How to Make Good Passwords

A good password is a password that are hard to guess, but at the same time fairly easy to remember. It should contain both uppercase and lowercase letters, mixed with numbers and/or common special characters.

One way to do this is to use a phrase, slogan or a song lyric. One which is easy to remember, but the point is, you don't use the phrase itself but rather the first letter in every word. Example: 'When I Find Myself In Times Of Trouble!' could becomes W1fm1t0t! replacing I with 1s and O with 0s. When you type the password you just think of the song, typing every first letter of your password.

Another way to make a good password is to combine a few pronounceable 'nonsense' words with special characters in or between them. Example: 'Ax!Sp4tt' or 'M1c0#C0Z'. As long as there words are not in any dictionary you would be all good.

Yet another way to do this is to take two words from the dictionary, each should have minimum 3-4 letters. Then, reverse them and use a mix of numbers and case settings on them. Example: take the word 'muggle' and 'hex' reversed they become 'xehleggum' -> 'X3h3!gguM' is a password you should be able to remember. Password crackers might still try to reverse dictionary words, so make sure it isn't just one plain word you've reversed.

1. Avoid using dictionary words!

   Avoid using words that are likely to appear in any dictionary. And by any I mean any dictionary word, name, date, number in any dictionary whether foreign, medical, technical, dictionaries of names, jargons, from movies or any other. One common way for attackers to guess passwords is by trying every combination of words from these dictionaries, adding numbers and other characters in front, behind and in the middle.

2. Avoid using misspellings of dictionary words!

   Quite a few of the cracker dictionaries has these common misspellings and the programs also permutates the dictionary words, stuffing them with numbers and other characters.

3. Avoid using sample or default passwords!

   Like the ones used on this or any other page.

4. Avoid using special characters!

   Some systems might have problem with these, and key layout might be different on different systems. So avoid using any uncommon character like norwegian ones, euro symbol and so on, as they'll often not work.

These days it sometimes seems like you can't do much on the Internet without being asked for your password and with the growing number of password is it getting harder and harder to maintain and remember them all. There are a few ways to make this easier, one is to make a hierarchy where the level 1 password is the most sensitive one, then it goes down to less sensitive and ends up with useless web forum registrations and similar things.

There are quite a few password management programs out there, and although you might use them to store webforum access passwords, do not use these to store your university, email or other sensitive passwords. I emphasise this because crackers love fast university networks with unseemingly unlimited bandwidth and mass storage, and if they get a hold of one account they can use it as a launchpad for an attack on the rest of our systems.

1. Never share your password!

   This is also stated in the guidelines for use of University computer equipment. The consequences of you sharing your password or someone stealing it, could involve criminal activities performed in your name. Don't even tell your favorite sysadmin or the helpdesk your password, because we will never need it.

2. Never write down a password!

   There are exceptions to this, as when you have just made a new password and you need time to learn it. In such cases, keep the note safe and hidden, and preferably write it in an obscure way. I.e. using your own private encryption scheme (write it in diagonal, inserting letters, write numbers instead of letters, etc.)

3. Change your password often!

   All depending on how much you are using your password, you should change it quite often. The more frequently you use your account, the more likely it is that someone might steal it. Everyone should change their password atleast once a year.

4. Use different passwords!

   Don't use the same password on our systems as the ones you use on webforums and webmail systems outside the university. Ideally all your passwords should be different, but then there would usually be to many and you would start forgetting the ones less used. The solution to this is to make up a hierarchical system where the less sensitive passwords are the same. Like if you are registered to different webforums you rarely use, you can have the same passwords for all of them.

5. Never store your password in a program!

   With the way e-mail clients and webbrowsers work these days, many ask whether you want to store the password for later use. Don't, as it usually means that the password is stored on your computer with a weak encryption or none at all and viruses or crackers can use this to spread their mischief further.

All in all, making and maintaining password isn't a matter you should take lightly. If you let people use your identity on the Internet, then you may become exposed to the consequences of their actions. There has been incidents where people has used this knowledge to exact revenge, commit fraud and other criminal acts.