Your password is like a key to your account, you need to safeguard it. Anyone who has your password can get into your account, and your files. Anyone who can guess your password has it. Anyone who has your password can pose as you.
There are a few basic parameters about strong password you’d take notice of.
Don’s use passwords that match any of the following:
- Words in any dictionary.
- Your user name.
- Your real name.
- Your spouse’s name.
- Anyone’s name (crackers don’t necessarily know that your aunt’s middle name is Agnes, but it’s easy enough to get a list of 100,000 names and try each one).
- Any word in any “cracking dictionary.” There are lists of words that crackers use to try to crack passwords: passwords that a lot of people use. Some of these lists include:
Abbreviations, Asteroids, Biology, Cartoons, Character Patterns, Machine names, famous names, female names, Bible, male names, Movies, Myths-legends, Number Patterns, Short Phrases, Places, Science Fiction, Shakespeare, Songs, Sports, Surnames
- Any of the above, with a single character before or after it (”8dinner”, “happy1”).
- Any of the above, capitalized (”cat” –> “Cat”)
-
Any of the above, reversed (”cat” –> “tac”), doubled (”cat” –> “catcat”) or mirrored (”cat” –> “cattac”).
- We used to tell people that taking a word and substituting some characters (a 0 (zero) for an o, or a 1 for an l) made a good password. This is no longer the case. New crackers have the capability to crack things like this, in certain situations.
- Words like “foobar”, “xyzzy” and “qwerty” are still just plain words. They are also popular passwords, and the crack programs look for them. Avoid them.
—
Basically it’s recommented to have a password that
- …is at least six characters long. This should be long enough to discourage a brute-force attack.
- …is a mix of lower- and upper-case characters, numbers, and punctuation marks.
—
A good trick for remember a strong password is the use of an uncommon phrase, and take the first, second or last letter of each word. “You can’t always get what you want” would yield “ycagwyw”.
The best passwords are those which are totally random to anyone else except you. It is difficult to tell you how to come up with these, but you’d be able to do it.
—
Generate a random password:
Automatic password generation tools available in debian are for example:
- APG (Automated Password Generator)
- pwgen generates random, meaningless but pronounceable passwords.
- Trigraph Password Generator generates pronounceable passwords.
My favorite tool is pwgen. It generates random, meaningless passwords but uses letter and number combinations that can be pronounced and memorized. Simply typing “pwgen” and hitting Enter will shoot back a screen full of passwords to choose from, helping to prevent shoulder-surfing sneaks, but you can easily hone down and customize the results with a few command-line switches.
—
A strong password is sufficiently long, random, or otherwise producible only by the user who chose it, such that successfully guessing it will require more time than the password cracker is willing to use guessing it. The length of time deemed to be too long will vary with the attacker, the attacker’s resources, the ease with which a password can be tried, and the value of the password to the attacker.
—
You can test your new password with Password Checker. Password Checker is a non-recording feature on this website that helps determine your password’s strength as you type.
—
What to do agains the attacker trying to crack your password using rainbow tables?
A rainbow table is a pre-computed table that greatly speeds up a search for a password with a given hash value. It is specific to one hash function, and usually restricted to passwords of a certain length and sometimes character set, e.g. alphanumeric passwords of up to 8 characters hashed by MD5.
Use passwords longer than those covered by commonly available tables.
Use characters not covered by commonly available tables.
Use a salt, which gives every installation or password a more or less unique hash function.
The salt is important because you often hear about community boards that have been cracked and all user passwords stored in the database are stolen.
For an example how to use md5 checksums with salt you’d consider this (in php):
<?php
function encryptPassword($password) {
$salt = 's+(_a*';
return md5($password.$salt);
}
?>
—
Do not type passwords on computers that you do not control if you aren’t pretty sure about the provided security. Computers such as those in Internet cafés, computer labs, shared systems, kiosk systems, conferences, and airport lounges.
Don’t take one and the same passwords for different matters. A big fault can be to register in a community with an email address and set the same password for the community login as for the email account. Obviously preventing this should be self-evident nevertheless I’m sure many people don’t even think about.
At least, the first and most important, always to keep in mind, rule is NEVER to give your password to anyone. You can have the strongest password ever which is useless if known by anyone.
—
What to do if your password is stolen?
Imagine the not desirable case that someone has stolen your password. After changing it you be sure to monitor all the information you protect with your passwords, such as your monthly financial statements, credit reports, online shopping accounts, and so on.
A Terabyte of RAM - Why not?
