Making passwords secure…

In the first OnMouseClick of 2008 I wrote about the importance of using unique passwords for all of your password protected online accounts. This is easier said than done. First you have to think of secure passwords to use, and then you have to remember what they are. If you followed my suggestion to create a book containing all of your relevant computer information, the second part is easy. Creating the passwords themselves can present more of a problem.

Anyone who watches television or goes to the movies has seen characters attempting to “crack” the password of an encrypted file, and nine times out of ten they are successful. While in real-life the process is generally more complex, too many of us use passwords that can easily be discovered by a third party.

While doing online research for this column, I happened upon a 2006 study done at Witchita State University titled “Password Security: What Users Know and What They Actually Do.” In the study three hundred and fifteen students were asked to complete a 101-question “Password Practices Survey.” A quick review of the survey results showed that over 75% of the respondents reported using either the same, or a variation of the same password for multiple websites. Over one-half of the survey takers use personally meaningful words or numbers for their passwords, and only about 15% write down a list of passwords in case the password is lost or forgotten.

Included as a part of the survey were questions about password practices that should be followed to insure a high level of password security.
1. Passwords should not include personally meaningful words or numbers (such as pets’ names, birthdays, anniversaries, etc.).
2. Passwords should have seven or more characters.
3. Passwords should use a combination of both upper and lowercase letters, numbers and punctuation or special characters (ie: &, $, #, {, ? etc.).
4. Unique passwords should be used for each account.
5. Passwords should be changed every three to six months.
While a majority of the respondents agreed that these “best practices” should be followed, only a small percentage of them actually reported following them.

The survey concluded that most of the respondents “...reported password generation practices that are simplistic and hence very insecure.” (To read the full report, which is only one web page long, go to http://psychology.wichita.edu/surl/usabilitynews/81/Passwords.htm.)

The best practices listed above provide some guidelines to use when creating and maintaining passwords. The difficult part is generating secure passwords in the first place. If you take your family and pet names out of the mix, and you cannot use personally significant numbers, what do you do?

One solution is to make up a sentence that has relevance to the account you are creating. Use the first letter of each word in the sentence, and you have the basis of your new password. To make the password more secure, add a couple of numbers, punctuation marks and/or special characters and you have a unique password that will be difficult to breach.

As an example, let us suppose you need to create a password for your online banking account. You might come up with the phrase “Our First National Bank of Anywhere personal banking account.” Take the first letter of each word and you have OFNBOAPBA. Next, you could substitute a punctuation mark or special character for every instance of a letter that repeats more than once, in this case the letter A, giving us OFNBO!PB&. Finally add one or more random numbers somewhere in the mix, OFNB742O!PB&, and you have a password that will be much more secure than using your son’s birthday or your pet’s name.

And for anyone who attended my presentation on working with FLICKR web galleries at the Monday, January 21 computer club meeting, a “how to” PDF file is available online at www.digitalquinn.com/howtoflickr/.