Wendys to try new chatbot for taking orders

 Obviously.

Wendys has partnered with Google to test a chatbot for taking orders at its drive-throughs.

Wendy’s tests an AI chatbot that takes your drive-thru order - The Verge

“The new automated ordering experience is designed to enhance the customer and crew experience by taking the complexity out of the ordering process so employees can focus on serving up fast, fresh, quality food and building relationships with fans that keep them coming back,”

I like that part about building relationships.

What if AI could rebuild the middle class?

 This is the very provocative title, of an article from NPR - https://mail.google.com/mail/u/0/#inbox/KtbxLwgdckptzskVZRGVlzLJJDcpQMMkHL

But it is still a good question. I play with a chatbot called Pi.  Mainly I do this because i used to play with Eliza, back in the day, and I am fascinated by how this idea - human language interface, has started to finally bloom.  I liken GPTs to librarians who are able to guide your search.

In the late 80's. Jerry Phillips (my advisor and great friend) went to a communications conference where we presented a paper explaining how an expert system could help a person write a good paper by asking that person questions and creating an outline, or even the finished product.  To say it was VERY controversial is a vast understatement.

I remember once making another grad student lose her cool. She said, snarkly, that my research would hurt people. I replied that we wanted to replace people. Just kidding but boy did she get mad at me! LOL

Nevertheless - what we have now is exactly what Phillips and I proposed.  Looking at the above article maybe it will not result in a dumbing down of humans but rather in a more even playing field. That is if we use it that way.

Misunderstanding Risk

 Pretty much everyone has their own idea of what risk is.  Funny thing is that these ideas are usually wrong and often manipulated by media and popular culture.

I will sum this up early with a statement and reference.

"You are 5 times more likely to accidentally kill yourself while taking a selfie than to die by shark attack."

Read that again.

More People Die Taking Selfies Than by Shark Attacks (newsweek.com)

So why no "selfie week' on discovery channel?

I used to teach Risk Analysis (IST-301) for Penn State. I learned much from Dr Will McGill, who first developed the class.  I could never do as well as Will but I had my own approach.

First we have to agree that risk is the probability that something BAD will happen.  The bad thing could involve money, danger to people or the environment, or something else.  In Cybersecurity we look at the risk to the CIA of information. But the rules apply everywhere.

Next one has to look at what is at risk. Those are referred to as 'assets.'  So the risk is that something bad will happen to assets - people, property, secrets, etc.

This is where things like health care and insurance come in. I survived a devastating motorcycle accident in 2013.  I was dead for a minute.  Afterward all the bills came to about $160K.  Because I had insurance that was negotiated down to about $16K. Insurance paid all but $2K.

Mind you the risk of dying on a motorcycle is 1 in 112.  The risk of dying by firearm 1 in358, plane crash 1 in 8,015, poisonous creature one in 42,120, and shark? 1 in 3.7 million.  (these are approximate)

Your chances of dying from a plane crash, a shark attack or lightning strike | indy100 | indy100

We all take risks every day. Can't avoid it. But we learn ways to avoid or mitigate the effects of the risk. A risk with a tiny bad thing is no big deal. A risk with a big bad thing is important.

Next time I will introduce two more points of risk to give you nightmares - a comet/asteroid and a CME.

Beware the post-disaster scams

 About 10 years ago I was interviewed by a talk show in London about scams following hurricane Katrina.  Turns out disasters are a ripe time for such scams, often aimed at elderly people.

So here is my sad, sad story.

Once I had cell service after Ian, I would check FB regularly to let my family and friends know that I am OK.  I got a friend request from a retired faculty member whom I barely knew back in the day.  I was initially suspicious (always am). I asked him a few questions to see if it was really him, but he found a way to avoid answering them.

He asked me if I had gotten my money from DHS. Scam warnings immediately went up, but he kept insisting that I trust him.  He then asked if he could have a DHS agent contact me.  I do not want to divulge this persons name since I am now sure it was a cloned acct.

However, I was soon contacted by a John Franklin, who claims to be a DHS agent.  He said I would get $150K in a Fedex box at 9:30 pm.  He wanted a lot of info from me, including a copy of my drivers license. I refused.  The only info i provided was info found on my FB anyway. Nothing private!

So then he contacted me at 9pm and said they needed $2k to complete delivery of my 150K - scam city!

So then I did what any citizen is supposed to do. I gathered documentation and first contacted DHS. Turns out they do have an agent John Franklin.  My bet is that his acct was spoofed also.  BANG! Now it is a Federal crime, impersonating a federal officer and a scam across state lines.

Here is Johns fake FB profile  (4) John Franklin | Facebook

DHS did not care! Email to John went without a reply. The web site at FBI for reporting things like this is impossible to figure out!  And NO email address for FBI. NONE! Zippo!

So I send the info to my local police.  Again no reply, although I cannot blame them since we are in the middle if Ians devastation zone.

So I have archived all information about this.  They honestly do not seem to care.  The scam is one thing but impersonating a federal agent in a scam....  wow. I had it all wrapped up as a present for them but oh well.

So bottom line. Try to be a good citizen but look out for yourself.  I have no doubt there are law enforcement people looking to break scams like this but good luck finding them.  I am very disappointed.

Getting online in a disaster area

 It has been almost 2 weeks now since Hurricane Ian passed right over our house. Luckily the house, shed, pets, vehicles and we, are OK.  The trees, fence, garden and birdcage are destroyed.  But hey, we were lucky!

The day of the Hurricane was surreal. We had bought new hurricane-proof bay windows, which I sat behind and watched it all go by. I did drink vodka, and listened to progressive rock music as I imagined the world crumbling around me. Suzi made a safe room where she, the pets and a radio sat.

The day after everything was in tatters. We had no water but we did have a pool for water to flush toilets. Luckily, we had bought about 8 cases of water over the preceding months.  We were also fortunate that the temps after Ian were in the 70s and low 80s so no need for air conditioning.

I expected that electricity and cable/wifi would be out for at least a few days.  I did not expect that cellular service would be down.  For four days we had no way to reach anyone to let them know we were safe.  Cell service came back in 4 days, electricity came back in 8 days. Cable/wifi are still dead.

Of course you need power with any electronics.  I was able to use my truck and an inverter to charge battery packs.  I also have a few solar-charging battery packs. More than enough to keep a cell phone running, or two in our case. I plan on getting more.

I do have 2 portable generators but had no luck getting either started. Neighbors and even the national guard tried, but nada. Lesson is to not wait until a disaster before making sure your generator works.

Now if you have unlimited data on your phone the magic starts.  Mobile tethering allows you to use your phone as a portable wi-fi hotspot.  Speed sux - about 2MB down and 3MB up last time I checked.  You ae limited on devices also but I have 2 computers on it now and so far no problem.

But be sure you have unlimited data or you may get a nasty surprise.

Now more magic.  If you have a smart TV, like my 85" Sony, you can get it on the hotspot and watch netflix or whatever.  Also, most TVs have a local antenna port. Get a $50 digital antenna from Wal Mart and you can watch local TV.  This and radio were our only info sources until cell came back.

One more little thing. We have a group here called CERT, Community Emergency Response Team. Given how cell was out, why not fall back on CB radios?  Pretty much every boomer has one in a box in their garage or shed.  With a tiny amount of prep these could be used for the CERT members to coordinate response.  I am planning to do a demo for the other CERT members.

Of course the problem is that coordination is needed early on. Almost nobody uses them besides truckers any longer.  New handhelds go for about $80. Battery powered.   Base satiations run the same price range but are not battery powered.

Also, demand a refund for the time any service, like cable, was down.  I expect this will become quite a kerfluffle.

Do we live in a simulation?

 Nah, really. Read this first ...

Do we live in a simulation? Here's why we may never know. (msn.com)

Pretty radical idea. But not really.

First of all, there is some pretty compelling 'evidence' in the apparent quantization of many physical things, at least in theory. For some phenomena we know a lot (electron states) and for others we know little (entanglement).

Simulations, at least as we know them, are digital and ruled by mathematics.  Physics, essentially, is ruled by what can and cannot be. Things that cannot be proven to be impossible are therefore possible.

Now here comes the interesting problem, at least in my mind. Many people believe in a God or Spirit of some sort. I am that way also but more Universalist. Is that not possibly a translation of a longing for the programmer of the simulation?

Now before I get into the metaphysical, let me drop one more bombshell. Maybe the illusion of self and reality that each of us has (even animals and plant) constitute the many worlds? Perhaps this is how the simulation works out?  

Now this is of course just conjecture. But an interesting thought experiment. Is such a thing possible to know and so what?

I see a bad Moon rising ...

 Hi all. We are 3 days from a hurricane that may, or may not, be really nasty.

The real bad scenario of security is when something goes wrong and you do not know what to do and it keeps getting worse.  This was the case at Chernobyl and 3-Mile-Island.  Interestingly all blamed on a control interface that was too complex for humans to handle.

I mean, part of the idea of security is to have secure systems that are very difficult to mess up.

So, this upcoming hurricane leaves us with something of an opportunity.

I am from Pennsylvania.  The worse that can happen there is a bad snow storm every 3-4 years. Worse if you live in the mountains like I did.  But 3/4 of the year it is not good for being out riding a motorcycle, so Suzi and I decided to move to tropical SW Florida, where one can ride 9/10 of the year. Its a plan!

OK, back to security. Friends would joke about hurricanes to me. I would laugh it off. I had come down in 2005 just in time to rent a Harley in Orlando and ride in the beginnings of Hurricane Charley in 05.  Admittedly I hated it but I was single, unhappy, and willing to ride the edge.

But we figured, all in all, it would be best for us. I LOVE warm, and HOT? I don't LOVE it but i LIKE it.

The Gulf is really peaceful although ironically, I cannot get in it. More specifically I cannot get out of it, due to my deteriorated lower back. LOL

So security - You know a potential disaster, one documented many times. Is coming. You know the time frame. Your data is 'spaghetti models' which are inaccurate but overall a hell of a lot better than nothing and better as time diminishes.

The answer, given everything we know, is to evacuate. But that is not possible.

So first, stay informed. A few of you MAY have to evacuate. Have a plan for that, put important papers and such on the cloud. Have SSD backup. Take laptop with you. Unplug everything else!!!  Take battery backups for phones. Have a special box with papers, IDs, ammo, whatever needed.

If you have a pet be sure to take care of them. Food, leash, muzzle, water bowl, etc.  Most animals do really well for a few days. And have some idea where to go. Believe it it not there are a few instances where one in my position (Rotonda) will have the best chances by going south.

BTW - Treat this like a camping trip although you may be camping in your vehicle.  If you have to find a safe place for the night.  There will likely be others there. Do not waste gasoline. Share info from battery phones. Don't be a jerk, there will be a lot of scared people with families.

Point is - we now have the ability to create scenarios and evaluate them. You bet your arse the govt. is doing this. I would. Help each other! Cooperate.  I do not want to evac but will if ordered to. But I will take my pets.

We are cleaning the house/yard and taking lots of pictures just in case needed for insurance.  Murphys law says that the more we prepare for disaster the less likely disaster is to strike.

So to conclude, this is exactly what every security analyst should do.  Run the scenarios. Assume different starting variables from worse to best. Know what you will do ahead of time. Revise your plan as data changes.  A hurricane is a lovely example of a natural disaster that can absolutely decimate a companies IT infrastructure.

Rise of the Help Desk - 70s through 90s

 I would always tell my students that the best kind of training they can get is by working at an IT help desk.  Most of us have bad memories from interacting with a Help Desk.  I understand that because Customer Resource Managers (CRM)   otherwise known as "press 1 for ... "  are universally disdained.

I first encountered a small Help Desk at Penn State, where visionaries such as Bill Verity were hired as systems analysts to help faculty and graduate students use the computing resources on the IBM mainframes. Those old guard, Bill, Dan Bernitt, Chet Smith and others, came from various disciplines. It was a time full of potential.

When I worked at Pitts Comp Center from 76 to 83, the latter part of that as a manager. They were also mainframe based and everyone had to put in 1 or 2 days a week at the User Consultant desk at Old Engineering Hall on the Oaklland campus.  Those were fun times as I would get a sausage dog at the Original.  I spent a lot of my youth on Oakland.

The Help Desk was an amazing training ground. One had to be aware of a broad range of things, not only programming.

What do you do if there is widespread cyber-warfare?

 In 2015, Dr Pete Forster and I developed a class for the MS Program in Homeland Security tentatively named SRA-404.  It was focused on cyber-espionage and cyber-warfare.  It was one of the first classes of its kind.  Peter is an expert on the political and espionage scene. My expertise was in the technology of cyber crime, espionage and warfare.

One of the bigger things, IMHO, to come out of the class was an exercise on what to do if this happens or how to prepare. In this posting I present the suggestions. I cannot say they are complete. A lot depends on specifics.

Direct attacks.

By these I mean worms, viruses, and such. They could conceivably be deployed for activation later.  Mainly we are talking about home and small-business systems. Of course you have good anti-virus and firewall protection. Make sure you have backups stored on a non-electronic media - such as CD or DVD. A low nuke could put off an EMP and potentially fry solid-state or magtape backups.  If you have access to a safe or faraday cage use it for your backups.  I bought a home safe and a home UPS for under $200. I also have multiple backups on CD and DVD (also SSD ) all of which goes in the safe with my pistols.

Attacks on servers and networks

I would create a doc with all of your PWs and IDs on it and print that a few times.  Also maybe encrypt it and put it somewhere on the cloud.  Having encrypted docs on the cloud is great if you know what you ae doing.  I will post more about that later.

Do not expect that any of your online services will be working under a cyberattack.  Therefore have a backup plan for paying bills, etc.  In the old days we used to write checks. I would also keep about 2K in cash (20s) just in case. Should hold you over for a week or more.

Now the bad stuff. I learned a lot living in a Hurricane zone.  Prepare as if a disaster were coming. Esp your meds, water, canned food, peanut butter, etc. In PA we had the occasional blackout during a blizzard. We used a wood stove to stay warm.

I am not suggesting becoming a survivalist, but the potential for damage from a cyberattack is too great to ignore. And BTW, a cyberattack can come from the Sun as well. More on that later.

Relauching the Blog

 Hi Yinz'all,

I am gonna try re-launching my blog, but as a slight twist from the traditional science/ security blog.

Yeah, it will have some of that. It will also have some of the memories of a city kid who followed his dreams and became a scientist.

but I refer you to the following:

Apple Steve Jobs Heres To The Crazy Ones - YouTube

The stories I tell will be mostly true, as true as I can remember them. But I will NOT say anything bad about anyone. Not my place. Watch for a few posts each week.

gerry

Perils of Social Networking

Many of us use social networking sites. Facebook, Linkedin, Instagram and more. Often fun sites, also great way to stay in touch with friends and family.

But of course there is a downside. These sites are a treasure trove of information about legitimate users. Their backgrounds, politics, interests, and even passwords.  As a result it is no surprise that big money is being put into ways this information can be stolen.

This is an article from ThreatPost about the threat. They claim that almost half of all social media logins are fraudulent. Automated attacks (bots) are the most popular form of attack.

https://threatpost.com/half-social-media-logins-fraud/147688/

Quantum entanglement and what it could mean to Cybersecurity

Chinese scientists have succeeded in sending a photon to a device in Earth orbit. The big deal is that they used quantum entanglement, what Einstein called 'spooky motion at a distance' to do it.

Entanglement is a cool property of the universe in which two 'objects' (a photon is an object) can be linked in such a way that a change in one results in a change in the other, regardless of how far they are separated. What is spooky about this is that there is no media. The change simply happens!

What is actually teleported is 'quantum information' - and this is where cybersecurity comes in.  One of the more common attacks is the 'man-in-the-middle' attack, where an attacker is able to eavesdrop on a communication. If full control of quantum entanglement can be achieved, there will be no 'middle' to attack.

However, much still needs to be understood. It is still not clear whether the change happens immediately, or somehow propagates with the speed of light.  An experiment called Bell's Inequality tries to solve this but the matter is still being debated. So far there is no evidence that the speed of light is violated. But the possibility exists. If there is no 'between' the issue of speed could become mute.

https://time.com/4854718/quantum-entanglement-teleport-space/?fbclid=IwAR3RCF7AGy-wo9qP4Lo_u2CQStO25XJEnPCVdfwI9DX2WFkqCiYwLTXpgwI

The Cyber-Threat to Universities

This is an article from the National Cyber-Security Center in the UK.  It specifically addresses the threat of cyber-espionage to universities and colleges in the UK. However, everything in this article also applies to the US.

I started work at Pitts Computer Center in 1977, and later went to the Penn State Information Technology Services in 1983. The emphasis was always on capability and accessibility. Security, if ever considered, was really an after thought.

This all changed as networks were introduced. Security measures had to be applied, especially at the network level. However, faculty balked at this. How dare the IT staff take away their complete and total control? I became the poster-boy for least-privilege access among the faculty to show that it would not negatively affect our work.

Two-factor authentication has been slowly adopted by many academic institutions, and is one way that  they are starting to address this issue. Read on to learn more.


https://www.ncsc.gov.uk/report/the-cyber-threat-to-universities

Are security questions secure?

Many online sites have a mechanism where a user who has forgotten a password can get a new password by answering one or more 'secret' questions.  In some cases these questions may be used as a second authentication factor.

The questions tend to be of the form "what was the name of your first pet," or "what is the name of your first grade teacher."  They are intended to be personal but also easy to remember.

The problem with this is that it may be possible to learn enough about a person using open source intelligence tools to answer these questions correctly.  In 2008, VP Candidate Sarah Palin had her Yahoo e-mail account hacked by a young man who correctly answered security questions about her birth date and where she first met her husband.

Even worse, a researcher at the University of Washington has pointed out that popular surveys encountered on social media could provide enough information to compromise these questions.  For example, consider the currently popular survey in which a person lists 10 concerts, 9 of which they have actually attended.  The game is to figure out which of the 10 they have not attended.

Although this seems harmless, and in most cases is harmless, it is possible to develop a profile of the users age, culture and interests from these surveys.  The general advice is that "secrets make bad passwords when those secrets can be discovered or guessed."

So what can you do?  In many cases the secret questions are required.  My advice is simple, answer the questions but lie, and remember the lie.  It helps if you have a basic scenario, such as Star Trek, to use in constructing your lies.  For example - "What was the name of your first pet?"  Answer: "Tribble."   "What was the name of your High School?"  Answer: "Starfleet Academy."

If you have a scenario in mind (Star Trek, Harry Potter, Lord of the Rings, etc.) it will be easier to construct lies that can be remembered.  Just make sure the scenario cannot be easily determined from your online presence.

Happy Easter! A bit of reminiscing.

I recently came across a number of articles explaining that a second 'great spot' has appeared on the planet Jupiter. We know this because our Juno spacecraft has been orbiting the gas giant and has been looking at the poles for the first time.

The Great Red Spot on Jupiter is an enormous cyclone that lies in the south temporal belt of Jupiter. It has been studied since the development of the telescope.  It changes over time, sometimes completely disappearing but eventually re-emerging.

The new spot, which lies at Jupiter's North pole, has been dubbed the Great Cold Spot, since its temperature is lower than surrounding clouds.

Back in 1968, I had learned programming through a cooperative venture between my high school and Carnegie-Mellon University. Programs were exciting for me and I looked for some way to apply programming to my life-long love of astronomy.

So I wrote a Fortran program to calculate when the Red Spot would cross the meridian of Jupiter, as seen from our perspective. The program would be seeded with data from Sky and Telescope magazine, and did a pretty good job.  My high school teachers were amazed, and they sent me to a weekend science education conference and I presented on my program.

This really has nothing to do with security but it is a fun memory.

Happy Easter to you all!

Cyber-Criminals targeting Anonymous FTP Servers

Last week the FBI issued a warning that cyber-criminals are actively targeting FTP servers used by medical and dental organizations. Their goal is to steal publicly-identifiable information. The purpose, according to the FBI site, is to ‘intimidate, harass, and blackmail business owners.’

So what is FTP?  It is one of the original protocols of ARPAnet and the early Internet. Its purpose was file transfer. It was developed to allow researchers to transfer data from local, insecure (likely University) computers to secure military computers for computation.  FTP would likely also be used to return results to the local computer for final formatting and publication. This was in the 1970’s and 80’s.

Seriously, there is little reason to run an FTP server today. The Word Wide Web can often serve files better.  In the few cases where it is necessary, administrators should ensure that ‘anonymous’ access is not enabled. FTP comes standard with any version of Linux/Unix – but in the vast majority of uses it is not needed.  Admins of networks and systems for health-care providers are advised to check their networks to ensure that anonymous FTP is not enabled.

The typical home user is not likely to use FTP for file sharing when there are better alternatives.  There are, however, home FTP servers – I have used them.  I find BOX, or some cloud-based variant, to be more convenient and safer. If you wanted to, for example, share documents or pictures with family members. Don't forget to encrypt important files just in case.

Still, users may want to ask their doctor or dentist if they have heard about this. Never hurts to ask, and it is their diligence, or lack of it, that we need to worry about.

What you can do about your privacy when it is out of your control.

Unfortunately, the only real control you have over your information and privacy is when it is in your possession. After you have made an online purchase or even simply navigated to a Web page information about you is stored on the servers of your ISP and the company or organization with whom you have done business.  Trying to stay entirely off the grid is virtually impossible today, since every bill paid, every phone call made, and even pictures of your automobile license plate will result in digital records tied to you.

Common advice is to only work with reputable online businesses. This sounds good, but how does someone decide which businesses are reputable and which are not?  At some point there may be something like a ‘good housekeeping seal of approval’ that indicates that a company's systems and security measures have been audited and approved.  However, at the current time this is a difficult task.  One might have assumed that Target, TJ Max, and Home Depot are reputable businesses.  However, in hindsight all three had vulnerabilities that allowed hackers to compromise customer information.

In reality, the only protection you have once your information is out of your control is from laws and regulations.  As examples, HIPAA grants legal protection to healthcare records and FERPA grants legal protection to educational records.  But aside from a few laws governing special situations, there are no laws defining a level of due diligence for companies to protect customer data.

In fact, the situation seems to be evolving in a way that will actually lessen customer privacy controls. Just last week the US Senate voted to remove protections that would prevent ISPs from sharing your information.  This opens the door for ISPs to share your browsing history, and possibly intercept, and modify, your communications (such as inserting ads or tracking cookies).

The EFF recently posted a great article on these increased risks.

So what can you do?  If your privacy is important to you, you should contact your State and Federal representatives.  In the case of Federal representatives, let them know that your privacy is important and demand that they strengthen, not weaken, privacy laws.  In the case of state representatives, let them know how important privacy is to you and urge them to pass state laws requiring compliance with stated rules of due diligence. Some states, such as Illinois, are already considering such laws. Your voice may be heard louder at the state level than at the Federal level.  However pressure needs to be applied in both places.

Please understand that privacy means different things to companies than it does to individuals. To a company, privacy means that it has the right to decide how information assets (customer information) are used.  To the individual, it means the right to control who has access to their information.  Because of these two views, the interests of the company will be at odds with the interests of the individual.  Only by having strongly-defined rules of due diligence under law will we be able to assure consumers that their information will be protected.  This allows for company ‘good faith’ use but also allows provides standard controls for what is now still a ‘wild west’ environment.

Slide set for tonight's session

I know many people who cannot attend tonight's presentation on practical tips for protecting your data and privacy in cyberspace.  So, here is a link to the slide set in PDF form.  I will be updating the presentation soon and will post updated slides when I do. Be safe!

http://personal.psu.edu/gms/privacy/Privacy%20Online.pdf

I am also happy to give this presentation to schools or civic groups.  No pay necessary but it would be great if you can cover my travel expenses.

Protecting your Privacy Online - talk on Weds March 22

About passwords and 2FA

If you are like most users, you have a dozen or more userids and passwords on various services such as Google, Facebook, Yahoo, etc.  It gets pretty complicated remembering all of these. So what is the security-savvy user to do?

What you DO NOT want to do is use the same set of userid/password credentials for multiple systems!  The reason for this is simple, if your credentials are stolen from one system the hackers will try them on other systems, such as social network sites or bank sites.

According to a recent article in The Hacker News, over 1 million sets of Yahoo and Google credentials are available on the dark Web. Information gleaned from these sites can then be used in various ways, such as creating spear phishing attacks.

One of the best methods for protection is 2FA, or Two-Factor Authentication. This requires a second method of authentication, such as a code sent by SMS to a cell phone. Some services, such as Google, provide for 2FA as an option.

Another popular approach is to use a password manager program.  These programs are like an encrypted database.  Here is a link to an article about the best password managers of 2017.

Yet another simple approach is to write them into a notebook and carry that with you. Or create a text file with the various credentials, print one or two copies to keep in safe places, then encrypt the file using Zip or some other method and store it on the cloud..  If you lose the paper copies or want to make a change you can retrieve the encrypted file from the cloud and edit or print it. Now you only need remember the decryption key, and your cloud credentials.

Your choice of password is also very important. Stupid passwords are easy to decrypt. One very simple exploit is to simply hash the top stupid passwords and compare them with the giant hashed password file.  You are likely to get at least a few hits.

Instead of a password, use a pass phrase. A simple sentence such as "I love hash browns with ice cream" can be extremely hard to crack. So how to you remember the phrase? Take your favorite poem, short story, or song. Employ the lyrics along with a userid helping you remember which lyric or sentence you are using. Avoid extremely popular pieces such as the Bible. You might also employ the approach of changing some characters to others, such as 4 for a, 0 for o, etc. A simple algorithm for this is easy to remember.

To give an example, my home network has WPA2 PKS for security. I have seen methods for cracking WPA2 PSK, but they rely on having a password of 12 characters or less, otherwise the time involved is too great. So my pass phrase is 27 characters. When I travel I turn the router off, but that is a story for another day!