Suggestions For Creating Passwords

Scope And Purpose Of This Post

Even after someone makes the very wise decision to start using a password manager so they can start having strong, unique passwords, they still have to decide what password generator settings to use.  They have to decide stuff like whether to use digits and punctuation in their passwords, how long their passwords should be, and whether they should use passphrases.

The password generator settings you use should depend on how you're going to use the password.  Passphrases are great for passwords you need to remember, but maybe not for your work password that you manually type >20 times a day.  My recommendations depend on the "password use case":

• Remembered and typed <8 times a day.
• This would be your master password for your password manager.
• Use a passphrase.  Six words for your master password.  Five words are okay for passwords that are far less important than your master password.
• If your password manager doesn't generate passphrases for you, make it generate a bunch of digits and use the diceware word list or an EFF word list.
• Not remembered and rarely/never typed.
• Your most common password use case, for stuff like Facebook.
• I recommend a "1D+1U+15L" password: 1 digit, 1 upper case letter, 15 lower case letters, for a total length of 17.
• If your password generator doesn't support that, go for 14 alphanum characters (uses lower case letters, upper case letters, digits)
  
• Remembered and typed many times a day.
• This is possibly the use case for your work password, which you have to type to unlock your computer and log in to many services.
• Because you are typing this so frequently, you might not need the memorability of a passphrase, and you probably don't want the typing hassle.
• I recommend something like a "1D+1U+12L" password, even if you have to manually modify a password generated by your password manager.

Note: for this blog post, we'll be assuming we never use an ambiguous letter or digit ("IOlo10"), except in passphrases.  It is tempting to think that if you know that a non-passphrase password only contains lower case letters, then "l" and "o" are unambiguous, but when you're looking at the computer-generated password two years after you generated it, you won't be confident.  For passphrases, you can disambiguate based on the words ("shallow" is a word, and "shaII0w" isn't), so "l" and "o" are okay.

Password Strength In Dollars

Purpose And Scope Of This Post

When discussing password strength, money-to-crack calculations are far better than time-to-crack calculations. I propose a money-to-crack model that applies to dedicated password cracking rigs as well as cloud computing, and I make some calculations using recent (2020-Nov) data.

This blog post is focused on:

• Offline attacks (explained in Gentle Introduction)
• Computer-generated passwords, not human-generated passwords (more info in Background: Guesses-To-Crack)

The cracking costs tables are towards the bottom, feel free to check those out first if you want to see results, not methodology and commentary.

Gentle Introduction

When someone creates a password, sometimes they are concerned about how resistant the password is to being guessed by an attacker.  For instance, a one-letter password for your bank account is probably unacceptably weak and a computer-generated 40-letter password is probably more than acceptably strong.  These two example passwords are so extreme in weakness/strength, that we can make these judgments intuitively, but we will have to be more careful and systematic if we want to determine what sorts of passwords are acceptably strong and not excessively painful to type.

This blog post will focus on password strength in the context of offline attacks, which is where an attacker has hacked some service, obtained hashes of passwords, and can very quickly check password guesses on their own machines.  Offline attacks are a worst-case scenario for password strength, and it makes sense to have the worst-case decide what we consider acceptable password strength.

There are a few ways to think about how strong a password is: guesses-to-crack (GTC, basically entropy), time-to-crack (TTC), and money-to-crack (MTC).  "Crack" simply means "correctly guess".  Each way builds on the previous way.  Discussions of password strength usually focus on GTC and TTC, and only rarely go into MTC.  I think that MTC is far superior to TTC for most discussions about passwords, and I propose my own way of calculating MTC and plug in numbers for hardware available in 2020-Nov.

Interestingly, there's only a 15x-38x difference in costs between realistic upper bounds (AWS cloud computing) and unrealistic lower bounds (arbitrary number of GPUs with no overhead).

Reasonable Prioritizations Of Accounts

Scope And Purpose Of This Post

This post talks about reasonable prioritizations for putting your money into various accounts (401k, IRA, HSA, tax-normal brokerage, etc).  I will try to add on to what the Bogleheads wiki and /r/PersonalFinance wiki have already said on the matter.

Sections:

• A Baseline Ordering
• A Possible Ordering When Saving For A House
• Explanation Of Terms/Accounts
• Overall Reasoning Of Baseline Ordering
• How Does Employee Stock Purchase Plan (ESPP) Fit In?
• Why Traditional Over Roth?
• What About Saving For A House Or Something Else Before Retirement?
• Can I Eliminate My Emergency Fund?

A Baseline Ordering

Vanilla: exotic spice but default flavor.

To give you something notable right away, here is a reasonable ordering for putting money into various accounts if you are mostly looking to save for retirement or other long-term goals:

• Pay down high-interest debt.
• Build up an emergency fund (savings/checking account, able to cover 3-6 months of expenses).
• Max out ESPP contributions and sell shares immediately.
• Contribute to your Traditional 401k enough to get the full match from your employer.
• Max out HSA contributions.
• Max out Traditional 401k contributions.
• Max out Roth IRA contributions (and Mega Backdoor Roth contributions to your 401k if your 401k supports it).
  
• Contribute to a taxable (normal) account.

Note: this ordering also assumes that your 401k doesn't have ridiculously high fees and that you have too much income to be eligible for making tax-deductible contributions to a Traditional IRA.  Even if your income is too high to be eligible for contributing to a Roth IRA, you can make non-tax-deductible contributions to a Traditional IRA and then Roth-convert that money so that you end up with Roth IRA money.

I will explain the terms/accounts and reasoning in the sections below.

Some Ways To Think About Work, Savings, And Expenses

Scope And Purpose Of This Post

This post covers some new formulas that I came up with on my own that deal with a quantity (like the monetary value of your retirement portfolio) that experiences both exponential growth and regular contributions.  It is very unlikely I am the first to come up with these formulas, but it has been hard for me to find these formulas on the internet.  This post also covers some implications of these formulas, and some ways to think about the opportunity costs of savings and expenses, especially in terms of work until retirement.

Most notably, Example 5 tries to answer whether using a toll road increases or decreases the amount of time spent working/commuting until retirement.  The math/logic in the example can be used more generally to think about whether any expense is worth the extra work you must do to pay the expense.

You do not have to do any of the math yourself; you can make a copy of my Money Formula Demo Google Sheet and change some of the inputs.  To make a copy, go to the "File" menu at the top of the spreadsheet and select "Make a copy".

Misc Math

Scope And Purpose Of This Post

This post is a grab-bag of various math things that have been useful more than once in my life, and thus publishing them on my blog might help me and others in the future.

Pretty math pictures generated by Roger's Online Equation Editor.

Sections:

• Value Over Time With Growth And Contributions
• ESPP Returns
• Simple Regression Stuff
• Mental Squaring
• Chi Squared Distribution Test
• Distribution Approximations
• J-Family of Means

Steps to Buy an ETF at Fidelity

Purpose And Scope Of This Post

I want to help answer the question, "How, exactly, do I buy an ETF?  What buttons do I click?  What options do I choose?   What numbers do I enter, especially for things like quantity and limit price?".  There seems to be lots of written material about how to choose an ETF and the different types of buy orders, but very little written material that tries to answer the questions in quotes above.  The best I can find is stuff like the "ETF Best Trading Practices" section of this pdf from Vanguard, which still leaves things at the abstract level of "use a limit order that is likely to be executed instantly".

This post will go, click-by-click, through the process of transferring money into a Fidelity account and submitting a buy order for an ETF.  Hopefully, this click-by-click will help make people's first time easier and less scary (especially due to clear statements of which clicks have real-world consequences).  Also, this post will give the exact logic/calculations I use for coming up with the quantities and limit prices for my buy limit orders.  The logic/calculations for quantity and limit price are applicable at all brokerages, not just Fidelity.

If you are wondering what ETF to buy, see this long post or this short post.

2022-Jan update: Fidelity now has a quantity calculator, which helps with a lot of the calculations mentioned below.  Also, Fidelity now lets you buy fractional amounts of ETFs where you specify how many dollars you want to spend.  The "Explanation Of How We Calculate Desired Quantity And Limit Price" could use some updating..

Starting Point For Saving And Investing

Scope Of This Post

This post is not financial advice, and I refuse to take any responsibility for any financial ruin you experience.  Please do your own research and make your own conclusions.

This post is a list of resources I found useful and a few thoughts not present in those resources.  This post tries not to assume any knowledge of the world of saving and investing.  A lot of friends and acquaintances have questions like "how do I even start saving for retirement or a house?".  I hope this post will help those people see what their options are, and be able to evaluate those options...after reading a lot of stuff from different places.  This is just a starting point; there is so much more to be said.

If you want to yell at me "I DON'T WANT TO KNOW STUFF, JUST TELL ME A PORTFOLIO", then read the oversimplified conversations post, possibly followed up by the steps to buy an ETF post.

If you have questions like, "should I prioritize my 401k or my IRA?", then read Reasonable Prioritizations Of Accounts.

Also, be careful; there's a lot of very bad investment advice out there (ex: "These are the must-buy Chinese biotech stocks of 2018!").  I hope to provide a safe starting point for people to educate themselves, but you should read my words with a critical eye as well.

Sam Soundar Biweekly Newsletter (SSBN), Index and Explanation

Index of SSBN Materials

• Issue 1, 2014-05-06, Spring Cleaning Edition
• Issue 2, 2014-05-07, Nautical Edition
• Issue 3, 2014-05-28, Bitter Resentment Edition
• Issue 4, 2017-05-26, Candy Coated Edition
• Issue 5, 2017-11-14, Honest Mistake Edition
• Issue 6, 2017-12-01, Social Harmony Edition 
• Issue 7, 2018-03-07, Truly Desperate Effort Edition
• Issue 8, 2018-07-01, Use Scrollwheel To Zoom Edition

Steps to Set Up KeePass

Scope of this Post

The following instructions are for how to set up the KeePass password manager on your Windows PCs, iPhones, and Android devices.  This post also covers the one-time process of creating a password database and putting it in Google Drive.

If you are hoping to use KeePass on Linux or MacOS, I haven't done it myself, but you might have success using KeePassXC or one of the KeePass packages that has made it into Mac OS X and several Linux distribution software repositories.  See this page for download options.  Also, there's the option of running KeePass under Mono on your MacOSX/Linux system.

If you use the following steps, you'll be able to access your always-up-to-date password database from all of your devices that you've installed KeePass on.

This post assumes you are comfortable using KeePass Plugins and also browser plugins which make using KeePass extremely convenient.  Future posts will cover if you want to be paranoid and trust only KeePass itself and Google.

The most notable links, folder locations, and component names are bolded.

Note that the version of KeePass we'll be using is KeePass2, so don't be afraid when folders or apps talk about KeePass2.