[PCWorld]

Post your comments for What Makes a Good Password? here

[lewac]

i have a very weak pw here because to me it doesn't matter if somebody else uses this account. however I have a VERY STRONG pw based upon certain children in the family (I use the first letter of their first name followed by the two digit year that they were born in. so 4 kids listed in oldest to youngest order followed by the year that each in turn was born gives me an impossible pw to crack.. but one very easy to remember. and one that is 12 chars long. not only that I could easily attach the latest arrival which gives me an additional 3 chars. thus my pw could look something like this: r69j73a11w12 the kids names are rusty, jesse, aliyah, wendy. and because they're my kids its pretty tough to forget the order that they were born and of course, their names. anybody can do this (if they have plenty of kids). like I say, easy as pie to remember... impossible to crack.

[lightsup55]

A good password:
- needs to contain a minimum of 8-12 characters
- needs to contain at least one lowercase letter
- NEEDS TO CONTAIN AT LEAST ONE UPPERCASE LETTER
- needs to contain at least 1 digit
- needs to contain at least one $pecial character
- should NOT be found in any dictionary, including alternative mispellings (misspelled on purpose) and other to 133t w4y$ t0 typ3 1t


Final thoughts:
"P@ssw0rd" is a bad password.

[Evildave]

LENGTH: Pure and simple.

For instance, "I'd rather have a bottle in front of me, than have a frontal lobotomy."

Got a quote? A misquote? A lyric (the above was from Dr. Rock)? Super easy to remember, very hard to crack.

http://xkcd.com/936/
http://imgs.xkcd.com...rd_strength.png

[MeMyselfandI]

All the password protection in the world can be rendered useless by a keylogger, writing down your difficult password, or by hacking an easier administrator password that can get access to your account/password. Unless you're dealing with national security- over thinking the use of passwords is unnecessary. How bad does someone want YOUR password? Are they willing to run a program 24/7 for 6 months trying to guess it? No? Why then bother with a 17,000 year hacker-proof password?

[rem736]

many sites/systems do not allow special characters (e.g., *%^#/) as part of a password. they only allow letters and numbers (albeit they encourage the use of both upper and lower case letters and combinations that do not make up a dictionary word). i can't understand this, especially from financial sites. you would think that they would want to be as secured as possible.

[my1login]

Probably the most comprehensive article I've seen on the subject Sandra. Sound analysis, conclusions and advice.

[JohnWright6oug]

MeMyselfandI, on 01 May 2012 - 05:33 AM, said:

All the password protection in the world can be rendered useless by a keylogger, writing down your difficult password, or by hacking an easier administrator password that can get access to your account/password. Unless you're dealing with national security- over thinking the use of passwords is unnecessary. How bad does someone want YOUR password? Are they willing to run a program 24/7 for 6 months trying to guess it? No? Why then bother with a 17,000 year hacker-proof password?

My sentiments exactly. Even though I think I'm important I can assure everyone that there aren't many people in this world who would be interested in my e-mails, my little bank account,the photos and documents on my computer. Basically nobody cares about me. Now if I were Donald Trump well......

[Evildave]

JohnWright6oug, on 02 May 2012 - 03:01 AM, said:

My sentiments exactly. Even though I think I'm important I can assure everyone that there aren't many people in this world who would be interested in my e-mails, my little bank account,the photos and documents on my computer. Basically nobody cares about me. Now if I were Donald Trump well......

Oh, every little bank account adds up. $1000 here, $200 there, it all adds up. Ask the 'Nigerians'.

When talking about the common security issues, botnets and bot infections and phishing scams and the like aren't about stealing a million dollars from one person, but a little bit of money from a million people, credit card numbers, that sort of thing. When it's all automated, one 'big hack' is worth far less than hundreds of thousands of little profits.