Slashdot | Password Memorability and Securability

Anonymous Patron writes “This Slashdot Thread pointed the way to This PDF Report on the memorability and security of passwords.

They did a study in which groups of students were studied for password usage. They say they observed a number of phenomena that run counter to the “established wisdom” on good password selection. My password for everything is 1234, is that bad?”

May 24, 2004 by Uncategorized 5

You may also like...

5 Responses

  1. kmhess says:
    May 24, 2004 at 11:28 pm

    Good stuff
    Bear in mind most problems (I wish I could find a percentage) are caused by human factors: people writing down their passwords in full view, or giving their info over the phone, etc. Ironic how the “random” method basically forced people to walk around with their password written down!

    Reply
  2. Porch Geese says:
    May 25, 2004 at 2:01 am

    Re:Good stuff

    Ironic how the “random” method basically forced people to walk around with their password written down!

    This is exactly why the “mnemonic phrase” method was created. It is pseudo-random. That is to say, it is based on a formula that is sufficiently difficult to operate in reverse.
    For example “tbatstdgaginw” is a seemingly-random password that would be difficult to guess and is unlikely to succumb to a dictionary search. But if I showed you: Twas brillig and the slivey toves Did gyre and gimble in the wabe”, you’d be able to remember the password easily enough to (hopefully) not have to write it down. Choosing a more personal, and hopefully esoteric, phrase might make it that much more secure.

    Reply
  3. Anonymous Patron says:
    May 25, 2004 at 7:38 am

    Patterns
    I like to make passwords that are a pattern on the keyboard. Although the letters are nonsense there is a pattern behind them. For example,

    zxzxcc, qwerty, poiuy, q1w2e3

    Try typing these and they make more sense.

    Reply
  4. Anonymous Patron says:
    May 26, 2004 at 3:42 am

    Re:Patterns
    And there are already password-cracking software systems that incorporate adjacent-key patterns as a supplement to the dictionaries they use for brute-force attacks.

    Reply
  5. Anonymous Patron says:
    May 26, 2004 at 8:16 am

    Re:Patterns
    If somebody wants to brute force into my Yahoo account they are welcome to. I am not guarding nuclear secrets so I only need a password that will keep out nosy people.

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

LISNews Archives