What's a good system to learn new passwords?

Feb 19, 2001
20,155
23
81
Say you want to learn a new random password that's generated. Beside making mnemonics which might not be possible everytime, are there other systems out there to help you learn 12+ character random passwords?

I forced myself in college to learn a couple and that's because we were assigned random passwords for our logins and every year I'd try to learn the new one... but it's been a while and I should probably learn a few new passwords given how many breaches have occurred in the past 5 years.
 

K7SN

Senior member
Jun 21, 2015
353
0
0
You really want to never loose or forget a password nowadays. Avoid things a competent but nefarious person can figure out or guess. When I was a kid, we'd have secret decoder rings that shifted letters a number (the code) of characters so if the code was two (2) an 'A" became a 'C', a B became and 'D',..., a 'X' became a "Z', a 'Y' became an 'A' and a 'Z' became a 'B' - Decoding was easy as you turned your wheel two negative two place and you could move your 'C' back to an 'A', etc.. I was a curious kid and soon took the challenge to decode without the code which is easy because there are a whole bunch of 'T's, Vowels, and not to many 'Q's, 'X's and 'Z"s - when I was in the service each civil engineer (I was an A/C Tech) had a storage locker in a main boiler room locked with a Sesame Lock Each lock had 10,000 combinations (0000, 0001, 0002, ... 9999) and you could reset them any time you wanted (Sort of a password) because in theory you could give your code to another to fetch a tool and at the end of the shift, change your combination. This bored E-4 found out you could open 90% of the locks with the combinations from 1920 to 1968 as people took the year they were born, wed, drafted, graduated High School or first got lucky, etc.. The civilian co-workers would keep their lunch so I'd change their combinations and hold their lunch hostage for five minutes to the amusement of all but the victim. Most of user generated passwords use the same stupidity coping with such mandated rules as using (3of4) upper and lower case, number and special characters. This yields "&1fast427Ford" and "MyxLoved-M&Ms" but a truly random generated password is almost impossible to hack in meaningful time because you can apply heuristics. The problem is you have to carry the dang thing written down and stuck in your desk, wallet or shoe which is inconvenient at least and risky at worse. Besides things people can access your desk, digging out your wallet is a pain and who wants to have to take a shoe of to log into ANandTech. I keep all of mine in a notepad file but with simple encryption so if they hack that file, they still have a lot of work to do. Now coming up with a simple encryption isn't difficult if you know the alphabet, have a QWERTY keyboard, etc.. Encode it, store it in a plain view, even on a sticky note stuck to your computer and decode it as you enter it until you memorize it. Example: use your keyboard and go left some number to encode and right the same number to decode but use truly random generated real passwords. Example (left 1) makes middle row an 'A' a 'L'. a 's' an 'A', a colon a "double quote, bottom row a 'Z' a 'M', a 'X' a 'Z' a comma is a fo9rward slash and a question mark is a '<' you can see the pattern with numbers only yielding other numbers, low case letters encoded to other lower case letters, upper case letters encoded to other uppercase letters, and the rest (special characters) which are on all four rows - converted to other special characters. That scheme makes it easier to crack because you have a pattern but it is easy to change and you don't have to remember (until you really do remember) the pattern .Besides if you can remember the complex password, it is time to change your password anyway. You can do tricks like not encoding some letters or numbers if the clown in the next cubical fancies himself a code breaker. Simple rules to encode and decode random passwords are easier than trying to come up with mnemonics for today's random generated password. The point is there should be something you keep in your mind and don't write down even if it is a simple as shift one left to encode and one right to decode. A good creative mind an come up with more encoding schemes than a 'cracker' can figure out.
 

TheRyuu

Diamond Member
Dec 3, 2005
5,479
14
81
You use a password manager. That way you dont have to remember.

(ok you still have to remember one in that case but it by no means has to be something completely random, you're just looking for enough entropy to make it hard).


This sounds needlessly complicated. Just use a password manager with a master password that you can remember and then RNG the rest.
 
Last edited:
Feb 19, 2001
20,155
23
81
You use a password manager. That way you dont have to remember.

(ok you still have to remember one in that case but it by no means has to be something completely random, you're just looking for enough entropy to make it hard).



This sounds needlessly complicated. Just use a password manager with a master password that you can remember and then RNG the rest.
I use a password manager, but it still helps to have a couple of GOOD passwords memorized. For example, you probably want your iCloud account or Gmail account to not have a 100 character random password on KeePass because it will make wiping your device a pain in the butt when you have to setup a new device.
 

K7SN

Senior member
Jun 21, 2015
353
0
0
I agree if his password manager can be consider secure to outside (cracker) influence. I was giving him a I agree (not simple) but not too complex set of possibilities like you would need in a cubical office.
 

lxskllr

No Lifer
Nov 30, 2004
59,391
9,919
126
I use a password manager, but it still helps to have a couple of GOOD passwords memorized. For example, you probably want your iCloud account or Gmail account to not have a 100 character random password on KeePass because it will make wiping your device a pain in the butt when you have to setup a new device.

Use a long passphrase. It doesn't have to be random to be good enough.
 

John Connor

Lifer
Nov 30, 2012
22,757
618
121
I have a system where I use the first letter of the lyrics of a song, add some numbers and symbols. And I read that Bruce Schneier uses the same method.

So say you use the song Happy Birthday. So your password would be just using the letters: HBTY. Happy, Birthday, To, You. Add some numbers and symbols how you see fit. Maybe, H@B@T@Y1234.
 

John Connor

Lifer
Nov 30, 2012
22,757
618
121
You really want to never loose or forget a password nowadays. Avoid things a competent but nefarious person can figure out or guess. When I was a kid, we'd have secret decoder rings that shifted letters a number (the code) of characters so if the code was two (2) an 'A" became a 'C', a B became and 'D',..., a 'X' became a "Z', a 'Y' became an 'A' and a 'Z' became a 'B' - Decoding was easy as you turned your wheel two negative two place and you could move your 'C' back to an 'A', etc.. I was a curious kid and soon took the challenge to decode without the code which is easy because there are a whole bunch of 'T's, Vowels, and not to many 'Q's, 'X's and 'Z"s - when I was in the service each civil engineer (I was an A/C Tech) had a storage locker in a main boiler room locked with a Sesame Lock Each lock had 10,000 combinations (0000, 0001, 0002, ... 9999) and you could reset them any time you wanted (Sort of a password) because in theory you could give your code to another to fetch a tool and at the end of the shift, change your combination. This bored E-4 found out you could open 90% of the locks with the combinations from 1920 to 1968 as people took the year they were born, wed, drafted, graduated High School or first got lucky, etc.. The civilian co-workers would keep their lunch so I'd change their combinations and hold their lunch hostage for five minutes to the amusement of all but the victim. Most of user generated passwords use the same stupidity coping with such mandated rules as using (3of4) upper and lower case, number and special characters. This yields "&1fast427Ford" and "MyxLoved-M&Ms" but a truly random generated password is almost impossible to hack in meaningful time because you can apply heuristics. The problem is you have to carry the dang thing written down and stuck in your desk, wallet or shoe which is inconvenient at least and risky at worse. Besides things people can access your desk, digging out your wallet is a pain and who wants to have to take a shoe of to log into ANandTech. I keep all of mine in a notepad file but with simple encryption so if they hack that file, they still have a lot of work to do. Now coming up with a simple encryption isn't difficult if you know the alphabet, have a QWERTY keyboard, etc.. Encode it, store it in a plain view, even on a sticky note stuck to your computer and decode it as you enter it until you memorize it. Example: use your keyboard and go left some number to encode and right the same number to decode but use truly random generated real passwords. Example (left 1) makes middle row an 'A' a 'L'. a 's' an 'A', a colon a "double quote, bottom row a 'Z' a 'M', a 'X' a 'Z' a comma is a fo9rward slash and a question mark is a '<' you can see the pattern with numbers only yielding other numbers, low case letters encoded to other lower case letters, upper case letters encoded to other uppercase letters, and the rest (special characters) which are on all four rows - converted to other special characters. That scheme makes it easier to crack because you have a pattern but it is easy to change and you don't have to remember (until you really do remember) the pattern .Besides if you can remember the complex password, it is time to change your password anyway. You can do tricks like not encoding some letters or numbers if the clown in the next cubical fancies himself a code breaker. Simple rules to encode and decode random passwords are easier than trying to come up with mnemonics for today's random generated password. The point is there should be something you keep in your mind and don't write down even if it is a simple as shift one left to encode and one right to decode. A good creative mind an come up with more encoding schemes than a 'cracker' can figure out.


Paragraphs, Robert. Paragraphs!
 

PrincessFrosty

Platinum Member
Feb 13, 2008
2,300
68
91
www.frostyhacks.blogspot.com
pass phrases are good replacements but you need to make sure that words are randomly picked and that you have at least 4 words in the passphrase for reasonably security vs 12 length characters as combined dictionary attacks are generally speaking just as fast against passphrases as brute force is against random chars. You have more unique symbols (words instead of chars) but you generally use a much shorter length.

There's no easy way to commit pure randomness to memory, you're often better off picking something you can re-construct but in an overly obscure way. Take a long word and do replacements on certain characters, not 1337 speak style replacements like o for 0 but more obscure ones like "a" to "%", mix in some capitalization.

What makes patterns bad is that they're easy to predict but hackers aren't mind readers they simply go for what is common behaviour, so every hacker worth his salt will make crack attempts with a dictionary list that is modified with a mask for example to check for 1337 speak replacements, but no hackers have a mask that replaces "a" with "%" it's just too obscure.