Password Tips

Attackers can use multiple methods, most often automated, to "crack" your password. These methods can consist of brute force attempts, dictionary attacks and social engineering (e.g., via phishing). A strong password can help deter the first two attack methods so you should keep the following in mind when selecting a password:

• Make passwords at least eight characters long
• Don't use a user name, a real name or company name
• Don't use a dictionary word (even slang and foreign languages)
• Don't use phone numbers, Social Security numbers, license plates or birthdates
• It should be significantly different from previous passwords
• It should contain characters from each of the following groups:
  • Uppercase and lowercase letters
  • Numbers
  • Symbols (!,@, #, $, %, etc.)
• Don't use the same password for multiple accounts (e.g., Swarthmore, Amazon, Gmail, etc.)

With today's password cracking capabilities, using any single word as part of a password, even with numbers substituted for letters, is NOT sufficient.

You should never share your passwords including with supervisors or co-workers. Don't write it down and then leave it on your display, under your keyboard, etc. In your browser (e.g., Internet Explorer, Firefox, Safari, etc.), you should always disable the Save Password option.

You can change your password any time.

Below are some ideas for generating strong yet memorable passwords (from: 'Perfect Passwords: Selection, Protection, Authentication' by Mark Burnett):

• Use three words (or more) together but not as a phrase.
  • Could be 3 synonyms, homonyms, antonyms, rhymes, etc.
  • Examples: WonSunTon, Pleasekeysfleas, Basesbasisbasses
• Use a made-up email address (not your own!).
  • Pick a name then a related phrase for the address.
  • Examples: Mickey@mouseworld.net, vacation@aruba.com
• Model your password after a real or made-up URL.
  • Examples: www.whatsmypassword.com, www.nonewsisgood.org, ftp.drydesert.edu
• Use word and number combinations that rhyme.
  • Pick two or more numbers and then a phrase that rhymes.
  • Hint: get some ideas from www.rhymezone.com
  • Examples: 43FruitTree!, 488studentsintheDebate?
• Use a common phrase stated in an uncommon way or as a question.
  • Examples: Temperaturesensitivedevice (i.e., a thermometer), whatISamovieonadisk? (i.e., DVD)
• Think of a personal secret (perhaps embarrassing?) that only you know.
  • Examples: asleep@Meeting!
• Invent an imaginary phone number.
  • Consider including spaces, dashes, and parenthesis.
  • Hint: don't use 867-5309 from the 1980's song...
  • Examples:(800) Sec-urme,1-888-keepout
• Take two or more words and swap the first letters.
  • Capitalize one or both of the first letters
  • Examples: Eink plephant,hexas Told-em!

A good password choice is one that is very hard to guess but also easy to remember.

Finally, below are the ten most common (and horribly weak) passwords discovered by hackers of the Gawker Media websites (courtesy of the Wall Street Journal):