Is Your Password Strong Enough?

I don't trust "How Secure Is My Password" to have and check my password.

EDITOR'S NOTE: Two points on that. (1) You're not providing your username, so even if you entered a real password, it would be useless without the context of the username. (And no, a website CANNOT learn your email address, unless you provide it.) (2) You can always enter a password similar enough to yours, to get an idea of how secure it would be.

Here's the site I use.

http://www.passwordmeter.com/

I keep track of my various passwords on a Rolodex, whick I deem to be safe enough, barring a home invasion.

I always wonder what secure site is going to let a password cracker sit there and try various passwords without locking the account? Most of these password cracking assumptions require the password accepting program to sit there and let them query it several times a second. Slowing or stopping this process isn't beyond the reals of possibility. I've implemented security on some of my severs that does this. Why would my bank let some ip submit 100 wrong passwords let alone a few million before shutting them off?

-I use one 16 combo random letter, upper & lower my and numbers . I use that password exclusively for infrequently visited sites like the one I vist and don't have a clue as to the password. I never change it

2-I add two exclamation marks at the end for sites I use often but not really in need of ultra strong security like forums (18) or email

3-I add to #2 the year of birth of my daughter for sites like Paypal or a web page

4-I have a separate 16 letter/number password phrase for my router and 35 letter/number/WPA2 for my router sign in to laptop etc They are written down in three places as I immediately forget them and might need them

Steve Gibson has said that the hardest password to crack is D0g. Takes a hacker longer to crack this than any other. Years??? Less than a second for even the strongest password. My bank uses two layers of questions before I even get to my password. So far so good.

I respectfully diasgree.

The first two sample passwords are strong only if you consider simple "brute force" attack. These sample passwords are actually quite WEAK because there is much text and context redundancy.

The third sample password is VERY STRONG because it is a sequence of INDEPENDENT characters.

Size matters LESS than randomness!

Hello Bob,
I would like to understand how these brute-force password crackers can work. Whenever I see them mentioned, they talk about how many attempts they can make per second, which seems contradictory to what my experience is with almost every website or program that I use. In almost all cases, there is a delay between entering a userid/password combo and the acceptance or denial. Plus most of them only allow a few attempts before shutting a person out.

EDITOR'S NOTE: Excellent question, and one I should have addressed in the article. You are correct that with most login systems there is a delay built in, and a lockout when a certain number of incorrect password attempts have been made. The "cracker" programs mentioned are used directly against a username/password database on a server. If a website's server is breached, the attackers can use their tools against the encrypted password database at high velocity. A similar attack can be used against a Windows password file.

As a teenager I knew a poet and remember a lot of his poetry.
He is now dead and none of his poems are on line.
The first letter of any line of his poetry are very secure passwords according to the site you gave.

I read somewhere to always "test" the lost password function on any site.

If they email the actual password and not a link to reset, using further security checks, then I'd seriously consider how safe that website and password actually are.

I shave the belly of my cat (he's a mean cat)and use a Magic Marker to write the passwords on his belly. After the hair grows back, you have to look closely to read the passwords. Anyone else trying to read them will end up with a LOT of scars!

I use 26 varied nonsensical characters for each of my passwords. I keep them stored in a unusual file location on my computer. When I need to use a particular password, I copy and paste it in. I never type in any passwords and all of my answers to the security questions are never truthful. I change passwords often.

C'mon now. How mean can that cat be if he will let you shave his belly!?

There are some good suggestions here, however even the best password can't protect you from someone cracking a database and downloading user passwords.

Which is what just happened to Twitter when someone stole 250,000 passwords.
http://www.prohackingtricks.com/2013/02/hackers-compromises-250000-twitter-accounts.html

I tried the secure password thing it said excelent but if i put same password on my yahoo it still says weak

I use the exellent program and app B-Folders 256Bit encrypted database on PC - Laptop - and Phones with one strong password to remember. Additionally the database is destroyed after 10 attempts to crack it.Syncronising between the units is a breeze.

Why is everyone obsessed with random, etc passwords when MANY sites won't even use ONE-WAY encryption of what you send in for login credentials!

And if you forget your password, MANY of these will send it back to you in a PLAIN TEXT email.

SHEESH! Check out --> https://defuse.ca/password-policy-hall-of-shame.htm

I often will use the first letters of each word in a long quote. I also use http://www.passwordchart.com which offers two layers of protection--the initial phrase which creates the matrix, and a unique word for the site you're accessing.

I use the first line of a poem by my favorite poet, and then add his initials and add an exclamation point.

My bank does not allow the use of characters above the numbers (ie @#*&$^). All I can use is letters and numbers. So although they encourage good passwords, they restrict your ability to create them, even restricting the length to something short.

Good article.

I was amazed when the breach at Equifax revealed my password. Here is a company, supposedly assisting me with security of my financial accounts, who somehow leaked my password. Do they not encrypt such information in a manner that would protect that information? From then on, I use a password generator that creates totally random unguessable sequences, and change them frequently. It's a pain, but better then the fear of potential consequences of a bad actor exploiting the next breach. I have lost trust in the watchdogs.