Saturday, August 1, 2009

how to choose secure passwords

"I need to change the password on my email account. Someone managed to figure out the old one."
"That's why your password should always include numbers as well as letters. Everyone thinks its fun to use the name of your dog or boyfriend, but that actually makes it easy to crack."
"My old password was Gj7B!X."
Greetings from a former RCC. This post exists because a friend fell for phishing, and it worked due to universal password usage. Universal passwords are bad, bad, bad. *finger wagging*

Guidelines for password selection:
  • use at least one number and one letter.
  • use both upper and lower case letters if possible.
  • also use at least one special character or punctuation mark (if permitted).
  • be at least seven characters long.
  • do NOT use dictionary words (especially in English), names of people/pets, addresses, birthdays, SSN's, driver's license #'s, passport #'s, variations of your usernames/aliases, or phone numbers. or for that matter, fundamental constants (e, pi, the speed of light, square root of 2, sequences of perfect numbers, fibonacci sequence, or if you do choose one of the irrationals, don't start in the first five digits or so)
  • do NOT use patterns on the keyboard (i.e., qwerty, ;lkjh, or 2468)
  • And change your passwords every three months.

You might ask: how the hell am I supposed to memorize a unique something like Q34jp$s! for every account I have? and change it every three months?! Who do you think I am?  River Tam?  Veronica Mars?

Actually, it's easy. Pick a novel, movie, or a book of poems. Pick a page/passage/quote at pseudo-random. Pick a sentence with a number in it. use the first character of each letter, preserve punctuation, use actual numbers to represent the numbers or constructions like "some1" If you're really desperate for numbers.  (Okay, fine, you can take every prime-th decimal digit of pi.  I'll allow you that.)

Now you have secure passwords. Remember, passwords are like underwear. Change often, don't share.

Current music: Slow Runner - Make you love me

1 comment:

  1. How the hell am I supposed to pick a novel or book that isn't going to end up in a database, feeding a Computer rules for the algorithm it's writing just to break my carefully constructed code? How convenient -- it seeks "all human sentences with numbers" from its database (Google) and applies the rules you just gave, and I'm out one secure password. Nice try. Let me guess: the Computer got to you?