quote: Edwin Schwing

---

Some of my "famous" former passwords include...
spiderman
batman
thematrix
names of former boyfriends
pet names
old addresses
other movies
generic things like, Coke, Pepsi, Dr.Evil, philhill, etc etc. (yes, I do capitalize my passwords)

---

Those are some of the weakest passwords you could ever have.

Any word which is in an ordinary dictionary should be OUT.

There is something called a "dictionary attack", whereby a hacker reverse engineers the password system by comparing known words to the "hash" passwords stored in the computer he is attacking. When he gets a match he has found out your password and is free to roam your account.

By using UNCOMMON words and words which are NOT related to you or your life you exponentially increase the amount of time required for said dictionary attack to be successful. When the hacker realizes that it's taking too long to get your password he'll (hopefully) give up and move on to easier targets.

I use words like "GoGoDoggy" and "FratiStat". Essentially, nonsense words but if you chose them out of your fertile imagination they are something you will probably always remember... AND other people will almost never figure them out.

I have a couple of passwords that, even if I verbally told you what the password was, you'd never get it. You'd stand there and say, "Huh?!"
 

---

Posted by Bob Maar (Member # 763) on 09-03-2005, 11:17 AM:
 
My password incluce in no specific order:

Brad01
Miller01
Joe01
Redifer01
Phil01
Hill01
Randy01
Stankey01

Then each month they become 02 the 03 then 04 etc.
 

---

Posted by Paul Mayer (Member # 355) on 09-03-2005, 11:43 AM:
 
One of the aerospace companies I worked for required us to change our login passwords every month or every quarter. Which is a pain if you keep with the spirit of the policy and truly change the password. I admit I actually did something like Bob Maar's approach, just added a number and incremented it. Lazy and compromising yes, but with riding REA on half a dozen or so software projects at any given time I had better things to do than try to come up with really different passwords and remembering them every month.
 

---

Posted by Scott Norwood (Member # 30) on 09-03-2005, 12:28 PM:
 
This is why forced password aging is a bad idea. It doesn't actually improve security and may reduce it, since it encourages people to write down their passwords and leave the written-down passwords in obvious places.

Sending passwords via unencrypted email is also a bad idea.

I have several passwords. I have a couple of passwords that I use for stuff that I really care about (shell accounts, ssh/VPN access at work, etc.), a couple for stuff that I sort-of care about (like this forum), and one for stuff that I really don't care about at all if it were to be compromised. I never use the "save password" function in a web browser or other software and remembering half a dozen or so passwords isn't a big deal.

My preferred way to come up with a non-obvious password is to take a phrase (for example, the first line of a favorite book) and use the first (or last) letter from each word in a series and add in a couple of numbers or other non-alpha-numeric characters. This should result in a string which isn't a dictionary word and thus isn't easily crackable.
 

---

Posted by Brad Miller (Member # 2) on 09-03-2005, 12:33 PM:
 
So Scott, something like SNizK3W1! would be acceptable, eh?

(Seriously, Scott comes up with some great passwords that are easy to remember, yet damn near impossible to crack, like my quick "Scott Norwood is cool" example above.)
 

---

Posted by Dieter Depypere (Member # 3184) on 09-03-2005, 01:29 PM:
 
I use pw's with not less than 12 characters (letters and numbers randomly put together). Works quite well.
 

---

Posted by Phil Hill (Member # 371) on 09-03-2005, 06:37 PM:
 
I can never remember anything so I always just use "password01" as my password for everything...
 

---

Posted by Leo Enticknap (Member # 534) on 09-04-2005, 05:04 PM:
 
For really important accounts that I care about (e.g. online banking), I use things like my employee number from a previous job, or a friend's phone number before they moved house: in short, a seemingly random collection of characters, but one I've already memorised and which isn't written down anywhere else in my home or office documents. This also means that I can write down a 'reminder phrase' (for example, writing 'Password - Serena's old 'phone number' on a bank letter), knowing that it'll tell me what the password is but will be meaningless if that piece of paper falls into the wrong hands.

Beware of 'x-rated' passwords! Many years ago, when at university, I heard an interview with a very irritating Welsh person on the radio. That afternoon I logged in to the university's network for the first time and had to set my password. With the broadcast fresh in my mind, I set it to 'sheepshagger' (a term of endearment the English use to describe the Welsh sometimes). A few weeks later, I was unable to log in and had to go to the helpdesk. The lady at the desk, who had a Welsh accent, said: 'Err, OK, I'll see if it works here. What's your password?'
 

---

Posted by John Pytlak (Member # 331) on 09-08-2005, 01:00 PM:
 
Good passwords can be formed from the first letters and numbers of an easily remembered phrase, e.g., "My 3 year old cat's name is Tiger" = M3yocniT or "Here is my 1 password for Film-Tech" = Him1pfFT
 

---