Take the 2-minute tour ×
Personal Productivity Stack Exchange is a question and answer site for people wanting to improve their personal productivity. It's 100% free, no registration required.

I just swapped my old password at work and every time I sit down at the computer, I end up typing the old one because it is an ingrained habit. How can I get myself to type the new one instead? To be clear, this isn't about remembering the new password, but about remembering to use the new password.

share|improve this question

4 Answers 4

up vote 2 down vote accepted

Remembering a Password

A password you can't remember is a bad password though. Read more below in Creating a Good Password Scheme.

But anyways, if you don't have a choice, then the most important advice I have is: type it over and over again!!

You need to make it become your brain associates with multiple environmental elements: associate it with a typing rythm, recognize how it "sings" to you as you type, associate characters with their pronunciation in their heads (remember to not whisper them to yourself thoug...), etc... This will help you memorize it, but will also add elements that drive your muscle memory home.

One thing I'd recommend would be to switch your computer's auto-lock rules for the next few days to be very strict and lock very quickly: you'll be forced to type in the password so often that you'll get used to it very quickly.

Remembering to Use a New Password

*The computer will remind you of that, don't worry... :)

But if you want to avoid the nagging (and the frustration of the "oh right, dammit, did it again!"), maybe just write "NEW PASSWORD" in on a BIG note stickied on your screen, desk, keyboard, mouse... Something that's in your face, and that you're bound to see when you sit back at your desk.

Even your OS allows it, may have it display it as a message on the login screen?

I have to say I never really had this problem for more than a day though. The weird thing is that sometimes, a long time later, I'd suddenly catch myself trying to use a very old password for no reason. But the repeated use of the previous password goes away in just a day or 2 usually, if it's used for most systems (computer, mail, source control...).

Creating a Good Password Scheme

Use Mnemonics

All my passwords follow these requirements:

  • more than 16 characters,
  • uppercase and lowercase letters, numbers, and special characters,
  • unique (or almost).

Yet I never forgot any of them, and they have a decent password strength.

What's the Catch?

Use a base password with your own transformation rules to be able to generate a password based on the environment or context in which it is used.

Say, create a strong base from something you can easily remember. For instance, let's say you're an old video game fan. You could start from the classic quote:

All Your Base Are Belong To Us!

Right. Easy. Now let's switch that to:

AllYourBaseAreBelong2Us!

That's actually already a decent password for most purposes, though anyone watching you type it a few times would be able to figure it out relatively quickly. And it's not unique for each system.

So now, let's say you want to register for a StackExchange account and you need to create a password.

This could become your new password:

SEAllYourBaseAreBelong2Us!

I just added a simple prefix to my password, thus rendering it:

  • unique to a system (ok, that's rather limited here, any site where the initials would boil down to SE would use the same, but still...),
  • longer.

Of course, that's just an example and a very simple transformation. But that's already decent and more secure than using "HelloKitty87".

Yes, but... Downsides?

What if Someone "Cracks the Code"?

Of course, that means there's a reproducible scheme behind all that, and that whoever figures out your scheme may be able to virtually access any platform or product for which you use the scheme.

That could happen if your scheme is too simple and someone could look at some of your passwords and figure out the base and the transformation rules. Say, if you used it on 2 web platforms developed by the same company, where a rotten employee would peek at unencrypted passwords. But it's still one step better than having the same password for everything, or simple ones.

Also, that's already a risk you run when using a password generator or a master password that may get stolen or broken. And at least with that memory scheme you don't need any additional system.

Many Websites Suck at Implementing Password Systems

A common problem I run into is websites that:

  • limit which characters can be used,
  • limit the length of the password.

The latter is not so bad: you type in your password as usual and they would just use whatever length they use, right? Wrong. Because often times they'll let you type in a longer password than what they'll store, so that fails, and you won't be able to remember what password length they expect and will have to try everything. Extremely annoying.

About the authorized character set limitation, that can also get quite tricky... Because sometimes some crappy sites will let you type in a password, say everything's OK... and then never let you login again.

Mitigations for that:

  • have a "short password" scheme as well,
  • get used to resorting to security questions / password recovery often. And make sure it's just as damn hard to break as your password.

Remember: a security question is a password itself. My recommendation: create a secondary password, and don't even give a damn about what the question asks. You may ask me for my dog's name or my mother's maiden name, but I'll answer you with something meaningless (to you) all the same (well, actually, I also have transformation rules in my security questions, but they're different ones).

Further Reading

Ah, and some final words of tonge-in-cheek wisdom:

XKCD: Password Strength

share|improve this answer
    
"A password you can't remember is a bad password though." Note that from the security viewpoint, the statement can be taken almost opposite : a password you can remember is a bad password. For example, see troyhunt.com/2011/03/only-secure-password-is-one-you-cant.html (it doesn't apply for a few cases, like a master password, or an OS login, which you indeed need to type, hence it's not a real answer here) –  T. Verron Jun 12 '13 at 10:26

Wait a week and see if you still have a problem remembering to use the new one first. Repetition creates habits.

share|improve this answer

I would not worry too much, the 'incorrect password' prompts are so annoying you'll get into the habit.

Or, use any kind of reminder: put a blank sticky note on the monitor edge.

share|improve this answer
1  
I've gotten used to typing my old password, backspace, and the new last character pretty well... –  enderland Jun 11 '13 at 18:56

If you're using a web browser to connect to the system you're working with, you can let your browser remember the current password for you. This could have security implications though; be sure to only use this functionality if nobody else can access your browser.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.