Practical Password Formulas

It's hard to remember passwords, so many people use the same passwords for everything: email, bank accounts, etc. The problem is, if a hacker gains access to one of your accounts, he now has access to all of your accounts. Some people save all their passwords in a file on their computer, or on a piece of paper on their desk to make the passwords easier to remember- this is also bad because there's only one location or file to compromise, and then a hacker has access to all your accounts.

So how to get around this? Have a password formula stored only in your head. A password formula is a simple algorithm that takes as input a key word (usually relating to the site you're trying to login to), performs some operations on this keyword to transform it, and the result is your password for the site. If you do this, then you only have to remember one piece of information: your formula. Mapping backwards from the password to the keyword should be so difficult that even if a hacker got access to one of your passwords, he shouldn't be able to deduce the formula and crack your other passwords.

Here's a (bad, insecure) example:

1. I'm logging into amazon.com, so my starting word is Amazon
2. reverse the letters and get: nozama
3. capitolize the second syllable: noZAMa
4. Turn the letter a into the number 4: noZ4M4
4. add the number of years you've used this site on the end: noZ4M46
5. ta da: your password for Amazon is noZ4M46.

This formula can apply to any site you're logging into. But please don't use it- it's very easy to guess. So how can you make your password formula easy to remember but difficult to create? This is a hard problem, but there are some helpful strategies.

Strategies to avoid:
- Don't allow dictionary words in your passwords. An alphanumeric password of length 8 has 36^8 = 2.8 trillion possibilities, but there are only about 300,000 common English words. That is a much smaller set of possibilities for a hacker to check.
- Don't use common transformations like turning the letter i into the number 1, or turning the letter e into the number 3. These are easily guessable.
- Don't simply translate the keyword into another language: there are password hacker dictionaries in other languages too (though, as one of my coworkers pointed not, not yet for Elvish)
- Don't simply add a number at the end of a word- this is also easily guessable

Some better ideas:
- Use word transformations based on your personal experience, free-association style (free-association is hard for other people to predict or guess). Example: one free-association type transformation rule could be "The site Amazon reminds me of the childhood memory of watching the Jungle Book", so transform the word Amazon into JungleBook. The rule is "x reminds me of the childhood memory y." Do you know what childhood memory Schwab.com reminds me of? I doubt it.
- Scramble the word so that no dictionary words remain. Example: switch all pairs of letters: JungleBook becomes uJgneloBko
- Funny rules are easier to remember. My old password formula had, as a transformation step, "Snoop Doggification"- I'd turn words like house into hizouse.
- Make sure your password formula has multiple steps.

And by all means do not enter your password into a website that claims it will tell you your password strength: what is to stop this website from archiving all the passwords people enter into a better hacker dictionary?

No one in Davis looks to Batman for wisdom and guidance

When I am feeling low or confused, I take a step back from my problem and ask myself, What Would Batman Do? Usually the answer is to use some expensive gadgets to kick some ass, which fits in well with my job. So today, not for Halloween but for general awesomeness, I wore my WWBD teeshirt. Not a single person at work got it, or even asked about it (at least, until I dramatically prompted them to). I got some flickers of recognition at the grocery store, but no smiles. Sigh. Clearly the town of Davis is not properly aware of the Adventures of Dr. McNinja, perhaps the best serial webcomic ever. Oh, and in case you were wondering, ninja zombies are not very effective ninjas. But they're pretty good at choreographed dances.

College application essay or folk song asking to be written?

An excellent college application essay, underscoring the irony of having to justify your eminent worth and prestige when you're barely old enough to form your own opinions. It's just asking to be turned into a folk song. I could hear a few promising riffs in my mind when reading it. Perhaps the chorus would be "I am an expert in stucco, a veteran in love, and an outlaw in Peru..."

Speaking of college, nowadays I have a handful of friends who are teaching college classes, and surprisingly, the experience seems to be quite disappointing. Students don't come to class, don't pay attention in lecture, they tell complicated and obvious lies to get out of homework and tests. I guess I knew this already, but when I was an offending student (minus the lying about tests) it never occurred to me that these lofty authority figures who were my teachers would actually take it personally and feel depressed when students did this. But despite the depressing stories, I still have the naive and hopeful idea that if I were teaching some class, it would be fun and the students would pay attention. I would, of course, use tricks from my favorite college classes, like overemphasizing the connections between the subject and $$$, letting one student hold a water gun in front of the class to shoot people who fell asleep, going heavy on the cartoons in slides, etc.

Obvious American Words

About half the time, when Marco and Lavinia (who are native Italian speakers) ask me what the word is for something, my answer makes them laugh and say "oh, it's so obvious! the word is the use of the object!" Example: comforter- it comforts you as you sleep! Power cord: it's a cord that provides power. Flip flop- that's the sound the shoe makes when you walk around in it.

Once I started noticing these obvious American words, now I can't stop noticing them. They're everywhere: arm hair, cashback, fingernail, bike seat, waterfall...

Also interesting: almost all programming languages use english keywords, so no matter what your native language is, you must learn bits of English to become a programmer. English is the international language of computer science, like Italian is the international language of music.

pumpkin carving

Last night a bunch of the coworkers gathered at Kristy and Bhavik's house to carve pumpkins. It was Marco and Lavinia's first Halloween, and they carved by far the best pumpkins. We got a few of those trace-and-carve books, which are surprisingly organized, with more directions than you could possibly need to take a knife to a vegetable, and a difficulty rating system for the pumpkin designs. Though the designs seemed mostly to be aimed at kids, there was this one design where a sexy vampire guy was going to either bite or kiss a sexy girl. Very Anne Rice. I then got to tell the story about the vampire romance community on Amazon. Anyway, the evening was lots of fun, with Kristy's spread of cookies and Bhavik's liquor, and by the end we were all covered with pumpkin guts. I stuck to my roots and carved the Batman pumpkin second to the right in the picture. More pictures here.

barefoot hiking

Last Saturday, we went hiking near Cache Creek way out in the boonies north of Davis. The day was bright and beautiful, but it had just rained the day before (presumably to remind me of the Seattle winter I'm missing), so the path we hiked was very muddy. So muddy it made our boots heavy. Anne S looked at her dog Lily who was bounding up and down the hills unhindered and said, 'I think Lily has the right idea' then took off her shoes and started hiking barefoot. After she oohed and aahed about how nice it felt, I took off my shoes too, and it *was* a very nice mud massage. We spent the rest of the hike teasing the boys about refusing to take their shoes off.

old friends, new friends, and salsa

Last Tuesday was my birthday, and I was planning on being low-key about it because I wasn't really sure if I knew my coworkers well enough yet to coerce them into some kind of birthday celebration. So to my surprise, on Monday Kristy stormed into my office, demanded to know why I hadn't told her sooner about it being my birthday, and planned a birthday dinner for me. On Tuesday, I came into the office and found a vase of fresh flowers (from my parents) and a card signed by the engineers (with notes like "May your birthday be free of deadlocks"). That night about 10 of us went out for delicious Caribbean food at Delta of Venus, then ice cream afterwards. It was a boisterous and fun dinner, interrupted only occasionally by an over-amplified poetry reading (it happened to be poetry jam night). On Wednesday, Skip surprised me with dinner at Chez Panisse, a restaurant I've wanted to go to for years, home of the famous Alice Waters. It was the best meal I have ever had. On Thursday the fabulous Danielle was in town, and we had an impromptu dinner party with her and a few other new friends. Some of the new friends ended up also being musicians, which lead to the inevitable raucous jam session in the garage. Somehow we managed to avoid getting the cops called on us. We suspect our 90 year old neighbors are mostly deaf. Friday we went over to dinner at Lavinia and Marco's place, and they gave us a salsa dancing lesson. Lavinia and Marco are incredible dancers (and ranked 14th in a national salsa competition in Italy last year), so at first I was a bit intimidated, but they were good teachers and soon we were shuffling around their living room hitting most of the 1,2,3 .... 5,6,7... steps. I'm into it.