Well, we said from the beginning that passwords are problems and everybody's got them right.
Well, let's take a look at a few tips for better passwords, including let's start with one of my favorite
tips from Casey thanks to the gang over the CD for this great password complexity cartoon.
You can see even a pretty complex password like this, an uncommon basswood like troubador, and then
a few common substitutions, like some capitalization as zero for the O for for the AI and then even
some punctuation and a number ampersand three.
In this case, that would take about three days to brute force if you were doing just a thousand guesses
per second.
Of course, we can run lots more guesses per second than that on a standard computer so that rates this
as an easy to guess.
But you can see it is really hard to remember that as a person.
However, if we took just four random common words, correct, horse battery staple, those don't have
any uppercase lowercase, no punctuation, no hard to remember substitutions.
It's just correct.
Horse battery staple.
That would take around 550 years for a computer to guess.
So you've already memorized this password and it's significantly harder for a computer to guess that
one, of course, don't use that password because I'm sure that's in a password database now, too.
Well, let's talk about some tips that will help you keep your passwords safer.
Think simple for you to remember, but hard for a computer to guess.
And a passphrase is a much better way to go than just taking a dictionary word, even an uncommon one
and doing some of those substitutions we saw.
We can crack through those really fast.
But here's some tips for keeping your passwords safe.
First of all, don't give out your password when it comes to social engineering.
We saw phishing, we saw pretexting call up and say this is Microsoft support.
We see a problem with your computer.
Let me help you.
Or looks like your accounts been hacked into.
Don't give out your password.
Ever log in directly to your computer, change your password.
If you feel like somebody might have had access to it.
Don't be afraid to burn those passwords, change those passwords on a pretty regular rotation.
But about once every six months is OK.
If you're using good passwords like we'll talk about here, that includes don't write those passwords
down, right?
When you give out a password or when you write it down and take it to your monitor, that's an easy
way for social engineering to work.
We talked about snacking.
Remember, if we just leave that posted on the monitor because it's such a hard password, we can't
remember it anymore.
Then we run into the risk of somebody just walking by our desk and having all of our passwords.
But you can choose a simple to remember password, like the first letters of a phrase I graduated from
high school in and some number at the age of and you use IGF H.
S the first letter of each of those phrases.
You can actually use a pass phrase and a lot of websites that allow you to do a really long password
or pass phrase.
That's a good idea.
You can use the first letters of all the words in a song that you like for a particular site.
So let's say that I wanted to use Mary had a little lamb.
Its fleece was white as snow mh l l i f w w a and then I did one substitution there dollar sign and
then seven and maybe the number doubled so seven and then 14.
That is a very difficult to guess password.
But Mary had a little lamb, its fleece was white as snow.
It's pretty easy to remember.
And then maybe the number seven you'd have to remember as well.
So if you wanted to do a password for this or even if you wrote this down on a Post-it and kept it in
your wallet or your purse, someplace where you don't leave your wallet out someplace, you don't leave
your purse out, just put it someplace that you don't give other people access to very much, or even
storing that one on your computer might not be the worst thing if it's just the hint cheap.
Seven.
Oh, Mary had a little lamb.
You just have to remember not to hum your password when you're typing it in, it's your keyboard.
Somebody will figure out what your password was.
When it comes to hacking.
We've seen that passwords get hacked from websites, right?
We got all of those passwords from a Windows seven box just by dumping the hash values of the password
files.
At some point, just about every Web site that you are a member of or you have an account on is going
to be hacked.
So don't use just one password.
If you use one password for one type of thing or one site, use a different password for a different
type of site or different different Web page, but always have a really tough password for your email,
have a different password for banking, have different passwords for different websites.
It's a smart thing because if one site gets hacked, then the first thing people are going to try is
using that username and password and the site's.
We saw sniffing could expose your password out over the network, if you log into a site that's not
secure, always use https to enter your passwords, make sure you're on a secure connection before you
log to Facebook to your Web site.
If you have a WordPress site, you want to make sure that you get a secure certificate so that you can
enter your password only using https.
Otherwise, anyone on the same network as you can see it in plain text when it comes to cracking.
This is for Web administrators especially, but web admins should always salt password hashes.
That's a technical term, but it just means adding a couple of random characters to the front of a password
hash and hashing it with those extra characters added in there.
That way, when and if a password database is dumped from a Web server, at least the attacker won't
be able to look those hashes up immediately online because we'll have added some extra characters before
those and change them up a little bit.
A good tip for passwords overall is to use multifactor authentication to factor authentication where
maybe before you log into your Gmail from a new computer, it will send you a text and ask if you want
to allow that.
That's a great thing to do.
Do that for your social media accounts, for your email account, for your bank accounts, anything
that you don't log into from a whole lot of different computers or anything that you want to keep really
safe.
To factor authentication or multifactor authentication is a really smart thing.
That's why in business will have a key card that gets us in.
But we'll also have to know a pin for certain areas or know a password for other things.
You can consider a password manager if you have a whole lot of passwords to remember.
Password manager can store passwords in encrypted form and it can even randomize passwords.
So it gives really long, random hard passwords for your banking website or for your email account.
Password manager can help you manage all of those passwords that we have in modern life.
I'll leave you with one last, most important tip that I give my students.
Make your email password your hardest password to crack.
That means if you only have one password as good as this one.
Mary had a little lamb.
Its fleece was white as snow.
You might want to pick a different song.
Of course it should be on your email account.
Now, why is that?
Well, because your email account is usually the one location that all your other passwords get reset
to.
So if you forget your banking password, you enter your email address and say, I forgot my password,
and then your bank sends you a link to your email account that you can click through and change your
password.
So if somebody gets into your email account, they can just do a search for a receipt or do a search
for a statement and they will find all of your purchases.
That's all the websites that you buy things from all of your passwords to all of your banking accounts,
or they'll find all of your accounts, credit card accounts, things like that.
Once they have your email password, they can go to each of those sites and say, I forgot my password
and it can reset back.
So protect your email account above just about everything else.
It's even more important than your bank account passwords because your bank account passwords usually
get reset to your email account.
So I hope all of these are useful tips.
I hope you've seen that it's really important to protect your passwords and to use good password security,
especially if you're a Web administrator or if you are in charge of a network or Web site.
You want to make sure that you enable secure sockets or secure connections to your website.
Hope you've enjoyed this section of go out there and change all your passwords and make them better.