attachment":[{"href":"https:\/\/jonoforbes.com\/blog\/wp-json\/wp\/v2\/media?parent=42"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jonoforbes.com\/blog\/wp-json\/wp\/v2\/categories?post=42"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jonoforbes.com\/blog\/wp-json\/wp\/v2\/tags?post=42"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}