Passwords are a part of our every day lives and once again they’ve come up in the media. Not too long ago Gawker Media informed that public that their user databases had been compromised exposing the passwords of roughly 1.3 million commenters. Soon afterward, various news outlets started talking about analysis of the passwords and criticizing the large number of weak passwords found in the data.
I think such talk is rather foolish – there is definitely a place for weak passwords in our everyday lives.
In a perfect world, every system you ever use would allow you to enter a password consisting of any character you like and be of any length. The human brain would have database style memory retrieval with the precision accuracy it would take that would allow you to instantly use a unique password for every system.
In reality, the human brain can’t possibly be expected to remember a unique password for each and every service that requires a password. To remedy this applications that keep track of your passwords have popped up. I do not think that such programs are a good idea for a couple of reasons. First and foremost, by using such applications it becomes imperative that the database used by the respective program is extremely well safeguarded and that the master password or key file used to gain access to the password store is guarded with one’s life. It follows that should an unscrupulous individual gain access to your password store there’s great potential for some serious damage. Another problem with password stores is that it becomes imperative that one always has access to a computer that has a copy of the program being used as the store in order to look up their passwords.
Personally, I prefer being able to derive my own passwords. This way I can access them anywhere I happen to be, there’s no program to safeguard and there’s no worry that someone will gain access to all of my passwords. In order to create a derivable password I start with a phrase or sentence that I can easily remember. For example, take the following sentence:
I, Michael Tozzo, am happy 365 days a year!
Taking the first letter of each word of the above sentence and leaving the numbers and punctuation in place yields the string “I,MT,ah365day!” which makes for an excellent password as it contains a mix of upper and lowercase letters, numbers and punctuation characters. You can easily customize a password like this by injecting something related to the site it’s being used on. For example, if I want to use the previous password on “facebook.com” I can make the first, third and fifth letters the first 3 letters of the site. This would make my password “fIa,cMT,ah365day!”. I use this method to come up with some really secure passwords that I use for my banking, my web hosting and other important things. I only use one or two key phrases for my passwords so I would have not been impressed if I lost one of them to a website where I merely go to post comments. I actually did have a relatively easy to guess password compromised by the Gawker Media fiasco as I have a commenter account on Kotaku. Did I scramble to change my passwords across multiple websites? Nope. Was I worried that anything of real importance was vulnerable? Nope.
An application like KeePass has a place for some people though, mainly those that need to keep track of many many passwords as part of their profession. Rarely does a person that needs access to a multitude of user names and passwords find themselves away from a computer so access is not an issue. It’s also not easy remembering another person’s password as it won’t have any meaning to you since you have no control over it.
The last thing I want to touch upon are issues related to the other side of passwords – how they are handled by the services that accept them. One of my biggest pet peeves when it comes to passwords are restrictions on the length of the password and viable characters in my password. If I want to use a password that’s 20 characters long or that contains something other than letters and numbers I should be able to without issue. Not only do I have to make exceptions to my own personal derivation rules, I’m forced to use a less secure password. A password consisting of only letters and numbers can be broken very quickly using brute force methods (trying every combination of letters and numbers). My other pet peeve relates to sites that allow an unlimited number of attempts at entering a password. Even Twitter had a breach related to the gaping security hole that the ability to carry out an unlimited number of password entry attempts provides. Your online banking site of choice will always lock you out after a certain number of failed attempts for this very reason.
Well, that’s all I have to say about passwords. I hope you learned something. 
.