Choosing Secure Passwords

It’s hard to get through a day on the internet without encountering dozens of requests for your username and password. With more and more of our work and leisure time spent online, most people find that remembering a unique password for each account they have is an impossible task. It’s made harder when sites have strange rules about how you must form your passwords. Some sites prohibit special characters like &, %, #, and @ in passwords. Other sites require them. Some sites have maximum length limits on passwords that are shorter than the minimum length required by other sites. What is the modern, internet-savvy user supposed to do?

Web security experts from Mozilla, the folks who bring you the FIrefox browser, tell me it’s certainly not what most of us do now…

• Are there little yellow notes stuck to the side of your monitor with usernames and passwords scribbled on them?
• Do you have at least one computer or online account where the password is “password”?
• Do you use your pet’s name as a password, and tell yourself you’re making it more secure by adding “123″ to the end?
• Do you have accounts on dozens of websites and log into all of them with one of three favorite, easy-to-remember passwords?
• Did you last change the password for your bank account shortly after the turn of the century? Before?

If you’ve secretly answered “yes, but…” to any of these, don’t worry. We won’t tell anyone, and in this guide we’ll show you how to create and manage strong, secure passwords without breaking a sweat. We’ll also show you how to memorize only one password and still have a unique password for every site you visit.

You’ll sleep better at night knowing you’re safer from identity theft, and with the tricks you’ll learn here you can help your friends and relatives be safer online as well.

Passwords Are Compromises

Any password is a compromise between a secure (long, random and unique) string of characters and an easy to remember word or phrase. As we need more and more passwords to get through the day, we all tend to push the compromise in the direction of easy to remember more than we should. A bit later, we’ll show you a technique creating passwords that will keep your’s memorable without making them easy to guess. We’ll also show you ways to let your computer manage all your passwords so you don’t have to remember them.

Threats to Your Passwords

The threats to your passwords fall into three major categories:

Social Engineering: The more an identity thief knows about you, the less secure passwords associated with your everyday life become. Don’t assume that the names of your children, pets or friends make secure passwords. They aren’t. Similarly, if you keep passwords written down in a “secret place”, anyone watching your day-to-day activity will quickly learn where they’re hidden.

Brute Force Attacks: If your passwords are insecure, an identity thief needs little more than your username to mount an attack against your accounts. Cracking software that uses lists of dictionary words in combination with common password configuration information quickly opens accounts with passwords such as “Jennifer3″ and “Bobcat123″. A security audit of a university computer system found that 20% of the accounts could be accessed using only a list of the 20 most popular female names followed by a single numeric digit.

Breaching Insecure Systems: If the administrators of a website use poor security practices, such as storing passwords unencrypted, identity thieves that manage to breach system security can steal the entire list of passwords and usernames. That’s a huge security problem for you if you’ve used the same password on other sites, particularly ones with access to your bank account or other sensitive information.