The Simple Guide to Complex Passwords

A book of random numbers.
Photo by Michael Wheeler

We all know a good password is necessary for good protection of our computer systems and our personal/business data. They are however one of the most annoying inventions in human history. The biggest problem of course is not that we need a good password, it’s that we need tens or hundreds of good passwords, ideally one for every single computer system and website we visit, plus more for banking, encryption and other miscellaneous tasks. For me, that’s at least 100 different passwords that I should have. Guess how many I used to have for all of these different things?

Three. Not thirty or three hundred, just three. One for encryption and banking, one for system logons, and one for all the miscellaneous websites I visit every day. Not ideal. Not even close to decent. Woefully inadequate. So I decided to change that, slowly and surely, until I had a unique password for every system and website. But how? I’m not stupid, and my memory is pretty decent, but the thought of remembering a hundred different passwords is boggling in and of itself!

So how on earth am I to solve this problem? I found a couple of inadequate options:

  • I could write the passwords down on a scrap of paper and keep them in my wallet. If I lose my wallet, I’m pretty much screwed anyway, so being a little more screwed probably isn’t going to matter. On the other hand, there’s no reason to put myself in more of a pickle than necessary.
  • I could use one of those handy little password-keeper applications. I take care of remembering one difficult password, and the program takes care of remembering all my other passwords (which are suitably encrypted, using my master password as the key). The God of computer security, Bruce Schneier, has written one of the best applications for this: Password Safe. There are a few problems though:
    • If you’ve been reading my blog long enough, you’ll know that I don’t like trusting people I’ve never met. And handing over all my most secret passwords to some application written by a dude I’ve never met is pretty trusting, if you ask me. I’m not good enough at cryptography to write my own, so that’s out of the question too.
    • I need to have the password safe on me whenever I need to access my passwords, which isn’t always the case. Sometimes I access websites via my smartphone, where most password applications won’t work (which is especially the case on Symbian). Synchronisation becomes a problem. Multiplatform support is lacking.
  • I could keep on using my three passwords, and just deal with the fact that it’s not ideal. Most other people deal with it, so in theory I can too.

After a bit of research though, I stumbled across the answer. Password algorithms! The central idea is that like a password is put through an algorithm to produce an encryption key which unlocks your data (or a website), you are taking something you can remember (a normal dictionary word) and using it to produce a password.

The really clever element of the idea is that you can write your password algorithm down, because without the starting words the algorithm is useless. The amount of stuff you have to remember is greatly reduced! It’s genius! Here’s how it works:

  1. Take a plain, simple word that you can remember (like ‘Jack’ or ‘Banana’).
  2. Apply a series of steps to the word (I’ll use ‘Banana’), like so:
    1. Start off by adding an exclamation mark after the sixth character. We end up with ‘Banana!’.
    2. Replace the fifth character with the ASCII value of the character. We end up with ‘Bana110a!’.
    3. Swap the capitalisation of the first and second characters (lowercase becomes uppercase and uppercase becomes lowercase. We end up with ‘bAna110a!’.
    4. Swap the third and fifth characters. We end up with ‘bA1an10a!’.
  3. Put the resultant password into the website or application where it does it’s magic and unlocks your data.

For all the sites that you visit often, you’ll be able to remember the password in it’s complete form (via muscle memory). For sites that you don’t visit so often, you can take your simple word and produce the result password in only a couple of simple steps. It makes it even easier if you use a pool of common words (like fruit), as you can just keep guessing your way through the common fruits if you happen to forget even the simple password.

There are things you can do to make the passwords even stronger, too:

  • Use phrases to begin with instead of words. This makes things a bit harder to remember though.
  • Use longer algorithms. This makes things more annoying to generate a password though.
  • Use different pools for different purposes. One pool of words for work, one pool of words for banking, one pool of words for websites, and so on. If work ever figures out my algorithm and my work pool and decides to be a bit malicious (unlikely as that may be), they still have to figure out the pools of words I use for other purposes. That buys me a decent chunk time I can use to change the algorithm.

There are a few drawbacks, however. You still have to remember something (although remembering ‘fruit’ really isn’t that difficult). If somebody figures out both your pool of words and your algorithm, you are pretty much screwed. But those are fairly low-risk prices to pay, I think.

I’ve recently converted to using this sort of algorithm-based password mechanism. I think it’s great. I’d be interested to hear other people’s thoughts too: have you been using it for years? Do you think it’s a stupid idea? Should we all just be using biometrics instead? Let me know!