Tuesday 1 October 2019

2017-07 Why "password" isn't...


How to choose (design) a good password 

A good password is more than just some obscure word or a random combination of characters. Modern password cracking software can easily break passwords in a surprisingly short time. Any password shorter than 12 characters is fair game and even longer passwords can fall if not constructed correctly.

So what is the procedure to construct a fairly safe password. To do this we need to bring in some thought as to what a password is and how it is used.

Your password(s) are the key to your personal data, you business reputation (as far as your website and email is concerned) and sometimes, even some financial transactions. Making a long, complex password can also be counter-productive if you need to write it down or save it somewhere just to remember it.
Password policies which force you to change your password every week or month can also end up being counter-productive, as this only encourages people to either write down the current password, or make their passwords "easy" so that they can remember them.

The following method can assist in negating both the previous issues and still give you a secure password that is not hard to remember (for you).


The Method

1. Choose a phrase of between 12 and 20 characters. Remember, windows based systems can often not take passwords longer than 16 characters, so keep that in mind. Start with ALL lowercase.
My sample phrase is:

i like feeding cats  = 16 characters

2. Change every 2nd word to start with a capital letter, starting from the first or the second word, as you like. I will start from the second word.

i Like feeding Cats

3. Substitute numbers for similar looking letters ( i -> 1, o -> 0, e -> 3 )
Make your own rules here, for example, I will substitute only ever second occurence, thus

i L1ke f3eding Cats

4. Substitute less used characters for similar looking characters ( s -> $, a -> @, etc)

i L1ke f3eding C@t$

5. Remove all spaces:

iL1kef3edingC@t$

6. If you can, add a random non-regular character to the start or end:

#iL1kef3edingC@t$


Now you have a strong password !