PrimeEagle
Active Member
I've also used words from multiple languages, all misspelled. Yours is a good idea, too!
Native Instruments Acct. Stolen! (again)
- Thread starter dijon
- Start date
NeonMediaKJT
Senior Member
did you get this solved after the second breach?
Zedcars
Klaatu barada nikto
Random dictionary words are not good advice. 3 words can be brute forced in seconds. 4 words in a few days. Determined hackers will gain access to your account if they really want to. Password managers are the best solution.
paul.reviews
His TL;DR Summary:
“Don't use words in passwords. Ever.
Don't try coming up with secure passwords, apart from the one protecting your password manager.
After adopting a solid password manager, don't give passwords another thought... let it do the hard work for you.
If you insist on tweeting "3 random word" advice, provide evidence to substantiate its security.”
_____________________________
A better solution is coming (both Apple and Google are actively working towards improving account security from a user’s perspective):
screenrant.com
Passwords: Using 3 Random Words Is A Really Bad Idea!
In 2015, the UK government released an article advocating the use of 3 random words in passwords, citing "pragmatism and algorithmic strength against common issues like brute force attacks". #Thinkrandom when creating passwords – #use3randomwords to make them https://t.co/6BlS8EqK7v...
paul.reviews
His TL;DR Summary:
“Don't use words in passwords. Ever.
Don't try coming up with secure passwords, apart from the one protecting your password manager.
After adopting a solid password manager, don't give passwords another thought... let it do the hard work for you.
If you insist on tweeting "3 random word" advice, provide evidence to substantiate its security.”
_____________________________
A better solution is coming (both Apple and Google are actively working towards improving account security from a user’s perspective):
How Apple Plans To Replace Passwords On iPhones, iPads & Macs
Eliminating passwords is becoming a trend.
screenrant.com
jcrosby
Senior Member
And Microsoft. But reality is what it is and this will take time before normalized and the kinks are worked out so common sense/best practices still apply for the time being...Random dictionary words are not good advice. 3 words can be brute forced in seconds. 4 words in a few days. Determined hackers will gain access to your account if they really want to. Password managers are the best solution.
Passwords: Using 3 Random Words Is A Really Bad Idea!
In 2015, the UK government released an article advocating the use of 3 random words in passwords, citing "pragmatism and algorithmic strength against common issues like brute force attacks". #Thinkrandom when creating passwords – #use3randomwords to make them https://t.co/6BlS8EqK7v...
His TL;DR Summary:
“Don't use words in passwords. Ever.
Don't try coming up with secure passwords, apart from the one protecting your password manager.
After adopting a solid password manager, don't give passwords another thought... let it do the hard work for you.
If you insist on tweeting "3 random word" advice, provide evidence to substantiate its security.”
_____________________________
A better solution is coming (both Apple and Google are actively working towards improving account security from a user’s perspective):
How Apple Plans To Replace Passwords On iPhones, iPads & Macs
Eliminating passwords is becoming a trend.
The Paul reviews article uses an example of offline brute force attack where the actual hashed password database is stolen and brute forced offline (using some very powerful computational horsepower). In a brute force attack against an actual live system your three or four words are going to be secure for a long time (assuming you avoid password re use, let’s leave 2FA out of this for a moment and focus on passwords alone)
Which brings me to the point, in cyber security there is a concept known as ‘assume breach’ we use the methodology to design systems that can minimise damage when you get hacked. Note I say when! Assume Breach means in simple terms you will be compromised at some point so assume the attacker is already in your systems and design your defenders around that.
Applying this methodology to passwords means in simple terms do not re-use passwords on multiple systems (sites) and implement a second factors of authentication where possible.
A stolen password hash can’t be partial matched only fully matched so with three words for example dogfishmarmot if and attacker try’s dogcatporpoise they don’t know they have got dog correct and must try every permutation until a full match is achieved.
TLDR Three words is fine, four is better five better still. Just DO NOT REUSE PASSWORDS! And use a password manager.
Which brings me to the point, in cyber security there is a concept known as ‘assume breach’ we use the methodology to design systems that can minimise damage when you get hacked. Note I say when! Assume Breach means in simple terms you will be compromised at some point so assume the attacker is already in your systems and design your defenders around that.
Applying this methodology to passwords means in simple terms do not re-use passwords on multiple systems (sites) and implement a second factors of authentication where possible.
A stolen password hash can’t be partial matched only fully matched so with three words for example dogfishmarmot if and attacker try’s dogcatporpoise they don’t know they have got dog correct and must try every permutation until a full match is achieved.
TLDR Three words is fine, four is better five better still. Just DO NOT REUSE PASSWORDS! And use a password manager.
JokerOne
Active Member
good points.
JokerOne
Active Member
"Its a damn poor mind that can only spell a word one way" -- President Andrew Jackson.
novaburst
Senior Member
I guess it's something like your quote but if you consider items purchased that can be pretty costly, you need to stop the hacker from using that software for free, plus the disruption, and stress, these things can course, any website needs to be a very safe place if there are any transaction with money, so yes maybe a password change here and there but it all must rely on the security of the web page,
JokerOne
Active Member
my only problem would be I would forget how I misspell them.
I have over 300 websites with logins. Many I haven't visited in years. I have one long cryptic master password if I need to change, lookup, a specific password. I let the password manager manage it. Its not a perfect system, but if one of these mom and pop sites gets hacked, the unique password the hacker now has is only good for the site they just hacked none of the others.
this works better for me than something like NostrommoDeethStarGalileoSeven7
Some sites require special characters etc.
My method DOES NOT WORK if you are on a public computer or common computer where someone you work with or the next person using your computer has access to it.
I also don't use my phone to login anywhere.
I think the advice given above about assume your password has been hacked and act appropriate is good advice.
thanks.
PrimeEagle
Active Member
It's two different things. For someone hacking a website, it's entirely up to them to be more secure to try and prevent that. But for someone hacking your password only, it's mostly on you.
PrimeEagle
Active Member
It should work. One thing you can do is use Incognito mode, so the browser doesn't save any cookies. Another is to clear the browser cache when you're done. And of course, make sure you're logged out of your password manager. Another option is to use the password manager app on your phone and type it in manually, which is a pain but it works.
dzilizzi
Senior Member
I'm thinking more Lord of the Rings Elven names. Nothing from movies. You have to go to the books. Or create your own language. Then you don't need too fancy a password.my only problem would be I would forget how I misspell them.
I have over 300 websites with logins. Many I haven't visited in years. I have one long cryptic master password if I need to change, lookup, a specific password. I let the password manager manage it. Its not a perfect system, but if one of these mom and pop sites gets hacked, the unique password the hacker now has is only good for the site they just hacked none of the others.
this works better for me than something like NostrommoDeethStarGalileoSeven7
Some sites require special characters etc.
My method DOES NOT WORK if you are on a public computer or common computer where someone you work with or the next person using your computer has access to it.
I also don't use my phone to login anywhere.
I think the advice given above about assume your password has been hacked and act appropriate is good advice.
thanks.
JokerOne
Active Member
those are two things I always forget to do.
Pretty much every movie / tv show / book / musical artist / video game / song title and lyrics are in the 'hackers database' already, as are most conceivable date combinations, name spelling variations, and slang words etc. You need pretty convoluted strings of random characters to safeguard nowadays. Don't forget theres a HUGE scene working on this day in, day out, and have been for the past 30 years.
Safest thing you can do is use 'password' as your password, but don't tell the hackers.
Seriously though, use a different password for every single account you own online and keep them in a secure document, or use 1passsword etc.
erica-grace
Senior Member
Interesting discussion.
Why cant you use special characters form the character map? Does that not make passwords more secure?
Why cant you use special characters form the character map? Does that not make passwords more secure?
JokerOne
Active Member
It maybe dependent on each site as to how they are stored (accepted). Give it a try and see if it works.
