Attackers can use multiple methods, most often automated, to crack your password. These methods can consist of brute force attempts, dictionary attacks and social engineering (e.g. , via phishing). A strong password can help deter the first two attack methods so you should keep the following in mind when selecting a password:
- Make passwords at least eight characters long (twelve or more is preferred)
- Don't use a username, a real name, or a company name
- Don't use a single dictionary word (even slang and foreign languages); a multi-word phrase is much better
- Don't use phone numbers, Social Security numbers, license plates, or birthdates
- It should be significantly different from previous passwords
- It should contain characters from each of the following groups:
- Uppercase and lowercase letters
- Numbers
- Symbols (!, @, #, $, %, etc.)
- Don't use the same password for multiple accounts (e.g. , Swarthmore, Amazon, Gmail, etc.)
...
You should never share your passwords including with supervisors or co-workers. Don't write it down and then leave it on your display, under your keyboard, etc. In your browser (e.g. Chrome, Firefox, Safari, Internet Explorer, FirefoxEdge, Safari, etc.), you should always disable the Save Password option.
...
- Use three words (or more) together but not as a phrase.
- Could be 3 synonyms, homonyms, antonyms, rhymes, etc.
- Examples: WonSunTon, Pleasekeysfleas, Basesbasisbasses
- Use a made-up email address (not your own!).
- Pick a name then a related phrase for the address.
- Examples: Mickey@mouseworld.net, vacation@aruba.com
- Model your password after a real or made-up URL.
- Examples: www.whatsmypassword.com, www.nonewsisgood.org, ftp.drydesert.edu
- Use word and number combinations that rhyme.
- Pick two or more numbers and then a phrase that rhymes.
- Hint: get some ideas from www.rhymezone.com
- Examples: 43FruitTree!, 488studentsintheDebate?
- Use a common phrase stated in an uncommon way or as a question.
- Examples: Temperaturesensitivedevice (ie.eg. , a thermometer), whatISamovieonadisk? (ie.eg. , DVD)
- Think of a personal secret (perhaps embarrassing?) that only you know.
- Examples: asleep@Meeting!
- Invent an imaginary phone number.
- Consider including spaces, dashes, and parenthesis.
- Hint: don't use 867-5309 from the 1980's 1980s song...
- Examples: (800) Sec-urme, 1-888-keepout
- Take two or more words and swap the first letters.
- Capitalize one or both of the first letters
- Examples: Eink plephant, hexas Told-em!
- Use a password generator
- Password generators such as the LastPass Password Generator can generate secure passwords with the click of a button.
- Use a password manager
- There are a number of reputable on-line and off-line password managers available. Some are free and others charge for their services.
- If you are a member an employee of the Swarthmore College faculty or staff community, you can use the online password manager LastPass for free. To get started, send an email to support@swarthmore.edu requesting access to LastPass.
...