how to:How To Create Strong Passwords and Passphrases

Posted by Brannon Cullum in Stay Safe and Anonymous Online
originally posted on October 06, 2010

You probably use multiple passwords online on a daily basis - to check your email, to log into Facebook account, to access your banking account. But is your password strong enough to withstand a breach? Using a weak password is one of the easiest ways to make yourself and your accounts vulnerable online.

As a BBC article notes, “The majority of passwords people use adopt generic, often easy to detect patterns. Knowing a bit of detail about someone, such as names of family and friends, favourite books and films, and where the individual lives, can often offer enough clues to successfully guess someone's password.”

Password cracking, the process of running computer programs against an encrypted password in order to reveal it, is easier than you think. Programs that run every word in a dictionary or word list against a user name are also common.

One of the simplest steps you can take to boost your online security is by using strong passwords. Better yet, you should be using passphrasesPassphrases are very similar to passwords, but are usually much longer and more complex. While a password may be six to ten characters, a passphrase is usually at least twenty to thirty characters in length.

Share

Step 1.

The first step in creating strong passwords is to know what weak passwords look like.  A weak password uses personal information, like your name, birthday, family member’s names, or a pet’s name. These types of passwords can easily be guessed by someone who knows you.

Step 2.

Learn what makes a password strong. A strong password is more secure and harder to break because it is original, complex and random. A strong password is also long, containing at least 7 to 14 characters, and has a variety of characters, including:

  • UPPERCASE letters A-Z
  • lowercase letters: a-z
  • Numbers: 0-9
  • Symbols: ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

Step 3.

Come up with your strong password. First, think of a word or sentence that comes to mind - it can be something completely random. Then change some of the letters to upper case and add in numbers, symbols and punctuation randomly (not just at the end of the phrase). It’s also a good idea to substitute a number or symbol for a letter, such as using 3 for E.
For example, the song title “All You Need Is Love” becomes “ALuN##d57\./!”

Step 4.

Check the strength of your password on this Microsoft test site. Type in your password and the bar below the text box will illuminate with the password’s strength. Your password should reach "Medium" strength at a minimum. Keep tweaking your password until it's strong enough.

Step 5.

To be extra secure, use a passphrase rather than a password. A passphrase is much longer--usually at least 20 characters. The easiest way to create a strong passphrase is to take a phrase and then distort it. Switch words around to make it nonsensical, replace letters with numbers and symbols, and use a mix of upper and lower case letters. Also take the time to learn how to use Diceware to create a strong passphrase.

For example, Mark Swearingen explains how he came up with the passphrase: %1943oRAnge\4sa7ya{Abe}

“The above might be an effective and easy-to-remember passphrase for someone named Samuel Abraham, who was born (or married, or discharged from the military) in 1943, whose favorite color is orange, who has a wife named Yolanda, has four children, and whose favorite number is 7. The passphrase contains the initials "sa" and "ya" as well as an abbreviated form of Sam's last name. The word "orange" is embedded within the passphrase, but the mixed case makes it less vulnerable to a 'dictionary attack.'”

Step 6.

Can’t come up with something original? Worried your password isn’t strong enough? Try using an automatic strong password generator like this one. There are a variety of password generators out there - just Google and play around with them until you find one you like.

Step 7.

Is it safe to use the same password for a variety of sites? No. While it’s easier to use the same password on different sites, it leaves you more vulnerable. It’s best to use different passwords for different sites.

Step 8.

The problem with stronger passwords is that they are harder to recall. So what’s the best way to remember them? Obviously, recalling passwords by memory is your safest bet. If your don’t believe you’ll be able to remember them, write your passwords down and keep them stored in a safe place. Never store your passwords in a computer file.

Step 9.

Other helpful tips:

  • If your password is compromised, change it immediately.
  • Never send your password to anyone over email.
  • Don’t share your passwords with other people.
  • Change your passwords every 3-6 months.
  • Try to avoid typing in your password on a public computer.
  • If you use Firefox for browsing, set up a master password.

 

Share

Share Your Lessons Learned and Suggestions!

blog comments powered by Disqus