Sunday, April 13, 2014

Creating Secure Passwords

Here are some fascinating statistics concerning user's passwords according to xato.net:
  • 4.7% of users have the password password;
  • 8.5% have the passwords password or 123456;
  • 9.8% have the passwords password, 123456 or 12345678;
  • 14% have a password from the top 10 passwords
  • 40% have a password from the top 100 passwords
  • 79% have a password from the top 500 passwords
  • 91% have a password from the top 1000 passwords
With frightening statistics like that, there are a plethora of recommendations concerning creating safe passwords. While I can't list them all, here are a few general rules concerning what I feel are some of the most important things to consider when creating a password.

1. Don't do the Obvious:
How tempted have you been to use your own name, your child's name, your birthday, your username, "password", or "1234" as your password? Don't. Just don't. These are among the first passwords hackers try. I can't tell you how many computers and phones of friends and family I have been able to get into just by guessing combinations of the things above. With so much personal information available on social websites, such as Facebook, you should never assume that people won't know information like the things listed above.

2. Don't Write Your Passwords Down in an Unsecured Location: 
I can't tell you how many times I've been at work, helping someone with his or her computer, and seen the person's username and password on a post-it note stuck to his or her monitor. Never assume that no one will look for your password in your desk drawer or in your notebook. It's best to use a password you can remember without ever writing it down.

3. Use Unique Passwords for Each Sensitive Site:
If a hacker does crack one of your passwords, one of the first things they'll likely try to do is try that same password with your username on a site where they can really do some damage--like a banking website, or Amazon.com. That's why it is very important to use unique passwords on each sensitive site. Your password for Amazon.com should be different from your other websites--same with your banking website. I know that you'll be tempted to use the same password for everything because it will be much easier to remember, but the more unique passwords you use across each of your online accounts, the better protected you will be.

4. Don't Use Passwords Found in the Dictionary:
Attacks by hackers known as "dictionary attacks" are becoming more and more common. The idea behind these attacks is for hackers to try using words found in the dictionary to hack into user accounts since these are the words users most often use for passwords. To combat against these attacks, users should try using combinations of words or throwing random characters in the middle of words for their passwords. I've also heard the recommendation of using the line from a Hymn as your password. This makes the password easy to remember and provides a nice reminder of a Gospel message each time you log in to your account. Phrases can also be used a good passwords. For example, the phrase "We believe in God the Eternal Father, and in His Son, Jesus Christ, and in the Holy Ghost" would translate into the password, "WbiGtEF,aiHS,JC,aitHG." While that password may be a little bit long, using the first letters of a slightly shorter phrase will be easy for you to remember and very difficult for a computer to guess. Just make sure to use a password that is AT LEAST 8 characters long.

If you are interested in seeing just how secure your password is, try putting something similar to it into the following website (I don't recommend using your actual password, as you never know if that information could be intercepted somehow, but typing in a password with the same combination of characters, letters, and special characters as your own password should yield a similar result for how secure it is). This site will tell you approximately how long it would take for a computer to guess your password:

https://howsecureismypassword.net/