text: What does a good password look like, then? Here’s one: “W9#!=_twXhRb” And another? This one is 16 characters long: “*Wdb_%|#N^X6CR_b” What are the chances of a human guessing these? Pretty slim. And a computer? Not much better, to be honest. They are randomly generated by software, and as long as I use a different one for each account, I’m pretty safe against password-guessing attacks.
  “But,” you say, “how am I supposed to remember them? I’ve got dozens of accounts, and I can’t remember one of those, let alone fifty!”
  Well, you shouldn’t try to remember passwords, in the same way that you shouldn’t try to generate them. Oh, there will be a handful that you might remember – maybe low-importance ones like the wifi key to your home AP – but most of them you should trust to a password manager. These are nifty pieces of software that will generate and then remember hundreds of passwords for you. Some of them will even automatically fill website fields for you if you ask them to. The best ones are open source, which means that people have pored over their code (hopefully) to check they’re trustworthy, and that if you’re not entirely sure, then you can pore of their code, too. And make changes and improvements and generally improve the world bit by bit.
  You will need to remember one password, though, and that’s the one to unlock the password manager. Make it really, really strong: it’s about the only one you mustn’t lose (though most websites will help you reset a password if you forget it, so it’s just a matter of going through each of the several hundred until they’re done…). Use the advice from the xkcd cartoon, or another strong password algorithm that’s easy to remember.
  To make things more safe, store the (password protected) key store somewhere that is not easily accessed by other people – not a shared drive at work, for instance, but maybe on your phone or on some cloud-based storage that you can get to if you lose your phone. Always set the password manager to auto-lock itself after some time, in case you leave your computer logged on, or your phone gets stolen.
  Would you send a password via email? What about by SMS? Is post[2] better? Is it acceptable to reveal a password over the phone in a crowded train carriage[4]? Would you give your laptop password to a random person conducting a survey on a railway station for the prize of a chocolate bar?
  In an ideal world, we would never share passwords, but there are times when we need to – and times when it’s worthwhile for material rewards[5]. There are some accounts which are shared – TV or film streaming accounts for the family – or that you’ve set up for somebody else, or which somebody urgently needs to access because you’re on holiday, for instance. So you may need to give out passwords from time to time. What’s the best mechanism? What’s the worst?
  This may sound surprising, but I’d generally say that the worst (marginally) is post. What you’re trying to avoid happening is a Bad Person[tm] from marrying two pieces of information: the username and the password. If someone has access to your post, then there’s a good chance that they might be able to work out enough information about you that they can guess the account name. The others? Well, they’re OK as long as you’re not also sending the username via the same channel. That, in fact, is the key test: you should never provide the two pieces of information in such a way that a person with access to one channel can put them together. So, telling someone a password in a crowded train carriage may be rude in relation to all of the other people in the carriage[6], but it may be very secure in terms of account safety.
  The reason I posed the question about the survey is that every few months a survey company in the UK asks people at mainline railway stations to tell them their password in exchange for a chocolate bar, and then write a headline about how awful it is that many people will give them their password. This is a stupid headline, for a stupid survey, for two reasons:
  If you’re the sort of person reading there’s a fairly high chance that you’re the sort of person who’s asked to clear up the mess what family, friends or colleagues get their accounts compromised[7]. Here are four rules for password security:
  use a password manager to store your passwords – if they’re strong enough in the first place, you won’t be able to remember them
  never send usernames and passwords over the same channel – you want to avoid the situation where an attacker has access to both and can use them.
  I’ll add a fifth one for luck: feel free to use underhand tactics to get chocolate bars from people performing poorly-designed surveys on railway stations.
  1 – I thought about changing the order, as they do impact on each other, but it made my head hurt, so I stopped.