Policies & Security : Choosing Good Passwords

The object when choosing a password is to make it as difficult as possible for a would-be intruder to make educated guesses about what you've chosen. This leaves him no alternative but a brute-force search, trying every possible combination of letters, numbers, and punctuation. A search of this sort, even conducted on a machine that could try one million passwords per second (some parallel processors are now capable of 400,000 per second) would require, on the average, over one hundred years to complete. Some guidelines:

Don't:

  • use your login name in any form (as-is, reversed, capitalized, doubled, etc.).
  • use your first or last name in any form.
  • use your spouse's or child's name.
  • use your pet's name.
  • use other information easily obtained about you. This includes license plate numbers, telephone numbers, social security numbers, the brand of your automobile, the name of the street you live on, etc.
  • use a password of all digits, or all the same letter. This significantly decreases the search time for an intruder.
  • use a word contained in (English or foreign language) dictionaries, spelling lists, or other lists of words.
  • use a password shorter than six characters.

Do:

  • use a password with mixed-case alphabetic.
  • use a password with non-alphabetic characters, e.g., digits or punctuation.
  • use a password that is easy to remember, so you don't have to write it down.
  • use a password that you can type quickly, without having to look at the keyboard. This makes it harder for someone to steal your password by watching over your shoulder.

Although this list may seem to restrict passwords to an extreme, there are several methods for choosing secure, easy-to-remember passwords that obey the above rules.

  • It’s very important that the password be easy to remember so that you’re not tempted to write it down.
  • Some tips:
    • Think of a sentence you can remember
    • Throw in a special character or two
    • Use numbers in place of words like 4 instead of for, fore, four or 2 in place of to, too, two
    • You can also use the number 1 in place of an I or an L

    Some examples:

    Lunch usually costs me $10 or less (Lucm$10ol)
    Let it snow!  Let it snow!  Let it snow! (L1s!L1s!L1s!)
    It Takes Two is my favorite song (IT2!imfs)
    It’s never too late! (Snvr2L8!)
    Where shall I go on vacation this year (w?s1goVty)

Such a password should then be examined in the light of the above guidelines in case any are violated by accident. For example, if the sentence had been:

How older US educators sit

the resulting password "HoUSe.s" contains enough information to make life easier for an intruder because the acronym spells a word found in the dictionary.

To protect your files, most UVA-Wise password systems only accept new passwords that conform to the following rules:

  • Must be at least 8 characters long.
  • Must not consist of all lowercase, or all uppercase characters, all digits, or all punctuation characters.
  • Must use a password with non-alphabetic characters, e.g., digits or punctuation.
  • Must not be part of the local computer's name.
  • Must not match anything in your UNIX account information, such as your login name or an item from your "finger" data entry (full name, login shell, home directory).
  • Must not be in the system's spelling dictionary - unless it has some uppercase letters other than the first character. For example, "Explain" would be rejected but "exPlain" would be accepted.
  • Must not have more than 2 characters repeated in a row - thus "ABCaaa" would be rejected.

These rules will probably be expanded to be more stringent in the future.