Security rule #1 regarding passwords is to not write them down. But we all have too many passwords to possibly remember. Here is a way to safely write down passwords.
All that's needed is a way to make the password you write down NOT be your real password, but be the input to a simple algorithm or mapping you can do in your head.
For example, your personal algorithm could be "remove all vowels and tack on the last 4 digits of my parent's phone number". When you sign up for a new account on some web site, you would create a password like "Rnbws8004" but what you write down is "Rainbows". Or your algorithm could be, "interleave the digits 4 2 0 3 between the consonants, eliminate the vowels, and put x's on the front and back", in which case you would set up the real password to be "xR4ain2b0ow3sx", but (as before) you would write down Rainbows.
You can't memorize 100 passwords, but you can remember one algorithm. If you never write down the algorithm, it is safe to write down the "seed" for the algorithm as if it is the password.
The key to doing this securely is to have an algorithm that's complex / odd enough no one can guess it or discover it by random testing. E.g. if your algorithm is "put 123 on the end", it's not safe.
About Me
- dvicci
- I’m a cycling fanatic in the information technology and security field with a bachelors in Social Welfare and a some training in the visual arts. I’m a son, a brother, a husband, and a father. I am good with my hands, still consider myself an artist, and could stand to lose a few pounds.
Tuesday, November 3, 2009
Mental Password Algorithms
Interesting...
Subscribe to:
Post Comments (Atom)
Writing down a bunch of "seeds", one per site, and having one algorithm, makes your passwords more predictable if so much as one password of yours is compromised.
ReplyDeleteIt's why, to date, I resist the urge to give anyone advice for securely managing many passwords. There are no genuinely good options if you don't have a good memory. It's part of why our options for authenticating a given transation are empirically flawed.