ProZ.com Translation Forums

How to invent a password | Misquoted!

Oliver Walter — Sat, 14 Aug 2010 22:21:00 +0000

Forum: Safe computing
Topic: How to invent a password
Poster: Oliver Walter
Post title: Misquoted!

Jessica, you've misquoted! Those words were Neil's, not mine! :P

Oliver

How to invent a password | "Pass phrase" -- easy to remember

Jessica Noyes — Sat, 14 Aug 2010 21:13:00 +0000

Forum: Safe computing
Topic: How to invent a password
Poster: Jessica Noyes
Post title: "Pass phrase" -- easy to remember

[quote]Oliver Walter wrote:
Another common method you consider is to think of not a password but a pass *phrase*, and then make your password consist of the first (or second/last) letter of each word in the phrase.
[/quote]

Yes, the beauty of a "pass phrase" is that you pick an inspirational, wry, or funny quote, and the quote itself is easy to remember. The advantage is that you don't need to write it down and take it with you if you're traveling. I like your idea of using the second letters, but I use the first, turn some of the letters into numbers, and punctuate. Thus: "Line of least resistance, lead me on," becomes L0lrlm0! (those are zeros, not o's).

How to invent a password | Banks: not only a password

Oliver Walter — Sat, 14 Aug 2010 09:25:00 +0000

Forum: Safe computing
Topic: How to invent a password
Poster: Oliver Walter
Post title: Banks: not only a password

[quote]Neil Coffey wrote:
That said, I think criminals will tend to be more bothered about doing this for your Swiss bank account than your ProZ account...
[/quote]
There's no point in their trying to do that unless (a) I have a Swiss bank account, and (b) I have online access to it.
But, more seriously: I have seen the login procedure for several UK banks, and they tend to be like this:

Your username is an 8-digit account number or a form of your date of birth plus a sequence number.
To log in you need to know more than one of the following: a password, a 4-digit PIN (Personal Identification Number), a memorable name or fact, a memorable date.
The login process asks you for a randomly selected 3 or 4 characters from your password, 2 or 3 randomly chosen digits from your PIN and a randomly selected one of the names, facts or date.

This will provide some protection against "keyloggers" that could be present on your own computer if your malware security is not good enough, or on a computer that you might use in an Internet cafe - I guess some of them may contain keyloggers.

Oliver

How to invent a password | keychain

Brian Young — Sat, 14 Aug 2010 04:45:00 +0000

Forum: Safe computing
Topic: How to invent a password
Poster: Brian Young
Post title: keychain

This is a little application that is part of the Mac operating software. I have it on my Macbook. I store all of my various passwords and other related info in the keychain. I get automatically logged in to most sites, though some don't allow that. My Mac can only be opened with a password, so I really only need to remember that one password. The Mac has two levels of protection, and if it is password protected at the firmware level, it is impossible to hack into.
The keychain contains information for those sites that do not allow automatic log on, but it is easy to find if I need it.

How to invent a password | I do

Tina Vonhof (X) — Sat, 14 Aug 2010 03:11:00 +0000

Forum: Safe computing
Topic: How to invent a password
Poster: Tina Vonhof (X)
Post title: I do

[quote]Neil Coffey wrote:

[quote]Tina Vonhof wrote:
How do you remember which password you used for what???
[/quote]

You don't. You write them down.
[/quote]

Yes of course I have them written down but that is what you are always told not to do....
I actually do have my own password system: I use a short phrase in my mother tongue that is relevant to the particular site (most sites I need such as my bank etc. are English language sites) and then add a number that is meaningful to me - similar to what Oliver suggests. I don't know if these can be cracked but at least I can remember them.

How to invent a password | You don't need to remember passwords

Neil Coffey — Fri, 13 Aug 2010 23:03:00 +0000

Forum: Safe computing
Topic: How to invent a password
Poster: Neil Coffey
Post title: You don't need to remember passwords

[quote]Tina Vonhof wrote:
How do you remember which password you used for what???
[/quote]

You don't. You write them down.

How to invent a password | Sorry, that's your problem!

Oliver Walter — Fri, 13 Aug 2010 22:52:00 +0000

Forum: Safe computing
Topic: How to invent a password
Poster: Oliver Walter
Post title: Sorry, that's your problem!

[quote]Tina Vonhof wrote:
How do you remember which password you used for what???
[/quote]
I think you'll have to invent your own system for that! :o
A possible approach might be:

Invent a nice long-enough rememberable password
Have a simple method of adding to that basic password a prefix or suffix that indicates what you use it for

Example: if your basic password is ppppp, you could perhaps use the password
pppppProz for Proz,
pppppBank for the bank and
pppppISP for your ISP.

If ppppp is well chosen and can't be cracked, neither can these. (But of course, if it is known that you use a system like this, if ppppp is ever cracked, the real passwords would not be very difficult to determine after that, depending on what you use for "Proz", "Bank" etc.
Oliver

How to invent a password | One question

Tina Vonhof (X) — Fri, 13 Aug 2010 21:37:00 +0000

Forum: Safe computing
Topic: How to invent a password
Poster: Tina Vonhof (X)
Post title: One question

How do you remember which password you used for what???

How to invent a password | Another password safe

Oliver Walter — Fri, 13 Aug 2010 20:41:00 +0000

Forum: Safe computing
Topic: How to invent a password
Poster: Oliver Walter
Post title: Another password safe

[quote]Drew MacFadyen wrote:
There are some good password generators online
[url removed]
[url removed]
[url removed]

Most will let you set char length, whether to use alpha, numerical and punctuation as well.
[/quote] Yes, I am aware that password generators exist, though I have never used one. The first one I encountered was, IIRC, part of VMS on the VAX computer (anybody remember them?). I used my own passwords because I thought the machine-generated ones would be too difficult to remember. I have never looked at the ones you have listed, so I have no idea whether their generated passwords are easy enough to remember.
[quote]
If you are like me, and cannot remember passwords to save your life (and wish to update/change them every 3 months - a good practice) the a free opensource password safe like
[url removed]

is highly valuable.
[/quote]Yes, such password safes are very valuable. I use this one:
[url removed]
and my master "password" for it is more than 12 characters long and easy for me to remember, but not related to anything about me personally.

If, in the situation mentioned by Neil, someone manages to obtain a password of yours in its encrypted state from a server that stores it, I think you're likely to be in trouble, whatever the password is.

I spoke to a person this afternoon who has worked on servers and he told me: servers (i.e. their software) usually enable the administrator to specify settings such as how many failed login attempts to allow before locking an account, with a default value of 3. If the admin wants unlimited attempts, the server will warn of the consequences and advise this should be done only for test purposes.
Remember that with such a password safe, the (encrypted) database of passwords resides on your computer so only people with access to it (which includes outsiders who manage to smuggle malware onto it) can even get hold of that database, before being able to consider "cracking" it.

Well, even if you don't like my suggestions (or extensions thereof such as longer words or bigger numbers) for how to create a password (& let me stress again a password should never be literally one word) I hope this thread will make some Prozians think again about their passwords (those few of you there may be, that is, whose passwords are at present not good ones) and perhaps change the important ones into "good" ones.

Oliver

How to invent a password | Password generators

Drew MacFadyen — Fri, 13 Aug 2010 20:00:00 +0000

Forum: Safe computing
Topic: How to invent a password
Poster: Drew MacFadyen
Post title: Password generators

There are some good password generators online
[url removed]
[url removed]
[url removed]

Most will let you set char length, whether to use alpha, numerical and punctuation as well.

If you are like me, and cannot remember passwords to save your life (and wish to update/change them every 3 months - a good practice) the a free opensource password safe like
[url removed]

is highly valuable.

Drew

How to invent a password | On-line vs off-line attacks

Neil Coffey — Fri, 13 Aug 2010 16:44:00 +0000

Forum: Safe computing
Topic: How to invent a password
Poster: Neil Coffey
Post title: On-line vs off-line attacks

[quote]Oliver Walter wrote:
Question to anybody who really knows: are there in fact any systems that require a user to log in with a password, that permit an unlimited number of failed attempts without taking some action such as suspending the account?
[/quote]

It's likely that a lot would, and would also look at the *frequency* of attempts as well as the number per se.

There's also another type of attack to be aware of, whereby the attacker gets hold of the hashed version of the password stored on the site, and can then do an "off-line attack"-- essentially they don't actually need to make login attempts to try and guess the password, they just take the data they've stolen and run a process at their leisure, making millions and millions of guesses if they want, until they find the password that matches the hash from the stolen data.

That said, I think criminals will tend to be more bothered about doing this for your Swiss bank account than your ProZ account...

How to invent a password | Dictionary attacks...

Neil Coffey — Fri, 13 Aug 2010 16:40:00 +0000

Forum: Safe computing
Topic: How to invent a password
Poster: Neil Coffey
Post title: Dictionary attacks...

[quote]Oliver Walter wrote:
If you use a password as part of your procedure to use some service on a computer or the Internet, it is important for the password to be a character string that is in fact not a word, so that so-called dictionary attacks cannot discover it.
[/quote]

It's worth bearing in mind that dictionary attacks are a bit cleverer than you seem to be assuming, and do indeed look for sequences of words, sequences of words with numbers in between, sequences of words with "i" replaced by "1" etc...

Another common method you consider is to think of not a password but a pass *phrase*, and then make your password consist of the first (or second/last) letter of each word in the phrase.

You could also just created a string of random letters and write it down-- usually the threat you're trying to protect yourself against doesn't hinge around remembering your password or somebody physically having access to the piece of paper you wrote it on, just around somebody else in a remote place not knowing it.

(Still preferable: use something like TrueCrypt to have a virtual drive that contains all your passwords, and protected with just one strong passphrase that you can remember.)

How to invent a password | I did wonder about that

Oliver Walter — Fri, 13 Aug 2010 16:04:00 +0000

Forum: Safe computing
Topic: How to invent a password
Poster: Oliver Walter
Post title: I did wonder about that

[quote]efreitag wrote:
Dear Olivier,

I hope you know that you've just "burnt" your system? If I were a criminal, I'd have an easy way of breaking into your password protected accounts (banking, mail, with the additional chance of getting further personal information from the latter) now.

Not a good idea ... Time to change your system, I'm afraid.
[/quote]
When I was writing my post, I did wonder whether that would "burn" it.
I think that password-protected accounts would not permit even a few hundred attempts at breaking in; they would suspend the account either for a set period or until the owner takes some other action to contact the institution in question. In my experience, login attempts will not be permitted after about 3 failures.
The situation where my system would not be so good is to use such passwords for encrypting the contents of files (e.g. with Word, Excel or Winzip; to do this with Word or Excel, use Save As... and then select General Options from Tools) because a "password-recovery" program can then try as many times as it likes.
And, if anybody is interested, I do not use this system at present for online banking or email accounts.

Question to anybody who really knows: are there in fact any systems that require a user to log in with a password, that permit an unlimited number of failed attempts without taking some action such as suspending the account?

Oliver

How to invent a password | You've just burnt your system

Erik Freitag — Fri, 13 Aug 2010 15:45:00 +0000

Forum: Safe computing
Topic: How to invent a password
Poster: Erik Freitag
Post title: You've just burnt your system

[quote]Oliver Walter wrote:

[quote]Sergei Leshchinsky wrote:
Opnet Notepad and let your cat walk over the keyboard. ;) [/quote]
1. I don't have a cat (nor a dog or parrot),
2. such a password would be too long (I suppose I could take the first n characters),
3. it would be just a little more difficult to remember than the type I have described.
Oliver [/quote]

Dear Olivier,

I hope you know that you've just "burnt" your system? If I were a criminal, I'd have an easy way of breaking into your password protected accounts (banking, mail, with the additional chance of getting further personal information from the latter) now.

Not a good idea ... Time to change your system, I'm afraid.

Best regards,
Erik

[Bearbeitet am 2010-08-13 15:46 GMT]

How to invent a password | That would be too long

Oliver Walter — Fri, 13 Aug 2010 15:21:00 +0000

Forum: Safe computing
Topic: How to invent a password
Poster: Oliver Walter
Post title: That would be too long

[quote]Sergei Leshchinsky wrote:
Opnet Notepad and let your cat walk over the keyboard. ;) [/quote]
1. I don't have a cat (nor a dog or parrot),
2. such a password would be too long (I suppose I could take the first n characters),
3. it would be just a little more difficult to remember than the type I have described.
Oliver

How to invent a password | Good idea, Sergei.

Gudrun Wolfrath — Fri, 13 Aug 2010 12:37:00 +0000

Forum: Safe computing
Topic: How to invent a password
Poster: Gudrun Wolfrath
Post title: Good idea, Sergei.

Cats are ever so creative.

How to invent a password | creative approach

Sergei Leshchinsky - Serhii Leshchynskyi — Fri, 13 Aug 2010 11:44:00 +0000

Forum: Safe computing
Topic: How to invent a password
Poster: Sergei Leshchinsky - Serhii Leshchynskyi
Post title: creative approach

Opnet Notepad and let your cat walk over the keyboard. ;)

How to invent a password

Oliver Walter — Fri, 13 Aug 2010 10:04:00 +0000

Forum: Safe computing
Topic: How to invent a password
Poster: Oliver Walter

If you use a password as part of your procedure to use some service on a computer or the Internet, it is important for the password to be a character string that is in fact not a word, so that so-called dictionary attacks cannot discover it. It should also not be a word that names anything that other people know about you.
I have a simple method that you can use to invent passwords that are probably not crackable (except by "brute force" attack) and are fairly easy to remember.
This method gives passwords of 8 or 9 characters and you can easily see how to extend them by multiples of 2 or 3 characters.
The 8 characters consist of two 3-letter words and a 2-digit number; one of the words is in upper case and one in lower case; the number can be at the start, middle or end of the password.
Examples of 3-character words: one, two, six, ten, sky, sun, sea, his, our, its, ear, eye, toe, lip. The number is, of course, one of 00, 01, ... 98, 99.
Examples of passwords: ONE00one, tenTEN99.
I have calculated that using one of the 4 "number" words, this gives a total of 19200 possible 8-character passwords. You could use a 3-digit number (000-999), giving ten times as many possible passwords.
I hope this is useful, or at least of interest, to somebody.
(P.S. my Proz password is not one of these!)

Oliver