On 22/08/17 14:46, Brian wrote: > Wow! Can you suggest something which gives one teensy-weensy bit of > memorability? I do not recommend “memorable passwords” at all. The reasons are as explained next. If the password is not important (for example, account of web forums) then you can use store it in a plain text file or a password manager. Firefox has a built-in password manager which works fine. Here memorability does not matter at all, as you just have to copy and paste, or let the password manager fill it automatically. Anyway, one could not memorize enough passwords for all the things that require one (esp. web sites). If the password is important, then for a reasonable amount of entropy, a memorable password will be too long and VERY slow to input. I suggest the following approach: Generate a 3-bit long password, for example: mario@svetlana [0] [/home/mario] $ head -c 3 /dev/urandom | base64 w5eJ Write it in a paper or leave it in the terminal. Invent a mnemonic for it or just memorize as is. In this case, I can think of “_W_ill has _5_ fingers in _each_ _J_and (hand spelled wrong)”. Several times through the day, try to remember the password and *then* look at the paper or terminal to check. Allow yourself 1 day to memorize it, then if you used a paper, either *eat it* or chew it until it is an homogeneous blob and then spit it. Repeat this for several days. Your password at the end is the *concatenation* of all these 4-character chunks in the order generated. If at some point you get a chunk that is hard to memorize, you can discard it and try again. Discarding removes some entropy but I do not think it is significant (as a *rule of thumb*: You can choose the “best” of 4 tries for any block and lose only 2 bits of entropy; if you do this each block, then you still have 88 bits of entropy). To assure that each chunk gives the maximum amount of entropy (24 bits) you must commit yourself to use whatever is generated, that is, without discarding. Each chunk gives 24 bits of entropy. I recommend to use a 4-chunck long password, for 96 bits of entropy. In my opinion, there is no point in a longer password; the attacker would simply kidnap you and give you amobarbital instead of trying brute force. 5 chunks give 120 bits, which is IMO is enough for *any* password that can be trusted to a single person. For stronger security requirements, one should instead require N of M good passwords to unlock the ICBM and then distribute the individual passwords as appropriate. Regards. -- Do not eat animals, respect them as you respect people. https://duckduckgo.com/?q=how+to+(become+OR+eat)+vegan
Attachment:
signature.asc
Description: OpenPGP digital signature