Passwords – Not fit-for-purpose, misused and Ugly

It’s a perennial subject, but one worth reiterating, as old habits die hard. “Popular Passwords”, from the numerous loss and publication of unencrypted password lists, a league table has been created. The data is from 2014, but I very much doubt much has changed, so the message goes out again. Please avoid using regular names, sport teams and standard mis-spelling of dictionary words, such as P455word1, it’s better than 12354567 or qwertyuiop, but no way is it secure.

Is your password below ?

There are password guessers which substitutes 5,$ etc for S. The dictionary used covers the main languages used for commerce, English, French, Spanish, German and more commonly now Korean, Japanese and Chinese.

The safest password is one which is randomly generated or at least not a dictionary word. Using password managers is one strategy that people and organisations use, but that means putting your trust in that product and relying on you remembering your password to unlock that, but it is a better solution than many others.

Guidelines

• Use 10 characters or more
• Avoid dictionary words
• Don’t reuse passwords across different services (for sensitive or high value services)
• Don’t just rely on common substitutions
• Write them down (keep the book/paper safe)

I know the last one is contentious. Better to write it down than to forget it or rely on another piece of software of technology that can be compromised. Your smartphone can be hacked anywhere in the world, your paper notebook is much, much harder to access.