Choosing a good password is always a problem. The essential tension is that a good password should be easy to remember, yet hard to guess. Most people err on one side or the other. Most people choose passwords that are too easy to guess, such as the name of their spouse or pet. Any word in the dictionary makes for a quick security breach. We have other vendors who send us passwords like 8#{aUv7. Yes, it's hard to guess, but also impossible to remember, guaranteeing that it'll have to be written down, copied, pasted, stored, and generally left laying about. Here's some hints of forming usable passwords:
- Combine two or more words, like 'noneshallpass'
- Some people convert their passwords into 'leet speak' by substituting zeros for ohs (o->0) and ones for ells (l->1). These are fairly easy to guess as well. The next step up would be to substitute threes for ees (e->3)
- Even better, if you speak a few words of a foreign language, use them. Such as: 'verb0ten'
Back when we wrote this, the common advice was to change passwords every 90 days. I was dubious. I thought one well-chosen, well-guarded password beat a string of mediocre ones that change so often you have to write them down.
Good news: the standards caught up. NIST's current password guidance says services shouldn't force people to change passwords on a schedule (only when there's evidence a password was compromised). It favors length over odd character rules, calling for at least 15 characters when a password is the only thing protecting an account. It also says services should allow password managers, which help people pick stronger passwords.
A few more tips for today:
- Use a different password for every important account. A password manager makes that painless.
- Turn on two-step verification (a code or prompt on your phone) wherever it's offered.
- If a site tells you your password was in a breach, change it right away.
In closing, have fun with the idea.