Security/title> <meta name="keywords" content="Memory Bloke Security"> <meta name="description" content="Security"> <link rel="stylesheet" type="text/css" href="style.css" /> </head> <body> <script type="text/javascript"> var _gaq = _gaq || []; _gaq.push(['_setAccount', 'UA-8152374-2']); _gaq.push(['_trackPageview']); (function() { var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true; ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js'; var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s); })(); </script> <h2>MemoryBloke.com is copyright Michael Curtis 2010-2024. All Rights Reserved.</h2> <table> <tr> <td><img src="MemoryBloke.JPG" WIDTH=169 BORDER=0></td> <td><img src="Filler.JPG" width="85px"></td> <td><h1>Security</h1></td> </tr> <tr><td align="left"><p> <u><a href="contents.htm">Contents..</a></u></p></td></tr> </table> <div> <main><article> <p>These are some ideas about using mnemonics to store passwords for web sites. It assumes that the email address used to log in is always the same.</p> <p>For each perso from the People 00-99 article (that's 100 cartoon people), they can each have a line of script which has three sentences. Each sentence can be translated into a short code by treating each sentence as an acrostic. For the web site password, you would use three different people and choose from each one of their three sentences; you would convert each sentence into its code; and string it together as one password.</p> <p>So, if you write down "<Some Site>.com" and beside it three numbers: 27, 29, 31 then you know to take sentence 1 from person 27, sentence 2 from person 29 and sentence 3 from person 31; and string their codes together.</p> <br /> <p>If somebody knew your person sentences and saw your site name and numbers 27, 29, 31 then, if they know this technique, they can log in to your web site too. Consider the following idea:</p> <p>2. Don't store the 27, 29 and 31 obviously. Maybe don't store them electronically either: someone would need to have access to your paperwork to see the 27, 29 and 31. An unwanted online snooper would not get access to that. You could have a peg location that signifies the web site that you want to log in to. At that place, you could imagine a Person does an Action to a Person story where each person means a number from 00 to 99 and so does the action. You would look up the three cartoon people of those numbers and grab sentence 1, 2 and 3. So you could recall the password of the site without generally needing to visit your paperwork.</p> <br /> <p>How can an acrostic sentence be turned into a code? Well, as an example, you can make an acrostic out of "How can an acrostic sentence be turned into a code?" by using the first two letters: HO [How] CA [can] AN AC SE BE TU IN A[ignore single letter A] CO</p> <p>And then you would have letter ranges which mean: A-Z, a-z, 0-9 and ten punctuation characters of your choice. So you would match the 'HO' of 'How' or the 'CA' of 'can' [from the acrostic sentence] to a keyboard character.</p> <br /> <p>The acrostic from earlier could be sentence 1 of the three sentences of a cartoon person fromn the Person 00-99" article. "HO CA AN AC SE BE TU IN CO" would be interpreted as 9 characters.</p> <p>The 72 keyboard characters need 72 spelling ranges so that the 'Ho' of ; 'How' gets mapped to one and only one spelling range. Eg. The range explained in the Double Digit Acrostics article where 'Anchor - Aqua means one and only one thing. Using that approach, 'HO' of 'How' falls within 'Home - Hypo' and you would have one and only one keyboard character match with it.</p> <p>What if you need to change your password? Then you need three different numbers to represent three different cartoon people; and you need to learn a new Person Action Person story and store those three numbers in a non-obvious way in your paperwork.</p> <br /> <p>It would be good to reach a point where your look up table of spelling ranges matching 72 keyboard characters is not stored on paper or electronically: just known rote. Also, you could jumble up the 72 characters before presenting them in a table; otherwise range 'A - something' is likely to be an 'A' and be guessable as such if someone knows that you are using a system based on this article.</p> </br> <p>If you store the year of password creation as well then you might have even more security. Eg. Year 2024 can mean that you have to tag the letter "T" to whatever password the main technique generates. Your Person Action Person story would need an extra aspect to record 2024; maybe a cactus would mean 2024 and the cactus would be part of the scene.</p> <br /> <p>I think it might be good to use the random number generation feature of a spreadsheet to make your three 'person numbers'. Or you could have dice where 0 to 9 are rollable. Two dice would give you a random two digit number. I say this because we probably are not super random when we try to think up random numbers.</p> <br /> <p>This article is just a suggestion. It is partly counter to the usual advice that you should not write passwords down. So maybe it is not a good idea. Ironically, the more unguessable a password is, the more you would want to write it down somewhere so that you can actually use it. And I am not sure how good a software password wallet is; you see news stories about people finding vulnerabilities in software, a lot. So for a period of time, a password wallet might be fantastic but is it good for always? And what if you lose access to the software that stores the wallet?</p> <p>In the news, I see that password leaks of millions of passwords sometimes. If a program tries to reuse a published password then there is a small canc that it is being used for logging in to another web site; although admittedly a string of characters might overlap. Maybe the year idea where a "T", for example, is added to a password should actually be a rule to alter all three codes in a very particular way. So then, a password from 2025 would tend to have even less overlap with a password from 2025.</p> </article></main> </div> </body> </html>