Yikes.
I think a lot of people consider password security about being:
1. Something they can easily remember.
2. Protection against their colleagues guessing their password, or an ex, or maybe some kid down the street.
3. Protection against someone who's logging into a site and trying to log in, one ID/password at a time.
The problem is, that's just insufficient, because that's not what that's protecting against isn't really what's going on. And the risk is that someone will be able to get into parts of your life, into accounts you have money associated with, etc., and Do Stuff with them. Not stuff you would like.
This article is interesting because it notes ways that folks actually break into the encrypted files that have passwords. It's not just about brute force attacks (though those are a first part of it), but about patterns (capital letters at the beginning; numbers at the end; substituting "@" for "a", etc., as well as pattern on a given site). The obscurity of the password as related to your life isn't as key (for these sorts of attacks) as not showing any particular pattern that can be figured out.
It's not your "enemy" that's likely to be hacking into your account this way. It's not anyone who even knows you, or wants to know you, and they're going to be selling the information to people who don't know you, either, but who do want your money (or access to what you have access to). And while they would prefer that you were a billionaire, they'll take whatever they get.
The bottom line (again) is:
1. Randomized / generated passwords. Which implies using a password generator / manager.
2. Different passwords at each site. Which implies using a password generator / manager.
3. Oh, yeah, using a password generator / manager. With a really long (but, in this case, easy to remember) password.
4. Two-factor authentication where possible.
I am not as diligent about any of the above as I would like, but I keep trying to be better.
Reshared post from +Les Jenkins
An illuminating look at how even the hardest to crack passwords aren't all that hard to crack. Bonus: A future article will be looking at password managers to see which ones offer the best passwords.