<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 06/10/2016 09:54 AM, Alberto di Bene
wrote:<br>
</div>
<blockquote cite="mid:55b7b31e-7a35-2d04-b1f7-f0afdd023188@usa.net"
type="cite"><font face="Verdana">Well, to be honest, my passwords
are in a dictionary...</font></blockquote>
<br>
My passwords are all cryptographically strong random strings of at
least 20 characters (unless the application won't allow that); they
are all generated by machine (I never see them so you can't torture
them out of me); none of them are re-used, ever; and they are stored
in a heavily encrypted file that only exposes one password at a time
on demand for a short span of time. That file is protected with a
_very long_ pass phrase that is not written anywhere. Often
multi-mode authentication is required.<br>
<br>
KeePass - cross platform, open source. <a class="moz-txt-link-freetext" href="http://keepass.info/">http://keepass.info/</a><br>
<br>
We require this or something equivalent from all of our internal
users.<br>
<br>
Whenever I introduce that process to somebody their initial
expectation is that this is a burdensome process that nobody can
realistically exercise... but the reality is that it's very easy to
implement and just requires a tiny bit of habit building.<br>
<br>
By the way -- never let your browser "remember" your password. The
moment you get hacked all such passwords are p0wn3d.<br>
<br>
_M<br>
<br>
<pre class="moz-signature" cols="72">--
kf4hcw
Pete McNeil
lifeatwarp9.com/kf4hcw</pre>
</body>
</html>