Longer is always better, but a fully random password will always be stronger than a “memorable” password of equal length.

You need exactly one memorable password, and that should be the one to your password manager, maybe two if you need to log into your device first. From there everything else should be long and random. Hell, with most of them you don’t ever even need to know your own passwords, the tool just handles them itself.

XKCD has it right that you need length over complexity, but it’s also from 2011. Today, we very easily can and should get both.

Passwords should be like bad experiences.

The more you remember the worse they were.

Agreed, I use AI for coding the way I used to use Stack Overflow:

Find me code examples, explain an error or give me some summaries of how something should work but then I go confirm that or test it separately!

I never trusted Stack Overflow for anything more than pointing me in the right direction for what to research. Documentation links, snippets, blogs etc, that sort of stuff. As long as I tell the AI to give me a reference, about 60-70% of the time I’ll get something I can actually use to confirm the code it gave me or get an answer for my question. At best what it does is save me googling time.

Hmm. Well, most chemical desiccants would probably cause moderate to severe damage when breathed in, and with a bit of suspense of disbelief could explain developmental issues…

Yikes, you just know those are stored in a file called passwords-donotsteal.txt…

Most of those password managers are also available on android, and automatically clear the clipboard after 30 seconds.

But that’s a bit like plugging a leak when the tanks empty. If they managed to get a tool onto your device to read the clipboard, what else is there to get? They’ll almost certainly have a key logger installed as well, if not a full backdoor.

And that’s assuming they’ll even go through the effort of installing anything and not just using ransomware to brick your device.

The first thing about security is knowing who you’re defending against, and you’re not defending against targeted attacks by nation states (if you as an individual are, you’ve already lost). Your main adversary is spray-and-pray “script kiddies”, maybe the occasional private actor.

The difference for random Vs chosen sentences is when brute forcing a password (short of a few common or predictable sentences) the attack works by trying out combinations of different words randomly (if they’re even that advanced in the first place instead of using characters). That means any sentences you come up with, based on 3 things in the room, are so unpredictable that it doesn’t matter that they aren’t truly random.

You can also change the space characters. Use - then _ then + and repeat:

Instead of iwentshoppingformilklastsaturday use can use i-went_shopping+for-milk_last+saturday. The amount of variables are just too high for it to truly matter.

Now all you need to deal with is the banking login being so poorly designed it only allows a max of 8 characters or BS like that, in which case you’ve lost before you even started.

If you have the right relationship for it, ask him about the porn he watches, his banking details and how much money he’s got in his account, and tell him you’ll go buy a billboard to put those on.

Those usually get people quite quickly, but they’re also kind of “gotcha!” moments, and people will generally not respond well to them.

If you want a more structured argument, I think you’ll need to reframe the issue. As I read your comment (I’m almost certainly missing huge amounts of context that could change this answer drastically) your father’s argument is “privacy is bad because it is only used for bad things” and you’re actually arguing back “privacy is good because I want to be left alone”. But your dad thinks that you shouldn’t be left alone, because being left alone means you’re doing something bad.

So, don’t argue why privacy is good, you need to argue why privacy isn’t bad. Find some examples of things he likes that only happened because of privacy. Try to avoid things like revolutions, resistance movements or stuff like that, because it will only reaffirm his view that privacy means you’re doing something bad/anti establishment.

This is where the aforementioned porn/finances comes in, since those are usually things people want to keep private, without having negatives attached (depends a bit with porn on morals). Any guilty pleasures that come into mind would also be useful for this.

Also, make the consequences of no privacy more personal. Government whatever, but what about Janet two doors down? What about his boss? What about his parents?

In the end I’d say it’s all about the framing of why privacy matters in the first place. Establish a minimum need for privacy, then expand from there. Hope this helps you (or someone else)!

First they made you fear someone, then they told you they lived down the street.

Debatable how deliberate that was, but it’s certainly not not what they wanted…