News, info, and opinion by Mac users, for Mac users.

December 15, 2006

security

A little bit on passwords

Posted Dec. 15, ’06, 6:38 AM PT by Derik DeLong
Category | Security

Bruce Schneier This isn’t strictly Mac related, but passwords are a fact of life, regardless of what platform you’re on. That goes double if you do anything online. Bruce Schneier, one of the lead security technology experts of our time, did a little breakdown of some MySpace passwords (retrieved by a recent phishing attack).

His blog entry is chock full of useful statistics and lessons in what not to do with passwords. A few quick rules of thumb out of my own book:

  • Longer is better, just as long as you can remember it. If you have to write it down or string together a lot of dictionary words, making it longer isn’t helping.
  • Mix letters and numbers. Don’t use just one or the other and if you use both, do it in earnest. Attaching “1” at the end of an all letter password isn’t helping.
  • Don’t use common words or phrases.

That said, the top password chosen in the sample was “password1”. That’s not a particularly bright password. Here’s a few other common ones: abc123, myspace1, password, blink182, qwerty1, 123abc, baseball1, football1, 123456, soccer, monkey1, liverpool1, princess1, jordan23, slipknot1, superman1, iloveyou1 and monkey. Note the adding of “1”. I removed one of the passwords from Bruce’s list. Enterprising individuals will be able to figure out why.

The good news is that compared to a corporations password database, this sample is much better in terms of security. Considering how much less important MySpace is, it’s a good sign that kids are learning the lesson earlier.

For Mac users, we need to keep password strength in mind when choosing ours. It’s even more important if you have any services from your Mac exposed to the net, particularly the FTP, personal file sharing, or remote login services.


1 Comments

Nick said:

Very, very good article and I would like to see more like that.

People need to be made aware again.

Kudos.

December 15, 2006 10:04 AM

Leave a comment

 



Visit other IDG sites: