Password Security Tips

A simple list of Dos and Donts to consider when creating new accounts or updating passwords for current accounts you have.

It may sound simple, but mistakes can often be made when in a rush or creating multiple accounts.

This post contains common good practice. Why not get into the habit of creating good passwords, before bad habits set in?

Do NOT:

1. Use your account name or any data that appears in your record in the password file.
2. Use any word or name that appears in any dictionary, reference or list regardless of case changes; especially do not use character strings that appear in password cracking tools’ word lists or bad password lists.
3. Phrases and slang with or without white space. Redundant with 2. See below.
4. Use any mythological, legendary, religious or fictional character, object, race, place or event. Redundant with 2.
5. Use acronyms. Redundant with 2.
6. Use alphabetic, numeric or keyboard sequences; many such sequences are included in cracking tools “word” lists. Redundant with 2.
7. Titles of books, movies, poems, essays, songs, CDs or musical compositions. Redundant with 2.
8. Vary the character sequences obtained from any of the foregoing items by any of the following methods:
   • Prepend or append symbols, punctuation marks and / or digits to a word.
   • Use words with some or all the letters reversed.
   • Use conjugations or plurals of words.
   • Use words with the vowels deleted.
   • Replace letters with like looking symbols or digits.
   • Replace digits with like looking letters or symbols

7. Use only the first or the last character in uppercase. Redundant with 2.
8. Use only vowels in uppercase. Redundant with 2.
9. Use only consonants in uppercase. Redundant with 2.
10. Use any personally related information.
11. Use anything you can imagine being collected into a list.
12. Use a publicly shown example good password.
13. Use great vanity license plates. In the future, may be redundant with 2.
14. Transliterate words from other languages.
15. Repeat any character more than once in a row.

DO:

1. Use at least 8 characters.
2. Include a digit or punctuation.
3. Use upper and lower case.
4. Choose a phrase or combination of words to make the password easier to remember.
5. May be two words separated by a non-letter non-digit.
6. May have non printing characters.
7. Use different passwords on different machines.
8. Change password regularly and don’t reuse passwords or make minor variations (incrementing a digit).

The suggestions overlap as they come from different sources. Most users and some systems will have real difficulty with non printing characters.
Personally related information Most people choose passwords that are easy to remember. One way to make passwords easy to remember is to pick passwords or parts of password that are directly related to oneself. Generally these are considered to be poor password choices.

Below is a list of all the personally related information that I have seen in passwords or in lists of what not to use in passwords. It’s listed in the order in which I think this information is most likely to be used in forming passwords:

1. One’s names and initials.
2. One’s account name.
3. Names of immediate family members.
4. Names, breeds or species of pets.
5. One’s birthday.
6. Family member’s birthdays.
7. One’s vehicle make, model, year.
8. Hobbies, interests and related words.
9. One’s job title.
10. Employer’s name.
11. Job related words.
12. Friend’s names.
13. Street numbers or names, city, county, state or zip code for home, work, family or friends.
14. Phone numbers for home, work, family or friends.
15. Social security numbers for self and immediate family.
16. License plate numbers.
17. Birthplace including street address.
18. University or college name.
19. College major.
20. High school name.
21. Student or employee ID numbers.
22. Serial numbers from consumer products.