IT | Security

Choosing a Strong Password

By: Absolute Team | 12/4/2008

Passwords are a huge security issue for businesses. Though the most common password used in a 2007 survey was "password", not much has improved. In 2008, the most common password is now "password1".

Bruce Schneier put together a good article for The Guardian about choosing a strong password. In order to describe what makes a "good" password, Schneier describes how programs are used to hack passwords. These programs are sophisticated, testing hundreds of thousands of passwords per second in an intelligent pattern.

The password-hacking programs will try the most likely passwords first, then will move on to typical password combinations of root+appendage (or prefix). Something like "nachos123", for example. There are common number and letter sequences that people use to prefix or suffix common words. 24% of all passwords can be cracked with the first 100,000 combinations of these options. The password program will try different dictionaries, will replace letters with common symbols such as "@" for "a", etc. Running all of these combinations, which could take weeks, will break two thirds of all passwords.

If the hacking program is fed personal information about you, like the name of a pet, birth date, or postal code, the effectiveness shoots straight up. If you save your password anywhere on your computer memory, including browser-recalled passwords, it can track them down.

How Should You Choose a Good Password?

Bruce Schneier recommends a password creation process that will turn a sentence into a password. His example was:

"This little piggy went to market" ===> "tlpWENT2m"

This way, you choose a sentence that is meaningful to you, and also choose your own method of code to break it down into a more secure character string. Once you have a password, don't write it anywhere or use it for multiple applications. If you fear you won't recall your password, write it down and keep it somewhere more secure, like in your wallet. If you can avoid writing the exact password, write the un-abbreviated sentence or a hint instead. You can also use a program such as Password Safe (free) to create an encrypted username / password list and a single Master Password.