Easy to remember strong passwords

Jacques alerted me to an article about accounts on Facebook being taken over by scammers. You can read the article at http://redtape.msnbc.com/2009/01/post-1.html#posts

It reminded me of the importance of using secure passwords, even on websites that don’t hold important information about you like credit card information and such. A strong password will exist of at least 8 characters, preferably more and contain numbers, lower and uppercase letters and some symbols.

The problem most people have however, is having to remember all these complicated passwords…

You can of course keep track of your passwords using text documents, spreadsheets or a simple notebook. There are also software solutions, but let’s face it: most of us are pretty lazy and we just want something we can easily remember ourselves.

The favorite-book-title method

About 2 years ago I came across a suggestion to use the titles of your favorite books or songs to make passwords. If for example your favorite book is “Lord of the Rings - part 3: the Return of the King” you can turn this into a password like this: LotR-p3:tRotK

I used this system for a while, but now I had to remember which book was connected to which account. Soon enough I was having to try all kinds of different book title combinations and getting locked out of some accounts because I exceeded my number of allowed incorrect tries…

The easy-to-remember-sentence method

So I dropped this method and designed my own. What I do now is use a fixed sentence which has a flexible default reference to the site or account I use the password for. Here’s an example of such a sentence:

My mother lives in New York and is a total digibeet with no FaceBook account for years to come.”

Translated into a password: mMliNY&=atDw-FBA4Ytc

With this system you:

  • take the first letter of a word - if it’s a noun, use a capital (think German ;-) );
  • use leetspeak where possible: to -> 2, for -> 4;
  • replace words with symbols: and -> &, is -> = and no or not -> - (minus sign).

Plus you have the flexible element of the account info. When you login to facebook the password is mMliNY&=atDw-FBA4Ytc, but when you login to your Google Account it becomes mMliNY&=atDw-GA4Ytc and when you login to your website admin… well, you get the idea…

Now all you have to remember is 1 sentence while your password passes the strength test. :-)

Patricia

P.S. I do recommend that you have a few different sentences that you use for the really, really important passwords like for your internet banking account and such. Just keep them down to 5 max. The human brain can easily remember 5 items, some people manage up to 9, but with more than 9 you will definitely run into the same trouble of remembering as before…

Gerbera.org

Gerbera.org
design titel

(EN) Gerbera.org - Comprehensive site on the Gerbera (”Barberton Daisy”), with history, care and flower-growing industry information.

(NL) Gerbera.org - Uitgebreide site over de Gerbera (”Barberton Daisy”), met historische en kwekers informatie en verzorgingstips.

Web software: WordPress blogging software
Doelgroep:Algemeen publiek
(100% W3C xhtml/css validatie)

Hearts Unlimited

Hearts Unlimited
design titel

(EN) Connecting Hearts in a Digital World - Hearts Unlimited is a small Dutch publishing house for books, courses, games and software.

(NL) Brengt harten samen in onze digitale wereld - Hearts Unlimited is een Nederlandse uitgeverij van boeken, opleidingen, spellen en software.

Web software: WordPress blogging software
Doelgroep:Algemeen publiek
(100% W3C xhtml/css validatie)

Essentie

Essentie
design titel

(NL) Spirituele therapie en praktijk voor coaching en training

(EN) Spiritual therapy plus coaching and training.

Web software: WordPress blogging software
Doelgroep: Spiritueel publiek
(100% W3C xhtml/css validatie)

Snap my Roll

I just installed the Snap my Roll plugin at www.patriciaritsemavaneck.name - this plugin randomly displays a snapshot of a site from your blogroll.

Sounds pretty cool but getting this feature up and running proved to be a little less cool…

First of all the instructions on how to activate and use the plugin at the WordPress Plugins pages are extremely minimal and also contain some typos:

<?php if (functionexists('snapmyroll')){snapmy_roll();} ?>

should be…

<?php if (function_exists('snap_my_roll')){snap_my_roll();} ?>

I got the almost correct line of php script from the developer’s blog, but if you copied from here, you need to remove the blank space before the first ? - question mark:

< ?php if (function_exists('snap_my_roll')){snap_my_roll();} ?>

Otherwise all instructions at this blog are in French and mine had become too rusty to make much sense of what was being asked in comments etc. And unfortunately, getting the php line correct didn’t make the plugin work…

I hate to give up quickly, so I decided to look at the plugin files to see if I could get this fixed myself. The original code is this:

function snap_my_roll(){
global $wpdb;
$js_url = get_settings('siteurl') . '/wp-content/plugins/SnapMyRoll/' . 'js/';
3jnrdb_wp_enqueue_script('jquery');
//store links in an array
$my_query = "SELECT link_name, link_url FROM 3jnrdb_wp_links WHERE link_visible = 'Y'";
$links = $wpdb->get_results($my_query, OBJECT);
//rand the the array and build the javascript
shuffle($links);
echo "<li>\n\t<h2>Snap my 'Roll</h2>\n";
echo '<script type="text/javascript" src="'.$js_url.'jquery.js"></script>'."\n";
echo '<script type="text/javascript" src="'.$js_url.'jquery.innerfade.js"></script>'."\n";
echo '<script type="text/javascript">'."\n";
echo "\$j=jQuery.noConflict();\n";
echo "\$j(document).ready( function(){\n";
echo "\$j('#blogroll').innerfade(\n";
echo "{ timeout: 4000 ,type: 'sequence', containerheight: '180px', runningclass: 'snap_li'});\n";
echo "});\n";
echo "</script>\n";
//lets print the list of images
echo '<ul id="blogroll">'."\n";
foreach($links as $link){
echo '<li style="width:252px;">'."\n\t".'<a href="' .$link->link_url.'" title="'.$link->link_name.'">'."\n\t".'<img src="http://images.websnapr.com/?url='.$link->link_url.'&size=s" alt="'.$link->link_name.'" /><br />»'.$link->link_name."\n\t".'</a></li>';
echo "\n";
}
echo "</ul>\n</li>";

}

?>

And the problem is with the path to the .js files this plugin uses. It calls 2 files:

  1. jquery.js
  2. jquery.innerfade.js

But in the download you only get jquery.innerfade.js - which isn’t a problem because WordPress comes with jquery.js. The only problem is that WP’s jquery.js file is located somewhere else…

So I relocated the jquery.innerfade.js file to sit next to jquery.js and changed the code to this:

function snap_my_roll(){
global $wpdb;
$js_url = get_settings('siteurl') . '/wp-includes/js/jquery/';
3jnrdb_wp_enqueue_script('jquery');
//store links in an array
$my_query = "SELECT link_name, link_url FROM 3jnrdb_wp_links WHERE link_visible = 'Y'";
$links = $wpdb->get_results($my_query, OBJECT);
//rand the the array and build the javascript
shuffle($links);
echo '<script type="text/javascript" src="'.$js_url.'jquery.js"></script>'."\n";
echo '<script type="text/javascript" src="'.$js_url.'jquery.innerfade.js"></script>'."\n";
echo '<script type="text/javascript">'."\n";
echo "\$j=jQuery.noConflict();\n";
echo "\$j(document).ready( function(){\n";
echo "\$j('#blogroll').innerfade(\n";
echo "{ timeout: 7000 ,type: 'sequence', containerheight: '133px', runningclass: 'snap_li'});\n";
echo "});\n";
echo "</script>\n";
//lets print the list of images
echo '<ul id="blogroll">'."\n";
foreach($links as $link){
echo '<li>'."\n\t".'<a href="' .$link->link_url.'" title="'.$link->link_name.'">'."\n\t".'<img class="websnapr" src="http://images.websnapr.com/?url='.$link->link_url.'&size=s" alt="'.$link->link_name.'" /></a></li>';
echo "\n";
}
echo "</ul>\n";

}

?>

I also made some changes to the generated html, but that is only to fit my template and not always a necessity.

Do I like this plugin?

At current I’m having mixed feelings about it.

  • This plugin uses a screen snap shot service from www.websnapr.com - it’s a free service with the usual limitations when you don’t upgrade to their pro account. They add a watermark text to the snap shots. It’s not very intrusive, but it wouldn’t look good on any professional sites (by which I mean sites used for commercial purposes as opposed to personal blogs and such).
  • In addition there seems to be a limit to the number of snap shots they will generate for you per day. I still have 3 snap shots in queue and they have been in this status for well over 12 hours by now…
  • As for the plugin itself, I don’t like the fact it cannot be used as a widget. If you add the php snippet to a text widget, it just displays the php code in your sidebar. (You can actually get another plugin to fix this problem, but that’s another story…)
  • The plugin prints a default title ‘Snap my Roll’ which can only be changed from within the php file.
  • What I also don’t like is that the plugin generates html that isn’t compliant with WordPress standards. It’s minor - just h2 tags instead of h3 tags for the plugin title, but still…

I think this plugin has potential. With some small adjustments it would be better suitable for general use. I will still look for an alternative at this point that suits my own needs better…

UPDATE - 20 March 2008 at 17:21
After only a couple of hours, I decided to let this plugin go. It wants to be the top layer of the site no matter what and that seriously disturbs my lightbox feature for photographs�

JSSpamBlock

Just installed the JSSpamBlock plugin on www.patriciaritsemavaneck.name. This is a plugin which sends a snippet of javascript to the browser of the commenter. When it’s processed, the plugin assumes we’re dealing with a human. If it’s not, the commenter gets to prove humanity by entering a given number in a form which appears after initial blocking.

I’m interested in giving this a try, though I also have SpamKarma 2 running as extra protection after a spammer would manage to pass this plugin.

After first installation and trying to leave a comment, I received a php error message which I forgot to copy but it was related to the following line in jspamblock.php:

if(JSSPAMBLOCK_LOGFILE != ''){
$log = fopen(JSSPAMBLOCK_LOGFILE, 'a');
}

The problem was that the script was trying to write to a non-existent yet defined logfile, and the solution was to remove the logfile definition:

Changed:
define('JSSPAMBLOCK_LOGFILE', 'jsspamblock.log');

to:
define('JSSPAMBLOCK_LOGFILE', '');

Of course it’s also possible to create a log file, upload this to the server and make sure the php has permission to write to it. The readme.txt instructions included in the plugin offer a clear explanation of how to proceed if this is what you want.

Time Confusion…

When using

<?php the_time('Y'); ?>

in the template to display the year (for example in copyrights statements in the footer), WordPress takes the year associated with the content on any given page.

So if you posted an article in 2006, your footer will show a copyright for 2006 when reading that article. If you wrote a page in 2007, the year will change to 2007 when viewing that page…

If you want to use php for automatically keeping your copyrights up-to-date, use the following script instead:

<?php echo date(Y); ?>

From Heavens

From Heavens
design titel

(EN) Spiritual site with daily ‘channelled’ messages.

(NL) Ontwerp voor website waar dagelijks korte ‘gechannelde’ berichten worden geplaatst.

Web software: WordPress blogging software
Doelgroep: Spiritueel publiek
(100% W3C xhtml/css validatie)

Longevity

Longevity
design titel

(EN) Site for Chinese products.

(NL) Ontwerp voor website waar producten met Chinees karakter verkocht worden.

Web software: WordPress blogging software
Doelgroep: Gezondheid en fittness
(100% W3C xhtml/css validatie)

Aventurijn

Aventurijn
design titel

(NL) Aanpassing van bestaande WordPress template (’Crop circles’) met header logo en eigen kleurenschema. Website is informatieve site van de school ‘Aventurijn’.

(EN) Adaptation of Wordpress template (’Crop circles’) - website of ‘Aventurijn’ school

Web software: WordPress blogging software
Doelgroep: Ouders schoolgaande kinderen