Password image
image credit

In the wake of the Heartbleed bug, IT professionals are quickly patching their services to ensure this loophole has been closed.  Also security professionals are advising people to change their passwords on any site or service that may have been compromised by Heartbleed.

This is the perfect time to come up with a better password strategy. I recently checked and found that I have several hundred sites that I have a password for.  You may not have as many as I do, but I’m sure you have more passwords then you can reliably commit to memory.

Here are some tips to help you choose and remember a good password.

Password length is just as important as using a complex password. One tip is to add leading and trailing characters, such as # or $. Other then not using common words, password length is the most important thing.

Using Steve Gibson’s excellent password haystack page at https://www.grc.com/haystack.htm  we can see how using more then lower case and password length can make a a difference.

A password with only 6 lowercase characters has 321,272,406 combinations and if we assume 1000 guesses per second, it could be can be cracked in in under 4 days. Adding just upper case characters to our password now brings the number of combinations up to 20,158,268,676 and would put the search time to several months. However some brute force techniques have been developed which would bring even months down to minutes.

Now lets add special characters, numbers and both lower and uppercase.  I’m also going to add leading and trailing characters.

Lets use <>.BirdRed$.<>  as a sample password.

It has 15 characters including a easily remembered phrase and mixed case, numbers, special characters and I’ve padded the leading and trailing ends.

Now there are 468,219,860,267,835,848,675,991,626,495 combinations and it would take 1.49 hundred thousand trillion centuries.  As you can see, adding length and different characters make it much tougher to crack.

Other tips.

Use a unique password on every site.

When padding, don’t use the same special character, mix them up but make sure you can still remember them.

Even if you pad them avoid easy to guess passwords like;

  • Children’s names.
  • Pet names.
  • Birthday dates.
  • Street names.

Having to do this for every site is quite a bit of work, want a better way? Read on.

Password Managers

If you want an easier to way to manage your passwords, there are now password managers that allow you to spend less time remembering and managing passwords. A password manager is a service that allow you to store your passwords in a ‘vault’ and will autofill your login credentials when you visit websites.  The better ones use strong encryption to allow you to store your passwords in the cloud so you can get to them from anywhere.  In this way you only have to remember your ‘master’ password.

The password manager I use and recommend is LastPass.  Several features I like about it include;

1. Cross platform – Runs on Macs, PC, iPhone, iPad and Android.

2. Strong encryption –  Your usernames / passwords are encrypted and only you know the master password. Not even Lastpass can access your private data on their servers.  Just don’t forget that master password!

3. Ease of use – Adding new passwords is very easy as well as seeing existing ones.

Go to lastpass.com and sign up for the service.  It’s free for Mac and PC,  if you want to use it on your mobile device it’s $12 per year (yes $1 per month).  Create a unique master password, then download the plug in for your browser of choice.

At this point whenever you are at a site that requires a password you can have Lastpass auto generate or remember one that you have put in. For more information check out their excellent documentation at Lastpass.com.