Re: [gentoo-user] Re: Coming up with a password that is very strong.

[Dale]

Nikos Chantziaras wrote:
> On 04/02/2019 07:47, Dale wrote:
>> How do you, especially those who admin systems that are always being
>> hacked at, generate strong passwords that meet the above?  I've googled
>> and found some ideas but if I use the same method, well, how many others
>> are using that same method, if you know what I mean.  ;-)  Just looking
>> for ideas.
>
> I don't use a password manager. For website logins, I just use the
> password manager in the browser (Firefox), which does not use a master
> password :-P I just assume my own system is not going to be compromised.
>
> For the websites I use, I generate a unique password per site using
> this command:
>
> $ pwmake 128
>
> This generates a password using 128 bits of entropy from /dev/urandom.
> You need dev-libs/libpwquality being installed (it's a dep of
> something important, I think, so should be installed on most systems
> already.)
>
> For remote systems I administer through SSH, I don't use passwords. I
> use a public/private key pair to log in (4096 bits.) My private key is
> protected with a strong password though, but it's easy to remember
> since it doesn't need to change. Something like:
>
> ilp&mac4d@4*r
>
> Which is short for:
>
> I like pizza and macaroni for dinner at four star restaurants.
>
>
>


One reason I use LastPass, it is mobile.  I can go to someone else's
computer, use LastPass to say make use of Paypal, Newegg, Ebay etc,
logoff and it is like I was never there.  Also, if my computer were to
die a sudden death, power supply goes bonkers and burns everything in it
up including hard drives, my passwords are still safe but available. 
When I get a new rig built, I can install LastPass, put in my email and
password then go on like nothing ever happened.  I can also use a
neighbors computer to order the parts for a new rig as well.  I just use
LastPass on their computer.  I could do that even if my backups were out
of date as well. 

I also like that it generates passwords that are dang near impossible to
crack.  It also doesn't have to be anything I can remember either.  This
is a few examples of what it generates.

*k0Dx^RiNPHOocIg

5wfy&YQA&vNa4^HHgwZ3

NnWM9DwCrVYyVryS3Aa9

Now I admit, I sometimes see one that pops up that I don't like the
looks of and I click for a new one.  Just like the last one in the
list.  It has two of the same letter at the beginning.  One upper and
one lower but still the same.  I'd skip that one.  Still, good luck
guessing it easily.  Cracking it is always possible but it makes it
difficult.  Also, I sometimes have to leave off the other characters
since some websites don't allow those.  My bank for example doesn't
allow a couple of them.  I think "*" and "$" is a no go.  It does reject
it when you try to enter it tho. 

If I were to ever get me a smart phone, LastPass works on those too.  I
still like my Razr tho.  It makes phone calls and allows me to text.  It
does what I need.  It also takes the place of a watch as well.  ;-) 

I get why some may just use Firefox or other browsers password tool but
thing is, if you don't have a backup of it and something happens, you
could be working a while to get those passwords going again.  If I
recall correctly, I have to go to the bank, present ID and such to do a
complete reset of my bank password.  I know it was that way several
years ago because I had to do it once. 

Those keys do work for things that support it.  I don't think any site I
use has that ability tho.  If it does, I don't know about it.  Maybe one
day tho. 

Dale

:-)  :-)