Is Your Password Strong ?

[Desslok]

The problem with passwords is there is no standard. So I create one on my bank site, and if I try to make it somewhere else I get "invalid special character", and I go somewhere else and it says "you must have 2 numbers, etc." I go somewhere else and I must have 3 numbers and 2 special characters. So some people end up with a bunch of different passwords that they forget or write down somewhere. Go around most offices and look under keyboards, you'd be surprised how many passwords you find on yellow stickies. I used to work tech support, it is scary.

 

[tw33k]

Allmy passwords are strong because I use a password generator and store them in a locked One Note file on a bit-locker encrypted flash drive. I then only need to remember 2 passwords

 

[malexous]

This is what I do to create my passwords. They are usually longer than this.

tiwidtcmptaultt

Then you improve it however you like. Example: Change the 'to' to '2'.

My password contains:

23.8% numbers. 14.3% special characters. 19% uppercase letters. 42.9% lowercase letters.

 

[Darryl Licht]

"...paranoia runs deep..."

Paranoia will destroy ya!

 

[Corrine]

Rich46 started a similar topic at another site we both frequent. One of the members posted a link to Password Strength Checker which has the option at the bottom of the page to download and test offline.

Another option is https://www.grc.com/passwords.htm which provides several options to select from. You can always use a portion of the generated password if it is too long.

64 random hexadecimal characters (0-9 and A-F)
63 random printable ASCII characters
63 random alpha-numeric characters (a-z, A-Z, 0-9)
[FONT=Verdana,Arial,Helvetica,Sans-Serif,MS Sans Serif]
[/FONT]

Every time this page is displayed, our server generates a unique set of custom, high quality, cryptographic-strength password strings which are safe for you to use

KeePass Password Safe is a safe password manager.

 

[Victek]

I don't see that anyone has mentioned using LastPass. LP is a plugin for IE, Firefox, Safari and Chrome that will generate complex passwords, store them and optionally input them into web sites for you. It encrypts your list locally and stores in the cloud so it's available from anywhere. All you have to do is create one very strong password (that you can type) for logging into LastPass. No more weak passwords, reusing passwords, forgetting passwords, etc.

LastPass - Password Manager, Form Filler, Password Management

 

[tw33k]

Excellent options once again Corrine

 

[Darryl Licht]

...Another option is https://www.grc.com/passwords.htm which provides several options to select from. You can always use a portion of the generated password if it is too long.

64 random hexadecimal characters (0-9 and A-F)
63 random printable ASCII characters
63 random alpha-numeric characters (a-z, A-Z, 0-9)

Every time this page is displayed, our server generates a unique set of custom, high quality, cryptographic-strength password strings which are safe for you to use

KeePass Password Safe is a safe password manager.

Great site that grc.com! reps on way...

Although, I'd hate to have to key in a 64 character PW at every login, or online purchase, etc...

IMHO - this is more appropriate for a WPA wireless key or similar where you can set it and forget it!

 

[NecroGnomezZz]

Since 1982, i have used my own little trick for passwords and i have never had a problem. I won't be specific as that would be kinda stupid now wouldn't it, but I use 3 letters from my name 4 digits from a date I know and then a letter that I can relate to. I combine all three of these into my password and it always gets a strong rating, I am surely not going to have the pc make my password then have the pc lose it, i count on my memory alone to retrieve it and my memory works when I relate it to things i know second-nature. Anyway this works and always has for me on pc passwords!
P.S. To my acquired knowledge My password should be in one place before it gets entered ANYWHERE and that's (in my head.)
Also, a kinda cool program is called "Key-Scrambler" that scrambles what You type as You type it (for malware such as keyloggers/hi-jack's, etc.)
Also has a shut-off feature for when that's needed for password entry as well.

Oh, for personals on the pc I use a few methods of protection:

1) BIOS/ startup password
2) Users must press CTRL-ALT-DEL Keys to login to any accounts, then password, and windows encryption is used on system drive with passkey/ password protection also.
3) for files & folders I use "Folder-Guard" w/password integration and user specific policies.
4) for .EXE Files I use "Silver-Key" & "Advanced Encryption 2009" (w/ auto-self-extracting .exe upon entering correct password) w/ Serpentine Or AES algorithms 256Bit usually.
5) for archives I also use the above with both password but the decryption takes too long of course, but it well should specially w/ 256Bit encoding...
6) For internal drives I have (4) 2 equal 1.8TB which total 3.6TB total for the (4) Half of which are mirrored auto sync'ed via windows drive management (they stay identical...) if system drive problems arise, I just insert win7 repair disc, reboot, and it puts good working mirrored system drive as default to work, and I boot back into windows. As easy as that.
I said so long to imaging programs a while back as i got sick of their shortcomings and losing my data alot. I wont go back now no way no how, Mirroring rules!

Anyway, Enjoy & Thanks for the input.

...Another option is https://www.grc.com/passwords.htm which provides several options to select from. You can always use a portion of the generated password if it is too long.

64 random hexadecimal characters (0-9 and A-F)
63 random printable ASCII characters
63 random alpha-numeric characters (a-z, A-Z, 0-9)

Every time this page is displayed, our server generates a unique set of custom, high quality, cryptographic-strength password strings which are safe for you to use

KeePass Password Safe is a safe password manager.

Great site that grc.com! reps on way...

Although, I'd hate to have to key in a 64 character PW at every login, or online purchase, etc...

IMHO - this is more appropriate for a WPA wireless key or similar where you can set it and forget it!

 

[WindowsStar]

Your online accounts, computer files, and personal information are more secure when you use strong passwords to help protect them.But do you?
check your password

why strong passwords are needed:
How I?d Hack Your Weak Passwords - Passwords - Lifehacker
Weak passwords dominate statistics for Hotmail's phishing scheme leak | Zero Day | ZDNet.com
What’s My Pass? The Top 500 Worst Passwords of All Time

Ahhhhh....No. I am not typing my password in there for a check. Now Microsoft knows my password. You have to be kidding.

Typically my passwords are 16+ Upper and Lower Case with symbols. I am fairly sure I would get a best rating. I don't use the same password anywhere.

 

[jimbo45]

Hi there.

The EASY way to defeat most brute force attacks is not necessarily to scramble up your password to something indecipherable but to keep a SIMPLE password but prefix it with a SPECIAL CHARACTER and possible insert another special character somewhere else in the string.

Put the special character at the START of the string -- even the most mathematically challenged amongst you can see that this will add ZILLIONS of combinations a "Brute Force" attack needs to go through -- and with modern equipment available to even a sophisticated hacker the time taken to decrypt a decent length password will be longer than the approximate future lifetime of the sun (around another 10 billion years or so).

Brute Force password attacks usually can't handle special characters very well.

Use something like a NOT sign ¬ an ! exclamation sign or a couple of characters from another language set such as the Icelandic þ and ð or - use Russian or Turkish or whatever.

This simple trick will defeat most password cracking schemes even brute force ones.

Incidentally I'm suprised that in the 100 worst password lists these two weren't even mentioned --- PA55WORD and ADMINISTRATOR -- I'm surprised at the number of computer installations where server passwords STILL haven't been changed from the default installation.

Encryption theory will confirm that it's FAR FAR harder to get the plaintext (i.e decrypt a password) from ANY string containing at least one special character - especially if the special character is the IST character in the password than from a random string of "normal" chars and numbers such as floR78BKtsq.

Cheers
jimbo

 

[tw33k]

I use Secure Login, a Firefox add-on, so I only have to enter my password once and then use it to log in

 

[Corrine]

Thanks tw33k and Darryl.

Ahhhhh....No. I am not typing my password in there for a check. Now Microsoft knows my password. You have to be kidding.

You are kidding, I hope WindowsStar.

 

[NecroGnomezZz]

No, Never The Same Password EVER

No I would never suggest using the same password EVER, sorry if i was mistaken by what I put in earlier message. But i have always used variations of my password system and never have had any negative breaches...

P.S. Any passwords I type for My Windows 7 accounts are totally different from those I use online, that's a must indeed, So no problem...
At any rate, a risk is taken when typing in anything now isn't it? But so long as one is secure as possible, well then that's a plus in itself. For the important stuff, personal data stored locally, It is a good thing to have alot more than a password to protect it.

For example if You have personal data that you in NO WAY WANT Intruder(s) to to get access to, I would suggest (as an example) doing all these yes (ALL) to protect it. That way (god forbid) somehow your password gets taken, You can rely on say "Serpentine" 256Bit data encryption that uses a keyfile (kept securely on a device Such as Your USB Pendrive) as well...

For example...

(Personals (compressed w/Password)/and 256bit Encrypted w/keyfile needed/as well as multi-level security for system, files/folders on PC) This is one variation of security that works for me quite well.<<<

You type a password and Microsoft will know Your password? Hmmm, No i don't think so. first off why would they want it, second off they only collect data they have to, otherwise they would be outta business my friend. Billionaire companies have little use for folks passwords; besides they have a little more to do than to steal from their income source, Even though pc software pricing may be high and one might think the other way around :LOL (MOST ARE LEGIT, There are always suspects to consider but hey stay protected if Your unsure then You can rest easier. Anyway The above example (in part, and mostly as a whole) has worked for me since I first started using a PC back in 1982 so, Hope this helps!

Oh and most passwords cannot include anything others than A-Z/a-z/0-9 as text FYI, So using cryptic codes cannot be possible with most...

Enjoy and Hope This Helps!

P.S. By The Way Just A Thought;

The SYSTEM that uses the data is KEY, because say someone gets my bank info, I am not worried whatsoever because they have security enough to imprision that person if they say empty my account via my CC#. My bank reimburses me 100%, the convict goes to prison, and even if the person is not caught I still get reimbursed because the data will not only show I did not withdrawal the funds, and banking system shows the transaction details and video of them...!, AND SO,

All is well and good in the Land Once Again...-=8^)~CheerzZz...<(___)~

 

[WindowsStar]

Thanks tw33k and Darryl.

Ahhhhh....No. I am not typing my password in there for a check. Now Microsoft knows my password. You have to be kidding.

You are kidding, I hope WindowsStar.

Yes it is a joke, but also being serious too, people should use caution. I would hope people don't go to random websites and type in their password for testing. I could setup a testing website and then capture everyone’s passwords. Social Engineering is the best way to gain access to whatever you want.

 

[WindowsStar]

KeePass Password Safe is a safe password manager.

Awesome software and wonderful developers. They added a major feature for me even though it took months to do. I highly recommend.

 

[Corrine]

Yes it is a joke, but also being serious too, people should use caution. I would hope people don't go to random websites and type in their password for testing. I could setup a testing website and then capture everyone’s passwords. Social Engineering is the best way to gain access to whatever you want.

Whew.

Excellent advice. You are so right about social engineering. We humans seem to be very gullible creatures.

 

[WindowsStar]

Yes it is a joke, but also being serious too, people should use caution. I would hope people don't go to random websites and type in their password for testing. I could setup a testing website and then capture everyone’s passwords. Social Engineering is the best way to gain access to whatever you want.

Whew.

Excellent advice. You are so right about social engineering. We humans seem to be very gullible creatures.

We sure are; you don't want to even know how well this works. Since I am in the IT field I test this on every vacation. Most of the time I walk into a building and go right to the first desk, reception, information etc. and Say "Hi I am Bill Smith from IT I was told Kathy, Kim or Karen was having a problem with accessing the network and I need to get access to a computer and check things out." From there it goes many ways but typically I am given access to an office where the person is out for the day and they have dialed up someone on the phone to help me with passwords!!! Amazing!!! I never do anything harmful but I do make sure I get the names of the employees and then I make a phone call later to talk to their IT manager and explain that their policies and security needs to be changed or updated and some training and education on Social Engineering needs to be provided. I have been hired several times to do much better audit checks later or for a sub company.

 

[Darryl Licht]

Yes it is a joke, but also being serious too...

Aren't they mutually exclusive?

 

[jimbo45]

Hi all
just forgive me from being slightly sceptical here -- but why would you EVER use 3rd party or ANY software to create a password for you.

At the very least the software designers would know the algorithm and therefore be able to reverse engineer it.

Maybe in 99.99% of cases these people would be legitimate and kosher -- but there are ALWAYS the odd one or two ---- everybody has their price unfortunately.

If you need a password create it YOURSELF and do what I suggested -- add special characters.

Cheers
jimbo