commrads

please to not be perpetuation of soviet-style russian hoax fake news. is propaganda, da?

If you want an easy way to make passwords you can remember I always use some very easy dictionary password then apply some rule.

For example...

Start with MAKE AMERICA GREAT AGAIN

Do the obvious of probably lower casing it and making it easier to type plus removing the spaces, or not. Actually not doing either of those makes it a lot harder to brute but we're trying to balance. Everyone appends the extra strength rules to the end.

Now the rule for humanising it we have "makeamericagreatagain". Append what you need to pass the tests, perhaps a common thing or not. Just prepend and capitalise last makes it very strong as it'll break the heuristic based on what most people do. All brute force generators try with ucfirst and append numbers usually up to four digits making those rules kind of limited in value.

Now the rule for fudging it. In this case I'll give a simple one. Remove the first and last letter of each word to get: [email protected]

This approach isn't brilliant all the time. This rule will still for example match statistically frequent letters and roughly match occurrence rates both individually and in pairs which some advanced heuristic brute force optimised lists create (I'm made all kinds of software for this though ironically not for hacking but when I've forgotten my own password but can make pretty good tools to heuristically produce a range of candidates and restricted search space because self heuristics is the easiest since you know all your own tendencies).

It's also easy to program such simple rules into a brute force but it's a start and if you're clever you can come up with a few rules to make it very difficult. There's millions of simple rules you can program into a generator and if your thinking can be unusual enough you can escape that but problem is as a human you're likely to think of similar rules as others will so you have to reach out just a bit beyond the simplest easy thing that comes to mind.

You can also use things like keepass or encrypting your passwords in a text file with one to unlock them all. Though I come from the old school where you had to keep all your passwords, etc in your head.

I've seen lists of passwords quite often a long time ago. Security experts make a lot of silly assumptions. first thing is sort them by frequency and look at the most common as well as a sampling of the uncommon. People assume that things at the top like "password1" or "[email protected]" are insecure. It really depends. Half of them are idiots, the other half just want a look over the wall. If you look at it from a hacker perspective then when you hack the easy ones loads of them are also disproportionately low value accounts that signed up then left. This was very common when you had facebook's and others strategy of making people sign up to see stuff.

I had a good laugh on that one this morning.