Anyone with a long jumbled password will have to write it down
somewhere; and there's the leaky cauldron!
Now then, where does Jimbo always look before logging into .....?
Fine, then make it something that only you know and can easily
remember. How about the second letter of each word in the phrase "Ed
Cryer was born and raised in the south of Wales in 03 04 62 and
graduated from high school in 1980", resulting in a password of
'draonanhofan342nrricn9'. Hard for me to remember, but easy for you to
remember, if it were true. There are also other ways of generating
easy to remember (but hard to guess) passwords, built up from 3-6
shorter words. The beauty of password managers such as Roboform is
that you only need to remember a single password, the one that
protects the vault containing all of the other passwords.
Ed, on the other hand, carries his in his head. And that marvellous
combination of dendrites & synaptic gaps that the human cerebellum uses
is far superior to even AES 256 encryption, which will be open to brute
force attempts.
Negative, Hoss.
The human factor is definitely the weakest link.
For most people, if it's strong enough to avoid being easily guessed,
it's too hard to remember, and vice versa.
A friend and I walked through the cube farm at work one day a few
years ago, (part of a security sweep, sanctioned by the boss),
counting the number of computer monitors with a yellow sticky note
hanging on the side with, you guessed it, the user's network password.
We didn't lift keyboards or open drawers, but I have no doubt we would
have found dozens more if we had. People, by far, are the weakest link
when it comes to computer security.
Having said that, though, the worst thing 'Ed' is doing is using the
same password over and over again at different sites. That raises the
odds significantly that eventually there will be a compromise, and if
it happens, the damage will not be contained.