Passphrases That You Can Memorize — But That Even the NSA Can’t Guess

THE // INTERCEPT ^ | 03/26/2015 9:29 AM | Micah Lee

[Utilizer]

It’s getting easier to secure your digital privacy. iPhones now encrypt a great deal of personal information; hard drives on Mac and Windows 8.1 computers are now automatically locked down; even Facebook, which made a fortune on open sharing, is providing end-to-end encryption in the chat tool WhatsApp. But none of this technology offers as much protection as you may think if you don’t know how to come up with a good passphrase.

A passphrase is like a password, but longer and more secure. In essence, it’s an encryption key that you memorize. Once you start caring more deeply about your privacy and improving your computer security habits, one of the first roadblocks you’ll run into is having to create a passphrase. You can’t secure much without one.

For example, when you encrypt your hard drive, a USB stick, or a document on your computer, the disk encryption is often only as strong as your passphrase. If you use a password database, or the password-saving feature in your web browser, you’ll want to set a strong master passphrase to protect them. If you want to encrypt your email with PGP, you protect your private key with a passphrase. In his first email to Laura Poitras, Edward Snowden wrote, “Please confirm that no one has ever had a copy of your private key and that it uses a strong passphrase. Assume your adversary is capable of one trillion guesses per second.”

[Utilizer]

Interesting way to generate a human-friendly and hard to guess passphrase.

[wally_bert]

Bookmark for later.

[RightFighter]

ThisIsAVerySecurePasswordPhrase

T#isI$Not

[Scrambler Bob]

M4L Password

[glorgau]

Yoda speak you should use when pass phrase generating you are. :-)

[MeganC]

The NSA doesn’t hack your passwords. The NSA calculates the hash key that’s generated by your password.

So “I Like Ice Cream” is not stored on your computer but the hash key of 7b783177134c3bfe95647ca3e12ddeb4 is stored on your computer and it can be calculated.

[PetroniusMaximus]

There are other ways of cracking passwords.

Like having one’s eyeballs pulled out or having a blowtorch applied to one’s genitals.

[MeganC]

Yoda speak you should use when pass phrase generating you are. :-)

=

97ab903e176f04b358ea884003107fc4

[MeganC]

“...or having a blowtorch applied to one’s genitals.”

Oh, you’ve had a yeast infection, too?

:-P

[Fester Chugabrew]

Ditto pop fizzle nuk crypto mulch gig

[Nevadan]

re: How to memorize your crazy passphrase

This is where I get in trouble. Every now and then my mind goes blank, and I can’t remember my 4 digit pin number on my ATM card. So just keeping my passphrase in my head would be a problem.

[Riflema]

I'd like to ask a (dumb) question: how do they know when they've cracked a password? If they know because the content is suddenly legible, what if you encrypt the content with one method, then encrypt the result using some other method.

Or an I missing something?

[Maurice Tift]

  Imagine your adversary has taken the lyrics from every song ever written, taken the scripts from every movie and TV show, taken the text from every book ever digitized and every page on Wikipedia, in every language, and used that as a basis for their guess list. Will your passphrase still survive?

  RamaLamaBoom5NakkaBamPowSmooNakka7

[Utilizer]

Encryption doesn’t work that way. Imagine having a bowlful of small 3D shapes such as spheres, cubes, and triangular pyramids. Place a firm sheet over it with cutouts of one shape, say squares. The result will be nothing but cube outputs. Then place all the resulting objects in another bowl and there is only one shape of filter to allow them to pass through again.

Not a perfect example, but it should point out why you have to use the same filter to encrypt and decrypt your files.

[thorvaldr]

I’ll stick with “Password123” thank you very much

[bgill]

If BB wants to snoop, it will.

[thackney]

For years my passwords gave been acronyms made from phrases with numbers and symbols.

[Rebelbase]

I hate it when that happens.

[goodnesswins]

bfl....computer security/passwords

[atomic_dog]

I’ll stick with “Password123” thank you very much

For me, "letmein!" will suffice.