A PasswordCard is a credit card-sized card you keep in your wallet, which lets you pick very secure passwords for all your websites, without having to remember them! You just keep them with you, and even if your wallet does get stolen, the thief will still not know your actual passwords.
A very cute idea, well implemented.
Your PasswordCard has a unique grid of random letters and digits on it. The rows have different colors, and the columns different symbols. All you do is remember a combination of a symbol and a color, and then read the letters and digits from there. It couldn’t be simpler!
A chain is only as strong as its weakest link. It’s far safer to pick secure passwords and write them down, than it is to remember simple and easy to guess passwords. You already protect your wallet very well, and even if it does get stolen the thief will still not know which of the many thousands of possibilities on the card is your password.
Better idea: memorize lyrics to a song, for each website choose a different starting word, use 4 consecutive words as password. You only have to remembered one number per page, you don’t need to print anything and you can have longer passwords.
YouDownNeverGonna
Crack how? With 4-5 words you’re going to have a pretty long password so bruteforce is out. Do you mean that if you will have one of my password you will have the rest? That’s because I gave you obvious example as a joke. What if my password is TakePicturesOfYou. What other password are possible? How will you crack them?
Take the lyrics of the top 1000 popular english songs, and do a rolling hash of 5 words at a time. To account for capitalization, you would have to multiplely the dataset a few times but I bet you most passwords created in this manner would be easily cracked using this method.
Spell the words with mistakes + add numbers and symbols with a rule, capitalize with a rule too
But lyrics of a song is an really obvious target to get to a dictionary(if it’s a dictionary attack)
More interesting would be encrypting name of the service, maybe with you login or something
So “gooey” + “lemmy”, let’s say we take three first letters and three last
“goommy”
Create a dictionary in your head only you know:
go out out mom mom yes (for an example I used short words)
Make mistakes that you would:
go oud oud mam mam yess
Add some numbers and symbols, capitalize
gO Oud Oud mAm mAm yEss (o, a, e are capitalized)
You get the point
Or just use a god damned pw manager. As soon as you have to memorize a system corners will be cut. 16 random characters will never be beaten by a mangled string.
Oh, I thought it was a smart card
Why not use something like Keepass? Just one password to remember.
Am I missing something?
I think this would be useful for people who only have a few passwords, or don’t use tech heavily.
Hell, maybe it could be useful for my day-to-day passwords, since I have probably 100+ in Bitwarden.
I’m not getting my elder family members to use Bitwarden.
I got my mom to use Bitwarden. There was a bit of effort setting her up, but now she is really happy with it.
It’s good for people who don’t trust, can’t or don’t want to use password managers. It’s also way simpler for a regular person (who’d otherwise write the password down anyway) while still being quite secure.
It’d also be great for choosing your password manager master password without risking that you forget it and without writing it down outright.
I like it, clever and practical.
one of my good friends, reuses the same simple, short, password on everything… her facebook got compromised and she STILL wont change her password… its maddening.
I’m thinking of trying to get her to use a password manager, or at least a card like this…
No, your not missing anything. Its a interesting option, thats all.
Where do you keep your KeepAss master password? Perhaps a password card could be a interesting way to keep/secure the master vault password for a password manager.
Where do you keep your KeepAss master password?
In my head. If you use a long passphrase, it’s easy to remember, easy to type, and secure.
The pregenerated book of codes is used since ancient times and it is interesting, but I would much prefer to educate people to use passphases instead.
And everybody has a phone with them at all times, you can have Keepass on it. It doesn’t use the cloud, it’s local, and if you need to sync the password database file automatically with your PC it’s safe to keep it in the cloud, it’s encrypted and only decrypted locally. But I myself use a self-hosted instance of Nextcloud.
It’s an interesting concept, but I love to carry a wallet as thin as possible.
I’m not George Costanza :)
Fair!
Just remember to never give your secret code to anyone. https://www.youtube.com/watch?v=aUVd4cFD5-s
Seems like this is recommending the use of 8 character passwords… Even with upper/lower case letters, numbers, and special characters can’t an 8 character password technically still be brute forced in like 10 minutes?
Yes, if you were using this as a key for a encrypted vaults with nuclear secrets, 8 wouldn’t be sufficient.
But if your using this with online services that implement rate limiting, (or TPM, or Hardware security key), the rate limiting makes this sufficiently complex.
So Bitwarden (rate limiting), hardware security key (something you have), and knowing how to read your password card (something you know). Gets you pretty far in terms of usable security.
Nothing is stopping you from using 16, 32, 64 characters, you just have to come up with a system you like to read the card
If you like this idea, you can roll your own, but if you use this website, make sure you use a incognito browser so the data doesnt stay on your hard drive after you print it. (tor browser for bonus points)
