Password methodology

Everyone should know that the more secure their passwords are the more secure their information is. Let alone that everyone is sharing more information publicly than they might realize, it's often the private information is much more important and regretful to let fall into unwanted hands. If people know that they're important, they eventually fall on a tiered system of security. Most systems have a minimal tier, which is enforced by requiring multiple numbers, special characters, and sometimes you have at least two groups of letters that are divided by a number. These will inherently be more secure than not requiring them, because it isn't about the content of your password but how fast someone can find out what it is. If it's a birthdate or a dead son's name, like in some hollywood movies, then it can be found out easier through social engineering or put to the top of the probable patterns. Context adds only a little help in the grand marshal of password cracking, brute force. Given that you have ability to run thousands of guesses per second, there is no reason you wouldn't brute force a password. It's likely that the person just got hold of a hundred passwords and user names at once and doesn't want to spend too much time on just yours. If it's tough, they'll skip it because it would take too much time.

 Toughness with passwords comes in tiers and the complexity of the password. People's passwords are determined by a balance of their want for security and the maximum complexity they feel they can manage. I've seen people typing in sentences as their password, which when used with numbers and special characters is pretty secure. This type of password works best with a password manager, where the sentence is a master password and the manager creates extremely secure passwords. You can keep this manager installed on a USB drive, which can be encrypted. The passwords the manager comes up with are many and more times secure than what a human could remember. And between accounts, each have their own unique passwords. This is more than most people care to go through to be secure. So we can take certain ideas from it and make it into a new method that we can keep in our heads.
Having a sentence password is nice, but if you use the same sentence on each account, if one is cracked then they all are. There is only one key they need to open all your doors, that doesn't seem optimal. The manager makes different keys for each door, we can do that by having different sentences for each account. Suddenly our method just got pretty complex, how do I remember which sentence is for which account when there are so many? We can take one long sentence and derive many different unique passwords from it using an algorithm. For example purposes, I'll use the sentence "The quick brown fox jumps over the lazy dog." You might know that this sentence is special because it is a pangram, using every letter in the English alphabet. That is an important part of what makes our algorithm work.

Our algorithm takes in one piece of information and turns it into a secure password. Take a website domain name as the input, we have "www.google.com" as the address and "google" as the domain (cutting off the .whatever). We then take the first letter of the domain and find it in our sentence. This is why we need a pangram, for websites can be start with any letter. If a website starts with a number, use the word in its place. We find the first instance of 'g' in our sentence at the very end. We take the 'g' and the next two letters, which when the sentence is wrapped around are "th". These are our first three letters in our password, but to throw a twist in, we will capitalize the second letter, ending up with "gTh".

Because each domain is unique, we end up with different passwords. But if we only use the first letter, there are only 26 starting three letter combinations, not very good. If we assume that domains are at least three characters long, we can break them down into the first character, the second to last character, and the very last character. When you have more than three characters, such as "google", you can still find the letters that make up this combination. In our example with "google", we will be using the 'l' and the 'e' found in our sentence. If we include the letter that is to their left we would get "el" and "he" to add to our password. Lets capitalize the last letter to get "hE".

If we just threw these together to get "gThelhE, we'd still only have a seven letter password that isn't as secure as we want. Using a simple dictionary brute force attack, this password would not stand up very long. To make it more secure we will choose a two digit number and a special character. For choosing these, we won't use the domain and we'll use what is called the salt. This is chosen by each person to make it unique to them and because it's only three characters it isn't very hard to remember. In this example I will choose "45" and '%', but I want to stress that you need to pick your own and remember it, because this will be the one thing that remains the same between passwords. When we put the number between the first and second part we get "gTh45elhE". To finish we throw on the '%' at the end to end up with "gTh45elhE%" as your password that you would use for your google account. To show that other sites would have different passwords, here is the password for your amazon account: "aZy45rowN%". Your password for facebook is now "fOx45rocK%". These are secure passwords because they are nine characters long, include two capital letters, two numbers, a special character, is not contextually related to anything, and they are unique to each input.

This means that you now have 17,576 (26x26x26) unique passwords at your finger tips, given that two domains don't share the same first and last two letters. For instance, "google" is identical to "great-tale" and other if the match. Turns out with web 2.0, many websites took to replacing suffixes with the letter 'r', so there are even more passwords likely to be the same. So we have duplicates, but only in rare cases, what can we do to make this all even more secure? Personalizing this algorithm is one of intentions it was made with as you can choose what sentence you use, some other pangrams are "Pack my red box with five dozen quality jugs. ", which is 36 letters long. "Back in June we delivered oxygen equipment of the same size." is another coming in at 49 letters. You can change which direction you pull the letters from, which ones are capitalized, what order you put them together, and they have your own personal salt.
If you want to use this algorithm with an account that doesn't have a domain name to pull your source word from, look at the login prompt and pull the application name, company name, or anything as long as you can use it consistently. This can also be the case when you have different accounts at the same website, where it is unwise to use the same password for different accounts one after another.

Despite that this creates complex passwords, there are still some websites that have a maximum level of security. These websites are putting you at risk. Any maximum limitation on passwords is unacceptable. There is no technical reason that a maximum should be preferred, it might be said that it is harder to limit passwords than to allow them to be complex. I have had a bank account where you could have a maximum of 8 characters and no special characters were allowed. With a password like, "gTh45elhE%", what do we do when we encounter limitations? We sadly have to dumb our password down. If we can't use special characters, use the number that shares the character's key instead. We use '5' instead of '%' and '3' instead of '#'. If we can't use numbers of our choosing, we can use our choice of letters instead. Sometimes it takes more work to dumb a password down than to come up with it in the first place.

I use a variation of this method that I feel is easy enough to use on a daily basis that I never allow a website to remember my passwords. It is another problem that your password might be held un-encrypted inside a cookie either on your computer or on a server. It gets easier the more you remember your sentence and get used to filling in with your salt. The algorithm that you use is your last level of security, if someone knows it they can get into any of your accounts. It is important to never share how you create your passwords. When explaining this method, I recommend changing certain aspects of your algorithm so it can't be figured out. I think that it is likely that even with all your passwords in plain-text, such as a key logger would have, that most crackers would not be able to backtrack what your algorithm is. They would have your salt and know where the characters are divided, but they would need to work out your sentence to be able to find out new passwords.


I hope this helps keep your data safe.