Ma stratégie de mots de passe
Sunday 7 March 2010 / 28 March 2015, by
Other versions of this article:
To protect your privacy, forget your passwords. Store them in a safe. Or don’t store them at all.
Frequently, I am asked to advise friends and colleagues on how to manage their passwords in order to have both good security and acceptable convenience. These days, with dozens of passwords needed and more and more privacy/safety issues, ordinary people (I mean non-professionals) are getting confused about their credentials and the complexity involved. Here is my personal answer.
Fragmented Suite for Piano and Bass Duke Ellington and Ray Brown 1972 → FSfPaBDEaRB1972 (this is just an example of course, not my own pass phrase; an excellent choice anyway. According to howsecureismypassword.net, It would take a computer about 609 million years to crack it. However, a password like “goofy2014” would take only 42 minutes.)
The personal pass phrase and the derived seed will never be stored anywhere except in your brain.
orches.tra+thepianoplayer, Master Key = FSfPaBDEaRB1972,sqG&Xaj0 (digit, punctuation and mixed case ticked, size 8)sqGGcaj-FjR2 (digit, punctuation and mixed case ticked, size 12)The very interesting feature of this tool is this: no password is saved anywhere, even in an encrypted form. They are re-calculated every time you need them, then vanish after use. Unstoppable: nobody can steal something that simply doesn’t exist.
At the same time, replace your old “qwerty” or “123456” so-called passwords with real ones.
(You may now shoot the pianist, he is armoured)
You may copy/paste the generated passwords; the password manager of your browser/mail client will generally remember them once you have used them for the 1st time. However, this is not safe if you didn’t set up a Master password to protect saved passwords (you may use your main seed “FSfPaBDEaRB1972” for this) plus a personal profile [3]. Even if you did, it is still not safe if you are using an old-fashioned browser/mail client, as those obsolete products (some are still available from their publishers, unfortunately) store password in an unsafe way. Anybody using a simple, free utility like SIW might discover them in seconds. So, do not allow an old browser/mail client to remember your passwords, or even better: do not use old browsers or mail clients. Never.
You may use this strategy not only for computer-related matters, but for many other things, for instance:
bicycle+thepianoplayer, Master key = FSfPaBDEaRB1972 → lock code = 267470 (digits only, size 6)suitcase+thepianoplayer, Master key = FSfPaBDEaRB1972 → lock code = 579736 (digits only, size 6)garagedoor+thepianoplayer, Master key = FSfPaBDEaRB1972 → lock code = 510303 (digits only, size 6)creditcard+thepianoplayer, Master key = FSfPaBDEaRB1972 → PIN code = 297672 (digits only, size 6)telephone+thepianoplayer, Master key = FSfPaBDEaRB1972 → PIN code = 470939 (digits only, size 6)(use only the first 4 digits here, as passhash ignores the size setting if less than 6, which makes sense to avoid weak passwords.)
So, my passwords are compliant with the following 5 requirements:
[1] Note: csync.org currently only offers the “portable page”, not the Firefox plugin itself; a back-up copy is still available here. The “portable page” is perfectly usable without the plugin.
[2] Except, as usual, Microsoft Internet Explorer
[3] Never store passwords on a public machine, of course
[4] This requirement is the most important one: people using the same password everywhere may loose their email, blog, bank account, personal web site, even their identity if this “one for all” password is stolen from just one site with poor security, or if you get connected from a rotten cybercafé (most are). You never know how secure a site is when you create your password.
[5] With a good probability of putting in no-win situation a tool like OphCrack, which allows cracking most simple passwords in two minutes.
RSS site
