I'm sorry, but a German dating site is the place to be super-secure? Riiiiiiiiiight...

Personally I'm completely careless when I am signing up for anywhere that doesn't make use of my credit card or isn't my email account. If someone wants to hack my "myspace" I could give a shit...

Still, good advice

This is a great bit of advice, especially since I usually forget my passwords... but isn't it a bit "less secret" now that it's all over the internet? Now they know that all they have to do is try your usual password with a few letter combonations...
But like Vestril said, if someone actually wants to put so much of their time and effort into hacking into something like my myspace or email? All the more luck to them. I don't care, they're not going to find anything interesting.

Waaaaait a sec. If I heard that my password was released along with 99,999 others, I'd be pretty pissed. That's 100,000 people who have to change their passwords now. Did they volunteer for this?

Actually, if you come up with your own scheme, like

number + common string + initials for site

common string + number + initials for site

number based on alphabet relation of site's first letter + common string + site initials + another common sting

comedy. any "scheme" that doesn't incorporate special characters, numbers, AND letters, and no sequences of letters that could make up a word isn't as secure as it could be.

i typically use a dictionary word, but swap out special characters and numbers for letters.

like $uic1d3G1rl$. all you have to remember is what you swap things out with.

simply adding a few characters like the article suggests makes cracking a password take .00001 more second than normal, especially if there is a dictionary word in there somewhere.

I have to agree with Vestril. Show me stats for a banking site and I might consider the numbers relevant. But if you do let me know what bank to avoid because a good password encryption is one way so they can't see your password. Using a generator to guess them proves nothing..

I am disappointed in you Wil. This is the kind of bogus study someone with your technical knowledge should be debunking, not spreading.

Well, sorry I let you down. The study was mentioned by Bruce Schneier, who I deeply respect and admire. When I read it, I remembered an article about salting I read at digg last week, and saw an opportunity to share something I thought was useful with the SG News readers, with a bit of perspective added via the "123456" article. There's a little forest in those trees, if you look for it, I hope.

Regardless of where the stats come from, any tips that help people make their passwords more secure is a good thing.

Now whether or not the average person will follow the advice...

I used to do that with anything I would mail in. I would add letters to my apartment number so I could track who sold my name.

For instance, if I sent in a rebate to Maxtor, I would include my apartment number as "#6 mx1". The rebate would still get to me, and then I would get a bunch of spam using that address.

Didn't really help at all, but was fun to see who sold what to whom.

I have had the same word as my password for 13 years... I use random numbers in the middle and at the end of it... and special characters if they are usable on certain places... it changes frequently... hopefully that's good enough... if not... none of my info is that important I guess.

I like to use a handful of passwords that are dictionary words that I can type in with one hand, like, say, "farts", and then I move that word to various locales on the keyboard with mnemonics for where I should place my pinky or index fingers. So, if I were at myspace, my mnemonic might be "narcissist", and I'd place my index finger on "i" and type in "farts" as "it89y".

I've never had any trouble with hacked passwords, so maybe it works.

I use different geometrical patterns with the shift button pushed for a certain part of it. This covers the whole letter, number, special character thing then, when it comes time to change my password I either pick a different part of the keyboard as a starting point or just change the pattern from say a pyramid to a pair of parallel lines.

[Edited on May 31, 2006 10:04PM]

I use the same password for everything. I know that's really bad. Good idea.

edited to add:

except for my login password at my old job. It was always variations of the word "password"...because I didn't care if it got hacked and we had to change it sooo much I would never have remembered which one was the most recent one.

[Edited on May 31, 2006 by PaperDress]

It's kinda sick that it's come to suggesting users salting their own passwords. Users are notoriously stupid, I'm not convinced this will get through to them either.

Anyone who uses a password that is sequential and comprised entirely of either alpha or numeric deserves to have their shit ripped off twice. Dictionary words as passwords, the same.

I prefer randomly generated, pronounceable passwords. It's strange how much they stick in your brain.