30

Given the recent events with a 'hacker' learning and retrying passwords from website administrators, what can we suggest to everyone about best practices when it comes to passwords?

  • use unique passwords between sites (i.e. never re-use a password)
  • words found in the dictionary are to be avoided
  • consider using words or phrases from a non-English language
  • use pass phrases and use the first letter of each word
  • l33tifying doesn't help very much

Please suggest more!

3
  • 4
    Tip three contradicts tip two.
    – Oddmund
    May 11, 2009 at 5:05
  • @Oddmund: Not if you use both English and non-English. I.e. One in spanish is uno, so use OneUno. Or word-split: half of the word comes from English, the other half from another language. Soccer in spanish is fútbol, so use futball. And then recurse from there.
    – Kevin M
    Jul 13, 2009 at 18:47
  • @Oddmund: No. Using words from a (non-english) language does not imply they are to be found in a (non-english) dictionary Apr 19, 2013 at 14:58

22 Answers 22

25
  • Use passwords that are not composed of common words or names. Dictionary attacks use dictionaries with millions of words and are very quick.

  • Use long passwords. I tend to use passphrases. I pick a phrase, sentence or rhyme and find some way to use a fair number of non alpha-numeric characters so that my words are not dictionary words.

  • Do not use the same password for multiple login services. Take some time to come up with a formula for picking passphrases. This allows you to use many different passwords that, if forgotten, you may be able to recreate with some trial and error.

  • If you have to, by all means write a good, long, secure password down and hide it somewhere. That at least is better than using a weak password that is easier to remember.

  • If the above suggestions prove unmanageable, use a password manager with a long secure password and then use random character passwords for everything else. Carry the password manager around with you on an encrypted USB flash drive (backed up of course).

6
  • Does anyone know why my use of bold in 'passphrases' doesn't seem to work? It looks fine in the preview when I'm in edit mode.. odd. May 7, 2009 at 4:28
  • are you using two stars, or one? Try just one...
    – Mikeage
    May 7, 2009 at 6:08
  • 1
    @Mikeage: one asterisk = italic; two = bold. I'd suggest trying <b> or <strong>; I suspect embedding it in a word is confusing SO's parser.
    – derobert
    May 7, 2009 at 16:19
  • 1
    I would try to put a space right after "pass" so you'd have pass[one space][asterisk][asterisk]phrases. If that doesn't work, try to put a space between the second batch of asterisks and the period.
    – pbz
    May 7, 2009 at 17:03
  • 3
    +1 to "write a good, long, secure password down and hide it". In the 1980s, somebody began warning users to NOT write their passwords down, that behavior stuck, and we are all worse off because of it.
    – Portman
    May 8, 2009 at 13:40
7

I have found several problems with passphrases:

  • Many sites have upper limit to password length - like 20 chars - it's silly, but what can you do.
  • Other sites don't allow spaces in passwords.
  • Typing long texts blindly is error-prone - especially when you're not good touch-typist.
  • Typing 50-char passphrase takes quite a bit longer than good 15-char password.

My solution for this problem has been to use passphrases as a mnemonic to the actual password. For example I could pick a few lines of great poem from William Henry Davies (76 chars):

No time to see, when woods we pass,
Where squirrels hide their nuts in grass.

And I would pick the first letters of each word, creating the following pretty good 16-char password:

Nttswwwp,Wshtnig

Using poetry is especially good, because it's easier to remember and when you are asked to change the password, you can just pick next few lines of a poem.

2
  • 3
    Plus, you get to learn a new bit of a poem each time your password changes, and thereby gain some culture points. :)
    – Jonathan
    May 8, 2009 at 9:11
  • 4
    I've shot myself in the foot with this one by using song lyrics. First, my tendency to hum the song. Second, getting the song stuck in my head for a month straight... May 8, 2009 at 12:35
4

When dictating a password regime to others, don't only require that they use unique, longer than a threshold, contain mixed case, special characters etc.. but also educate the user about password managers or schemes to construct/remember those passwords... if you don't, the users will write the passwords down or find other, insecure ways to "remember" them.

6
  • Teaching Password managers is a bad example for the average non-technical user. You're trading a bad practice (writing down passwords) for a slightly better, but still bad practice (storing them electronically). A vulnerability in a password manager (such as weak master password, remote exploit, etc.) can lead to disaster.
    – spoulson
    May 7, 2009 at 12:58
  • In other words, I would not store high value passwords in a password manager, like bank logins, etc.
    – spoulson
    May 7, 2009 at 13:00
  • I disagree with you in the respect that even Bruce Schneier recommends the use of a password manager with a strong password over the use of weak passwords that are reused and/or shuffled between sites.
    – Martin C.
    May 7, 2009 at 16:23
  • @spoulson: blind reliance in technology is always dangerous.. I personaly believe that a highly encrypted password vault (with a good pwd, mind you) is just as secure as a login prompt. If you trust the OS vendor to harden the login, you can also trust the Password Managers author. Paranoia rules .. don't trust anyone .. etc... but in the end it always amounts to a leap of faith ...
    – lexu
    May 7, 2009 at 20:22
  • 2
    Schneier goes so far as recommend writing them down: schneier.com/blog/archives/2005/06/write_down_your.html
    – Will M
    Feb 12, 2010 at 23:29
4

If you have trouble remembering passwords, use some well know text. Pick a sentence, use nth letter from each word as password, keep the punctuation. (e.g. password generated from 1st letters of first sentence of this answer could be "Iyhtrp,uswkt."). You can make it stronger by change some to upper case, and adding some special chars.

1
  • That's a really good method!
    – Techboy
    May 9, 2009 at 13:45
3

Don't use a password, that's where you're going wrong in the first place. Use either a random collection of characters (8 minimum) or a passphrase. You can come up with a formula for generating a different passphrase for each site for example ILikeStackOverflowOnions or ILikeServerFaultOnions; this keeps you safe against outsiders however could still cause problems if the actual site is hacked and the passwords aren't salted, or if the admin was corrupt in the first place.

4
  • 1+ But why no spaces or punctuation in the passphrase? That's adding some strength to them imho, like "I like olives and serverfault.com!" which should be a pretty strong password yet extremely fast and easy to type and remember ^^ (some really old or obscure systems frown on spaces in passwords - tell them to go to hell ;) May 7, 2009 at 17:54
  • Well yeh, spaces are of course a plus, as is punctuation. But I've found there's some very annoying insecure sites that won't take passwords with punctuation in, I once had a bank that didn't :-( May 7, 2009 at 18:45
  • 1
    @Oskar Duveborn: Note that instead of using punctuation in the password, you can just make it longer; mathematically, the result (number of possible passwords) is the same. You could even use PWs with just lower-case characters, if you make them a bit longer.
    – sleske
    May 21, 2010 at 1:55
  • Yeah, I'm just into punctuation to ease remembering a phrase for people. Benefits of a longer password is just a bonus ;) I also had a bank that didn't take spaces, three years ago. These days it's fine though. And older unix systems have 8 characters max but, as you can't see what you type you could always pretend you're typing the entire 30 character password there too ;) May 21, 2010 at 6:57
3

Change your password regularly. Where I work, it's a 30 day cycle. It's a PITA, but it mitigates the value of hacked passwords to a limited time window. That, plus a complex AD password policy dictates it needs to be at least 8 characters, contain upper, lower, numeric, and symbols.

To supplement, we use a self-service password manager service. It provides a custom Windows GINA that provides functionality to let the user reset their password if they forget it, or unlock it if they goofed it too many times. The password manager app requires the user enroll in the service, provide a bunch of personal info only they would know that is later used as questions when the user needs to reset password/unlock their account.

1
  • 3
    Enforcing time-based password changes is generally seen as a really bad practice. I can almost guarantee that the last few digits of most people's passwords will contain the month or year when it was last set.
    – Andrew
    May 21, 2010 at 2:43
3

I believe passwords should be generated, rather than thought up by the user. This avoids all those silly problems with easy to guess passwords.

I like to use pwgen, which generates password lists like

Bai4phei Gohh7Too cee3Iegh eegh7Aiy kaing6Mu ohBi0woo oH7bieRo Opai1Vov
sahpee6Y joo3iKe4 iegai4Ae chi1Akee se2vaDoo Xivae4ew eN4aquoh ahMaeye1
Ci3mie2e Oosh3aiy pueX1OoF uXee7chi theo4doT ied6Haeg Pey3beer viZeish2 
Itoogoa3 RaeD6woh IeJ9guLo Afuozii9 equahGh7 ui9uaJae qui4Geis Eikib2ko 
Ua7viequ iedieY9Y Deihae1u uu6aR7xa ThooG6mu HeiZ7jai choo7ohM jael0Lai 
Beelae6s wu0uTieK eiX8equu uPeeS2ub WaiceeP1 tha2Ohz1 xeiroh9E Eak6leiy 

but really any pw generation program will do. One advantage of pwgen is that it tries to make the passwords (somewhat) memorably, by including some vowels.

1
  • That's the way I do it. Generate a bunch of passwords and pick one that doesn't have ambiguous characters, such a 1, l I, etc. May 21, 2010 at 5:35
3

Anything different from (source dailywtf.com):

alt text

2
  1. Use strong passwords.
  2. Don't reuse passwords.
  3. In consideration of #2, use a tool like PwdHash in the face of overwhelming disparate accounts.
2

Stay away from these Top 500 worst passwords.

Long, complex passwords offer good security, basically strong passwords, but definitely use different passwords for all user accounts.

1
  • Interesting link...
    – David Z
    May 7, 2009 at 5:41
2

Use a tool like SuperGenPass to generate unique passwords for any web sites that you have a login for.

1
  • +1 for just generating passwords, rather than having a million silly rules for creating them.
    – sleske
    May 21, 2010 at 1:58
2

Hak5 just did an episode demonstrating a tool from Remote Exploit that takes a number of strings and generates a dictionary of all combinations, upper, lower, leet spelling, etc. So you give it input like the target's name, kid's names, birthdates, or other information you know about the target. The dictionary it generates can be used as input to brute force a weak password.

Moral: Avoid using personal information in your password

5
  • 1
    On the other side of things, a while back I worked on a site where one of the client's password requirements was "cannot be any form of a dictionary word" (leet, etc.) so I had to build a similar generator that would identify all of the various variations that were forbidden, and was fast enough to run within a postback cycle when they changed their password. May 7, 2009 at 17:55
  • Good point, the more choices you limit, the clearer the possible choices could be.
    – spoulson
    May 7, 2009 at 19:54
  • 1
    I'm not sure if @spoulson implies the same, but: if you actively prohibit any word from a dictionary, aren't you basically limiting the number of possible passwords? And hence, in theory, make it easier to find the password?
    – Arjan
    Jul 13, 2009 at 21:14
  • The idea is to remove recognizable patterns in a password that can be either dictionary attacked or easily remembered by a third party. Removing the ability to create weak passwords doesn't make the password scheme any weaker.
    – spoulson
    Jul 14, 2009 at 12:03
  • @Ajran: Yes, of course you're right, disallowing "weak" passwords effectively reduces the bitlength of passwords (of a given maximum length). However, this only matters if you actually disallow a non-negligible part of the password space, which is hopefully not the case.
    – sleske
    May 21, 2010 at 1:49
2

If you know words or phrases in a non-english language, you could use those as part of your password. For example, I commonly use Japanese words as part of my passwords which fends off dictionary attacks yet allows me to remember them (as opposed to randomly generated passwords).

1
  • 2
    Do not assume that people who attack your passwords will only speak English. Do not assume that an attacker who only speaks English will not add other language dictionaries to his password cracker.
    – pgs
    Jun 15, 2009 at 3:11
2

I started using Password Safe, which was originally designed by Bruce Schneier, for storing any web-passwords. I have a very strong passphrase on the password safe, and all other passwords are auto-generated and never re-used accross websites.

The software also has features like expiring passwords and the like.

I consider this (given the strong safe password) to be the best trade-off and most secure approach to website passwords.

1

For family and friends I usually say that it's cool to use stuff like pets names and mothers maiden name and stuff as long as the following two things happen:

  • concatenate at least two names (ex: mothers maiden name + pets name)
  • incorporate uppercase and special characters.
4
  • OK for low-security applications, I guess. But you wouldn't want to do that for e.g. an online banking site.
    – David Z
    May 7, 2009 at 5:40
  • bad idea full stop. It's too predictable and encourages weak passwords everywhere. The same advise should be give to family and friends as that given to employees.
    – Judioo
    May 7, 2009 at 13:14
  • @i-moan I tend to agree but I'm using it as a step in the right direction. If I can get them to use this approach as opposed to JUST using the pets name or something I think it's a step in the right direction May 8, 2009 at 1:27
  • Good comments. Things that are easy for you to remember, but mixed up a little so impossible for others to guess
    – Techboy
    May 9, 2009 at 13:44
1

When instituting mandatory password expiry period, choose a factor of 7, rather than a block of days (e.g. 30 or 60 days).

The result of the 30 day expiry may be that the user is required to change their password on a holiday or weekend, and may have a surprise when they come into work the next day.

If you were to set the scale of expiry to a factor of 7, this would ensure that the password change-date would fall on the same day-of-week as the previous change.

1
  • Actually, most systems with expiration have two expiration dates: After the first, you need to change your pw on next login. Only after the second has passed only a pw change, the expiration actually takes place. So this should normally not be an issue.
    – sleske
    May 21, 2010 at 1:52
1

If you have multiple sites for the same user base then I must highly suggest some form of single sign on(like Shibboleth). When users have different passwords for multiples sites they tend to have trouble remembering them all. One or two passwords are easily remembers by most people, three the user may write them down in a secret location. If more then four the user very well may just write them all out on a post it note and apply it to desk or monitor.

Passwords need not be overly complex, though they need to be complex enough to prevent first or second attempt's. As long as your system/sites have some sort of security measure which limits the number of log in attempts then the passwords don't need to be over complex.

As an example, if your systems have a limit of 3 logon attempts per hour, then a basic password such as "Cindy65" is more then complex enough. While the hacker may know that the users real name is Cindy, he really would never know that she was born in 1965. His attempts would naturally be "cindy", "lastname", "Cindy", Lastname", though by this time he is blocked out.

While this may be a simplistic case and a simple password, it is all that is really needed if you the admin have set up everything correct server side. We can also ask for slightly more complex passwords that is easy to remember, such as a random combination of keys. Symbols and capital letters also help greatly.

We just need to remember, the harder we make it on the user, the more likely it is that they will write it down in public.

One thing I always like to ask my users to do is write their name concatenated with the name of a medication they are on, favorite food, best friends name, etc. These combination of dictionary words while simplistic are nearly impossible to crack.

Examples: CindyProzac, WilliamCodene, JoePetertherabbit

Good Luck.

0

Don't write it down. And if you do, put it in a safe. And don't write that combo down, either.

2
  • 2
    When was the last time that somebody broke into a home and stole a password? For home users, writing a password down is often the MOST secure, because it encourages strong, unique, hard-to-remember passwords.
    – Portman
    May 8, 2009 at 13:43
  • I agree with Ben - especially for a work environment
    – Techboy
    May 9, 2009 at 13:46
0

If security requirements are really tight, I'd try and avoid the use of passwords wherever possible. Think using ssh key based authentication, client certificates on smart cards, etc. It takes a lot of skill and budget to make that work properly though, so a proper risk assessment should be made.

If you decide to stick with passwords, I'd follow the advice of capar and lexu.

0

Restrictions on password length are silly. (Restricting passwords to between 6-8 characters is common, yet makes no sense on modern systems).

Requiring frequent password changes encourages users to write down their passwords and to choose simpler ones. This is a tradeoff of threats, and you must consider which threat is more relevant.

Requiring a user to contain "special characters" in an exactly 8-character password, instead of allowing a 30-character password consisting of letters only, makes no sense.

Don't give users an obvious password and ask that they change it. They won't. Either require that they change it on the first login, select a strong password for them knowing that they will write it down, or make them select a strong one in front of you.

0

We train our users to pick passphrases and use the first letter of each word.
WTOUTPPAUTFLOEW -- add a zero or 3 (leetifying), vary the capslock a couple times and you've got something no dictionary will ever pick out but is still easy to remember.

however-- just make sure you don't change their password to a passphrase based on the company slogan/vision statement etc.

-1

To help prevent what happened to that web site administrator, and assuming you have access to a Unix shell or Cygwin, you can use

$ echo -n *password* | md5sum -

d1b13e9abbe4edb1b07317241969376e -

and check that value against an MD5 database, like http://gdataonline.com/. Make sure it doesn't appear in there.

Also, here's an example of a more, raw MD5 dictionary, that I got by simply googling for that hash value (warning: large file): https://secure.sensepost.com/sp-hash/jebwy

2
  • 1
    Yeah right, this is the perfect way of submitting new hashes to their work queue so that at some point in time a simple google search for the hash will reveal the password. I strongly advise against submitting hashes to such sites. Jun 14, 2009 at 17:45
  • 2
    Your hash is "jeffa" btw... Jun 14, 2009 at 17:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .