So how many user accounts and passwords do you have? How many passwords do you need to remember for access to your various work and personal related systems?…
The advent of Web 2.0 and the rise of social networking sites and other web services has compelled most of us to create dozens of new online accounts – each requiring a username and a password.
Let’s face it… trying to manage various user ids and passwords can often be a frustrating & sometimes time consuming thing to do. This article looks at some of the common scenarios, related issues & pitfalls, and some tips to help you better manage your passwords.
Not yet another user id & password?!
Many of us have access to multiple systems be it work related, or personal ones such as our online banking & personal finance sites. As an example, just being an employee at a regular sized company means that you already have a wide range of user accounts and passwords you need to remember and use. There’s your network domain account, email account, time tracking systems, expense systems, HR systems, training systems…. the list goes on and on.
Add to that – your list of personal user accounts and passwords for sites such as LinkedIn, Facebook, Twitter, etc, and you’ve probably got anywhere between 10 to 30 or more user ids and passwords to remember.
Some you may not use very often, and some you might use every day, however in order to successfully gain access to all of these various online systems, you need to use and remember a variety of user accounts and passwords. Add to this a mix of different password complexity requirements, password lengths, lockouts and expiry dates, and we have a fairly complex situation.
Why Can’t I Just Use a short & easy to remember word?
Meet your opponent – the cracker…
These bad guys are basically people who use the method of employing various techniques and tools to guess, methodically determine, or otherwise obtain a password to gain unauthorised access to a protected resource. Password cracking was once a very specialised skill, however thanks to tools such as L0phtcrack,or other utilities which can be easily obtained and used to crack office document passwords & Windows operating system passwords, it’s child’s play to do.
Without going into too much detail, these tools use dictionary or brute force guessing to work out what your password is. These days, the tool can do this very quickly, especially if you are using dictionary words – hence why you should avoid using dictionary words, and incorporating symbols and numbers into your passwords. There are many other ways of breaking someone’s password, such as defeating the secret questions and answers as in the Palin example, and lots of ways to help protect against these forms of attack, however let’s park this topic for now, and get back on track to the topic of passwords.
The not so secure things to do with your passwords
To simplify the laborious task of remembering our various passwords to different work & personal systems, people often make use of less than secure practices, and do one or more of the following:
Write down their user ids and passwords insecurely. i.e. write down each user id and password on an A4 piece of paper or a single post-it note, and then store this next to the monitor, in their top draw, or within easy arms reach somewhere on their desk. The pieces of paper are often very very easy to find. In a similar way, some people store their user IDs and passwords within text files, or word / excel documents and keep these files on their laptop or desktop’s local hard drive – not quite as bad as handwritten password notes, but again is not very secure.
Use the same password or small handful of passwords across multiple systems. Some people use the same password for their various work systems, but also use the exact same password for their personal accounts such as Gmail, Facebook, Linkedin, banking site, and other online systems. The problem with using the same password for everything is that if it’s compromised and someone finds it, the rest of your identity and system access is at risk. Not a good situation.
For example if you accidentally disclosed your Gmail password or it was compromised, and you use the same login & password details for other online accounts, such as your Amazon shopping account or worse still your online banking account, thieves could potentially gain access to all of your financial information, & personal information.
Making Password Management Easier
There are a variety of ways to help us remember passwords. There are various point solutions available on the internet (such as Keepass & Roboform) which are software solutions for password management, however for now, below are some quick and simple tips relating to passwords, which will hopefully help you create and manage your passwords helping you make them easier to remember without needing to write or store them.
Remembering all your unique passwords with some “generation logic”!
Coming up with a password when setting yourself up with access to a new system, which is both easy to remember and safe – is no easy task. However, you don’t need to remember 100 strong passwords if you have one piece of logic for generating them in the first place.
One way to generate unique passwords is to choose a “master” or “base” strong password, and then apply a piece of logic or rule that mashes it in some form with the service name or web site address you are using:
So it would look something like this:
{your base password} & {sitenamelogic}
For example, say your base password was the following:
M3and&{sitenamerule}
And then the rest of the password could be the first two consonants and first two vowels of the service name you are using, and the month backwards.
So with this particular password rule for example, the Yahoo email password using the above bass password and the yahoo account would be:
M3and&yhao40
And for eBay would be:
M3and&byea40
Before you decide on your single base password generation rule, keep in mind that while password requirements are different for each service in terms of length and characters allowed and required, a good guideline is a password at least 8 characters long that includes both letters and numbers. To make a password even more secure – or applicable for services that require special characters – add them around it, like @M3and&byea40!
Here’s some additional password memory tips:
Try one or all of these different techniques below to create a secure but memorable password. Note, one problem with rules-based passwords is that some sites have their own password requirements that conflict with your established password, such as “no special characters” or “at least 12 characters in length” or “all numbers/numbers and letters/just alphabetical.” In those cases, somehow you have to remember the exception to your rule for those services:
Use a favorite Song or Phrase
Use the first letters of a favorite phrase or song lyric. For example, if you wanted to use lyrics “It’s a beautiful day” from the the U2 song “A Beautiful Day”, your base password might be “Iabd.” Remembering the password is a matter of humming the song. Then combine this base with some extra information unique to the service you are logging in to.
Connect the first letters
Develop a password using the first letters of a sentence or phrase that means something to you – like your national anthem or a slogan you have seen somewhere. ‘Where the Bloody Hell are you!?’ would become “WtBHay!?”.
Pass Phrases
Length can be a huge advantage to memorisation. If your typing is accurate, consider large phrases from a favorite book. Phrases are easy to memorise and can be combined with some easy to remember symbols and / or numbers:
“It was A dark and stormy night! ”
“Houston, we have @ problem!2″
The length of a pass phrase has several advantages:
• The length can provide security even if special symbols are not used. This can help with sites that prevent the use of symbols.
• Make good use of punctuation and capitalization to make a secure pass phrase that complies with common password rules.
• When coming up with a mnemonic sentence, try and make the sentence funny or relevant to yourself. That way you will find it easier to remember the sentence, so you can remember the password.
You might combine several of these methods and still come up with a truly memorable yet very strong pass phrase. You might use a favorite quotation, song lyric, or the advertising slogan you despise most (preferably six words long or more) and create an acronym by using the first letter of each word (Where Would You Like To Go Today = wwyltgt).
The Most Secure P@55w0rd5!
The most secure passwords contain lowercase letters, capital letters, numbers, AND symbols. This sounds painful, however using the above methods can help make all of your passwords more secure, but easy to remember.
Use one of the above methods to create a password with both letters and numbers, and then hold down the shift key while typing part of it. This helps to create special characters. For example, make a standard of holding down shift for the first four characters, or characters three through seven, or whatever you like. You won’t have to stop and remember where you inserted that pesky exclamation point or whether you replaced the ’s’ with ‘5′ or ‘$’ this time.
Additional Password Tips:
• Avoid using the same password for several logins, especially if they involve sensitive financial or other personal information.
• When registering new accounts on websites that ask for your email address, never use the same password as you do for your email account.
• Don’t use common words or dictionary words as your password. These are easy to guess or break with automated password cracking tools.
• When using numbers only, make sure the sequence is completely random and has no importance. It’s best not to use any number that is a matter of record, such as a publically known phone numbers or a date of birth.
• Do not simply combine two or more dictionary words even if you think they are rare. Many password crackers try combinations of dictionary words first.
The Future of The Password
This is unfortunately only the tip of the iceberg when it comes to this topic. There are a variety of other issues and considerations when it comes to passwords.
The main point to this article however is to provide you with some easy and cost effective ways of creating and remembering your various passwords.
From here onwards however, the future of the password is an interesting one, and is something which is frequently debated. There are a variety of centralised Single Sign On & Simplified Password solutions out there today, as well as other means of confirming someone’s identity, such as biometrics, voice analysis, and token based authentication options.
There are also a variety of solutions out there which when combined with other security measures help to protect systems and their users (such as “Captcha” & secondary authentication token solutions), however again these are not 100% bullet proof and can still be compromised.
Over the next couple of years, authentication solutions will mature further, and will become a part of a longer term Identity Management Strategy which many enterprises will adopt.
For now, try some of the above tips to help you create stronger but easier to remember passwords.
