Best Tool For Remembering Passwords? 1007
StonyCreekBare writes "Lately I've been rethinking my personal security practices. Should my laptop be stolen, having Firefox 'fill in' passwords automatically for me when I go to my bank's site seems sub-optimal. Keeping passwords for all the varied sites on the computer in a plain-text file seems unwise as well. Keeping them in my brain is a prescription for disaster, as my brain is increasingly leaky. A paper notepad likewise has its disadvantages. I have looked at a number of password managers, password 'vaults' and so on. The number of tools out there is a bit overwhelming. Magic Password Generator add-in for Firefox seems competent, but it's tied to Firefox, and I have other places and applications where I want passwords. And I might be accessing my sites from other computers that don't have it installed. The ideal tool in my mind should be something that is independent of any application, browser, or computer; something that is easily carried, but which if lost poses no risk of compromise. What does the Slashdot crowd like in password tools?"
paper in your wallet (Score:5, Interesting)
Keep them on a slip of paper, in your wallet.
but DONT list what each is for - you can remember that part easily enough
Re: (Score:2)
Re:paper in your wallet (Score:5, Funny)
Websites could do more to protect their users too. For example if you accidentally write your password here on Slashdot comments, it comes up as masked. Like for example my password is ********.
Re:paper in your wallet (Score:5, Funny)
Really? That works? My password is hunter32. :P
Seems like i can see it still though.
Re:paper in your wallet (Score:5, Funny)
Really? I couldn't see it. this is what i saw
Really? That works? My password is ********.
Re: (Score:3, Funny)
I put on my robe and wizard hat...
Re:paper in your wallet (Score:5, Funny)
You only see it because it's your password. Everyone else sees it like this:
Really? That works? My password is ********.
Re: (Score:3, Funny)
Hey, wait...how did you know my password?
Re:paper in your wallet (Score:5, Funny)
He didn't know your password. He just typed "********" but you saw it as "hunter32" because that's your password.
Re: (Score:3, Funny)
brilliant social engineering.
I almost tried it for a second...
Re: (Score:3, Funny)
Not me...my password is:
1...2...3....4............5
Re: (Score:3, Funny)
Re: (Score:3, Insightful)
People rarely steal passwords that way because of masking. Get rid of masking, and shoulder-surfing will flourish.
Re: (Score:3, Insightful)
and if your wallet is lost/stolen, not identifying each password with a particular site will give you enough time to change the passwords before you can be compromised
But I needed the wallet to know what the passwords were so I could change them! DOH!
Re:paper in your wallet (Score:5, Insightful)
I agree.
100% security is impossible. Any data you transmit or store on a physical device can be recovered, regardless of encryption. All you can do is make it more costly to recover that data -- the best security makes it more expensive than it is worth.
Given that's true, then all security is a tradeoff. Storing passwords on a piece of paper in your wallet is actually very secure for the majority of people, more secure than you can really hope for without going to extreme lengths.
If you have communications or data that are so sensitive that you really have to go to extreme lengths to protect it, then you need the help of a security professional, not encryption and advice on password management.
So, make your passwords random, different for each thing that requires a password, and write it down on a cheat sheet. Guard that sheet like you would your credit cards. If your wallet is lost, immediately set all your passwords to something temporary then build a new password list all over again.
Re: (Score:3, Informative)
It became increasingly anoying to remember which password I used where. And with the increasing number of password protected sites and apps I also started using the same passwords over and over.So I needed a new scheme.
My requirements were that:
it had to be long (14 chars minimum),
had to contain letters and digits,
should not be guessable, or at least parts of it (duh!),
must be unique for eve
Re: (Score:3, Informative)
Re: (Score:3, Funny)
Re: (Score:3, Informative)
100% security is possible if you have physical control of a device and want to make sure that nobody ever gets access to it again. (Turning the device into a fine powder and then either melting it down or distributing it across a very large area).... I believe at one point at least that is how the government handled things.
Storing a backup version of your data that you do not need frequent access to on the other hand is possible to get 99.999% secure but as you increase the security level you also frequent
Re: (Score:3, Funny)
Then I revert to my backup backup, which I keep on a post-it note stuck to my work computer.
Re:paper in your wallet (Score:5, Informative)
I do something similar, but its the default output of pwgen. All I have to do is recall the first few syllables, the general grid location of the password, or just a part of the password.
I carry this around in my wallet, sure my password is on there, but with no real frame of reference its hard to decipher and make a guess.
Also, suggest printing with a fixed width font.
$ pwgen
gah5eiP2 Ga4cie3c ya6gaiTi eic1EeCo Shaisae5 ChaeXah2 Jaet0ooz ahThai3j
Yie7UH9f Iefie1ja ooghu8Oh uot7aeL0 gughes2M fahGh9ah Ohz7ohto wae2Seh1
avah3Oog Iechie2f eiPhoZi9 Mavohli9 Kohshis7 Meilo8ce Queis5hu Eiz9aij8
Pae9ahPu Equ0zoo9 Oothahk3 pich2Xao IeZai3ae aiLa7Ath Eol2aes7 aeZ5raht
AVai9nee Aam7ahzo Ioch2oqu faiGh0th eYae2ohl si7Te0we einai3Wa oash6Ahj
Eik5uul2 opai8zoY ohw5Ihaf Mi7keix9 aevi1Wa3 mo9ohJ5I Piek2yoR Si1phieZ
Ahc9luch ohNg6Oon daghieP9 reCh7jas joo4ooVi yooR6yeu eeph5Aip shie3Ahp
quoVeg8U Nee3phah CahXee0r aoD8Thai Ai5Aigha eePh0zee Cheip5Ch xeebe0Oy
laeFeez4 Ag9sheeR Ga4gooph Oijae9da aePao2ta ahz8ieNg bu9EhieS quooWoo3
ahghea7N Bot9hieC He3eeGhi ouli8Oof ik3Ohsoh Rahz9Che aeXaNg1e soh3Thee
Ahkith6u Ahs2Zuid eth6Ej0o Go0iho1d xaPhah9z aiNg1yoh Aer8Eet3 juZ3aThu
gee4KooK Hee9iqu3 Duh4aipu AiP6ahph Shaec5ne neeXa6Re Roh6fief Baef9ieM
eeGoo4ie eva1aeQu lu4hiJoh sae2DuYu fahGae7b Doh5Ifi6 jeish9Ae Rierieb5
Eedae7Iu moo6aiG3 ohNei0ie ew9ieHeu xoh5caeL NeiD0ohs iipe4aeP Lich0xak
Oozei5ao gaNgieV2 Dei0ae9l us3Loh8k phal5aeN aip0KeeV Aeg1rais oth1Ahdi
was3ow8Y Oquud1bu emee7Ohr iewa6baJ ao8Airie beegooL9 heiveF7u ongooD9w
iic4uGh0 Ohn9zeiC Neen4noh kei1Seng chieV3oh QuuQu2ju Eex1gaf3 aot8Dah1
EDoh1aej eaBae1ri Eih0woh6 Eiw3Johp Yi3aizuu Og9shohl ho6mi6Xu AeT8eihu
Iev5ohph lies0Iev eeV4jiek Tha1xoo8 gua9biiT aa4Maiga ohXoh3ai eisi8Jee
Ieloh3mo Quoch6sh Eecha0Ra zahnguM8 ieP5Jeye Mao5maec Ephae8af quihei8A
Re:paper in your wallet (Score:5, Insightful)
It is not hard to guess (Score:4, Funny)
Re: (Score:3, Insightful)
I would advise against your method, because you just reduced the search space for anyone wanting to get in from millions of possibilities to just 160 different passwords. Having a list with your actual password on it makes it pretty easy to brute-force.
Same goes with an earlier suggestion of having your passwords on a slip of paper in your wallet but not indicate which passwords are for what. Very easy to brute force.
Re:paper in your wallet (Score:5, Funny)
I have a similar setup, I have this on a piece of paper in my wallet
ABCDEFGHIJKLMNOPQRSTUVWXYZ
and I simply remember which letter my password starts with, and then what letter comes second etc.
For example, if my password was SLASHDOT, I would start by remembering the first letter, which is S, then remember the second letter, which is L, and I continue remembering until I have completed the password.
Re:paper in your wallet (Score:5, Insightful)
Congrats, and thanks.
Now I have an oh-so-sort dictionary (only 160 entries!) to feed to my favorite password-cracking program. The odds of my success just went from potentially being neigh-impossible to almost-certain.
160? Why are you assuming the password must start on a "word" boundary? I guess you're also assuming it's 8 characters long? So if it's "ao2taahz8ieNgbu9" you'll miss it.
Re:paper in your wallet (Score:5, Insightful)
160 characters * 8 letters = 1280 characters.
Number of one-character passwords: 1280 (actually it's even less but stay with me)
Number of two-character passwords: 1279
Number of three-character passwords: 1278
Number of 100-character passwords: 1180
Number of 1280-character passwords: 1
Total number of passwords = 1 + 2 + 3 + ... + 1280 = (1638400 + 1280) / 2 = 819840 passwords
Not that good, actually. And if you limit password length to 64 characters, you get only 79904 passwords (equivalent to a three-letter password using lowercase, numbers and simple punctuation only)
Re: (Score:3, Insightful)
That's interesting, but for mine I will sometimes choose a password that wraps and (more commonly) one which is backwards. Funny thing about it, though, is that for my "secure" sites I add a non-alphanumaric to the end (bang is my normal, but I've used the asterisk in the past). My list is shorter than the GP's, though. I've used this method since the early 90s when my group at NASA implemented a draconian password regimen which required a new password every 30 days, 8 character minimum, 2 non-alpha charact
Re: (Score:3, Insightful)
Good luck trying even 100 passwords in a reasonable time on any relatively secure system. Most lock you out if you fail 3-5 tries within 5-15 minutes. Say you can try 5 per 5 minutes, at a minimum it is going to take about 2 hours. I know some systems by default base lockout time on number of password failures increasing up to 24 hours to 2 weeks for remotely accessed systems. On more secure systems the system administrator gets a brute force notice and/or a semi permanent to permanent ban from that IP,
Re: (Score:3, Insightful)
would you trust those same people with your bank account password? Because that's what he mentioned.
Further, and forgive me for having used unspoken assumptions, but I would imagine that if someone is going to the trouble of setting up a password manager then they might actually end up using those passwords for more than just websites. The anecdotal "it works fine for me" is nearly meaningless; he could have 1 password for all the sites, and have it be something like his street address or such, and guess
Re: (Score:3, Interesting)
Re:paper in your wallet (Score:5, Insightful)
GPG is available on almost every possible platform. That satisfies the portability issue. Text files with encrypted ASCII text blocks inside are easy to backup (or can even be printed to hard copy).
Plus, if you have a password that multiple people need to know, just encrypt the text with all of their public keys and email the ASCII text block to them.
How about... (Score:2)
Truecrypt (Score:5, Insightful)
Do what I set up for my father, Truecrypt installed to a USB key, passwords in a plaintext file inside the arcive.
Re:Truecrypt (Score:4, Insightful)
Re:Truecrypt (Score:5, Funny)
Re:Truecrypt (Score:5, Interesting)
Re: (Score:3, Interesting)
what if your not using windows. what about using it from multiple computers.
Mine is on a USB drive in an encrypted drive image, which stores the application and data files which which themselves are encrypted. my current problem is that it is OSX specific. I would love a way to be able to mount that drive on windows and Linux too.
Of course such things don't work well unless you use a java app, which may or may not run depending if java is installed or not.
Re:Truecrypt (Score:4, Informative)
keepass is available for windows linux and osx. You can run the windows version as a standalone binary.
I keep my keyfile and db on usb key (with backups of the db strewn around all over the place), and the master password in my head
Re:Truecrypt (Score:5, Informative)
keepass is available for windows linux and osx
Dunno why you'd need it on Mac OS X though, the built-in Keychain and Keychain Access.app does the same thing and more. It will do autofill, autofill after asking you for the master password, or you can just use it to store the passwords and look them up manually.
Keychain can also store secure notes and certificates for websites and such. It's pretty nifty how well it all works, you hardly ever have to worry about manually managing passwords and certificates.
Re:Truecrypt (Score:4, Informative)
KeepassX is a truly cross platform version of keepass. It does not run under wine and is just about indistinguishable from the windows-only keepass.
Re:Truecrypt (Score:4, Interesting)
Do what I set up for my father, Truecrypt installed to a USB key, passwords in a plaintext file inside the arcive.
Why bother with passwords?
Start authenticating with your GPG key. (http://gpgauth.com)
Your GPG key logs you in, compromised sites don't hurt you.
Re: (Score:3, Interesting)
PassGorithm - One Algorithm, infinite passwords (Score:4, Interesting)
Re: (Score:3, Insightful)
I used to do something like this, but as companies buy each other out, rebrand parts of themselves and other such shenanigans the website name and URL tend to change. This can get confusing.
Re: (Score:3, Insightful)
Why is it on a USB key? You're not carrying around your Truecrypt volume and typing your passphrase into strange computers are you?
Xmarks, KeePass and Encrypted Zip combination (Score:2)
I recommend this three step method:
Step 1) Memorize one very long complex password. Take your time and pick something out that is long enough that someone could watch you type it a dozen times and have absolutely no hope of getting close to it. Use this password to encrypt a zip file, 256 bit AES, with separate text files for each system where you need a password. Never type this password on a computer you can't trust implicitly and save the archive somewhere safe online and on a thumb drive. Update this p
Re: (Score:2)
Did you ever play with AccessDiver? If I remember right, that was one of the default brute force cracking schemes.
Keepass (Score:5, Informative)
http://keepass.info/download.html [keepass.info]
Re: (Score:3, Insightful)
Keepassx also works great on Linux, Macs, and Windows, which I hav
if you use a mac... (Score:2, Informative)
Re:if you use a mac... (Score:5, Informative)
I prefer the built-in Mac Keychain. With the Mac OS Keychain plugin, Firefox will save its passwords there as well (and it can share them with Safari).
One important consideration - change your Keychain password so it's different than your login password. Use something that's easy to remember but hard to guess, e.g. the price of a cheese pizza and a large soda at Panucci's Pizza ($10.77).
Re: (Score:2, Funny)
Re: (Score:2)
Re: (Score:2, Informative)
Hashapass (Score:2, Interesting)
Re: (Score:3, Insightful)
Hashapass is a clever idea, but don't you run into the problem of various sites having different requirements for a valid password?
In my experience some sites want you to have a long passwords, others actually limit the length. Some only allow alphanumeric characters, and others mandate the presence of a non-alphanumeric character. Even worse, a lot of sites don't state clearly at the login prompt what their requirements are (you might need to fail once to see or even find it on another page), so doing
1password (Score:2, Informative)
Re: (Score:3, Informative)
I'll second this. 1Password also works with both Safari and Firefox (and maybe others), allowing you to disable the browser's ability to remember passwords. All you need to do is remember the master password. It's an excellent utility for corporate environments too.
Try Keepassx (Score:2, Interesting)
I've used Keepassx for a few years now. It's cross platform (Windows / Linux) and stores the files encrypted. I tried one of Bruce Schneier's public domain solutions previously, but the Linux install (Password Gorilla ???) was rather painful on some systems if I recall correctly.
Just be sure to use a substantial password for the database...
PasswordSafe (Score:5, Interesting)
I first saw the link to PasswordSafe [sourceforge.net] from Bruce Schneier's site. If I have to take advice from someone on keeping something secure, it's Bruce.
Re: (Score:2)
Easiest one is... (Score:3, Interesting)
Plain-text on a different computer? (Score:2, Interesting)
If you have access to any other box, how about a plain-text file there? Even a little security through obscurity (ie hidden file burried in the filesystem somewhere) would be better than letting Firefox automagically fill it in. I guess you could always encrypt the file so you only have a single one you absolutely must remember (shades of Flourish and Blott's losing all those copies of the Invisible Book of Invisibility though).
KeePass - fantastic software. (Score:5, Informative)
* Stores all of your passwords in a secure encrypted file
* Has auto-type so you don't have to type or remember your passwords
* Has a great password generator tool, so that you can reset all of your passwords to something secure
* Easily transferable password database.
* Can run off a USB stick
I checked it out a month ago on the recommendation of a mate, and have been using it ever since.
It has everything that you need. Fantastic program and has been serving me brilliantly for the past month. I have now gone through all of the sites that I use regularly and have been resetting my passwords to something random. If any of those passwords are leaked then it won't be the disaster it could have been!
And on the plus side, for the sites that I login to very occasionally (eg, once every six months) I don't have to scrounge around in my memory trying to figure out what my username+password is.
And for those horrible sites that have mandatory minimum password requirements, it makes it really easy to generate a password that fits their bizarre criteria. (Eg, only 6-10 characters long, certain characters not allowed, must contain upper and lower case etc etc etc).
Don't use Firefox's password storage! They are all stored in plain text! Anyone can view them!!
Re:KeePass - fantastic software. (Score:5, Informative)
If you turn on the master password then the password file is encrypted [luxsci.com].
Never store your passwords! (Score:2)
Never ever ever ever (EVER!) store your passwords where they can be retrieved by unauthorized 3rd parties! That includes password storing utilities, scraps of paper under your keyboard, or a little note in your wallet.
Written down, in a lockbox, in a safe, in the floor of your basement, under a rug, in your house that has an active alarm system (that you use), in a armed guard and gated community is ok. Ok, most of us can be a bit less secure than that, but I don't recommend
Post-It Note on the Monitor (Score:5, Funny)
Post-It notes have the distinct advantage that no computer virus or Trojan can steal it.
Re: (Score:2)
Opera Password Manager (Score:2)
Opera does not store its Master Password in the plaintext format. Moreover, Opera doesn't even store its hash. The developers have chosen a different route: the password along with the salt participates in the encryption o
Can't be 100% secure (Score:4, Insightful)
Similarly, few thieves are going to be looking for passwords on old sheets of paper. Most thieves if they break into a house look for A) cash B) jewellery C) expensive-looking technology. Even though it is much more important to us geeks, a thief is going to go for sellable things, chances are your plasma is more sellable than your Pentium 4 tower, your monitor more than your external HDD and your PS3 more than your stack of back-up DVDs.
There is a -lot- more threat from crackers, viruses, keyloggers and other malware than the run-of-the-mill thief getting your laptop.
Write your own (Score:2, Insightful)
I wrote my own password generator in vb.net. I'm sure it's not as random as it could be, but I think it's good enough.
Re: (Score:3, Insightful)
I wrote my own password generator in vb.net. I'm sure it's not as random as it could be, but I think it's good enough.
Well okay but how do you remember it? Unless the password generator always generates the same password.
Password Safe (Score:3, Informative)
I have to track a lot of personal passwords and also 200+ passwords for client websites, emails, etc. I use Password Safe and recommend it:
http://passwordsafe.sourceforge.net/ [sourceforge.net]
Hides when minimised and has a useful function that enables it to copy a password and minimise again when you double click a client name (i.e., if you need their main/default password). Quick and easy.
Used to have Filezilla set to remember client passwords until a PDF hole led to a bot stealing Filezilla's password store and auto-hacking a lot of sites that were a serious pain to clean up.
KeePass (Score:2)
Another vote for KeePass
Gringotts (Score:2)
All kinds of solutions that work, really .... (Score:2)
I've researched this one for my boss, as well as for personal use. I agree that for Mac users, 1password isn't too bad a program.
If you want a *hardware* based solution, I've looked at Mandylion Labs' Password Manager before too.
Personally, I thought the Mandylion Labs solution was overkill for anything less than corporate use, though. Its "strong points" are largely centered around an I.T. staff centrally administering password policies for the keyfob and so on.
Another basic, but potentially effective an
Keepass (Score:2)
http://keepass.info/ [keepass.info]
LockNote (Score:3, Informative)
I use Steganos LockNote (GPL, http://www.steganos.com/us/products/for-free/locknote/overview/ [steganos.com]), it's essentially a self-contained AES encrypting Notepad.
And it's extremely stand-alone/portable, so you can just stick it on a USB stick.
How I remember passes (Score:2)
Re:How I remember passes (Score:5, Funny)
A guy I used to work with told me a story about a late-night support call with the operations center. He figured out that they needed to run a job that was under someone else's account. So they conference-called in this other guy at home in the middle of the night, and asked him for his password. He refused to give it over the phone, and the operations people were getting madder and madder because the night's jobs were being held up. Finally, he agreed to give them the password but only if they turned off the speaker phone.
The guy's password was BigBlackDonkeyDick.
Hilarity ensued. I'm pretty sure the whole shop knew the guy's password by the next morning (hell, I still remember it and I didn't even know the guy!)
Simple - a spreadsheet (Score:2)
Prepended or Appended Passphrase (Score:3, Interesting)
Create a passphrase which you prepend or append to every important password. Don't divulge that passphrase to any but the most trusted (spouse, family attorney, etc.).
Keep a list of passwords sans the passphrase in a safe but accessible place in case you forget one. If someone finds that list, it'll do them little good since not only will they not know the passphrase, neither will they even know it exists.
I'm assuming you have no state secrets or other seekrit stuff which may be intimidated out of you by other means (pliers, electrodes, etc.).
Re: (Score:3, Insightful)
Create a passphrase which you prepend or append to every important password.
Bad idea. You should never use the same password (or part thereof) on two or more systems (that you do not control). In your case, if an attacker managed to get two of your passwords (say to two different web sites) then they could simply compare them and determine your super-secret pass phrase that you attach to all your passwords. Combine that with your list and you're owned.
Re: (Score:3, Insightful)
Hashing Works (Score:5, Interesting)
Re: (Score:3, Interesting)
Mod parent up.
I once wanted to make an account at a new website, only my rather unique account name was used, I tried logging in with my "password system" based on the site name and sure enough, I don't know how many years ago I setup an account (long enough to not remember the place) but unbeknownst to me, I was golden.
The advantages is you never write them down, you never have to seek a resource to decrypt anything, you have unique passwords for everyplace.
I have since modified this so it's just as easy t
Re: (Score:3, Interesting)
Yes, I have a similar mental hash, although it is more complicated and so the password is longer. It makes sure that no two sites have the same password, so no one can get into my e-mail, say, just because they have found my Slashdot password. They take too long to type in, though, so I let Firefox remember them. Firefox protects them all with one master password that I enter once per session. In turn, my entire home directory (including the Firefox profile) is on a TrueCrypt partition (protected by a c
Re: (Score:3, Insightful)
everyone uses this method but nobody want to reply and agree with you because then someone could find that person, reverse engineer their hash and then own them.
shit!
Re: (Score:3, Informative)
Use the master password feature and stop worrying (Score:5, Informative)
1Password (Score:3, Informative)
On my Mac, I live & die by 1Password. I resisted putting all my passwords into a single store like it, but once I started, I was blown away by the program.
For my PC at work, TrueCrypt with a spreadsheet inside.
OBZVault: runs on Linux, Mac OS X, and Windows (Score:3, Informative)
I recommend OBZVault [offbyzero.com]. OBZVault is a cross-platform encrypted text editor; with it you can secure sensitive information like passwords, quotes and messages, and access them from any operating system.
We use OBZVault in-house to store all our important company secrets (passwords, PINs, etc.) in a single file that gets checked into our source control system. Using OBZVault we can access that file on any of the operating systems we use (Linux, Mac OS X, and MS Windows).
It's licensed per physical machine, not per operating system, so e.g. a dual-boot Mac OS X and Ubuntu machine will only need one licence.
(Disclaimer: I co-founded OffByZero [offbyzero.com], the company that produces OBZVault.)
Old School (Score:3, Interesting)
Notecard In Wallet For Life (Score:3, Interesting)
Passphrases from books (Score:3, Interesting)
What's so wrong with using the opening sentences of books, with a bit of 1337 speak? Take the the first part of the opening sentence from James Joyce's "Ulysses":
Change a few letters to numbers, or introduce a misspelling. Even add different punctuation if you want. That'll be pretty stong. Then you can even email yourself a password hint: Joyce, or Dublin, or Stephen, or anything really. You'll remember it, if you're not an idiot. Follow the same pattern with different books for different important sites, and unless the CIA or Mossad is after you, you'll do fine.
/not my password ... or is it?
Re: (Score:2)
Re: (Score:2, Redundant)
Is your head. Plain and simple. Never write a password down on your hand and NEVER on a sticky note on your monitor. Make at least two or three passwords. One for forum and slashdot and another for banking and secure sites. Use firefox's "master password" lock and set that password to your third password.
Congrats on completely ignoring every part of the OP's question. Your head is not the most secure place if your memory ain't what it used to be, because you'll inevitably be writing it down, and the OP specifically mentioned that he is using Firefox for password management now and wants to move away from that.
It always baffles me when people obviously don't read the question on an Ask Slashdot before jumping in with an answer. What the hell makes you think you can solve someone's problem when you can't ev
Re: (Score:3, Insightful)
That's not the best idea. If a secure location becomes compromised, you just gave up access to everything you do. Not to say people don't do it, but people also set their passwords to "password".
Here's an old post [slashdot.org] I did here 4 years ago on the subject. Users haven't gotten any smarter. Just poorer when their bank account gets compromised.
Re: (Score:3, Informative)
Mod parent up.
I have been using pwdhash for more than 2 years and I absolutely love it. It generates tough passwords based on the website URL and a master password. The password generation happens in *your* browser, there is no remote server holding your password. Absolutely safe. All you need to remember is a master password!