New idea ... one for MSE?

hsbcarter_2

I was thinking that perhaps what might be useful is a password format reminder website.

I have a number of passwords for different websites and if I could just remember the criteria for the password creation I would be able to remember what my password is. I'llk try and explain

https://www.madeupwebsite.com says you need a password which is just alphanumeric (I have a password which is alphanumeric)

https://www.moresophisticatedwebsite.com says you need a password that has a capital, a special character and 2 numbers (from that description I know the password that I need).

I know a lot of people say that you should have a different password for many websites but most people perhaps have 3/4 depending on what the criteria is for the password creation.

The current problem is that once you have registered the only way you can find out the password format is by re-registering - which is a pain!

The idea of the free website (a bit like https://www.saynoto0870.com) would be to have a user database that would state the criteria for a password and add it to the database so anyone could look it up.

Does anyone think this is a go-er (i.e ad supported like saynoto0870)?

HSB

MoneySavingUser

http://keepass.info/

hsbcarter_2

Its not quite the same thing really - I was more interested in people helping others by having a database of all the password formats so that you can access your password format anywhere in the world and never actually be comprised.

I think people would be more suspicious of the site you posted. Thanks anyway!

robt_2

hsbcarter wrote: »

Its not quite the same thing really - I was more interested in people helping others by having a database of all the password formats so that you can access your password format anywhere in the world and never actually be comprised.

I think people would be more suspicious of the site you posted. Thanks anyway!

Keepass is well known and well respected.

I'm not entirely sure what you are suggesting to be honest. If you want to be careless with your passwords why don't you just put them in a text file and put it into a password protected cloud storage system? Why is that different to what you are suggesting?

I think you are trying to solve a problem that doesn't exist?

frivolous_fay

I know what you mean - it's returning to an account you haven't looked at in a year and trying to remember whether your passwords have numbers in them, or a capital, or are entirely numeric, or even how long they're meant to be! It's not good taking 3 guesses at it and getting locked out, possibly until a new password can be posted to you a week later (ICICI, I'm looking at you)

Sounds like a mammoth task though... plenty of banks have at least two passwords with odd formats... and now and again they change the criteria (ICICI, you again)

How annoying is it to enter a password when registering on a site, only to be told AFTER the event that you must have a numerical character in the password?! I sometimes think it would be much better if they just said so BEFORE you select your password - but then I wonder if it would just make it easier for fraudsters to guess your passwords?

robt_2

You should be having a mixture of upper and lower case letters and numbers as a minimum anyway.

Fire_Fox

hsbcarter wrote: »

Its not quite the same thing really - I was more interested in people helping others by having a database of all the password formats so that you can access your password format anywhere in the world and never actually be comprised.

I think people would be more suspicious of the site you posted. Thanks anyway!

Why would you want to access passwords for sites you rarely use from anywhere in the world? What if someone hacked into the password website, or a member of staff had a quick shufty? Why do you have to reregister when you could just click the forgotten password button?

KeePass can be accessed from other computers, maybe only on same network I am not sure. Also there are KeePass compatible apps for smartphones so you can sync the two. Also Weave add-on for Firefox transfers passwords over from one computer to another. Your last option is to use your mobile phone to store the password formats rather than the passwords themselves.

Fire_Fox

frivolous_fay wrote: »

I know what you mean - it's returning to an account you haven't looked at in a year and trying to remember whether your passwords have numbers in them, or a capital, or are entirely numeric, or even how long they're meant to be! It's not good taking 3 guesses at it and getting locked out, possibly until a new password can be posted to you a week later (ICICI, I'm looking at you)

I have locked myself out of 'Verified by Visa' twice, had to do a password reset a third time. When I rang them last I found out I'd opened two Verified accounts by mistake which they reckon they cannot delete! I have now used all my regular password combinations so I am blatently going to lock myself out again in due course.

And I hate the security questions. Mostly I haven't the foggiest what the secret word is, I don't even remember setting one. Or they give you a choice of questions - mother's maiden name (a matter of public record), place of birth (a matter of public record), first car (don't drive), football team (am female), first pet (had two at the same time), first school (dunno), last school (has four words, did I use them all?) and so on.

hsbcarter_2

I'm pleased that at least one person on this thread understood what I was trying to get across, but alas if the other 6 can't get the concept then its probably not worth pursuing. I will try and describe it again (a last time?) and then if people don't understand it, I'll give up

What I am proposing is not a website that contains the "actual" passwords only the format that they are held in. This means that if I was logging into MSE and had forgotten my password I could look up what format MSE would be expecting it to be in and I would then be able to remember the kind of password I use for a site such as that.

The problem with clicking on a "forgotten password" button is:

1) The reset could take a few hours
2) You need access to your email
3) You will need to reset the password

My proposed solution is that if you knew the format of the password demanded by the website you would probably remember the kinds of words you use.

Something such as Keepass is obviously better but more complicated and something to store lots of important passwords but not necessarily all your forum / message board passwords.

The way to keep the proposed solution up-to-date would be akin to how SayNoto0870 works and ask the General Public to help.

HSB

robt_2

I understand what you mean, and it is just a pointless idea (IMO).

Why don't you keep a text file of the 'format' of each password on your computer desktop? Or email it to yourself? Why are you trying to over-complicate things so much?

Why are you putting so much emphasis of the 'format' of the password? You should be using numbers along with upper and lower case letters as a minimum for everything. I would also throw into the arena that if you can remember the password just from the 'format' of it then your password is not strong enough....

gerryco

Why not work around the whole issue by constructing your own single password format which satisfies all the criteria set by the various websites.

As an example the password 'pAsswOR238d' will satisfy those that require a mixture of caps and lower case, and alphanumeric.

So another password that uses the same format would be 'wEbsiTE987s'. You could contrive a format that would probably satisfy most requirements, while still using different passwords for each website.