Tuesday, June 10, 2008

Passwords (part II ... Suggested solutions)

well here we are with passwords again. I talked earlier about passwords importance and risks. Today I wanna talk about best practices.
Generally, system administrators advise employees to follow the following practices to keep their passwords secured :

•Use very lengthy passwords. It’s ok to have a meaning if it’s long enough (using a sentence of 100 characters for example as a password). But this means you’ll have to memorize a new sentence every now and then. And even a sentence for every site or program because you don’t want a single password compromised to break down all you secrets and identities.

•Add alphanumerical characters to you passwords to make it difficult. (And of course you’ll make it difficult for yourself to remember!)

•Use alternating case. For example (TeStPasSworD). This pattern also hardens passwords but still have the draw backs mentioned in the previous points.

•Add some special characters that are not on the keyboard. It’s a good trick that few people know. You can add a character that is not on the standard keyboard by pressing the (Alt) key and while pressing, enter the UNICODE numerical value that corresponds to a special character. For example (Alt + 1223) gives (╟). This technique is very powerful actually, but a lot of password providers limit the characters that can be entered in a password to a limited set of characters

As a conclusion for all the previous practices, I suggest a tricky technique that tries to make it easier on the user and more difficult on the cracker. Every one of us has a favorite password or two that he remembers very well. Well, why don’t we use this password plus some additions to make it difficult on the cracker but easy on you.

The technique I'm describing here suggests that you use a password that consists of two parts. The fist part is a password that you know very well and remember. (6-10 characters). The second part is a number that is changed every now and then (4-6 characters) and changed for every program or site. You don’t have to memorize this number. You can put it on your favorite sticky note or a memo on your mobile or even on a file on a USB flash drive because this number alone doesn’t mean anything.

You could also use the first part of the password to make categories. Like social networking sites have as the first part. Important accounts (bank, OS account) have as the 1st part. and of course the 2nd part is randomized and different for each site.

Now let us take look on the resulting password. The result is a password that you remember very well, you can write the part that you don’t remember on anything, this part can be changed by any frequency since you don’t remember it from the beginning, you can create levels of security where for example the “not so important” passwords you can have them grouped with the same keyword that you remember well and they differ internally by the number that is generated randomly by the administrator and the best of all is that the password you just created is an alphanumeric password that is 10-16 characters length and very hard to break!
Ok, now Mr. Black hat, if you wanna a piece of me , come n' get it.

No comments:

Post a Comment