Passwords

Passwords are hard to remember. Randomly generated passwords are just annoying. Here is my password strategy... I string together a few easy to pronounce phonemes followed by a number.

I use a password safe to keep track of all my passwords. When I look up a password it's handy to be able to remember the password for a couple minutes without having to write it down. I find that if I pronounce a nonsense word plus a number in my head that I can remember it for a few minutes. Here are some examples of random, nonsense passwords that are still easy to pronounce:

 todami54
 zukeka08
 bagopu48
 gomipu79
 jiyiku70

There are other password generators such as `apg` and `pwgen`. Neither one of those makes passwords that are easy to pronounce or remember. They claim to be "pronounceable", but they don't work for me. What is the point of making a password that is only slightly easier than impossible to pronounce? You are still going to have to write it down. You still won't remember it a few minutes later.

This script will by default generate 61,412,500 unique passwords. That may not seem like very many, but most SSH daemons will only allow one login attempt per second, so it would still take nearly 2 years to try them all. This script also allows you to adjust the size of the password.

Passwords are a bad idea anyway. I use this along with public keys and an automatic ban system such as `fail2ban` which blocks out an IP address for a period of time if there are too many failed login attempts.

Click here to download this script: randpass <include svncat src="file:///home/svn/src/python/randpass" highlight="python" />