The worst part of the left one is the implication they have only two passwords. The “under the keyboard” part at least requires physical access and (hopefully) means its not something stupid or short like “p@ssw0rd”.
my workplace makes us change passwords every 3 months and I don’t respect them so its the same password with the same number at the end -1 because I can’t be bothered. If I get hacked oh no ive dealt damage to a multi billion dollar corporation woe.
I wonder why passphrases fell out of style? If you remembered a series of random words like you were activating the freaking Winter Soldier, boom, 40+ characters!
If we take the EFF wordlist commonly used to generate passphrases, we have 7776 words. If we take ASCII alphanumerics and special characters we have about 92. Assuming we generate a NIST compliant password of 15 characters in length we get 92^15=2.8*10^29 of combinations. To get the same level of security (same number of combinations) using the EFF wordlist we need (log(2.8)+29)/log(7776)=29.45/3.9=7.6 around 8 words. If we assume the words are 7 characters long on average, plus the separators, we get 7*8+6=62 characters long. If we start to also include Unicode characters like other scripts or emojis (something I’ve recommended to others) the required number of words grows even more. I don’t know about you, but I can’t be bothered to type that all out every time, a password manager works for me.
Did they ever get into style. I use them, but I don’t know anyone else who does. And some sites make diceware passphrases harder to use by e.g. requiring you to add numbers, special characters or capital letters, or by banning spaces. Or by banning non-ASCII, which makes it harder to use diceware passphrases in other languagess than English.
This is why passphrases are better than passwords. So the “Under the keyboard” can be used as password. It has 3 out of the 4 types to match complexity and plentiful for length. And so much easier ro remember. It could be also a quote from your favorite movie or book, part of a lyric of your favorite song, etc.
I will take a stanza from a song, use the first letter from each word, switch the S to 5 or $ as an example, and make sure I have two uppercase, two lower, two numbers. and two special characters, 8 minimum, although now it runs about 13.
I hum as I type in my password. All I have to remember is how I typed it out.
Come at me, dictionary cracks. The result is bonkers as fuck, but I loved that stanza. I have passwords I have used for 20+ years.
My coworker who sits next to me recently commented to me that I always hum the same tune when I log into my computer. Then he mentioned I hum a different tune when I log into the proxmox.
Meanwhile, half of the people at every company I’ve ever worked at:
The worst part of the left one is the implication they have only two passwords. The “under the keyboard” part at least requires physical access and (hopefully) means its not something stupid or short like “p@ssw0rd”.
I have yet to see a sticky note password that was anywhere near NIST compliant lol.
NIST compliance is 15 characters. That’s it. No stupid cycling every three months. No stupid special characters.
Somebody finally read the XKCD comic.
my workplace makes us change passwords every 3 months and I don’t respect them so its the same password with the same number at the end -1 because I can’t be bothered. If I get hacked oh no ive dealt damage to a multi billion dollar corporation woe.
I have a system of using month and year plus a common trailing string. My annoyance is that every year the last number on the year keeps moving.
I wonder why passphrases fell out of style? If you remembered a series of random words like you were activating the freaking Winter Soldier, boom, 40+ characters!
If we take the EFF wordlist commonly used to generate passphrases, we have 7776 words. If we take ASCII alphanumerics and special characters we have about 92. Assuming we generate a NIST compliant password of 15 characters in length we get 92^15=2.8*10^29 of combinations. To get the same level of security (same number of combinations) using the EFF wordlist we need (log(2.8)+29)/log(7776)=29.45/3.9=7.6 around 8 words. If we assume the words are 7 characters long on average, plus the separators, we get 7*8+6=62 characters long. If we start to also include Unicode characters like other scripts or emojis (something I’ve recommended to others) the required number of words grows even more. I don’t know about you, but I can’t be bothered to type that all out every time, a password manager works for me.
Yeah, that makes a lot of sense. I guess I meant for things where you need to actually memorize a password, like for the password manager.
But yeah for 99% of cases, a backed up KeePass database with randomly generated ridiculous passwords for every little service is fantastic. 👍
I can memorize the 8 words though, which is why I use that method for anything where I can’t use keepass.
Did they ever get into style. I use them, but I don’t know anyone else who does. And some sites make diceware passphrases harder to use by e.g. requiring you to add numbers, special characters or capital letters, or by banning spaces. Or by banning non-ASCII, which makes it harder to use diceware passphrases in other languagess than English.
Ain’t it 8 characters, and 15 for machine accounts?
I just read it yesterday but maybe it was an older entry
That’s fine at home. Not so great in an office, though
I agree, but if I had to choose between someone reusing passwords and someone who kept them under the keyboard I’d probably choose the latter
You can’t fit that many post-it notes under the keyboard though, so if they’re doing the latter they’re probably doing the former
This is why passphrases are better than passwords. So the “Under the keyboard” can be used as password. It has 3 out of the 4 types to match complexity and plentiful for length. And so much easier ro remember. It could be also a quote from your favorite movie or book, part of a lyric of your favorite song, etc.
So at a customer I found the following note. At the desk of an employee with the last name “Sun”:
“‘Sun’ is user name and password!”
I wonder why we use passwords at all.
Woah now what about changing 1 to !
Holy $#!7111
Alt joke:
Thanks for the tip! My password is now…
hunter2I feel more secure already. :D******* you say?
I will take a stanza from a song, use the first letter from each word, switch the S to 5 or $ as an example, and make sure I have two uppercase, two lower, two numbers. and two special characters, 8 minimum, although now it runs about 13.
I hum as I type in my password. All I have to remember is how I typed it out.
Come at me, dictionary cracks. The result is bonkers as fuck, but I loved that stanza. I have passwords I have used for 20+ years.
My coworker who sits next to me recently commented to me that I always hum the same tune when I log into my computer. Then he mentioned I hum a different tune when I log into the proxmox.
My sticky note would be like:
computer - Local H
proxmox - Sonic Youth
mail server - Future of the Left
NAS - Faith No More
Inventory - Slothrust
etc.
Oct0ber2026!
That’s why you should never change your password. No one will think to guess @utumn2O23 in 2026.
I have a nice notepad from a conference on my desk labelled “Passwords”