{"id":4,"date":"2013-12-01T00:33:47","date_gmt":"2013-12-01T00:33:47","guid":{"rendered":"http:\/\/www.bennish.net\/blog\/?p=4"},"modified":"2020-10-30T23:49:59","modified_gmt":"2020-10-30T23:49:59","slug":"my-personal-password-policy","status":"publish","type":"post","link":"https:\/\/www.bennish.net\/blog\/2013\/12\/my-personal-password-policy\/","title":{"rendered":"My Personal Password Policy (PPP)"},"content":{"rendered":"

\"Padlock\"<\/a><\/p>\n

Remembering passwords is a hassle!\u00a0 We all know the things that we are supposed<\/em> to do but we are all human beings (aren’t we?) and it’s almost impossible (and certainly very impractical) to set strong, unique, and memorable passwords for each and every account we have.<\/p>\n

I’ve come up with a policy about how I deal with my passwords.\u00a0 My love of TLA<\/abbr>s means that I have decided to call it my PPP or Personal Password Policy.<\/em>\u00a0 I’m quite proud of it tbh (the acronym too) and I hope that you find it useful and\/or interesting.<\/p>\n

Note: I use the word “cracker” when most people are more familiar with the word “hacker” being used.\u00a0\u00a0 Read more about why I do this<\/a>.<\/p>\n

<\/p>\n

Entropy<\/h2>\n

The entropy of a password (in information theory terms)<\/a>, is a number which you could say represents its “strength” and the estimated time it would take to crack it – in general, the larger the number the stronger the password. It is measured in ‘bits’ and every time it increases by 1 bit, the average time it takes to crack the password doubles.<\/p>\n

However, it’s pretty much impossible to know the real entropy for passwords that have been thought up by a human brain.\u00a0 For example if a certain character in a human-created password is a ‘q’, the chance of the next letter being a ‘u’ is much larger than usual because ‘u’ tends to come after ‘q’ in the English language.\u00a0 Hence adding the ‘u’ adds very little entropy.\u00a0 Certain words would add less entropy for some people than for others.\u00a0 For a massive tennis fan, the string ‘tennis’ probably has a lot less entropy than for someone who has never even heard of the game, i.e. it’s a lot more likely to appear in their password.<\/p>\n

We are often told not to make passwords based on dictionary words and a number of people think that if they use dictionary words but replace certain letters with digits, this will increase the strength of their passwords a lot.\u00a0 But it doesn’t!\u00a0 Password cracking software can easily try a few replacements such as ‘0’ for ‘o’, ‘1’ for ‘i’, ‘5’ for ‘s’, ‘4’ for ‘a’, etc without much extra effort.\u00a0 So ‘p455w0rd’, ‘m0nk3y’ and ‘l3tm31n’ are still<\/strong> bad choices of password because the process of replacing letters with numbers doesn’t really increase entropy very much.<\/p>\n

To make a truly “strong” password, it’s not really a matter of the range of characters that it uses, how long the password is, etc, but a matter of how strange or odd<\/em> <\/strong>your password is.\u00a0\u00a0 So I want to think up passwords that are easy to remember and yet very strange.\u00a0 Ones that are quick to type yet long enough to be very secure.\u00a0 Can I really do this?\u00a0 I’m not really convinced that I can tbh.\u00a0 So I don’t try.<\/p>\n

I use two methods of password creation and they both involve using an automated process to generate the passwords for me so that the entropy can actually be calculated.<\/p>\n

    \n
  1. Each character<\/strong> in the password is chosen at random from a pool.<\/li>\n
  2. Each word<\/strong> in the password is chosen at random from a pool – this is called a “passphrase” (more on this later.)<\/li>\n<\/ol>\n

    Read more about Password Strength on Wikipedia<\/a><\/p>\n

    Password generation<\/h2>\n

    My passwords are all unique, randomly generated, and have at least 15 alphanumeric characters.\u00a0 I use a bookmark in my browser to this secure page on random.org<\/a> which I click whenever I want to generate a new password.<\/p>\n

    To avoid ambiguity when reading, this page does not use certain characters because they can often appear very similar:<\/p>\n