Hacker News Reader

Comment by req2 | Hacker News Reader

Memorable passwords don't need to be simple, dictionary, or insecure.

MySonPlaysLittleLeague is a password that someone can easily remember, but few people get pointed in the direction of good sentence passwords, and most password policies indirectly limit the use of sentence passwords with character limits or number and punctuation requirements.

View on HN

My favourite technique isn't to make the sentence itself the password, but the first letter of each word (with some punctuation thrown in for good measure). E.g. pick a line or two from a song, like "All the fear has left me now / I'm not frightened anymore" and that becomes "atfhlmn-infa" (if it's something that insists on digits too then you can easily do a substitution like "atfhlmn-1nfa"). Memorable without being insecure.

However, this is prone to being truncated by sites / software that only allows or uses the first 8 characters...

Another method that I have used in the past is leet-speak (oh look at me, aren't I cool - cough, cough), so I just used my name and converted it: Haitsma became H41t5m4, very similar to a random string, yet very memorable (depending on your interpretation of leet-speak, of course)

I use Chinese pinyin phrases, then substitute some numbers for good measure. Example:

The phrase: "How are you" is 你好吗？ Romanized, that becomes ni3 hao3 ma3. So a password might be ni3hao3ma3 or n13h403M43.

If the system in question permits it (unix accounts do, at least) including spaces in passwords--making it technically a pass phrase--is another nice trick.

Reply on news.ycombinator.com