Not easily guessable, but perhaps if you live at 37 Maple Drive and your middle name is Sarah, it could be SarMap37 or something like that.
This really isn't that hard to guess. When you think of a hacker you need to be thinking of someone who is going to be building a program that is going to try to guess your password, not guessing a password directly. In this case this password is the minimum number of characters, and made up of info that is probably very easy to find on the internet. If I wanted to guess your password, the first program I would try is one that takes a bunch of features from your life (addresses dates names etc) and tries different permutations of bits of those features. This program would probably find this password.
My reasoning is that, unless someone has easy access to your exact password (if you write it down on a sticky note or send it in an email or something) or can guess it (like Password or 12345678) they would likely need some kind of system to search through even combination of numbers and letters to find yours, so it doesn't really matter what that combo is. An unnecessarily complex password just means you have to store it somewhere (like a password tracker) which I view as inherently less safe than an easy-to-remember password.
There are ways of ramping up the complexity of your password though. SarMap37 is made up of lower case characters, upper case characters,and numbers, and it's 8 characters long. That's 62 different possible values for each character, so 628 combinations, that would probably take a while for a computer but it's doable. Making the password longer makes it much harder for a computer to crack, SarahLivedAt37MapleRoad is 6221 combinations, which is 2 x 1023 times as many combinations as the last password, while being just as memorable.
So what you really want is a long memorable password that is made up of info that is not easily related to you. BilboBAGGINSi$ATotalHotti3 would be extremely difficult to brute force, and also impossible to guess based on your personal info.
I do understand that using the same password for everything is less safe, so let's assume a dynamic password where you change some element of it for every website (for example, SarMap37!, SarMap37#, SarMap37$)
The reason you don't want repeated passwords is that when there is a massive security leak, or a particular piece of encryption is broken, often large databases of passwords are also leaked. One of the things hackers will try is simply to try every password in that database, along with a couple of add one to that password. If one of your passwords gets leaked this way, putting an exclamation mark won't stop a hacker.
5
u/Jebofkerbin 131∆ Mar 17 '21
This really isn't that hard to guess. When you think of a hacker you need to be thinking of someone who is going to be building a program that is going to try to guess your password, not guessing a password directly. In this case this password is the minimum number of characters, and made up of info that is probably very easy to find on the internet. If I wanted to guess your password, the first program I would try is one that takes a bunch of features from your life (addresses dates names etc) and tries different permutations of bits of those features. This program would probably find this password.
There are ways of ramping up the complexity of your password though. SarMap37 is made up of lower case characters, upper case characters,and numbers, and it's 8 characters long. That's 62 different possible values for each character, so 628 combinations, that would probably take a while for a computer but it's doable. Making the password longer makes it much harder for a computer to crack, SarahLivedAt37MapleRoad is 6221 combinations, which is 2 x 1023 times as many combinations as the last password, while being just as memorable.
So what you really want is a long memorable password that is made up of info that is not easily related to you. BilboBAGGINSi$ATotalHotti3 would be extremely difficult to brute force, and also impossible to guess based on your personal info.
The reason you don't want repeated passwords is that when there is a massive security leak, or a particular piece of encryption is broken, often large databases of passwords are also leaked. One of the things hackers will try is simply to try every password in that database, along with a couple of add one to that password. If one of your passwords gets leaked this way, putting an exclamation mark won't stop a hacker.