How to Choose a Password - Computerphile

How do you pick the perfect password? Is it as simple as XKCD make out, or is there more to it? Dr Mike Pound follows on from his password cracking video.
Password Cracking on a 4x Titan X Beast: • Password Cracking - Co...
EXTRA BITS: • EXTRA BITS: Password C...
Indie Game Developer: • Indie Games & the Four...
Indie App Developer: • Life of an Indie App D...
/ computerphile
/ computer_phile
This video was filmed and edited by Sean Riley.
Computer Science at the University of Nottingham: bit.ly/nottscomputer
Computerphile is a sister project to Brady Haran's Numberphile. More at www.bradyharan.com

[@jord99]

An excellent poem there at the start: "Some people watching will have good passwords, Some people will have thought about this before, Some people should have thought about this and haven't, And hopefully will, after we talk about this, a little bit more"

[@Flexy59]

69 likes

[@Project_Kritical]

jord99 That was amazing.

[@Flexy59]

Truly was. I will paint that onto my wall or tattoo it somewhere

[@victoriencornet5714]

3 years later... I don't know half of you half as well as I should like; and I like less than half of you half as well as you deserve.

[@adityapai5147]

wah

[@minihjalte]

Dr Mike Pound is my favorite presenter on computerphile.

[@BattousaiHBr]

he _pounds_ the information on us.

[@andljoy]

He is one of them, Professor Brailsford however is my favorite. Steve furber was also amazing when he was on.

[@Malonomy]

Gotta love Rob Miles too (and Tom Scott of course)

[@minihjalte]

Malonomy Tom Scott isnt really a presenter as he doesnt work at the university

[@augustolin15]

I'm in love with him

[@chinareds54]

All this talk about passwords always reminds me of this scene in Harry Potter and the Prisoner of Azkaban (the book at least, not sure if it made it into the movie): In the story, the students have to say a password to get into their dormitory. Because of heightened security, they change the password so often that one of the students with rather poor memory (Neville) ends up writing down the whole list of passwords on a piece of paper. That list ends up getting stolen, defeating the entire purpose of the heightened security.

[@tonyhancock1377]

It would ronelove

[@justineberlein5916]

No, but that's actually why you *don't* want to force people to change their passwords too frequently. The more frequently you have to change your password, the more likely you are to make insecure ones, to the point that people can sometimes even guess your current password given a list of your previous ones. So frequent password changes actually lead to exactly the sort of security issue that let Sirius break into Gryffindor Tower

[@Hazzardworks]

"Make a password with words people don't usually use." *changes password to "Nickelbackisagoodband"*

[@moloe0]

Hahahahhahaha

[@sindreandreandersen5815]

Hazzardworks *logs into your user*

[@slickm7]

Appleisnotoverpriced

[@cartererickson7395]

Chris McKenzie Nintendoswitchesarenowinstock

[@Horny_Fruit_Flies]

TrumpIsLikeReallySmart

[@ThePolfAlmighty]

"Computerphile - Making you uncomfortable towards your life choices since 20XX"

[@Huntracony]

I´ve had multiple sites/servises tell me my password is too long, and even had one telling me I couldn´t use special characters. How am I supposed to have a safe password when you don´t let me damnit.

[@laharl2k]

if the account isnt too important make the password jfjfuenx;3*7bckflDam#,3:#ebuxBDUgrjrb&{¥¡cjDNdu47`¥ejbxkif and put it in a txt in a pendrive or somewhere in your documents. if you can go stronger by lenght go stronger by user a more dificult charset

[@emanwe01]

If those sites are doing that part wrong, they've probably got other security holes, too. :/

[@bobzone09]

That would require me to switch banks entirely :/

[@icedragon769]

+Laharl Krichevskoy Did you miss the part where he said "I´ve had multiple sites/servises tell me my password is too long, and even had one telling me I couldn´t use special characters. "? Also, please please please don't put passwords in text files. If you're going to use super-strong random passwords, use a password manager.

[@ahmh8411]

When it is a one off site that i probably won't visit again i just write heyhey, maybe adding a capital letter or a number if needed.

[@tncorgi92]

"Pick a word that other people don't use very often, like your favorite band name." lol

[@uuu12343]

"Maybe delete your account out of shame" *proceeds to face palm* Straight savage

[@somedaythewave]

now they're gonna use the least likely 10,000 words in the dictionary great going mike

[@mensrightsedinburgh4764]

Why? most words like that will be words 0.001% of the population even know. things like Nudiustertian.

[@somedaythewave]

its a joke.

[@mika2666]

or just 10.000-20.000 :P

[@Kram1032]

Stackexchange uses a scheme where the 10000 most common passwords are simply disallowed. Otherwise it simply has to be long enough (I think >8 symbols) That seems pretty sensible to me.

[@engineerwolf3692]

never go too common or too uncommon. because they are guaranteed to be on list.

[@maxuix2]

2 more of these vids, and we'll socially engineer his master password boys!

[@elave16]

as a person that speaks 4 languages I changed my password to 4 words in 4 languages

[@MrBibo2050]

//Rule successfully added to dictionary for user: [elave16]

[@igorbednarski8048]

@@MrBibo2050 yeah, know that you know his scheme it's a piece of cake, you just need to guess which 4 of the thousands of languages out there he used (it might include fictional languages like Eldar, Dorthraki or Klingon), narrows it down to just ~4^(10^7) or so possible passwords..

[@pmj_studio4065]

That's what I thought, use as many languages as you can, but not English or your first language.

[@brusch1553]

@@pmj_studio4065 dont use any languange. I mean just dont use meaningful words

[@gabrielhorth]

Yo_savais_你_would

[@GGanon]

4 years ago, watching this video made me realize I had a bad password system and I switched to using a password manager. Thanks computerphile

[@fruitshuit]

I'd be interested to hear Mike talk about workplace password resets. Lots of places I've worked require employees to reset their passwords every month, and some have onerous requirements for length and symbol usage. I think that rather than improving security, it encourages people to make passwords easy to guess (since they expect to forget), or worse, actually write their passwords down and stick them to the computer.

[@AgentM124]

it would be something if your 128 character uber password gets a hash collision with the password "password"

[@ThymeCypher]

Which is why using MD5 is very much no longer the recommended hashing method.

[@fgregerfeaxcwfeffece]

You know that this is already so much more unlikely then getting struck by a lightning and eaten by rabid squirrels afterwards that this argument is somewhat ridicoulous? In Fact getting attacked by rabid squirrels has happend way more often then successfull attacks based on md5 collisions. Just google it.

[@fgregerfeaxcwfeffece]

any scientific proof of that or just your holy book? edit: apparently the post this was meant to answer was deleted, so we got our answer.

[@JellyMyst]

Come on now, person who mixed up username and password when making your KZbin account, that's clearly not an argument of any sort. It's a joke.

[@FathinLuqmanTantowi]

nice password there.

[@rylog8]

"Oops! Your password is too long!" "Oops! You need to include a number, a symbol, and an upper and lowercase letter" "Oops, that character is not supported!"

[@baronvonbeandip]

@@reallyappreciateyourhelplu9928 verb please

[@TheScrowlingFender7]

That's the worst. That's why I put those rules in the notes section of that site's entry.

[@jumpingspider7105]

Guys, post your passwords, lets see who's is best!

[@raalotephinscorcies5382]

KZbin automatically conceals passwords in the comment section. See, here's my paypal password: *****************

[@Mattimaro]

********** Omg, it really does! That is so cool!

[@MrZebrot]

does it really? password123

[@thewolfofthestars1847]

tRoLOloLOloLOl1234

[@Rythmbot]

bigtittybuttboob14

[@ThalesII]

It's all fine and dandy until you have to use a website that either: a) forces you to use uppercase, numbers, symbols, runes, smoke signals... or b) limits you password to something like 12-16 characters

[@gfrewqpoiu]

my Banks Online Banking takes the cake here, they use CONSECUTIVE numbers for the username and exactly 6 Numbers as the password. You CANNOT change the Username and you must use a 6 Number Password

[@BoTuLoX]

In my experience banks are the ones with the worst online security of all companies.

[@icedragon769]

That's what password managers are for.

[@gasdive]

I'd change banks

[@Stars-Mine]

Yea, I would change banks as well. Not only is a 6 charachter set to small, you claim its only a 6 number set. You dont even need one titan to crack that. an 8800 GTX could do it in under a second.

[@Parker8752]

How about using more than one language in the password? For example, horsecaballocapallceffyl is just horse in English, Spanish, Irish and Welsh - unless the hacker tries dictionary attacking you with multiple languages at once (which would surely increase the search space to the point of absurdity), that should be safe, still only requires you to remember four words, and most people know at least some words from a foreign language.

[@kaitlyn__L]

what about not even making them the same word but in different languages, just slip in a japanese word or a portugese word or whatever, as one of them

[@Parker8752]

My example was only the same word because I was lazy and didn't feel like putting multiple words through google translate ;).

[@ukbenji]

+Parker8752 gotta throw In a _ mid letters and they shouldn't have a chance of getting it :D

[@mtvirux]

passwordunodeuxsthree incoming...

[@rikanoniem5214]

That sounds alright at first glance, until you realize the search space is actually quite low because you still used a common English word as the base component. Say, the dictionary is a top 1000 of English words with european translations. Assuming that horse is in there, your password is going to be in there. I'd say that, to actually benefit from multiple languages, do use a set of different words, in the different languages.

[@TheVirIngens]

More tips: - Mix different languages - Use phonetic spelling instead of the dictionary version

[@ragnkja]

And if you use phonetic substitution (a common example in English would be to replace "for" with "4") in the middle of one of your words, use one of those other languages. (The main reason I don't use more words from my north-Norwegian dialect than I do is that a lot of them need letters that require a Norwegian or possibly Danish keyboard to write, which is a problem if I ever need to write them on a different keyboard.)

[@starlight4497]

Another tip is to legit put spaces into your password. Means a brute force attempt will never work, or so I have been told

[@thanushehehe7302]

You can’t mix languages in Some websites

[@Scarletraven87]

Use your dialect, if you have any Use your dialect in phonetic, if you can Use your dialect in phonetic and add symbols if you like But in the end, don't use it everywhere, cause a single cracked database screws you over everywhere else.

[@dycedargselderbrother5353]

I've gotten permanently locked out of accounts using non-7bit characters. In a few cases it looked like I damaged their database or something given how the site behaved when trying to login or reset the password. This is gradually less of an issue over time but at least once upon a time a lot of sites appeared to use hand-rolled systems that didn't sanitize input.

[@raymondlinz1333]

Love these videos. Great presentation Dr. Mike! On the subject of choosing passwords, I've ran across something odd myself. A password is something you use over and over again. I've used it as a psychological tool. My password is a positive affirmation of a couple short sentences. If you are going to type it over and over again, then why not? I feel that I perceive a difference in myself just because I changed the password I type constantly. Also cracking full sentence passwords might be hard :)

[@Meanie010]

I just use the entire lyrics of bohemian rhapsody as my password. It makes every login attempt a rock concert.

[@kathanshah8305]

No time for losers

[@cynical5062]

Me: uses the lyrics of Never Gonna Give You Up as my password, therefore rickrolling anyone who tries to login to my account.

[@DJoppiesaus]

Always when I type a password it gets replaced with * or •, and that's so easy to crack! They really need to fix this!

[@tuneboyz5634]

Thats hiding the password dumbass

[@SabyasachiGhosh1618]

r/whoosh

[@zionj104]

@@tuneboyz5634 THATS THE JOKE

[@doubledenial8178]

@@tuneboyz5634 Yeah but they're hiding the password with a single character, that can't be secure

[@adi-sngh]

@@tuneboyz5634 r/woosh

[@Kek5kopF]

That video was very good, I learned a lot. Another approach for coming up with safe passwords is generating a bunch of random passwords and modify them so you can find some meaning and remember it easier.

[@macronencer]

I got a lot more canny about passwords a few years ago, and have adopted a common scheme for them. I thought this would mean I could remember them all much more easily and still be secure. But the really irritating thing is that whatever rules I choose, there always seems to be one web site that will moan about my choice of characters. Some of them even tell me I can't use a password because it is too LONG. WTF? Are they even hashing it?? Have to wonder. It would be nice if there were an RFC or some kind of standard that all sites followed: then we could all use a scheme and be sure that it would be acceptable in most places.

[@jamesedwards3923]

This is why you use password managers of some sort. Dude are trying to account for something others did not care about. Stop it, you know depending on the site password restructions are horrible to none at all. Find some way to secure your passwords and use it. Notice that most places that get hacked do not tell you what hash they used. Which means the hash is not even a 256 bit hash. Which means it is probably SHA-1 or MD5 with low ittrations. Or worse no ittrations.

[@franspigel9281]

From the video you're commenting on: "password systems in general are not a very useful way to authenticate, because they're hard to remember, unless you pick an easy one to remember, in which case it's easy, and not secure. So in some sense we've tried to find a way of authenticating ourselves which is hard for a human to remember, easy for a computer to guess, and people do it badly. "

[@macronencer]

@@franspigel9281 I generally agree, though I do think there *are* ways to make passwords easy(ish) to remember and also hard to crack :)

[@phizlip]

@@macronencer passphrases are the future

[@ConorCraig]

this guy's videos are the dopest. particularly the image/video based ones...I hope there are more of those to come in the future.

[@NickMachiels]

great effort on spreading password and IT security awareness!

[@djmips]

Finally! someone who points out the issues with the XKCD system.

[@joshua43214]

He nailed about putting a random underscore in a word. Pass phrases that use random characters inside words are fairly easy to remember and very hard to crack.

[@JohnDoe_1237]

learn german and use only ONE word :D some LONG german words: Grundstücksverkehrsgenehmigungszuständigkeitsübertragungsverordnung or maybe Verkehrswegeplanungsbeschleunigungsgesetz, or Unternehmenssteuerfortentwicklungsgesetz. you also could combine this three words xD

[@JohnMichaelson]

It'd be more secure to reverse one of them.

[@dave5194]

+John Michaelson but would be incredibly hard to remember

[@psychic8872]

That could be cracked by using a dictionary of the 1000 longest german words (or 1000 long common words in general). Reversing or other tricks will not increase entropy much and will make it even harder for you to remember or make a mistake in typing.

[@Encypruon]

How about welsh? upload.wikimedia.org/wikipedia/commons/e/e8/Llanfairpwllgwyngyllgogerychwyrndrobwllllantysiliogogogoch_station_sign_(cropped_version_1).jpg

[@JohnDoe_1237]

lol, not bad. we should mix them up ;D

[@picassodilly]

A great easy to remember/ hard to crack password I’ve heard is take a song lyric or quote, then use only the first letter of each word in it- For example, “unwritten” Staring- At The Blank Page Before You, Open Up The Dirty Window Reaching- For Something In The Distance So Close You Can Almost Taste It Feel The Rain On Your Skin becomes “satbpbyoutdwrfsitdscycatiftroys” Throw in a few symbols at The pauses in the song for extra security and good luck finding that in a dictionary attack. (You’ll probably want to use a more obscure song, just to be safe)

[@richkitten9539]

But that’s easier to crack if you know that’s what the person is doing. Given a few thousand songs, the number of possible passwords is far more limited than if you randomly arranged some words

[@kevinskipp2762]

@@richkitten9539 I do something similar but use random lines i.e. not consecutive line from one song/poem but separate lines from different songs/poems or quotes, and also mix up which letter I use, so sometimes 1st letter of word, other times last letter, or even both the first and last. Then using symbols in memorable locations.

[@desudesu8695]

@@richkitten9539 dont tell peopel then xD. "A great easy to remember/ hard to crack password I’ve heard is take a song lyric or quote, then use only the first letter of each word in it-" nobody will ever guess that unless they read this coment thread

[@redanwrong]

been using one of these managers, dad got me into it, but this video convinced me to change the master

[@FrederikHanghjIversen]

I think this presentation is brilliant. I have one small point to make when it comes to random websites that require you to make an account. If the website is not going to be storing sensitive information, then surely just using a week password to circumvent this annoying requirement of having to create an account is not much of an issue.

[@DarioVolaric]

I always make my passwords 'incorrect'. So whenever i forget my password it will say 'your password is incorrect'

[@caldrago1470]

*slow clap*

[@LandoCalrissiano]

This fried my slow clap processor.

[@PGGerz]

I make my password "*******" so they think its encrypted

[@caldrago1470]

it_twit - Redstoner&Mapmaker Now that is a joke I can bear because I haven't seen it chewed up and spat out hundreds of times before.

[@threeqtrsnorthrn1669]

My password is : bythetimeyouhaveguessedmyrealylongpasswordiwillhavestileyourbagel

[@justarandompally]

What about foreign words? Would people run dictionaries for all ~94 generally used languages?

[@fdagpigj]

And what about extinct/dormant languages like, for example, some of the Sami languages or Livonian?

[@ElectricityTaster]

Robin Williams Just a quick view at your Google+ page and I would say those three languages are English, Spanish and maybe Genoese/Italian.

[@robinw77]

agun17 Nice try! :-) One out of three ain't bad, as Meatloaf didn't say ;-)

[@ElectricityTaster]

Robin Williams I'd add german just because it's so popular on the internet and pop culture.

[@robinw77]

+agun17 Actually I've been asked if I'm German an unusual amount of times over the years

[@davidcharles3230]

Great video! Would love one on the implications that will arise with the advent of quantum computing, particularly with respect to current encryption models and what will be needed in the future.

[@delacreaux]

To emphasise the point made around 4:17 , just for fun, I tried typing in "correct horse battery staple" into the password strength checker for my Google account. It was considered strong up until I finished typing the last word, at which case it dropped to medium, so he's absolutely right that XKCD's password is not a good choice, just like any other password everyone knows.

[@JanStrojil]

One more point - is there conclusive research on how useful/counterproductive the "change your password every 6 months" policy is? (Especially if the new password can't resemble any of the old ones.)

[@RainaRamsay]

I, too, would like to know this. In particular, assuming I do use a password manager, do I have to change my master password every n months? If so, what is n?

[@briancarnell]

Depends on how paranoid you are. The reason you would want to change a password every n months is to make sure if you password is compromised, that the time period in which an attack has access to your accounts is limited. Not sure how realistic that is anymore--most hackers are going to get what they want quickly. I use LastPass and change my master password every year at the beginning of January. This lets me create a strong password that I can commit to memory, while avoiding some of the issues that come about if you never change passwords (like temptation to reuse passwords, etc).

[@tncorgi92]

When the financial firm where I worked started this policy, we found that most of the users started writing their password on their desk blotters, bottom of their keyboards, etc because they could never remember it themselves.

[@Correctrix]

I wish there were. I certainly know that all it does is force me to use simpler passwords.

[@stoppi89]

Paul Drake Main reason why forcing regular Password changes decrease Security. Forcing the regular change is probably bad 99% of the time if sample size of people is bigger than 6 (means: If you have a group of +6 people and force them to regularly change their password, you gonna have a bad day [sooner or later]).

[@brandonthesteele]

My favorite stuff is the "Secret Question" stuff that pops up when I forget my password or when I need to answer a "shield" question. I give wrong, easy to remember answers to the questions about what my first car was, where I went to Elementary school, etc. If I get to make up my own question, then it's REALLY fun.

[@TheScrowlingFender7]

I recently started to use my generator for the security questions but I don't get asked them as much by sites as I used to.

[@vatsalsrivastava3516]

Thank you so much for enlightening us about that, Sir! These two videos were highly informative. :)

[@AndrewMeyer]

1. 4:59 He addressed that: "(You can add a few more bits to account for the fact that this is only one of a few common formats.)" 2. 5:42 The comic assumed the top 2048 words. You can tell based on the bits of entropy in the illustration. One thing I think would be great to mention here is diceware. A nice system for choosing passwords that makes it easy for you to generate memorable passwords with any level of entropy you desire. I use around 100 bits of entropy for my low security master password, and ~120 bits for my high security master password.

[@matthewthomas4620]

For cases where you cannot use a password manager (ex. the password for the password manager) I have found a sentence mnemonic to be capable of generating easy to remember (even when seldom used) passwords that as far as I know are fairly tough to break. Obviously they need to be long enough, especially considering that the character set is somewhat restricted and certainly biased, but they are much better than what many people use for cases where a manager is just not an option. example: PW = Wyu#THHymc23 Mnemonic = (W)hen (y)ou (u)se Hashtag(#) (T)he (H)oly (H)and-grenade (y)ou (m)ust (c)ount to(2) three(3) The PW is dictionary proof, and while not truly random has high enough entropy that I imagine it is reasonably safe from brute force. Certainly their are weaknesses in such a password. It is not random. However you can easily remember very long passwords that contain mixed case, numbers and symbols without any English words. Thus providing reasonable security when you cannot use a password manager.

[@sallerc]

Also, use 2-step verification on important accounts like your email.

[@ToveriJuri]

But don't be a popular public figure with a shitty phone company. In that case use cheap GSM phone with a prepaid SIM card that's not linked to your name in any way.

[@ryanprov]

The problem is not to 2FA, the problem is that SMS is not a secure 2FA. It is really easy for attackers to social engineer employees at cell companies into essentially allowing them to clone your SIM card so that they receive all your texts. Now your 2FA is compromised. And this is not just an issue for public figures... if you work somewhere that handles sensitive information you can be targeted for this kind of attack in order to get your work credentials. I've seen it a surprising amount for people working in tech. Always use a proper authenticator app for 2FA, never use SMS! Some sites (like Google) allow using SMS as a backup for 2FA -- this is a bad idea! Make sure to always disable SMS 2FA or SMS account recovery, it is not at all secure and often is easier than actually cracking your password if the payoff is right (which could be a consequence of your employer, even if you personally don't have a lot of money or anything).

[@AmrZewar]

awesome instructor ,you simplify things so nicely.

[@b.t.burton5000]

I never thought I would find a Computerphile video from the Avast website

[@danielbengtsson9833]

It'd be interesting to hear his opinion on mixing languages. Let's say you have a 3 word password, you seperate them with spcial characters and then the first word is english, the second is japanese for example and the third one swedish. Would that break these rainbow lists of hashes?

[@ToastiLP]

I'll just hope nobody cares enough about me to even try.

[@chainingsolid]

The cost to try is so low, they don't need to care about you, or even know you exist, it automated!

[@rmsgrey]

Security through obscurity isn't terrible, but it's also not reliable. Sure, hacking into Bill Gates' online banking service would be great, but if you can set up a distributed attack that gets online banking details for a thousand people, you can probably get more money before anyone catches on that something's wrong, and you can pick off the thousand people with the weakest passwords rather than having to crack strong ones. Also, posting something like that on a video about password strength is like daring someone to crack your password - it massively reduces the obscurity you're relying on for your security...

[@guraski]

that should be your password

[@dave5194]

+Sam Lenz but now everybody knows it 😯

[@psychic8872]

You are right but the limits mentioned in the video I think are in case someone has access to the hard drive. Besides most sites and especially banks block login attempts after a few tries.

[@kahisawheel]

This guy is great. Very easy to listen to.

[@heaslyben]

Another good one! Thanks! Would also be interested to know more about bcrypt. Is it still a best practice?

[@ragnkja]

If you're multilingual, perhaps use a combination of words from the languages you speak. For instance, to crack a password that's a combination of Norwegian, English and German words (or any subset of the three), you would need to search a pretty big search space in order to find whichever one I might have chosen.

[@astropgn]

yeey! I use a manager for a quite some time now. All my passwords are also 25 random characters (with some superior Ansi characters, like Ų#ҹ) and I don't know what they are :D! One day my friend asked me to log into my FB acc on his computer. I just said I couldn't. And I wasn't lying to him!

[@SUFHolbek]

Definitely in my top 10 funniest stories of 2016

[@Clownin]

Keep the program and file on an encrypted flash drive. It's what I do when I need to login to something. Also, I have two different files. One for stuff I rarely login to and one that I carry because I know I'll need it day to day. Which password manager do you use?

[@emileriksson7689]

what manager is that?

[@Clownin]

I use Keepass

[@SuperWolfkin]

if you're using KeePass (like i am) you should keep a copy of your DB on your flash drive. If you trust it keep a copy on DropBox and then connect to it via the KeePass Android App and you can have access to your password via phone.

[@Battusai1984]

As a small side project while i was learning c# i made something in wpf that does the same thing as a password manager, I use three root words and the sites name press enter and it produces a garbled mess of a string i then use as a password, i then paste that in the form/loginbox, besides just having been a fun thing to get working (Z+4=space) i don't have any worries about server or local, or keyloggers since i don't actually ever type the password. If you want to make the "four random words" even more secure, type two of them backwards.

[@imranemokhtari5433]

this guy is awesome at explaining things of this nature lets just say

[@DillonStrichman]

Password cracking groups watching this video, furiously scribbling notes about giving low-frequency words a higher precedence

I used XKCD to make an even stronger policy for myself. 4 words of 4 different languages. Example höstjääpalochampionshipmira höst is Swedish for autumn jääpalo is Finnish for the sport bandy mira is Russian for world. my hook to the password is that in the autumn there is a world cup/championship for club teams in bandy. I don't use this particular password, but I think it would be very very hard to crack if I did (and hadn't used it as an example)!

[@user-dt4sh9tm2g]

it's mir (мир), not mira js

@@user-dt4sh9tm2g at russian bandy federation, world cup in bandy is Кубок мира .

[@gabrielmarciu69]

I love steam, they don't have any restriction other than the character one. Nice video, changed my password everywhere now :)

[@VoxAcies]

People argue that using a password manager is putting all eggs in one basket, but you can mitigate that by using multiple databases with different keys. The alternatives are always worse, unless your memory is phenomenal and you can remember 100 different complex passwords. Another way is to have some sort of algorithm to generate passwords for different things (which is essentially your own private hashing method), but it can also fail, if some input data changes (e.g. a website URL, name etc). Password manager is easy to use, reasonably secure and has manageable risks. It's the way to go for most people who care about these things.

[@fellpower]

"Make a password with words people don't usually use." Changes my password to "brain"

[@derstreber2]

You could pick at least 6 different words, all words being longer than 6 characters each, preferably uncommonly used words, and use words from 2 to 4 different languages (English, French, German, Spanish) while ensuring that words you use don't show up in multiple languages.(If they are going to use a dictionary attack, better give them more dictionaries to look through) Also if you wish, you could misspell one or more of those words in a memorable way. You would need to throw in at least 1 symbol and a capital letter somewhere to make most websites happy but the rest of the password would stand on its own. I would not pick "rubiks" or "lemmings" as both of these things are well known in geek culture. Nor would I choose to use brand names as a list of common brand names could easily be created. My guess is if you ask 100 people to list 20 different brand names off the top of their head there would be quite a bit of overlap. (I think people from a similar locality would have closer matching lists but country wide there would still be a lot of overlap.)

[@SuperAWaC]

are you joking? now you've gone off the opposite extreme.

[@tsobf242]

Oh shut up. You can be paranoid all you want, but don't advise others to be too.

[@derstreber2]

+SuperAWaC Not that extreme in my opinion. If you speak multiple languages why not include them in your password?

[@derstreber2]

M. de k. lol yeah like that (although ideally you wouldn't want to share that with thousands of people on the youtube comments) The best part is when people look over at your login and see: ********************************************************************************************* , they think your some kind of super genius demigod.(I have gotten several interesting comments in person. More people look over your shoulder than you would think.) So yeah, there are some benefits of being paranoid.

[@diurdi]

Just go straight to Navajo language

[@knahrvorn]

Regarding password managers: Is it a good idea to use your browser's ability to remember passwords and sync them with your online account with said browser? For instance Firefox has this, and Google offers it, too, with Chrome. This is, of course, assuming that you use a strong password (and preferably also 2 factor authentication) to protect your Firefox/Google account, and that the individual passwords are random ones.

[@CheapSushi]

This was excellent, learned a lot.

[@FatheredPuma81]

My bank limits the length of ones password to I think 8 characters and force you to use a "special character" which they limit you to like . , ? and ! for choices. So my imgur password can be much stronger than my bank password essentially.

[@logosimian]

Many such cases. I created a password generator that hashes a long, beautiful sequence of unrelated unicode characters from whater two keys I punch in. There were letters. There were numbers. There were musical notes. Works for most websites. Not for banks. Or Google websites.

[@Everest314]

Why did I get a Futjitsu Palm Security ad before the video I watched after this? :D 1:57 facepalm "because, oh dear" :D

[@poorusher]

This is great. I was only slightly put off by the Tesco carrier bag.

[@Twisted_Code]

Ha, that XKCD comic is EXACTLY what I was thinking of when I clicked on the link to this video. Once upon a time, I think I even used "correct horse battery staple" as part (not the whole thing. I'm not that crazy) of a password. I'll be darned if I can actually remember where I used it. Welp, guess I'll be resetting that one if it's not stored in my password manager!

[@TheWanderer1000000]

My password is pretty damn clever. Sadly I can never share it with anyone. *FeelsBadMan*

[@kellynolen498]

Thats only 3 words super crackable all in the top 300 words and just because you used damn doesnt make it better

[@norb3695]

@@kellynolen498 That's not their password xD I know i'm late

[@PhilHibbs]

You should have mentioned the XKCD about the 5$ wrench.

[@davidtiganila27]

the solution to that is to string together four physical locks - physical locks can easily be broken, but if you have enough of them, the attacker will get bored and go home : D

[@markallen7294]

Phil Hibbs i

[@roflchopter11]

@@davidtiganila27 the wrench is used on the person suspected of knowing the password (or their loved ones)

[@supetorus9612]

I have used several different passwords over the years, and they get more and more complex. I tend to remember which password to use with a site by when I created my account there. Currently I have two I commonly use, both are 16 random characters.

[@ZacharyGodfrey]

@Computerphile Mike mentioned LastPass and discussed password managers that encrypt a database of passwords. Could you do a video where he discusses Master Password and the idea of a stateless password manager that cryptographically generates your passwords as you need them?

[@Gamesaucer]

The real problem is that many sites REQUIRE you to use several symbols, capital letters and numbers. It's annoying, because it means all my passwords are hard to remember. Sure, I can sprinkle one or maybe two special characters in there but more than that and it becomes even harder to remember.

[@MaxMakerChannel]

Special characters are difficult to type on foreign keyboards.

[@Motorman2112]

Doesn't this just make it quicker to brute force too? The attackers knows that they can skip over anything that doesn't meet the published requirements. Yes, the inclusions of symbols make the search space larger, but the exclusion of passwords NOT containing them make it smaller again...

[@Gamesaucer]

No they're not. What special characters you can type varies per keyboard type, but there's always a few, like @, ', _, %, §, etc.

[@Gamesaucer]

M. de k. Let's not, because it can now publicly be found on the internet.

[@logicalfundy]

. . . which is why you should do what he explained at the end of the video: Use a password manager.

[@Androidonator]

what if my database is sheet of paper can they hack it ?

[@lilyliao9521]

Matouš Hrdlička yes

[@cameronl1859]

That's actually the easiest type of hack, it requires no technical skill whatsoever and can be perpetrated by absolutely anyone close to you (plus, those people have more reason to target you than does some rando hacker).

[@jamesedwards3923]

A physical paper. Where you did not make the password cryptic is insanely foolish. You do not write down the password. You give yourself hints. Like in password recovery options and the like. Some people do do that. Writing down your actual passwords is something you should 'never' do for the long term. Store your passwords in some sort of encrypted file system.

[@danielchin1259]

Encrypt it

[@Clout253]

He’s

[@Gortart]

You can also use different keyboard layouts. For example "rkdnl" doesn't look like a word but in standard Korean keyboard layout, it spells "가위" which means scissors. I can use this and some random English word to make something like "rksuitdnltea" and it is very hard to crack, but easy to remember.

[@joechief2456]

For an upgrade over the xkcd method you can try diceware - which is just a list of over 100,000 English words each with a unique outcome of 5 ordered dice rolls. So you can take one dice and roll it 5 times to generate each word, or take 5 dice with some consistent method of ordering them. The advantage there is that they're true random (not pseudorandom), accessible (can be made with a printout and a single dice), not biased towards common English words, and easily memorable for the same reasons that the xkcd method is. They're currently recommending 6 word passwords to ensure you've got some breathing room over the theoretical capability of an attacker specifically targeting diceware passwords. I do have a question though - are there any attack scenarios in which it matters if a site appropriately hashes their passwords in a hypothetical world where no one reuses passwords? My impression is that an attacker that can access the password store can simply modify the entries to gain access to a target's account on that service and only needs to break the hash to attack other services with a reused password. In that circumstance there's no advantage to proprer hashing as the only compromised service in the event of the hash being broken was the one already compromised by having the database accessed anyway. Am I missing something?

[@hellterminator]

_Never_ reuse a password? I use the same username/password combo for… well, probably hundreds of sites by now, but only for sites I don't care about. It's actually been leaked already, but idgaf. What you gonna do? Steal my account with 0 posts on a random forum that required registration to display URLs I stumbled upon while Googling something a couple years ago? Knock yourself out! I consider those accounts stolen and I'm completely fine with that. Now emails, online banking, social media… that's a different story.

[@logicalfundy]

Keep in mind that impersonating you is a thing. I've had to scramble to inform friends and family their shared passwords were a problem because I received links to viruses from accounts they had, but had forgotten.

[@hellterminator]

logicalfundy Impersonating me? The whole point is that I'm nobody on these accounts. No contacts, no posts, no personal information (I even use a separate email account for these registrations to avoid spam on my real account). Impersonate me all you want, but there's nothing in it for you.

[@fdagpigj]

And a separate username?

[@Guaulden]

Actually you could just use 10minutemail, then you wouldn't need to have a separete mail for things like that.

[@hellterminator]

Guaulden I do like 10minutemail, but a separate email is actually easier and more reliable. 1. If the site is slow and the registration email takes longer than 10 minutes to arrive you don't have to remember to extend it every 10 minutes (and be forced to star over if you forget). 2. Many sites block 10minutemail and other similar services. 3. Maybe one day you will actually need to receive an email from one of those sites again.

[@LudwigvanBeethoven2]

"Never ever reuse your password, ever" Me: I Always everytime reuse my password, everytime.

[@thanushehehe7302]

♫♪Ludwig van Beethoven♪♫ Never ever Reise your password ever is my password

[@robertgregory2618]

He means at other sites.

[@Dthenn]

Nice! Now I know how long all of your passwords are!

[@derkarlotto]

What passwordmanager do you use/ whats a safe one? I dont know much about this sort of thing, so any tips on what to look for in a passwordmanager/what to avoid would be apreciated.

[@ChristopherPuzey]

Is c0/\/\pu73rp4i|e ok to use for youtube?

[@LlamaFluff]

Yes

[@kanjitard]

Not anymore

[@mothman.industries]

Damnit, how'd you know?

[@miroslavhoudek7085]

That wouldn't work for me, it's my mom's maiden name :-/

[@25NN25]

awww see what u did there :3

[@pbpbpbpbpbpbpbpbpb]

Pick some book. Write down a sentence. Insert some underscores and miss some spaces. Done.

[@nerdexproject]

This video literally made me change up most of my passwords! xD Hope I'm safe now!

[@thehansenman68]

Great video! I have one question though: what about intentionally mispelling words in the password? Say instead of using horse, you put hourse in the password? If you do this with a longer and more unusual word, I can imagine it being even harder to hack and only slightly harder to remember.

[@sieevansetiawan4792]

I think it is similar to his explanation at 7:40

[@Squidward1314]

Yesterday I had to create a new password on a library website. It forced me to pick one with the length 6 or less. I mean really?

[@streamingmadman2427]

Can you recommend a great password manager?

[@EvoX180]

Streamingmadman lastpass

[@jamesedwards3923]

KeePass or Password Safe.

[@jamesedwards3923]

The biggest problem with password restrictions. Is that many websites and services are fairly lazy. If you set the limit to one trillion characters. With a full character sets. I assure you. You can have secure passwords because most people can not remember trillions of 'random' characters. However, if you use a series of phrases. Not only can your password be long and complicated. It would also be strong enough to remember. Strong enough to resist brute force and dictionary attacks. Passwords are hard for me to do at work because I am restricted to what the passwords can be. Same thing when using some websites or services.

[@oops8685]

Password Manager + 2FA = best security I can think of. Even they get your master password, they can't do much unless they also have your 2FA device. I personally use LastPass with sesame, and google authenticator as a backup. On top of that I also have 2FA for alot of my specific accounts such as my google account, facebook, amazon, etc. so even if they SOMEHOW get through my LastPass and have all of my other accounts, they still need my phone to get into those accounts.

[@xxertad]

I had to change all my passwords after watching this

[@freibuis]

problem with some place where they only allow a small password length :( sad panda

[@BattousaiHBr]

you mean _that_ sad panda?

[@Topstormking]

If they only allow a small password then assume that they have bad overall security and that there is a higher chance that a password leak might happen.

[@BattousaiHBr]

Topstormking this is actually the first time i heard they only allowing small passwords. EDIT: just tested with a 16 length password with special characters etc and it worked fine.

[@dospy1]

use only the first N letters of the random password where N is the maximum allowed letters in a password

[@andisaidheyyeyaaeyaaaeyaey8612]

The funniest thing was when I constantly had to remake a password for a site because I couldn't log in with it, and discovered that the site only saved say 10 characters. When I tried to log in with my 12 character password it wouldn't take it unless I removed the last two. No warning "your password is too long" when you created it or anything whatsoever. It just didn't save it, and didn't stop you if you tried to log in with a password that was too long.

[@zephh_sk]

So here's how I figured out my password. On old Nokias 3310 there were games like Snake and Space Impact. I used to play alot of Space Impact and tried to challenge my highscore quite lot of times. Once I've scored a highscore I never ever beaten again. In highscore options you had a code for your highscore (can't quite remember why though) and that highscore was combination of 8 character long random letters and numbers. Since this highscore was so important to me you're damn sure I've remembered that highscore's code and it's my password.

[@General12th]

"unbruteforceable" Brilliant word. Should be in every dictionary.

[@roflchopter11]

It's probably in his password

[@Onychoprion27]

You can also use conlangs, if you're nerdy enough. Nobody expects the Klingon Inquisition.

[@TheScrowlingFender7]

I've used phrases generated both my manager and diceware on a strength checker. Says that it would take centuries if not decades, depending on the words + things that sites require.

[@Hexanitrobenzene]

1:57 His expressions are so great :D

[@marketingdan5007]

I use last pass, gonna make the master pass stronger now though

[@cmwh1te]

Mine is upwards of 35 characters, and that's still theoretically vulnerable to a motivated attacker.

[@MegaZsolti]

My password is *********.

[@iamacookiecow]

Too short

[@MegaZsolti]

***** Oh, would **************** be better?

[@ruben307]

far better. that is the difference between a hour and 100 million years or so

[@BeHappyTo]

See, when YOU type hunter2, it shows to us as *********

[@JohnDoe-lr5fy]

All I see is hunter2 .

[@alialiyev6168]

"You moving your phone out of your pocket, and Google saying you moved your phone weirdly" I have been laughing to this for 5 minutes.

[@MrDsalomon]

Excellent presentation that is easier to understand at 0.75 the normal speed.

[@r.bresenitz6640]

Also: mix languages and include typos.

[@Yemto]

How about using words in another language, or every word in a different language?

[@lewismassie]

That is an interesting point. How long would it take to find a password written in four different obscure languages

[@Anonymous-jo2no]

I was about to say it... I know some long words from two foreign languages (not including my native tongue, English, and the language I studied until B2).

[@ragnkja]

If you speak multiple languages, combine them!

[@user-jh3mu5nb1g]

Unless you know the languages well, then this kind of password just becomes difficult to remember and not really any more secure.

[@brandonmtb3767]

The fact you mentioned this makes it a tactical that someone could use to crack it. Passwords must be as long as possible and random lEtTeRs and $ymb0|s

[@Musicrafter12]

I use a system where I have a base password, then I append something to the end, unique for each website I have an account with. It's easy to remember, but should also be secure against both brute-forcing and dictionary attacks. It also protects me from having all my accounts breached due to one single breach in one account. I don't use a password manager, either -- I don't need one because of the system I use.

[@inthefade]

I often use my passwords on accounts at friends' houses or on their phones. Usually if I don't have my phone on me, or like recently when I broke it. This makes a password manager completely impractical.

[@Verrisin]

except most sites will force you to have 6--12 char long password with symbols and numbers in it - you know... so it's safe....