The Evolution of My Passwords

I don’t remember whether it was 2008 or 2009, but a website had its database leaked, and millions of simple user passwords were cracked. I was still at Juniper then, and company IT sent around an article recommending the creation and use of secure passwords. One suggestion was to generate a password from a sentence plus some rules.

It was a good method. I followed it, and it became a habit that has lasted to this day.

Let me explain the method. First you pick some sentences you can remember, for example:

1. life is about making an impact, not making an income.
2. whatever the mind of man can conceive and believe, it can achieve.
3. you miss one hundred percent of the shots you don’t take.
4. Fang shu wu ren hua zi luo, chun shan yi lu niao kong ti — no one is around as flowers fall among fragrant trees; birds cry in vain along the spring mountain path.
5. An dan le dao guang jian yin, yuan qu le gu jiao zheng ming — the glint of blades has faded; the horns and drums have fallen silent in the distance.

These sentences, which form the main body of the password, can be public — for instance, you can put them in a password hint — but if you can avoid putting them anywhere, don’t.

Then choose a rule that only you know: it must not exist in any physical or cyberspace (a word people rarely use nowadays) form — on paper, in Evernote, Google Spreadsheet, Dropbox, or anywhere else. The rule is up to you, but keep it as simple as possible, because every time you enter the password, you have to run the sentence through the rule to generate your actual password.

The simplest rule might be: string together the first letter of each word, all lowercase. But that rule is too simple and too insecure.

A little more complex: string together the first letter of each word and capitalize every third letter. That is secure enough, but it may still fail most password checks (which require a mix of letters and numbers).

The ideal: the first character of the password is a fixed digit, say 7; then string together the first letter of each word, capitalize every third letter, and end with a fixed suffix, such as 2#33 (2333).

Under the last rule, the sentences above become:

1. 7liAmaInmAi2#33
2. 7wtMomCcaBicA2#33
3. 7ymOhpOtsYdt2#33
4. 7fsWrhZlcSylNkt2#33
5. 7adLdgJyyQlgJzm2#33

This method is very secure, but somewhat troublesome — entering it on a phone is even more of a chore. So it is only suitable for scenarios with high password requirements. For other scenarios, you can use tools like LastPass to generate and autofill passwords. At present, I mainly use it for machine login passwords and passwords for a few important websites.

That’s enough about the method. Let me talk about what passwords like these mean to me.

The first login password I used came from this sentence: whatever the mind of man can conceive and believe, it can achieve. Of course, my rule was different from all the rules above; it is indescribable :)

Because of Juniper IT’s annoying constraints, passwords could only be certain lengths, so on my company computer this password had to be truncated. Still, I typed it many times a day, so the sentence was repeated over and over on my lips.

Later I felt it was a pity that this daily opportunity to force my brain to recall and compute the same thing was spent reciting sentences I already knew by heart. Why not use it for something more meaningful?

I started using sentences to describe my goals.

I want to be a distinguished engineer.

This seems to have been the first password sentence of mine that was not a famous quote or classical poetry. I am still far from that goal, but reinforcing it every time I came back from the bathroom still had a subtle influence on me.

About a year later, I changed this password to:

I want to start my own business.

And then I really did try to start a company. During that period, because I sometimes shared my computer with others and no longer needed an extra way to remind myself of my goal, this scheme lay dormant for a while.

After the startup failed and I returned to Juniper, the password I set was:

I want to relocate to US.

A year later, with only the last step remaining, I said to myself:

I want my L1b visa.

A few months later I arrived in the US and began a new life:

I want to catch up with silicon valley.

During that time I hungrily learned everything new, attending at least one meetup every week.

Later I moved to a small web security team at Juniper SF and began a new journey. Soon the novelty wore off — especially after my boss was replaced by an Indian manager who did not understand technology very well — and I wrote:

I like what I do but I’d find a team I love to work with.

At the time, I had intended to move to another Juniper team working on cloud infrastructure, but two months later I received a call from adRise/Tubi TV; they were willing to help me apply for an O1 to change my work status. So my password became:

I want my O1a visa.

Afterward I got the work visa as I had hoped, and the password changed accordingly: I will make adRise to be proud of its engineering.

There were also some sappy variants that I will spare you.

For a while, the Caltrain train I took to and from work broke down every few days. Day after day of exhaustion plus various unexpected incidents left me quite lost and anxious for those two weeks, and I casually changed my password to: I don’t know how long I can survive from caltrain.

Of course, sometimes a goal was reached and I allowed myself a little pride: I got my green card. After the pride came the inevitable question: I got my green card. what’s next?

That is a hard question.

Later, my wife complained that I spent too little time with our little one, so I changed my password to: I want to be a good father.

That remains the password to this day.

(This piece was written half a year ago… I never published it. Today, while writing an article about security, I came across it by chance and thought I might as well post it…)

Now I still keep passwords made from this sentence in a few places, but most of my passwords have been replaced by ones generated by this script:

#!/usr/bin/env bash
pwgen -n1vsy 16