Passwords, which are easy to remember, are not random and not strong. If I will know that your passwords are 3 dictionary words, I will try to bruteforce them using words, not characters. 50000 common words in ^3 is too small.
Jut generate random password and memorize it, like you memorize other random numbers and strings, like lock combinations, room numbers, car numbers, etc. Learn how to memorize arbitrary long strings of characters and you will have no problems with them for rest of your life.
To make life easier, memorize short password first, e.g. Gc@b%, let call it "alpha", then, when password expired, memorize two new short passwords, "beta" and "gamma", and include your old password "alpha" between them (or rotate it, or flip, or use part of it, etc.), so your password will 2 times longer and stronger. Repeat procedure next time. In short time, you will have list of "words" - short pieces of random strings, which are hard to guess by strangers, but remembered well by you. You can use that dictionary to construct new passwords while keeping adding new random or non-random "words" to dictionary, e.g. "car" - something related to your car, "house" - something related to house, etc. Then your password might look like "alpha-car-beta-house", which is easy to remember by YOU, but hard to guess.
No one recommends a 3 word passphrase. And for the situation you were asked about - a master password for a password safe - the recommendation is a 7 word phrase.
Even if you use the limited Diceware list (7776 words) you get 7776^7 which is plenty.
Gc@b%
26 upper, 26 lower, 10 numeric, 20 special chars (which are risky to use)
82^5. 3707398432. That's weaker than the 3 words phrase from a 50,000 dictionary, which is a phrase that no-one recommends and that you rejected as being too weak.
82^5 is for just one word. Combine 7 of them and you will have strong master password, much stronger than one made from 7 common words. My master password contains 16 random characters, but it still easy for me to change it when needed. I can make it twice longer without problem, but it is hard to type already.
It is random, and it is strong. It starts with a random 60-bit number and uniquely maps it to one of 2^60 distinct two-line poems. For 120 bits, memorize four lines.
Not entirely - I just think that the concept of a "master password" is still quite a bit broken. I would love if there were more biometric ways of me proving my identity to some system that maintained all these secure tokens that was also somehow revoke-able. I realize that may relate to mental memory.
For now, I guess it looks like a master password, which yes this paper elucidates methods for. But as long as you're memorizing 1 password (not 400), then how you manage to memorize it is of fairly small systemic gain.
Comments
The whole point of this paper is that it makes a 60-bit random password which is easy to remember.
Passwords, which are easy to remember, are not random and not strong. If I will know that your passwords are 3 dictionary words, I will try to bruteforce them using words, not characters. 50000 common words in ^3 is too small.
Jut generate random password and memorize it, like you memorize other random numbers and strings, like lock combinations, room numbers, car numbers, etc. Learn how to memorize arbitrary long strings of characters and you will have no problems with them for rest of your life.
To make life easier, memorize short password first, e.g. Gc@b%, let call it "alpha", then, when password expired, memorize two new short passwords, "beta" and "gamma", and include your old password "alpha" between them (or rotate it, or flip, or use part of it, etc.), so your password will 2 times longer and stronger. Repeat procedure next time. In short time, you will have list of "words" - short pieces of random strings, which are hard to guess by strangers, but remembered well by you. You can use that dictionary to construct new passwords while keeping adding new random or non-random "words" to dictionary, e.g. "car" - something related to your car, "house" - something related to house, etc. Then your password might look like "alpha-car-beta-house", which is easy to remember by YOU, but hard to guess.
No one recommends a 3 word passphrase. And for the situation you were asked about - a master password for a password safe - the recommendation is a 7 word phrase.
Even if you use the limited Diceware list (7776 words) you get 7776^7 which is plenty.
26 upper, 26 lower, 10 numeric, 20 special chars (which are risky to use)
82^5. 3707398432. That's weaker than the 3 words phrase from a 50,000 dictionary, which is a phrase that no-one recommends and that you rejected as being too weak.
82^5 is for just one word. Combine 7 of them and you will have strong master password, much stronger than one made from 7 common words. My master password contains 16 random characters, but it still easy for me to change it when needed. I can make it twice longer without problem, but it is hard to type already.
It is random, and it is strong. It starts with a random 60-bit number and uniquely maps it to one of 2^60 distinct two-line poems. For 120 bits, memorize four lines.
Right, and I think it's a good idea. codemac and lisivka apparently disagree.
Not entirely - I just think that the concept of a "master password" is still quite a bit broken. I would love if there were more biometric ways of me proving my identity to some system that maintained all these secure tokens that was also somehow revoke-able. I realize that may relate to mental memory.
For now, I guess it looks like a master password, which yes this paper elucidates methods for. But as long as you're memorizing 1 password (not 400), then how you manage to memorize it is of fairly small systemic gain.