In case everyone isn't already familiar with it, there's a good xkcd strip which describes how to make good passwords. horse something staple something. The key is to finding a phrase you can remember and associate with whatever you are using the password for.

Though you really should uses phrases you associate with the thing in question, otherwise you're unlikely to be able to remember it.

But I don't understand why four dictionary words joined together without any obfuscation should be so hard to crack.

@FaheemMitha I happened to use that strip in complains to some service providers, when they started requiring impossible-to-remember passwords. But, eventually, a password manager allowed me to reconcile with the universe.

@fra-san I've never used a password manager, but I would have security concerns if I did.

IMO, it's better not to store sensitive passwords, and just remember them instead.

@FaheemMitha It doesn't sound weird to me, though it largely depends on the size of the dictionary and how randomly the words are chosen.

@FaheemMitha What kind of concerns?

@fra-san I didn't say "weird". But I don't know how password cracking works, so...

@fra-san Well, if someone gets access to the security manager.

I remember reading of a case where that happened. Something to do with Apple.

@FaheemMitha Sure. As often, it's a trade-off: reasonably impossible-to-guess passwords with a manager, at the risk of someone stealing the whole password database, v. easier-to-guess passwords that cannot be stolen.

@FaheemMitha password cracking works by a server getting broken into, their password database leaking and people with enough computing time testing all the "simple" passwords against that database. If they find one, they can test if the same user uses the same password in some other system. Password managers help there in two ways: making it easier to use a sufficiently-complex password that's uncrackable in practice, and by making it easier to use distinct and unrelated passwords everywhere.

The other attack would be breaking into your client system. If that happens, the attacker can probably eavesdrop on the passwords you type (either the pw manager's master password, or the service passwords), and copy the password manager database off your system. (Or they can install some other malware to do something more interesting... in any case, you lose if your client system is broken into.)

@ilkkachu I wonder how often such servers get broken into. And not reported.

@FaheemMitha haveibeenpwned.com

Duplicating passwords is suicidally stupid. I wonder how many people do that.

The vast, vast majority?

@terdon This looks like an excuse to sell their services.

@FaheemMitha I assume you're doing your usual thing of not actually checking what it is, right?

@terdon I typed in my email address. It threw up some alarming text. At the bottom it said how much better off I would be if I used their <...>.

@FaheemMitha Their what?

Onepassword? That's an add for an (as far as I know) unaffiliated but very popular, good and mainstream password manager.

@terdon 1Password.com. Whatever that is.

Point is, this is the work of a security professional who has collected a very large list of emails associated with accounts whose passwords are known to have been leaked in various data breaches. If it tells you it found yours, believe it and change those passwords!

You may choose to use the very good tools designed for that job, like onepassword, or not. But do change your passwords.

@terdon Passwords? What passwords? I typed in my email address.

@FaheemMitha Yes. Which you have used to create an account on dozens of sites over the years. Some of those sites have been hacked, and the password you used on those sites has been stolen.

I remember for a while I was getting threatening emails citing an old password of mine. It was a password that I was no longer using, for a site I didn't care about.

@terdon Ah, I see. Probably not dozens of sites, but I understand what you mean.

It only mentions two sites, neither of which I care about. And both of which I'd assume to be insecure even if someone hadn't told me about them.

good, then!

As long as you've never used that password anywhere else ever.

@AndrasDeak I don't reuse passwords, ever. Because I'm not mental.

As others said, 99% of users reuse passworss, or add trivial variations

@FaheemMitha yes, we covered that already

we're trying to explain the point of that altruistic website

I generally generate custom passwords (not using a service) based on the site name or some other association. Then I try to remember it. A lot of the time I manage it.

@AndrasDeak Excuse my paranoia. I live in India.

@FaheemMitha if you forget you can reset with an SMS anyway

@FaheemMitha How then? I mean, if you don't reuse passwords and don't use a password manager, that means you must have to remember dozens of diferent passwords. How do you do that? Do you just have a preternaturally good memory?

I also don't provide personal information online. Which is another very stupid thing people do.

@FaheemMitha Oh. Ouch, that is a very bad idea. Everyone uses the site's name, so that is included in cracking attempts and makes it quite easy to find.

My mother has a folder full of paper snippets with passwords. Works better considering her attack vectors.

@terdon Not dozens. And my memory is poor. But I manage based on associations. I use some heuristics.

@terdon Not the site name. A related word.

Ah, right.

I also change characters for good measure.

I know there is a lot of worry about getting defrauded by random people, but when I've robbed, it's been by people I've known and trusted. Including a bank.

@FaheemMitha Eh, that's mostly pointless. Things like 'fah33m" or whatever are very well known.

@terdon I don't use my name because I'm (still) not a moron.

I use private word associations that would mean nothing to anyone but me. Sometimes it's helpful to be a freak.

@FaheemMitha I mean the character changes. Those are probably not adding anything.

I'm not saying the passwords are unbreakable.

@terdon Dunno. I would have thought they would make a cracker work a little harder.

But as I already said, I don't really know how password crackers work. I tried one on some of my passwords once and let it run for a while.

My impression of fraud in India, at least, is that people mostly get in trouble by trusting people they think they know and can trust. I find it helpful just to assume up front that everyone is out to get you.

@FaheemMitha That's so common and standard practice that there are bound to be functions in all the tools that go through them. Your practice of i) not reusing passwords and ii) using unrelated words (not those in the title) are what would be keeping you safe. Changing the characters is unlikely to make any difference above that.

@terdon OK. You might know more about it than me.

The other thing that one hears a lot is crooks simply calling people up and asking for their information. It seems this is often alarmingly successful. Also, people using phones being told to install this or that.

I remember some years ago some woman called me up and said some money was due to me and my mother. She wasn't very convincing, but I was willing to give her the benefit of the doubt. I started asking her some questions, and she hung up.

If anyone tried to get me to install anything on my phone or computer, I'd immediately assume he or she was up to no good.

(Excuse uninteresting rambling. I'll shut up now.)

There was a wave of "fedex scams" here earlier this year. Peple getting messages of an incoming parcel, with a link to collect it, and the link instructs readers to install an apk disabling default security policies

With the extent of digital illiteracy, many people don't get suspicious

@AndrasDeak People asking you to install stuff is never a good thing. They love trying to get you to install apps here. I keep telling them no. I try very hard not to do it, even when it's clearly harmless/legitimate.

I also don't use credit or debit cards in India. It's probably not safe. And India doesn't have any proper consumer protection. Or any of those idiotic pay services.

@FaheemMitha all the time, the same as credit card information gets leaked? Even though there's probably some legal requirements on their safe storage... They pop up in the news from time to time too.

@ilkkachu People are supposed to report such things. But how does one know if they don't?

@FaheemMitha "some alarming text". I suppose it also said what it meant, and perhaps even provided some source to the data they'd found with your email address on it. (I don't know what it shows, actually, it didn't bother to say anything about my email address, so I guess they're not full-on selling their product...)

@ilkkachu It mentioned two sites, both of which I do use. And then a bunch of very non-specific stuff.

@FaheemMitha they don't know. Which is all the more reason to take care of the passwords you use...

If bad people have access to my account on those sites, I don't care. Actually, one of those sites has nothing of any value (from my perspective on it). The other one, is also not of any use to anyone.

If they mentioned a bank I use, I might be worried.

Though since a bank robbed me, I'm also trying to keep less money in my bank accounts.

Many years ago, I used to use mathematical expressions for passwords, but I don't do that much any longer. I wonder if I should do that more. It's not a bad system. Thought the passwords generated are generally not very long. I understand that length is desirable.

Does anyone have thoughts about Google Chromecast? I've never used one, but I was just looking at it. It would be for my guest room, not for me personally.

One review reported it doesn't work with Amazon Prime. Which is a pretty big defect, if true.