Established 1993

Iconography

Gray Arrow

“Password must contain at least one uppercase letter, symbol, and number!”

I’m sure we’ve all seen this phrase when signing up for a new account online. In the earlier days of the web, there wasn’t as much concern about web security, making simple passwords quite common. But while plain passwords are easy to remember, they are incredibly unsecure.

Let’s take a look at the first five entries in SplashData’s 25 worst passwords of 2013:

  1. 123456
  2. password
  3. 12345678
  4. qwerty
  5. abc123

Enticing though they may be, those five passwords could be guessed in under a second. And that’s just using just a desktop computer!

In our line of work, when handling client information online, we commonly run into passwords structured something like “arthur42.” Just a name or a word followed by a number. You might think that the number makes it secure, but in reality, it only makes the password minutely more difficult to crack. Rather than an instant guess, it jumps to 11 minutes. Capitalizing the “A” increases decryption time to a whopping 15 hours, but I think we can do even better.

Building a Better Password

When a website urges you to add a symbol and number to your password, you may find yourself wondering, “What good will that really do?”

Going back to our example above, let’s try adding another number and a single symbol. “Arthur423$” would take 58 years. That’s 1,411 times longer than the password above! While that’s definitely an improvement and you’re vastly better off using that than “arthur42,” we can still do better.

The reason these simple passwords are easy to crack is because the automated tools used to crack them have a huge dictionary of words to pull from. They’ll automatically (and very quickly) try those words and variations on their spelling and capitalization while also trying to append numbers to them until they finally get a match. So while adding a “$” or “3” doesn’t solve our problem, you can see how utilizing symbols and numbers can greatly boost the security of your password. Less than a second to 58 years is quite a jump!

So, what would we consider to be a good, strong password? I personally use a random password generator that just now gave me “M$j%[email protected]*O.” Using the same parameters used to gauge “arthur42,” it would take your average desktop PC 16 billion years to crack it. Since that’s 3 billion years longer than the age of the universe, I think we’ve found our secure password.

Remembering a Better Password

“M$j%[email protected]*O” may be secure, but it’s not very easy to remember. Some people come up with memory tricks to remember their passwords, but that’s not always possible. So what are our options? How can we be secure, but not have to rack our brains trying to remember dozens of super-complicated passwords?

Personally, I use a password manager. A password manager is a program that keeps track of your passwords for you in an encrypted database. It only requires the memorization of one super strong password to be given access to all of your accounts. Now, this may seem like an “all your eggs in one basket” approach, but any good password manager will require multiple means of verification (commonly known as two-factor authentication). That way you — and only you — can have access to your passwords.

My preferred manager at the moment is KeePass, which allows you to store your passwords in a secure, encrypted database file. To unlock that encrypted file, you can utilize up to 3 methods of verification: encryption key file, password, and Windows account verification (which will limit access to the database to the user who created it). I utilize the encryption key file and a strong password. The downside to KeePass is that it requires a good bit of setup and a little extra know-how to use it effectively.

A more user-friendly method is LastPass, which exists as a website and browser plugin for managing passwords. The major advantage LastPass has over KeePass is the browser plugin detects what site you’re attempting to log into and auto-populates the login form for you. The major disadvantage is that your encrypted passwords are stored on a 3rd party’s server rather than locally on your own machine. But since LastPass also offers two-factor authentication via several mobile apps for an extra layer of security, it’s still a strong option — and much preferable to “arthur42.”

In Summary

While prompts to create a stronger password may seem like an annoyance or inconvenience, the value of a strong password cannot be overstated. The easiest way for someone to gain unwanted access to your email, social media, or other online accounts is by guessing your password. The weaker the password, the easier this becomes. Tools like LastPass and KeePass can be very helpful for utilizing strong, complicated passwords without the hassle of having to memorize them.

 

Tagged: , , ,

Leave a Comment

Good words are worth much, and cost little. George Herbert
    • Find Your Park CVB Ad
    • An ad design for the Visit Hagerstown and Washington County Convention and Visitors Bureau, in cooperation with the National Park Service.
    • Longmeadow Dental Website
    • Copywriting, website design and development for Longmeadow Family Dental Care. See it live!
    • USMH Self-Mailer
    • Die-cut self-mailer designed for the University System of Maryland at Hagerstown.
    • City Center Banner Stands
    • Design and printing of banner stands for the City of Hagerstown.
    • Potomac River Atlas
    • The Hagerstown-Washington County Convention and Visitors Bureau & the Washington County GIS office approached the team at Icon Graphics to take Bonn A. Poland IV’s fantastic comprehensive GIS maps of the Potomac River and create both a print and an online atlas. See it live!
    • Blues Fest Website
    • In 2014, we redesigned the Western Maryland Blues Fest's website to be fully responsive and easily updated for each successive year's designs. The artwork, logo, and colors swap out every year to match the annually changing art and theme. See it live!
    • David Lyles Developers Web Redesign
    • We redesigned David Lyles Developers website to showcase their outstanding residential and commercial developments, along with their incredible remodeling work. The site also includes links to all of their commercial and residential listings. See it live!
    • Hollowell Web Design
    • Hollowell Brethren in Christ approached us to redesign their website, requesting a modern friendly design with streamlined navigation that gives lots of information about the church and the site. See it live!
    • Goodwill Annual Report 2014
    • The 2014 annual report for Horizon Goodwill in Hagerstown. We went with a GPS theme for the entire report, each interior spread a custom design.