I have just opened a new internet bank account and although having already been given a user name I had to think of a password, memorable date, inside leg measurement in cm. etc. etc.
It struck me that I must now have more than 50 of the blasted things: log-on here, other fora, eBay, PayPal, credit cards PINs, debit card PINs, house alarm, frequent flyer card, mobile phone, remote answering machine, email account access and on and on. Maybe it's even more than 50.
I've tried making them different and, maybe the memory is failing, but I have recently become involved in a string of reset password emails because of confusing some of them. You know the sort of thing - right password but wrong capitalisation, right password -wrong bank.
They tell us to make them different, not obvious dates but then not to write them down - tosh, it's an impossibility.
Without revealing your innermost secrets has anyone got some clues how to remember them all as I've run out of ideas like my old dad's blue car registration number linked to the blue bank etc.
Last edited by: Dulwich Estate on Tue 17 Aug 10 at 17:19
|
I have them all on a Excel Spreadsheet which it turn is password protected (I only have to remeber the one)
This Spreadsheet is stored on a memory stick with a backup copy on another CD both of these are kept in a locable drawer.
Possibly not the best of methods but with all different passwords and what not, I could not think of anything better.
|
There are programs for storing passwords that encrypt them and are reasonably difficult to crack. The one I use is Dataviz Passwords Plus, but there are various free ones.
I would avoid a passworded Excel spreadsheet. Unless it's improved they are fairly easy to break - not that I know how to do it, but then I'm not a cyber-crim.
A simple trick to make them more difficult to steal is always to include a "phrase" which might just be a number you can remember in all your passwords. When you save them, leave out the number, so if anybody does crack your 'store', they haven't got the full passwords.
Last edited by: Manatee on Tue 17 Aug 10 at 18:10
|
|
I change my password numbers to letters (1=A etc.) and then change my passwords to words that are appropriate (to me) to the application.
|
Ex-girlfriend's names combined with the month or year or whatever they were current.
For my main bank account I use the one who took me for the most money. For my phone bill I use the most gobby one. For electricity, well you get the idea......
|
>> For electricity, well you get the idea......
>>
Presumably the current one :-)
|
|
who did you use for the gas one?
|
|
BB, you wouldn't believe me if I told you but I think you are probably already right on the money !
|
How about two encrypted memory sticks. One used to back up the other.
With the very secure ones you get only 6 tries at the password and then all is erased.
Also you might need to check that they still work OK if you change operating systems.
They are small enough to put away somewhere --- not in your desk drawer! !
|
I use a basic root password to which I add a fairly obvious password for the various purposes.
So the root might be 'Cat67' and then I add 'halifax' for my Halifax credit card: Cat67halifax, or 'car4' for here: 'Cat67car4', and so on.
The advantage is I have a fighting chance of guessing a forgotten password.
The 'root' is not recorded anywhere so I reckon the system strikes a reasonable balance between usability and security.
|
Except you've now told the moderators how to log into your halifax account.
|
...Except you've now told the moderators how to log into your halifax account....
Good point.
Or it would be, but I don't have that card registered online as such, the password refers to some second layer of security, similar to 'Verified by Visa', which sometimes pops up when you buy something online.
|
If you want a 'root' that you are unlikely to forget but would be relatively difficult (but not impossible) for someone else to find out, and is an otherwise random selection of letters and numbers, I'd guess most of the contributors here could remember the registration numner of their first car.
Helps if your not still driving round in it, of course !
|
I've got loads. I have given up trying to remember them all. I tend to have repeated ones in groups, variations etc. But being lazy it is so much easy to use the 'remember pasword button'! The only type of passwords I wouldn't do this with are banking ones.
I have also found I've been using the reset password feature a bit more lately for some reason too! I have two computers and I think they have got out of step. I have started using xmarks to sync bookmarks and that has a password save feature. I have switched that on. If someone does steal my passwords all they will be able to do is to write rubbish as me on internet fora.....
|
>> If someone does steal my passwords all they
>> will be able to do is to write rubbish as me on internet fora.....
If I happen to have accounts with one or two internet fora that have the same password, and somebody really wants to pretend to be me then that's life.
|
D
I use Roboform for my logins & pws.
For things like bank PINs I'd suggest you might want to look at Truecrypt. It is VERY secure encryption and it works very conveniently. You create a file, which when opened with TC appears to be a folder so you can do all of the usual things like click on a file and it fires up the apporpriate program to open the file. You are not restricted to any one file type so you could put a Word or Excel file in there. As someone has already said, don't use the Office password function, it is very weak.
Keepass may be worth a look too.
JH
|
No words of great wisdom.
1) I have a few passwords that I remember.
2) I have a one password that I use for huge numbers of sites where I'm not bothered if anyone finds out.
3) There are a handful of others that I write down - in places that people are unlikely to look in, and in forms that they wouldn't know it was a password.
And there are others that if I have to ask for a password reminder, I ask for a password reminder.
|
My wife does all the internet banking.
Passwords for forums, Facebook etc.etc., I do what Iffy does and have a "Root" followed by "Skype" etc. Not this Forum though, that's unique. I also keep these written down as they're not important.
My PIN number has it's roots in a Star Trek episode but it's very very subtle and certainly not 1701 or any other Starship registration. But it's something I will never forget.
The burglar alarm code is a pattern on the keypad made as you key in each number.
|
|
Storage Crypt is very good.
|
Keep them coming !
The root idea is an interesting one as it doesn't need to be written down, saved in a file or on a memory stick you need to keep hold of - useful if you are internet banking from Vladivostok say.
|
It seems to me there are fundamentally two different circumstances and different risks attendant on passwords.
1) is the risk of someone online hacking into bank accounts etc
2) is the risk of a burglar finding your written down passwords
There is little you can do about (2) even if you memorise everything. What do you do if faced with a threat of violence?
|
|
We also have a safe with a keypad that unlocks it but we never got around to putting in a code so it's still on its factory settings and is very easy to remember. Daft really, but we only keep passports/documents in it and the safe itself is well hidden. Must dig out the instruction manual. It's probably in the safe...
|
Remember to put the PIN somewhere safe...
JH
|
|
My dad has a huge safe, with a proper twisty turny knob like in the movies. Being a stickler for proper procedures, as dads are, he gave me and my two sisters one third of the combination each so that in the event of his death we could get together and open it. I've long since lost my part and my younger sister is dead, so probably have to dynamite it when the time comes. Hope it's worth it and it's not just full of his Haynes manuals.
|
Once spent a full day on a building site breaking into an old safe.
They are full of sand in the middle.
Got the side tin opened finally to find it was full of -----------
nothing :-(
|
I once watched a chap break into a 1920s safe. He took out a sheaf of photocopied papers with the designs of every safe known to man. He then measured two inches to the right of, and one inch above (or whatever it was) the key hole, and drilled. and drilled. and drilled. and drilled. And he drilled. For about an hour, through toughened steel, a hole maybe 5mm in diameter. Then he put in a piece of stiff wire/a thin screwdriver and lifted up the latch and was in.
He spurned my offer of some oil to lubricate his bit - I think he was foolish, but anyway, it was his drill bit and his elbow grease.
|
...I once watched a chap break into a 1920s safe...
An underworld slang term for a safe is a "peter".
Some prisoners use the same word to describe their cell, which I guess is a safe for people.
I've never been able to find out where the term comes from.
Is it rhyming slang?
Or was Peter somebody-or-other a famous safe maker?
|
>> Is it rhyming slang?
>> Or was Peter somebody-or-other a famous safe maker?
A quick Google suggests there is no definitive answer to this, but a few different solutions present themselves:
1) Cockney rhyming slang: Peter Pan = "can"
2) From St Peter, being a stable person or rock, i.e. unmoving or "safe"
3) From saltpetre or gunpowder; a safe-cracker would have been known as a "petre-man" or "peter-man", so the link could have been made between "peter" and "safe" in that way.
|
...A quick Google suggests...
Dave,
Thanks - you've done better with google on this one than I did.
Peter Pan -can - makes some sense, but I also quite like the gunpowder link.
|
>> ...A quick Google suggests...
>>
>> Dave,
>>
>> Thanks - you've done better with google on this one than I did.
>>
>> Peter Pan -can - makes some sense, but I also quite like the gunpowder link.
>>
>>
>>
"Peter" was slang for a tin trunk centuries before it became applied to safes.
Peter Pan was written in about 1905, I think.
|
Having driven work vehicles for years, I've filled in many many tachographs, run sheets and visitors' books with the same registration numbers day in day out. A lot of those registration numbers have stuck in the mind, and I use combinations of those for most passwords.
Anyone who can guess the number plate of the 3rd lorry I drove in 2006 AND the one from my 2nd taxi, is welcome to log in to my twitter account :-)
I also use road names from previous customers' addresses. The advantage is that a password hint of i.e. "That street in Belper" is enough to jog my memory but still vague enough to confuse others.
|
My day to day job is fairly closely related to this topic.
Only 5 years ago attitudes to passwords were much different. Understanding of the issues has definitely improved for large numbers of the population. It's continuing to get better, and it's not all just people who've had their fingers burned, a lot of it has come from education which is really encouraging.
Some good, practicable advice above. The only major consideration i didn't see listed was changing your passwords. In general noone does it. However it would vastly cut down all sorts of common problems related to compromised passwords. A lot of internet banking break ins occur some months after the initial password capture, for example. It also means that "old" user / password lists still retain value for a long time in the wrong circles, which is unfortunate, because it makes the whole scenario that much more lucrative for the bad guys.
It's important to remain practical in it all. A few folks have identified "classes" of accounts, this is a fairly workable technique to help stay on top of it all. The main pitfall i come across is the number of people who fail to class their email password at the same level as their banking password (typically an attacker can reset all your accounts once he has access to your email).
|
|
As an ex-builder...."I also use road names from previous customers' addresses" has a strong appeal.
|
>>
>> their email password at the same level as their banking password (typically an attacker can
>> reset all your accounts once he has access to your email).
>>
But no one ever records passwords in emails, so how has does that work?
|
...so how has does that work?...
I'm no expert, but don't some sites email a code or a link when you have forgotten your password?
|
Cliff
I think what Craig is saying is that you should use a suitably complex pw for your email, as you would for your bank account. This is because if someone has your email address and pw, they can get into all sorts of other accounts by using the "remind me" function. First action would be to totaly hijack the email account by changing the pw and then gather as many others, as I've described above, pdq and abuse them.
He's not suggesting saving pws in emails.
Hope I got that right Craig.
JH
Last edited by: Tooslow on Thu 19 Aug 10 at 19:23
|
Nothing much to add but this is what I do.
1. I have a spreadsheet where I put all my passwords and login details. Where possible I 'disguise' them by a phrase such as the reg of my first car, name of first cat etc. and sometimes I add a memorable date on the end. So for example the password for one website that I often order things from is disguised as ' reg of first car plus year I joined that business based in XX city'.
2. I then take it a step further by not saying in the spreadsheet which company this relates to. It would just state 'Organisation 1'.
3. I then have a mapping document (which is not kept on the pc) which tells me that 'Organisation 1' is Barclays On-Line (no, I don't have a real Barclays account…)
4. So any criminal would need my list of passwords AND they would need to know things such as the name of our first cat AND even if they had all that they would still need the mapping document.
5. Passwords to financial websites and e-mail are particularly 'strong' using a combination of letters and numbers and using case sensitivity where possible.
6. Really important passwords such as my bank account are changed every couple of months
|
|
I find just using "password" all the time keeps things a lot easier......
|
...I find just using "password" all the time keeps things a lot easier...
You jest, but I believe plenty of people use 'Pa55word' in the belief it's secure.
|
swear words and combinations of work well.
I just checked my cisco firewall / router at home and none of them tried swear words
Most hack attempts never go for the great variety of English swear words !
(I must state I use more than one combination at a time).
|
At the other end of the scale
A teenager has been jailed for 16 weeks after he refused to give police the password to his computer........was convicted of failing to disclose an encryption key
Police seized his computer but could not access material on it as it had a 50-character encryption password.
www.bbc.co.uk/news/uk-england-11479831
|
|
I am quite pleased that this person, repulsive though he may (or may not) be, refused to allow access to his machine.
|
|
did you read the link FT?
|
|
Yes. That he kept the contents of his machine "secret" should be no bar to him being prosecuted for the offence he was originally arrested in connection with. That he was convicted of "failing to disclose an encryption key", but (AFAICS) nothing else, is down to laziness.
|
or cost to us the taxpayers
|
|
Huge costs are incurred by pursuing others. This person has been accused - not found guilty. There is a difference. I'd like that difference resolved, it should not, from at least two perspectives, be allowed to stay unresolved.
|
too many words FT
why are you defending the undefendable?
who knows whats on the hard drive if he denies permission to view to officers of the law who have good reason
|
>> why are you defending the undefendable?
I am not doing that.
|
>> I am quite pleased that this person, repulsive though he may (or may not) be,
>> refused to allow access to his machine.
>>
In a way I agree - what ever happened to 'You do not have to say anything, but what you do say....'
I know the wording did change some years back, but wasn't aware you had to admit guilt these days...
|
Wow, this is *old*.
WRT PINs, use a book code.
WRT passwords, use a complex constant string, combined with another string with some relevance to the thing that the PW's for. You could also use a book code.
It doesn't have to be fashionable, you see.
|
My strongest password is for my WPA2 personal encryption, wi-fi laptop to router.
It's a 28 alphanumeric sequence I made up randomly.
All my banking sites have a field requiring entry of individual characters from a previously chosen sequence.
Each log-on to the site generates a different request for input and input is by mouse click, not by keypad on the laptop. Key-loggers should be outwitted by this.
I also keep log-in details (not these banking passwords, of course as they are never used in full) on the handy Firefox add-on "Paste email".
Again, log-in is simply by mouse click, not keyboard input.
If someone nicks the laptop log-in and passwords to sites, other than banking, are easy enough to find, but frankly if someone hacks my log-in here, for instance, I'm not the least bit concerned.
|
If you have smart phone, there are usually (often free) apps available which you can keep password in phones and then you can sync that with desktop application. So, you enter data once and have a copy if either phone or computer is lost.
|
>> If you have smart phone, there are usually (often free) apps available which you can
>> keep password in phones
I am outraged. The only place to record passwords, your PIN, or whatever is in the old grey matter. If it won't stay there, there's something wrong with the password selection process.
|
I am impressed by your powers of perfect recall FT !
Now that I no longer work for a living my password requirement has reduced to around 25 or more. I say around, because I haven't counted them. For starters, Internet: 9 or more banks / building societies, 5 fora, and maybe 7 shopping sites, eBay, PayPal. Then there are PINs for 3 credit cards and two debit cards. To this add: home alarm code, 2 mobile phone codes and an answering machine code. Then there's the key pad for the good old Pug 306, not forgetting the radio code.
How can you remember that lot ?
I'm currently thinking about what I could do with the mass of clues available on book spines on shelves where I'm typing. As long as you don't move the books, it might work too.
|
PINs and Passwords - How to remember them - Redviper
