Discussion on:

Helping Users remember their passwords

Please read the original piece. Do you have a method to the madness of remembering passwords that you could divulge? (Without giving anything away, of course.)

Hi,

What I do is start with a "secure" number like my visa pin and then write down something like +234, which added to my pin gives the actual password. Unless someone knows my visa pin the written down numbers are meaningless.

Herb

Thanks for sharing.

YOur visa pin is compromised, even if you don't tell them what it is.

one other thing: with pin numbers I create a sentence that lets me recreate the pin. The sentence is on my phone, and thephone is locked when not in use. I use a couple of tricks for creating the sentence.

erm... i really like some my password just using number form cellphone... like this one

word = 4(four)
soo = 33388777

or

word = love
soo = 55566688833

erm...hope it will work...also don forget u all must insert some unix word..

That's the key. Thanks for posting.

I use FCC call signs (TV, radio stations, ham radio friends), cryptic EDS*NET IDs (now that I don't work for them), ZIP codes of favorite cities and car license plates.

Those make great passwords.

Hobbies - like radio - would be a great way to remember something. Thanks.

P.S. I've always wanted to get into ham radio. It seems like it would be a lot of fun.

The Amateur Radio Relay League.

www.arrl.org

Great website to get started and no more morse code requirement.

Good luck

I carry a mobile phone. The phone is locked after two minutes disuse and needs a code to unlock it. That is about a secure as it gets, especially as I seldom leave the phone unattended.

on the phone I have a notebook app.

I keep hints for all passwords in the notebook.

I have a stable of password and occasionally add a new candidate to the stable. I seldom change a password

I also follow the rules about using stable passwords for non critical stuff and changing passwords for critical stuff fairly regularly. Generally they include numbers.

Having said that, most of the time the passwords are in my head not on paper.

What I find that works and also produces a relatively secure PW is to pick a sentence that has meaning to them and also has a word or two that can be converted to a number and then use the first or last letter of the sentence for each character, except for the easily converted numbers.

i.e. My mother went to the store twice on the even months and three times on the odd months = mmw2tstotema3otom or yrt2eeenensdesneds.

We've used much the same strategy as norm mentions above - suggesting the use of Bible verses or favorite song lyrics to provide a series of letters and numbers for passwords. Using the first letter of each word for John 3:16 can result in 4Gsltw316 or something similar. Need to change your password? Use the next verse...

We've also set up each of our computers with KeePass password database software and been proactive in training the entire staff on how to use it. This has been a huge help! We did the training two months ago and already I'm encountering far fewer passwords in Outlook and Word documents.

I've also suggested to a few especially challenged staff that while they can't write down their password, they can write down something to remind them of their password. For example, they could have a scripture verse written out as part of their cubicle decorations.

What are other people's thoughts on this? Is this a secure suggestion?

Thanks for sharing.

My passwords are not English words, and as afar as possible archaic words or ones not in standard dictionaries. If I really need to my password will hold words from three languages, some transliterated from another alphabet. Sometimes I invent words.

I Also wrote a password generator program that generates easily pronouncable random passwords of any desired length. I lost the code several times but it never takes me more than an hour to rewrite it.

Remember one long passphrase to access your uname/passwd lists. My preference is KeepassX since it can open the same password data file across most platforms and from a usb portableapp.

I believe a Password Safe facility must incorporate the following features:
1. provide an opportunity to identify what a password is used for (access a specific site, computer, facility). Password retrieval must be permitted via the name of the site, computer, facility).
2.encrypt all information stored in the safe so that nobody can view it by accessing the files in which it is saved using some other tool(s). Even then complete passwords should not be saved in the password safe but rather they should be at least encoded. All my passwords have a standard (fixed) set of numbers/characters with prefixes and/or suffixes, e.g. RTPstdRBC where 'std' is replaced by the standard set of digits/characters
3.allow access to data stored in a password safe only via a single password per user.

I favour a meaningful pass-phrase rather than password as it is easier for an end-user to remember while retaining a higher level of security.
For example, if they support a football team named the Kings then an easily memorised pass-phrase might be kings42008 (Kings for 2008).

I also suggest substituting letters for numbers and visa versa. My examples above might then be re-phrased as k1ng542oo8.
It may look hard to remember this form of pass-phrase however if it is [silently] spoken phonetically then is is easy enough to remember.

Just for example, if we were to use the word(s) "techrepublic" from TR (and I'm using a QWERTY UK keyboard, so yours may differ slightly), use a key adjacent to the word you remembered.

So taking the example above, and moving to a key to the left of the *actual* word, techrepublic would become; rwxgewoyvkux

All I've had to do to produce that password, is remember techrepublic and move one key left on the keyboard; that's it and hardly a candidate for easy cracking.

If you want to include numbers, as four of the five vowels are on the top row of the alpha keys, moving left (or right) *and* up, will produce passwords that include numbers. In this case, techrepublic becomes; 53dy4307go8d

All of us have hobbies, interests that are totally unique to our lives and also usually involve terms and names that we never, EVER, forget. These are great reference points for passwords. The associations can be totally unique.

One woman spoke Gaelic and used that language. Beautiful.

My boss once proposed making your password simply this:
********
Eight asterisks. Who would know otherwise?