Password Length And Complexity

[C1ay]

The manager I use is passphrase protected with a nice long wacky passphrase spelled out with leet

Most of my passwords are themselves derivatives of various passphrases I create solely for the purpose of creating a password....

[Pyrotex]

I got an unbeatable password.
Nobody will EVER guess it in a million years.
It's the word "password". Yuck, yuck, yuck, yuck...

Okay, sometimes I have to pad it with zeros to make it long enough.

But NOBODY would ever guess that in a ZILLION years!

[alexander]

it's the first password that any dictionary cracker tries... in many variations :P

[Donk]

In a former life I learned quite a bit about keyloggers. Anyone who does that gets a hefty dose of paranoia - you visualise a shadowy figure leaning over your shoulder watching your every move...

Even after my escape into the real world, some of the paranoia remains.

High-strength passwords - at least a dozen random characters/symbols

Different passwords for every login

A single encrypted file on an encrypted memory stick contains all the passwords

Use password manager wherever possible (thanks for the link, C1ay - it looks interesting)

Where password manager can't be used (new computer for instance), copy/paste from file using the mouse right-click or edit pulldown, not ctrl-C/ctrl-V. Some keyloggers can convert the ctrl-V keypress into the paste string. Back then, mouse clicks weren't readable via keylogger - if they are now, I'm not sure I want to hear about it!

Change passwords frequently - especially if I've used them on a machine I don't entirely trust

My memory isn't what it was. If I have to remember a password (e.g. the encrypted password file) I think of a few words connected to what I'm doing at the time (say, George Hotel, desk), change them around using my own leet-similar code (G30rg3 H0t37 d35k) and connect with an odd character (G30rg3!H0t37!d35k).

And a few other things I'm too paranoid to talk about!

[kelcya]

keep in mind that a bigger charset will increase the time it takes to bruteforce a password.

[alexander]

space is actually a better random character then an exclamation mark...

Donk, in my current life i deal with key loggers, both software and hardware, thing is, if someone installed a key logger on your computer to "get your passwords" you are already screwed... they both got in and installed it so your security was compromized already, at that point you dont even have to run a key logger to get your passwords, because there are many ways to get the data, regardless of whether you typed it or pasted it (its as easy to log the copy actions as it is to log key presses).

Now hardware loggers are a little different, in that if you copy and paste your passwords they will not catch those passwords, but you cant copy and paste your login password, thus you are still (as they say in leet speak) pwned, as software loggers can be installed afterwards with your login password.

Biometric authentication is still bad, as its easy to lift a finger print, and use it to get in (most of those devices are easy to fool).

Centrally managed changing keys are probably one of the only, still not fool proof, ways to manage security. But honestly you can be paranoid as you can be with password security in your organization, bottom line is that there is still a "Human Factor" in the equation, which means that exploiting that factor is most of the time, the easiest route to take to gain access. I've talked to many guys who do penetration testing, and i just have to say, you'd be surprised how far a fake badge and a printed design on a shirt, or a cell phone that rings at just the right time, or a telephone butt set set can take you, or a dozen cheap flash drives, or carefully labeled cds can take you... and ofcourse nothing beats the phone call from your new IT guy

[buddyzen]

one of my friends that posts around here theory5 uses a password generator it is pretty neet =D

[C1ay]

Originally Posted by buddyzen

one of my friends that posts around here theory5 uses a password generator it is pretty neet =D

The problem with password generators is that they produce great passwords that are very difficult to remember when you can actually make great passwords yourself that are very easy to remember.

[freeztar]

This thread reeks of paranoia!

Do you guys really have such sensitive data that it needs to be protected with such zeal?

Sure, I use complex passwords for my banking/credit info, but email is pretty benign.
IOW, I don't view someone hacking into my yahoo account a big threat. They'll see evites and chatter amongst friends, and that's about it.

Of course, a little paranoia is not a bad thing. I guess I'm just not seeing the bigger picture...

Edumacate me!

[Donk]

You want edumacating? Or maybe I should leave you in happy innocence...

I've admitted the paranoia. Nobody is going to find anything of any use to them on my computers - not the ones connected to the internet, at least But when you've been part of a group who were constantly checking out each other's security, you make sure the doors are not only locked and bolted, but hidden as well. I remember the time when one member gloated that nobody could crack his machine... a few hours later a screenshot of his desktop appeared on the forum

You're probably right, freez. Most people wouldn't burgle a house even if the door was left wide open. Even fewer would check to see if it was locked; fewer still would check around the back for an open window. But I wish more people would learn just a little bit more about computer security - then maybe the internet wouldn't be so deluged in spam.