Frapestaartje / flickr

One of my new year’s rituals is to change my passwords.  All of them.  Personal PC’s, work PC’s, servers, and all the websites I visit that require a password. The hardest part of this for me is to actually choose a new password.  It has to be secure, but also easy enough to remember.  Additionally, each of them has to be at least a little different, in the event that if one of them becomes compromised, I’m not totally screwed.

Passphrases

There’s a trick I learned a few years ago that made creating passphrases (a password made of multiple words) much easier.  Did you know that the space character is a valid password character on most systems? That allows you to create an easy to remember short phrase or sentence to log in, instead of trying to remember a sequence of random characters.

The one drawback to this is that typing the space key sounds a little different than all the other keys. This might provide an intruder that has physical access to you a little more information about cracking your password, but I believe that if you make the words in the passphrase long enough, and type it quickly enough, that “hearing” the space key(s) shouldn’t matter.

How to create a passphrase

You want it to be easy enough to remember, but not easy enough to guess. For example, if you’re a well-known fan of Tiger Woods, you don’t want your passphrase to be “in the hole!“, as that would be very easy to guess.  The goal here is to be random.  And, if you’re like me (and, for your sake, I hope you’re not), you might have a problem thinking about random things.  That’s where a random word generator comes it.  My favorite is the Random Phrase Generator (that same site also has random words, sentences and paragraphs).  You can create a random phrase up to four words long, with the ability to select the type (noun, verb, adjective, etc.) and the obscurity (from Very Common to Obscure), and it will spit out a phrase for you:

The Creativity Tools from watchout4snakes.com

The phrase itself may not satisfy all systems’ password complexity requirements.  Many systems may require the presence of at least one character from a certain character set, such as capital letters, numbers and punctuation. Try to mix it up a bit.  Instead of using a space, use a punctuation character or number. Or, although it’s frowned upon, you could use 1337 speak; replace l’s or i’s with the number 1, O’s or o’s with the number zero, etc. The reason it’s frowned upon is that it’s a well known substitution cipher, and may not provide much more security than without the substitution.

Using hashes

I read about this concept a few weeks ago on Lifehacker; it pointed to an article on cybernetnews called “How to Remember Secure Passwords Without Writing Them Down“.  The gist of the article is to create an apparent random string of characters using the MD5 hash tool. If you’re technically savvy, you may already have MD5 (as well as SHA) hashing tools already on your computer. If not, there’s a web site for that: the Online MD5 Hash Generator. Enter a word or phrase of your choosing, then press the “Calculate MD5″ button, and you’ll see a long string of characters generated.  All you need to do is remember the first eight or so characters in the hash, and use it as your password.

If you do have the tools, you can use the same technique, but use your favorite mp3 or favorite photo to hash and use the beginning sequence of digits as your password.  At first, I thought this was a crazy way to come up with passwords, but after trying it in a test, I found that you do start naturally remembering the password after entering it several times.  If you forget the password, just redo your hash.

Making them unique

I mentioned earlier that I make all my passwords slightly different to avoid having all my accounts breached if one password is cracked. When creating passwords for seriously sensitive sites (like your bank account, for instance), it should probably be entirely different than your Twitter password, so your financial information remains safe if (or should it be when) Twitter’s password information is breached. Your work passwords should also be completely different than your personal passwords for similar reasons. However, for those not-so-sensitive services, such as the aforementioned Twitter or Facebook, try simply modifying the password in such a way as to personalize it for that site. Perhaps add the first few characters of the site’s domain name to the beginning or end of your password, or somewhere in between.

So, get to it! Happy password changing!