The Password Pandemic: A password “classification scheme” for the home or small business user

Stronghold Cyber Security ^ | November 13, 2017 | Jason McNew

[Gennie]

Humanity has a massive password problem. We might call it The Password Pandemic. Computers keep getting faster and cheaper, making passwords easier to crack, while human operators do not change their bad password habits. This is a losing proposition, with the advantage clearly toward hackers and cyber criminals.

Most users of the Internet now know that they need to use “strong” passwords, and that they should use a different password for each site. With a dozen or several dozen online accounts, this quickly becomes unmanageable. Exasperated, people just use the same (usually weak) password across several accounts. Hackers know this, and take full advantage. This is why “password dumps” are so useful to cyber criminals.

[Gennie]

This is a good overview on how to create passwords for different types of online accounts.

[CatQuilt]

I finally got a password management tool, LastPass, and it's wonderful. You can use it to generate a long random password for every account. At the very least, it's easy to set up a different (and less random) password for each account.

LastPass

[Perseverando]

Link doesn’t work.

Are your LastPass passwords in the cloud? If so, what if your main password to your account is compromised and then changed? Then what?

Just asking.

[glorgau]

Get a password manager and change your life.

I don’t even know my passwords anymore. Just the main one - which I tell to nobody. Use Ben Franklin’s aphorism, “Three can keep a secret if two of them are dead”

[Perseverando]

I’ve been using Norton Security’s Identity Safe for at least 5 years. However I have refrained from using the cloud option so far. I want to keep my PW’s on my PC.

I’m inclined to believe the theory that “if it’s in the cloud, is it really yours?”

[jonno]

Password Bookmark

[Verginius Rufus]

Of course really smart people like John Podesta create passwords which are impossible to guess or crack.

[tiki]

I have a system that remains somewhat random, some things stay the same, other things change for each site and capitalization changes.

If I forget which variation I have used on that site I have just 4 alternatives to check out.

[bboop]

Don’t forget - ‘The Cloud is just someone else’s computer.’ haha

[bboop]

My system - 3 or 4 weak passwords with variations that I can never remember. I write them on a piece of paper and put them in a manila folder. Total Chaos. However, I believe that others, including my scientist husband, us a variation of the same. Oh, and I curse a lot.

[kosciusko51]

I’m partial to this password manager:

https://www.pwsafe.org/

[DBG8489]

Even NIST now recommends permanent pass phrases as opposed to the typical corporate “8-14 character with caps and specials” changed every 30-90 days.

https://pages.nist.gov/800-63-3/sp800-63-3.html

And you can run crack progs against your own phrases to see how secure they are before you put them in use.

[Karoo]

I use a pw manager and it is great.

[Sergio]

Tech Bookmark.

[Perseverando]

While doing a little research as a result of this thread, it appears PC Mag just did its updated “The Best Password Managers of 2017” - https://www.pcmag.com/article2/0,2817,2407168,00.asp

The list appears to be the premium (paid) list. I think they do a free list as well.

[Perseverando]

Found it:

The Best Free Password Managers of 2017 - https://www.pcmag.com/article2/0,2817,2475964,00.asp

[taxcontrol]

Stop using pass WORDS!

Folks, you need to use pass PHRASES!!!!

For example:

“I love red roses!” = 17 characters and it is easy to remember. For many, it is easier than “Redr0ses” and significantly harder to brute force crack.

[JohnyBoy]

Another vote for last pass. I use it on my PC and on my phone. Made password storage 1000 times easier.

[JohnyBoy]

>Are your LastPass passwords in the cloud? If so, what if your main password to your account is compromised and then changed? Then what?

They’re stored in the cloud. Last pass does not have access to the passwords as your master password encrypts them. I make backup copies of the full list to an encrypted drive from time to time.

[Perseverando]

> They’re stored in the cloud. Last pass does not have access to the passwords as your master password encrypts them. I make backup copies of the full list to an encrypted drive from time to time.

My only concern is about the loss of control should the master password be hacked on LastPass’s site, and then the list is downloaded and the master PW is changed.

How do you begin to recover from this?