Hacker News Reader

Comment by FreakyT | Hacker News Reader

I like using phrase passwords like this, but unfortunately a lot of sites have massive lists of ridiculous rules which disallow these sorts of passwords, despite their apparent security.

Google currently gets it right, but a lot of IT departments I've encountered are absolutely adamant about things like "must contain 1 number, 1 symbol, 1 uppercase, 1 lowercase" etc, essentially enforcing a completely non-memorable string of 8 random characters.

View on HN

If you know your passwords are strong without those requirements, you could always come up with a standard prefix that adds no security but serves only to satisfy those rules. For example, all your passwords could begin with "$A1a". Unfortunately, this doesn't help when you run into the truly bizarre (but fortunately rare) case of sites that disallow specific characters (e.g. '$', which I believe I discovered is disallowed on Seattle City Light's website).

This is yet another wonderful use case for password managers. Let them remember the weird symbol combo you needed to log in to all the shitty sites, and use your awesome wordsmith skills to craft a nonsense string of words for your master password.

Good point, though I've often found that even that doesn't help because of "no dictonary word" requirements. So a password like $A1aHackerNews would still fail because it contains dictionary words.

Reply on news.ycombinator.com