Bitwarden is my memory.

I don’t. Use a password manager. Check out BitWarden, DashLane, or 1Password.

You don't.

Just remember the one that goes to your password manager.

KeePassXC

Create random long sentences and remember the first letter of each word. Write that sentence down somewhere safe for the first few months. You'll remember it after that if you use it regularly.

EDIT: This is of course only for the master password of your password manager so you can use secure and unique passwords everywhere.

Get a password manager. Most of them can generate a secure password for you and save it. And you will only have to remember one master password.

Edit: thanks for the gold!

>I find that combo-ing words works best. Something like
>
>Ihavegentialwarts
>
>Or
>
>HorseBoxMushroomTape

You can make that more complicated by using leetspeak I think.

For example:

Ih4v3g3nt14lw4rt$

So the numbers and the $ meets the requirements of a special character on your password and the use of numbers. Not sure if that's effective though.

dashlane also works. im using the free version

Don’t actually use CorrectHorseBatteryStaple as your password though. It’s widespread enough that brute-force password crackers will try that one first.

It is much more secure than using the same/similar password across multiple sites.

Then if one website gets hacked they don’t have your password for all the others.

I would recommend KeepassXC, it's free, Open source and local on your machine.

That xkcd the reason why I stopped using difficult to remember randomised strings for passwords.

InfoSec dudes always told me length is just as secure as the special characters, etc. So their advice for people was pick a phrase that uses the whole of the 14-28 character limit.

My VP told me he tends to uses expletives. So for instance for Gmail his password may be:

FuckingGmailBullshit2023.

His favorite was for a program at work he hated with a passion so his former password was:

IFuckingHateYouMuthafucker1

His goal was for something to so screw-up the desktop guys needed to ask for his password lol

The issue with that is that it makes it way harder to remember, without actually making it that much harder to crack (because any dictionary attack is also going to include common substitutions). Now you need to know which o you replaced with an @, or was it a 0? Did you swap an i or an l with a 1, or maybe it was an e with a 3.

The is the real life hack! It saves your passwords and you can use a long password with all the variations of password requirements! There’s even mobile version. I’m a huge Keepass fan.

Yeah but you also have to satisfy the requirements of the password which almost always wants a special character. I just use ch@racter5 !nstead of l33ters if necessary to use my easier to remember phrase.

Simple math:

Password 1: mynameisjohnsmith is 17 characters long using plain lowercase letters - has 26^17 combinations.

Password 2: xq7$L9p& is 8 letters long using captials, numbers, and special characters too and has 64^8 combinations.

Password 1 format has about 4 Billion times more combinations than password 2. If a supercomputer could crack password 2 in 1 second, it would take over 120 years to crack the first password.

I think that was the point of the xkcd comic referenced earlier.

Modern password crackers know most people subdtitute A with 4 or @, I with 1, S with 5 etc. Those passwords crack almost as quickly as ones without special characters.

I use 1Password and it's amazing.

Every login I have has a 15-20 unique password!

Especially if crackers start using AI, which knows which words generally follow others. Crap, now I have to change my master password, too!

Haven't multiple password managers been compromised? Kinda defeats the purpose to keep all your eggs in one basket. Memory or physical keys are the only internet proof solutions I'm aware of.

We had a discussion at work about using a password manager AND adding something unique to the end of the password that you entry manually. Eg password manager stores z0?!aP5 but the password is actually z0?!aP5FukU Makes auto changing passwords etc a bit more tedious but could be a good idea?

You could do far worse than the "strong" generator on dinopass.com

Passphrases are more secure. https://www.okta.com/identity-101/password-vs-passphrase/

Bitwarden has a passphrase generator, yes.

Changing password regularly isn't best practice anymore. I setup my end users with mfa and teach them to use long passwords that are easy to remmember.

"IworkforthiscompanyasanITemplyeesince2018toearn$" is a perflecty safe password, easy to remmember... he'll to type in when needed to be done to often.. but hey, that's why we have windows hello with pincodes.

Yay xkcd 🏆

That's not an ideal scenario, but it's not unheard of.

When I was last under that kind of policy, I used root and extension passphrases. Which, by the way, can be used for the current long+no/low-expiry practices.

For example, you've got your XKCD standard passphrases:

$ genphrase -n 9 | column
RueOutboundStar         IstanbulAvengedAngry    InchRapHermes
RoyaltyWestWaited       ClassicMoonbeamSwifter  ProvesIdiocyRig
ClanAutismEnclose       ThudsGrubbySeeks        EyesOverdressFights

Those are popular, but they're also susceptible to word stacking attacks. If an attacker figures out that you're using this practice, then the cracking effort potentially goes from theoretical millennia to theoretical weeks. ThisIsReallySecure is presented like it's 52^18, when really it could be more like 16842^4. Running those numbers through some rough calculations and you're looking at 25 million centuries vs 9 weeks. Indicative, of course, and different formulas with different assumptions have different results.

So, to improve that a bit, you take the otherwise rational standard and tweak it slightly. One idea is to mix languages e.g. BuenoThisCavaquinhoRocks or GoodDayToDieQapla!. Congratulations, you just mitigated a word stack attack with Klingon.

But this post is about root and extension. It isn't a new idea, but one way that we can apply it to XKCD passphrases looks like this:

$ genphrase -n 9 -s extension | column
[extension]BuddingRebel         Money[extension]Meant           Bunt[extension]Balmy
Backwash[extension]Director     ScholarArrange[extension]       Head[extension]Unselect
ForcingHexagram[extension]      PlannerDeserves[extension]      Facebook[extension]Frisbee

We can see here that this particular passphrase generator randomises the extension location. So what I used to do is generate a bunch at once and pick one that sounded to me to be more memorable than its peers. So let's say that from this list you choose Backwash[extension]Director. It works like this:

Backwash[extension]Director
^^^^^^^^^         ^^^^^^^^^----root      
Backwash[extension]Director
         ^^^^^^^^^-------------extension

For each usage, you keep the root and change the extension to something that's relelvant to the passphrase's target i.e.

Backwash[facebook.com]Director
Backwash[reddit.com]Director
Backwash[ThatCustomerIHate]Director
Backwash[prod-ad-01]Director
Backwash[qa-sql-02]Director

And so on. Then you simply apply whatever adjustments you need to meet your password requirements, sometimes this is just a sprinkling of 13375p34k e.g.

Backwash[f4cebook.com]Director

So now you just need to remember your root: Backwash Director and the convention for your extension. In the previous example, that convention is: "It's the middle word in the sequence, wrapped with square brackets, is the url of the website and has one 133t5p34k change", which is actually a lot easier and more intuitive to remember than it is to type out verbosely like that.

So let's compare Backwash[f4cebook.com]Director to your standard:

• minimum 14 characters --> we're at 30 chars
• one upper and --> Our passphrase words are capitalised, so that's a bingo
• lower case letter --> Check
• one number --> The 1337 change in the extension matches
• one symbol --> The square brackets in the root matches
• and we can't reuse the previous 10 passwords --> Let's cover that below
• and we can't use common names. --> This needs more detail, but I think we're ok here

For the matter of not re-using passwords, you flip the method upside down: Once you've figured out and memorised an extension convention ^(my rhymes are illin') then you simply swap the root around. Generate a fresh set of phrases:

$ genphrase -n 9 -s extension | column
Slippers[extension]Tugboat      GrimyTwiddle[extension]         PyramidSauna[extension]
PatienceOdds[extension]         [extension]TipPremier           PearlsThroat[extension]
Financial[extension]Sedation    [extension]BodiedProbiotic      [extension]PegPictures

Choose one that grabs you, like Slippers[extension]Tugboat and now instead of remembering Backwash Director, you now remember Slippers Tugboat

Additionally: While it's probably not a great idea, one thing you can do with this is to store your roots somewhere as you cycle them. That way if you come across somewhere where you forgot to update, you can reference your old roots. Ideally these would be in an encrypted vault or password manager. And if someone happens across said store of roots, all they'll see is something that looks like

Darwin Generator
Shortly Alpine
Upfront Stuffing
Fellows Insight
Lives Catty
Ritual Unadvised
Clink Brunt
Beige Entry
Backwash Director

Because your extension convention is in your head, them having access to that file/post-it/whatever isn't great, but it's not the end of the world either.

That's a good memory trick. Create a bizarre image out of your passphrase. The strangeness makes it easier to remember.

Mouse fan car trick

Picture a mouse fanning itself while sitting in a convertible car then doing a magic trick with the fan.

That's what the emergency sheet is for. If for any reason you forget your password, you can look it up from your emergency sheet. Here's the link

Personally I would randomly and automatically say all my passphrases out loud in my mind every few weeks. I guess it's like survival instinct because I know it's something really important

Random, unrelated 3-5 words. Not super hard to remember. Write it down on a paper and put it somewhere not too obvious. Don't write the account name or what it's for.

This.  Some take this comic too literally, but the idea is that length is orders of magnitude more crack resistant than complexity.

The best functional application of this is a few word sentence that only has meaning to you.  Add a single number, symbol or capital letter and suddenly it takes longer than the age of the universe to crack with all the computing power in the world... and you never have to write it down.

Common advice of ultracomplex passwords along with frequent changing of passwords is a security nightmare.  Users simply write passwords down, usually on a post it under their keyboard or somewhere else easy to find.  It's where something that sounds good fails in practice.

At least NIST is now recommending long passwords and advising against frequent password changes.

You're almost there, but you're still a few moves behind me. I suggest you have it tattooed as you said, but inside the buttholes of your friends. GI doctors are going to charge an enormous amount. By time they look up five buttholes with a scope. And it gets even more expensive the more times you change your master password. But that's the price of modern security.

I don’t know my master password. It’s on an emergency sheet, but I don’t actually know what it is. How do I log in then? Part of it is in my head, the first 6 digits, then the rest is filled with a long press on a yubikey where a long random string is saved. Combine that with biometrics and 2FA and it’s secure AND convenient. Make sure you have backup Yubikey(s).

Okay, I’ll jump into the fray, though there has already been some good advice.

> how to do it

First, as others have said, use the password generator in Bitwarden to create a passphrase. Four words, like UnplantedSurrenderTwiceCaptivate, will be enough for most people.

> how to memorize it

Temporarily TURN OFF biometric or PIN authentication. For the next week, force yourself to use your master password every time you need to use your vault.

Keep the master password (for now) on a piece of paper in your pocket. Refer to it when necessary as you are memorizing it. I expect within a day or four you will have a grasp on it. As others say, there’s no reason to indicate on that piece of paper that it’s for Bitwarden.

> hide my password

As an aside, you MUST NOT rely on your memory alone for your master password (or anything else). An emergency sheet is not optional. Your only choice is HOW to protect that sheet. It could be as simple as storing a copy with your birth certificate and vehicle title, or it can be crazy complex, like encryption and using external resources like a Dead Man’s Switch to help you regain access.

> never think it’s for Bitwarden

Just to be clear, not everyone needs to get crazy complicated about this. I know, for instance, that I don’t have a drug addled ex brother-in-law who is going to break into my house and rummage through things for half an hour looking for my emergency sheet. Someone breaking into my home in inner NE Portland is going to be looking for cash, booze, small electronics, and other items to support their drug habit.

In spite of that, I do actually take precautions. My emergency sheet is enclosed as part of an encrypted full backup. The thumb drives with the backup are in our own fireproof box, along with birth certificates etc. Copies of that thumb drive are at our son’s house, and the encryption key is in his Bitwarden vault. My wife also has a copy in her own vault. And since I need to update that backup periodically, I have a copy of that encryption key in my own vault.

You see? There is no single answer. Like a lot of things in security, you have to decide how much protection you really need. You could simply have a copy of the emergency sheet at your parents’ house, for instance. Only you can decide what’s going to work for you.

I love this idea! It never occurred to me to use affirmations as passwords!

Such a fun idea, I love write more!!!

Help, what’s the last one say? I won’t be cracking passwords anytime soon. 😂

Do they egg you on and keep you creative?

O should be O. Zero should be Ø. Capitals get underlined.

This is genius!!!

I used to love doing that

A password manager is a place where all of your sticky notes are encrypted, salted, and hashed preventing most hackers from accessing them, even in event of a breach.

All you need to remember is ONE strong password such as tigglebittys1886Fr33edumb$32$.

Remember that password. You can do it. Everyone can. You have one job. You never need to remember any other passwords again thereafter. If you can’t remember 1 fucking password, you are no longer my mom

When I need to memorize a password, I do full sentences now. Like "My dog is the ruler of the house." Not random, but when you consider that you can't partially crack a hash and the infinite combination of words to make sentences, it's going to be nontrivial to crack.

It also depends who the threat actor is and what kind of password it is.

Is it something that an attacker can easily try millions of different attempts against (such as a crypto wallet that was stolen by malware), then you want something reasonably complex.

If it's a service such as NetFlix or Gmail, an attacker is only going to get a handful of guesses before their IP is blocked or they start getting served CAPTCHAs or similar. Combine that with less technical users (such as my elderly parents) who might rarely type in their password, and you want something that is easy to remember, such as a group of common words or a sentence.

(Disclosure: I'm the author of a Diceware implementation.)

Yeah no one is gonna guess that! What sites do you use that for? 🤣 Remember any comment you make online like this gives a threat actor information to try and crack your passwords. General concepts are ok but anything specific gives them advice on an approach to cracking it.

You nailed it. To remember the password, it’s an easy way to avoid forgetting it.

+1

it’s been known for a while and is so dumb most sites still require the “complex” characters and sometimes even limit which special characters you can use. I’m glad most orgs have gotten rid of having to change your password every 60 days as it’s been shown people will pick really simple passwords to remember or start writing it down.

Way to miss the point

4 words from a dict of 2000 is 2000^4, or about 2^44

A single word from a much larger dict (Randall uses a 64k dict) with common patters is only 24 bits of entropy

Now you could argue that 2^44 isn't enough nowadays. With bcrypt or scrypt you're likely to be limited to aout 2^8 hashes per second, so about 2^36 seconds or 2000 years to run through it.

A truely random 12 character password from a set of say 96 characters would be 2^79, or around the same as a 7 words from a 2000 word dictionary

Good luck getting people to actually choose and remember that type of password

It doesn't mean numbers and special characters are not important. But it does mean a very long password with only letters is much better than a shorter one (let's say less than 10 characters) with numbers and symbols. Of course, a long password plus numbers and symbols is stronger.

The point is that you don't make it overly complex so it becomes difficult to remember. For example, passphrase (4 to 6 words) + symbol + 4 digits is fine. If you add words separators like dots or hypens that increases strenght in a simple way.

For example, KineticParticleEquallyMotion$23 is preferred than Tr0ub4dor&3 if you want to remember it easily.

As for personal strategy, I want the master password to be simple to type and simple to remember. The fact that Bitwarden supports 2FA makes me worry less about complexity as an attacker would need to obtain both.

For the rest of most of the online accounts I do create overly complex random generated passwords (over 32 characters, including numbers and symbols). With the password generator integrated into Bitwarden. Specially for those services without 2FA.

My router's WiFi password is very long. And I use QR codes if I need to add new devices (IoT devices are a special case). Something like:

673AEHKT#BgpRch*$!kkuGE86chAlqG!^Xl378Y!%d#z3^#WNO3C#dYjeY85gd7q

In summary, longer and simple beats shorter and complex. But long and complex beats long and simple. If ease of recall is the priority, choose long and simple.

I use the "Correct Horse Battery Staple" framework (if I may call it that way 😁). It's based on an XKCD comic. https://xkcd.com/936/

The idea is to that you make a passphrase instead of an overly complex password that you might easily forget. Focus is on length instead of complexity.

Since 2FA is enabled on my account I don't worry too much about the password looking "simple" (dictionary words, no numbers or symbols). Usually I get 20 to 30 characters which is fine for me.

For inspiration:

https://www.correcthorsebatterystaple.net/

the use of special characters and symbols are seen as more important than they are.

when a password is cracked their are different ways to approach how to guess or crack the password. many use the a dictionary attack the easiest attack

but password strength can not be measured just on it's strength but in how it is used. for instance if I required every user to have a long complex password some users will write it down close by or any of the other poor password management.

NIST used to recommend companies force their users to have complex passwords that change often. it turns out to be horrible advice, people having to change passwords often causes issues and if you force very specific rules those rules work against you.

take for instance you have guess a password you have no idea length or composition (upper/lower/number/symbol) there is no guaranteed "best approach"

BUT if you have to guess a password and you know they have to have 8-12 characters no "words" and you must have one upper, one lower, one number, one symbol. That is something we could have someone write a script to come up with every combo.

So while symbols and numbers to add complexity their complexity makes it harder to use.

my old master password was 10 characters and LEEET speak inspired numbers/letters/symbols bitwarden says it is 12 days to crack

my new master password is a rare phrase and is 18 characters all letters and would take 3 years to crack

TLDR: phrase or random word passwords are a minor trade off of strength for usability

Pick a random obscure quote you've never shared with anyone that you like and keep the first (or last if you're paranoid) letter of each word and keep the punctuation.

Example:

"He who hates does not know God, but he who loves has the key that unlocks the door to the meaning of ultimate reality." -MLK

password: HwhdnkG,bhwlhtktutdttmour.

The paranoia here is hilarious. What do we have that picks random passwords for you all the time and you trust it to keep it all safe. Maybe just open that (bitwarden obviously) 🫣 and make it pick whatever amount random words you need, write it down and remember.

This Wikipedia article does a good job at explaining the length-vs-complexity tradeoff, but basically these are about equally strong:

• 8 uppper/lower/symbol/digits (7Sm##ndP4)
• 11 lowercase (trvtuovmynt)
• 4 diceware words (correct horse battery staple)

So, the best choice really comes down to if you will be auto-filling, typing, or remembering the password.

If a password makes you cringe just thinking about saying it out loud, congratulations you’ve probably just created the ultimate scam-proof security.

My password is Donald Trump sucks

Only Remember a few important ones then use a password manager to generate all others. Never have any password overlap between any service.

Also scammers, just remember no one ever needs your PW but you, if it's really your bank or the tax man they have access to see what they need already.

Honestly, this might be the most unhinged but genius cybersecurity advice I’ve ever read fear of social shame might just save our bank accounts!

Wtf? Who falls for this?