Choosing better passwords

While formulating a strong password is important, most people have multiple accounts and each should have a different password. This can be handled by creating passwords using a method similar to the one described in this proposal. Basically, each password is site-specific and formed from three separate components:

PIN-1 is memorized by the user and never written down (except, perhaps, if kept in a safety deposit box or other highly secure location). The other two components may be written down but must be kept in a relatively secure location (such as in the user's wallet or in a locked desk drawer).

The user forms passwords by combining these three components in any order that is easy to remember, like:

SITE PIN-2 PIN-1

Following that ordering, for the site www.example.net, a user might select the password "exampleRB8s#i8", where "example" (component 2, SITE) is derived from the site's domain name, "RB8s" is a random string used with this password only (component 3, PIN-2), and "#i8" is the user's secret PIN (component 1, PIN-1). Because it is probably difficult to remember, the user might record "www.example.net RB8s" but not PIN-1.

For httpd.apache.org, the same user might select the password "httpd33ABB#i8".

For the site dacs.dss.ca, the user might select the password "dacsceIM#i8".

Because the characters comprising PIN-1 must be acceptable to all of the sites where a user has an account, and some sites accept a rather limited character set for their passwords, it may be necessary to restrict PIN-1 to the alphanumeric alphabet. The other two components can be chosen from whatever password characters are permitted by the particular site. As some sites unfortunately allow only relatively short passwords, it is preferable to shorten SITE rather than either of the other two components.

Provided the basic rules are followed, a user can strengthen the method by making minor changes to the typed password as the three components are combined. As a simple example, one or more separating characters, also from a restricted character set so that it will be widely accepted, might be added before and after the middle component:

SITE Z PIN-2 Z PIN-1

In this example, a 'Z' is used as a separating character. This alteration is memorized, not recorded.

More generally, a user might make character substitutions, insertions, or deletions that are easy to remember and perform mentally as the three components are combined and typed. For example, all digits in PIN-2 might be recorded with one added to them (modulo ten), or every third written character might be discarded. Applying these changes to the recorded components makes them less useful to anyone else that might read them.

Since most people are not very good at it, the random strings should be chosen using a good-quality random generator, such as the random() function:

% dacsexpr -e "random(string, 4, 'a-zA-Z0-9,./;@#')"
"y2FJ"

Or, on FreeBSD or macOS:

% jot -r -c 20 33 126 | rs -g 0 4
ib2Y
25$z
vI9Z
^KpZ
51b7

The main disadvantage of the method is that if the "little black book" of password components is needed at more than one location it must either be carried or duplicated (with the copies synchronized). In practice, users will remember frequently used passwords and not need to consult the written components. Still, losing the written material could be painful, but passwords can usually be reset and a secondary copy could be kept at a safe, alternate location.

To summarize, these passwords:

Software is available to help evaluate password strength (e.g., How Big is Your Haystack?), but avoid giving out an actual password you intend to use.