A friend of mine once said that the best password would look like line noise. I have aspired to keep with that idea. I have decided to post how I came up with a password for some systems. Needless to say, I have already gone through all steps to remove any traces of this password from those systems, including:
- there are no backups in rotation that would restore a system to the old password
- all machines that are even close to a network, or power, plug have been checked to make sure the old password will not work
- no other accounts used that password
The reason I am showing this, is to show how I came up with a password that is believe is FAIRLY secure, but still could be remembered.
In making this password, I started with a pass phrase. I like to use phrases, because it gives the user something that can be easily remembered. So, I started with the phrase:
and they all lived happily ever after
Then, I took the first letter of each word to get:
Now, we want to mix it up with upper case along with the lower case alpha characters:
Next, we want to throw some non-alpha characters into the mix:
The strengths of this password is that:
- it is not a dictionary word
- it uses a mixture of upper and lower alpha characters
- it uses non-alpha characters
- it is easier to remember than many auto-generated passwords
The weaknesses of this password is that:
- it is a known phrase
- the use of non-alpha characters, along with upper alpha characters, match “normal” replacement characters
- it is still confusing enough to invite users to write it down in conspicuous locations
Honestly, there are no perfect passwords. The best you can hope for is something that looks like line noise, that the users will not write down on a post-it and put on their monitor.
One final note; you may feel that keeping passwords hidden from everyone else is perfect job security, but don’t but up with that crap from anyone else. The last thing you want is them leaving, or just forgetting what the password was. Don’t let it happen to you, especially if you live outside of Texas. At least in Texas, you could argue justifiable homicide.
Filed under: Tech |