How do you
choose a good password?
Most people use
passwords that are based on personal information and
are easy to remember. However, that also makes it easier for an
attacker to guess or "crack" them. Consider a four-digit PIN
number. Is yours a combination of the month, day, or year of your
birthday? Or the last four digits of your social security number? Or
your address or phone number? Think about how easily it is to find
this information out about somebody. What about your email
password—is it a word that can be found in the dictionary? If
so, it
may be susceptible to "dictionary" attacks, which attempt to guess
passwords based on words in the dictionary.
Although
intentionally misspelling a word ("daytt" instead of
"date") may offer some protection against dictionary attacks, an even
better method is to rely on a series of words and use memory
techniques, or mnemonics, to help you remember how to decode it. For
example, instead of the password "hoops," use "IlTpbb" for "[I] [l]ike
[T]o [p]lay [b]asket[b]all." Using both lowercase and capital letters
adds another layer of obscurity. Your best defense, though, is to use
a combination of numbers, special characters, and both lowercase and
capital letters. Change the same example we used above to "Il!2pBb."
and see how much more complicated it has become just by adding numbers
and special characters.
Don't assume
that now that you've developed a strong password you
should use it for every system or program you log into. If an attacker
does guess it, he would have access to all of your accounts. You
should use these techniques to develop unique passwords for each of
your accounts.
Here is a
review of tactics to use when choosing a password:
- Don't use
passwords that are based on personal information that can be easily
accessed or guessed
- Don't use words that can be found in any dictionary of any
language
- Develop a mnemonic for remembering complex passwords
- Use both lowercase and capital letters
- Use a combination of letters, numbers, and special
characters
- Use different passwords on different systems
