For years we've been encouraged to dream up weak passwords which are easy for machines to crack, concedes the guy who wrote the book on creating passwords.
We've all spent time staring at our keyboards, trying to think of yet another password containing a mix of upper and lowercase letters along with at least one number or special character. You can thank former National Institute of Standards and Technology manager Bill Burr, who came up with these rules back in 2003 when writing the password guidelines which many organisations now treat as gospel.
![The traditional password rules encourage us to dream up terrible passwords.](http://web.archive.org./web/20170810193119im_/https://www.fairfaxstatic.com.au/content/dam/images/z/q/t/g/x/image.related.articleLeadwide.620x349.gxrxac.png/1502232744426.jpg)
It's a challenge to dream up memorable passwords which follow these arcane rules, so we tend to use tricks like 'p@ssw0rd1' – thinking that we're outsmarting hackers when we're actually playing right into their hands.
After a brute force password attack cycles through common dictionary words, it goes back and tries the obvious leet-speak tricks such as substituting '0' for 'o'. It doesn't take long to crack your seemingly uncrackable p@ssw0rd.
As an extra security precaution you might be forced to change your password every month, but of course it's too hard to remember an entirely new password so we simply cycle through from 'p@ssw0rd1' to 'p@ssw0rd12' throughout the year.
If you've ever thought that these rules encouraged people to use weak passwords then you're not alone. Even Burr himself now concedes they're a bad idea, according to the Wall Street Journal.
Rather than a password, you're better off dreaming up a passphrase – even 'PasswordIsATerriblePassword' is still a stronger password than 'p@ssw0rd1'.
This is reflected in the new National Institute of Standards and Technology password guide, published in June, which recommends giving users at least 64 characters to play with and doing away with rules like insisting on at least one digit.
The new guides also recommend scrapping the need to regularly change passwords – allowing users to dream up long and complex passwords without worrying about what they'll change them to next month.
Fans of Charles Dickens might opt for 'They were the best of times, they were the worst of times' as a password, which is much harder for a machine to crack than '2cities' but easier for you to remember if you're a fan of the book.
If your literary tastes are a bit more lowbrow, you might use the opening lyrics to your favourite song. In theory the best passwords look like complete gibberish, but they're obviously more difficult to commit to memory. Taking the first letter of each word gives you the basis of a strong password like 'DyEfLaPb*DtTwWtSa?', which is easy to remember if you sing along to Katy Perry's Firework in your head as you login.
As an extra security precaution, you might use one-off email aliases for some important accounts. The world might know that your email address is bill@smith.com, but they won't have any luck hacking into your iTunes account if you register with bill-apple@smith.com.
As an added bonus this makes it easier to spot phishing attempts, because legit emails from Apple will never be sent to bill@smith.com.
What are your tricks for dreaming up strong passwords and have they kept you safe over the years?
0 comments
New User? Sign up