Best practices for passwords
1. Use a strong password.
What is a strong password?
A strong password is a minimum of 10 characters and is much stronger if you use 20 or more. The best passwords use completely meaningless random lower case, upper case, numeric and punctuation characters and never contain a real, meaningful word in any language.
2. Make your password memorable.
This seems to be in conflict with point 1! How can a password be memorable if it is completely random characters? One trick is to think of a phrase or sentence that is unique to you and then take the first letter of each word.
For example “My first child is called Jane she was born in January it was a short labour”. Taking the first letter of each word gives us “mfcicjswbijiwasl”. We should try and mix upper and lower case so let’s have every other letter upper case: “mFcIcJsWbIjIwAsL”.
We need some numbers in there so lets put the day of the month either side of the letters. She was born on the 15th of the month so our password now becomes: “1mFcIcJsWbIjIwAsL5″. All that is left is some special characters. These are ones such as !”£$%^&*()_{}:?><., you could always swap certain letters for a special character so instead of having any letter “s” in the word we could swap this with “$”.
Another trick is to surround the password with certain characters such as “{” and “}”. If we do this, our password now becomes:
“{1mFcIcJ$WbIjIwA$L5}” – a 20 character password including upper case, lower case, numerical and special characters in it. This is a very string password, cannot be determined from a dictionary (a popular way of attempting to break passwords) is difficult to remember unless you know the phrase (which only you do) and all from: “My first child is called Jane she was born in January we had awful weather”!
3. Do not use the same password.
Using the same password on multiple sites, for banking, your website and your email is potentially asking for trouble. If you password is compromised hackers will attempt to try you password on other systems just to see if you use the same one. They know many people do so it is worth a shot to them.
4. Do not store passwords.
Although tempting, never store passwords in a software system. Well know hacks have involved gaining access to the passwords stored in FTP programs users use to upload their websites. Some web browsers are not known for storing passwords very securely and if your machine is compromised or worse lost or stolen the next user could have all your details waiting to go with no guessing or hacking required!
5. Keep your user id safe.
This is very similar to your password. Many sites require you to create a user id for using their services. Keep changing your user id from site to site then it is something else needed to get into you account.
6. Never share your password.
Never ever share your password. Are the person’s intentions honest? Even if you trust the person has THEIR machine been compromised allowing hackers to obtain the password to your system? If you can keep to a password that is derived from a phrase known to you there should be no need to write the password down. Doing so weakens the strength of the password. The number of times I have seen a password written down on a post it note and fixed to the computer monitor!
7. Never respond with your password in an email or any request for it i.e. over the telephone.
Email “phishing” scams use fraudulent messages to entice you to reveal your user name and password. They can also be used in order to steal your identity and more. Reputable companies will never ask you to reveal your password over the phone and will normally have a secure procedure for resetting your password.
8. Do not enter your passwords on computers you cannot trust.
Computers open to the general public have to be considered unsafe. Do you know there is no key logging device attached to the system? Is there virus and internet security up to scratch? Computer terminals in internet cafes, computer labs, conference centres, airport lounges and hotels may be convenient but could compromise your security.
