The Art of Creating Strong Passwords
By Michael Scalisi, PC World
When it comes to password strength, educating users is just as important as enforcing policies.
Left to their own devices, people will choose passwords that are simple for them to remember. They'll use their spouse's name, their dog's name, their favorite sports team or a recent vacation spot.
Sometimes while working on a user's computer, I'll need to log on as that person after a reboot. Unfortunately, he's wandered off, not wanting to hover over the IT guy. I generally prefer not to know other people's passwords, so I usually don't ask. In this situation, I sometimes take a guess. I've been right a surprising number of times, and sometimes with people who are very powerful. It's easy. I simply glance around their offices and note what their obsessions are.
Clearly, password policies are needed.
By using the following tips, people will be able to create easy-to-remember passwords that follow these typical requirements: at least eight characters long and with at least three of the following character types: uppercase letters, lowercase letters, numbers and special characters.
- Substitute numbers for letters and vice versa. (o instead of 0, 4 instead of A, 1 instead of L, E instead of 3)
- Substitute words for numbers (one, two, three ... )
- Combine both of the above (0ne, thr33, f1ve)
- Use capitalization in random places (bLue, happY)
- Use special characters ( !@#$%^&*(){}[] ) to punctuate and separate words
- Create passwords out of words, numbers or phrases you'll remember
- Misspell words
Using these tips, you can create memorable passwords that will be nearly impossible to guess. Here are some examples of converting memorable information into a complex password
We'll start with some easy ones:
- Friday becomes frYday!
- Robert becomes #robERt#
- 867-5309 becomes 8siX753o9
More complex passwords:
- 19 Peach Place becomes: 0ne9peacHpl!
- I love Jill becomes: eYelov3Jill
- My dog Fritz becomes MeyedogfrltZ
While some of these examples look nearly indecipherable, you can see how they're not difficult to memorize -- as long as you know the originating word, number or phrase and the basic methodology used to create it. By educating users on how to create strong passwords, you strengthen the security of your company, and your users will benefit additionally by have safer personal experiences with online banking and social networking.
Michael Scalisi is an IT manager based in Alameda, Calif.
