> We all want good passwords, but if it's too much for users
> they'll actually end up creating a less secure situation...
Exactly. Another example of security theory failing to respect reality. Security theory is often impractical to the point of being untenable.
Passwords like "secret" or "happy" or "monday" are a little too simple, as are children's names or birthdays or other such things. Hackers can easy scan for these relatively simple choices. On the other hand, passwords like "DKipx8b3qw4" are too cryptic to be remembered by users -- they will write them down, and in a conveniently accessible location.
And let's face it, if the hacker is using a brute force approach or has a back door or decryption -- well, it really doesn't matter then does it? So we're really interested in stopping the casual snooper, and the inexperienced or lazy hacker.
Things like arbitrary two word combinations -- dogChop or fleaDish -- work well, as does sticking an arbitrary number in -- dog2Chop or flea4Dish -- or varying the punctuation -- dOgchoP or FleAdish. These passwords are drivel and will defeat most dictionary based crackers, but are simple enough for users to remember as they can be pronounced.
There are other schemes, but the key is to make it easy enough for the user to remember so they'll use it w/o writing it down.
5 Replies
727 Views