Remembering Pin Numbers/Passwords nightmare

masonic

Madiba wrote:

yeah as long as it does the same job, it doesnt matter what you use.

Though I would imagine reverse engineering open source to be easier.

Thoughts?

The underlying cryptography is in the public domain anyway. Most authors boast about the algorhithms they use, so reverse engineering should be easy in both cases. As others have said, these days it is the strength of the key that protects you, rather than the obscurity of the encryption method.

The advantage offered by open-source is that you can be a lot more confident that there are no 'back doors' to the encryption than you can be of proprietary software.

judderman62

Robert_Sterling wrote:

A Viz Tip

Write your pin number on the back of the card.

:rotfl: :rotfl: :rotfl:

James

Re PINs use one PIN only. Ask you're credit card providers for Chip & Signature Cards. They should provide them for you as you have difficulty remembering numbers AND you're taking APACS best advice by not using the same PIN for each card.

There are conflicting messages from card issuers and the industry:

Use the same PIN for your Credit & Debit Card - UK Card Issuer

Never use the same PIN - CitiBank Japan.

Don't use the same PIN for every card - Mixed message from APACS.

masonic

James wrote:

Use the same PIN for your Credit & Debit Card - UK Card Issuer

I notice they also advise customers to choose a PIN "which makes a pattern when typed into the keypad". :rolleyes:

climbgirl

masonic wrote:

One method I like is to have a common password for everything, but 'mix in' letters/numbers specific to the account. That gives you a unique and complex password that you can easily derive from two memorable ones.

I do this too. I've also written my passwords into an email I forwarded to my internet account, in a way that I can spot them but that wouldn't make any sense to anyone else, and is in no way connected to the subject of banking! That way I can always access them if I've got an internet connection.

mister_t

I use password safe

http://passwordsafe.sourceforge.net/

another open source encrypted password database. It was originally written by the chap that created the blowfish and twofish algorithms, but has since gone opensource. I think you can get it to autotype the fields for you if you want.

Just means you need to remember one strong password. Must better than trusting the security of an excel spreadsheet.

James

You maybe able to keep your PIN secret and secure but can the industry?

Fraudsters get away with £1000

"Unfortunately all the transactions were carried out using chip and pin, so we have no finger prints or signatures."

And if you've live in Bournemouth or Poole check your statements.

amcluesent

One 'trick' for password is to make them from two parts -

Part one is gobbledygook, but you write this down and keep in your wallet or purse (yes, really!)
Part two is a name or word you will not forget and never write this down.

Now create a passwords by combining the two parts -

k!rs91lm + fiona

to give -

k!rs91lmfiona

This can't be cracked by dictionary attacks or by brute-force guessing in reasonable time. As it's a two-factor pass (something you own and something you know) it's pretty robust. As you write down the gobbledygook, you aren't having to try and remember this.

You could also insert the first letter of each site name between the two parts to make it specific to each site, e.g. for amazon -

k!rs91lm + a + fiona

If you are logging in from a public machine you need to defeat key-loggers; type a few letters of the password into the web-page, then select the desktop background, type away then go back to the web-page and complete the password.

gelato_cat

How does that work then?

Suze

amcluesent wrote:

to defeat key-loggers; type a few letters of the password into the web-page, then select the desktop background

masonic

Suzey wrote:

How does that work then?

When you click on the desktop, the password box in the webpage loses focus, so anything you type won't affect it. Some less sophisticated keyloggers just record every keystroke, so they won't be able to tell that what you are typing when the desktop is in focus isn't actually part of the password.