Wednesday, December 15, 2010

Protecting your Passwords from the foolest of situations

     Your password is your most basic and first level of security. Protecting it is as important as maintaining your other credentials, may it be an email account, a systems guest account or whatever, name it. In this post, we will see some ways of securing our passwords and use a sample Java Password Generator for those who want a quick and and simple yet quite secure password.

One of the basic issues about passwords is simplicity. The simpler a password is, the more it is prone to being compromised. Imagine your password for example is a series of numbers, say 416352, normally you would type it in the numpad since it is easier there. With this, anyone with the intent of stealing your password does not have to memorize the sequence of characters, but instead look at the pattern of how you type them through the numpad. Now this seem too simple of a scenario, but it always happen, and some are even worse, where the victim's password is as simple as his nickname.
     Now to protect your password from visual spying, here are some tips that you might want to consider about your passwords:

1. Make it longer, not just long. A longer password is always better. Some experts suggest that a password should be at least 12 characters long, while some say only about 8 is enough. Well what's important here is the password's long, and it cannot be memorized in a quick and simple glance. For me, the standard length of a password should be 12 to 16 characters long.

2. Use Alphanumeric Characters. When deciding for a password, it is always a good idea to make it a combination of letters and characters. This makes it hard to memorize the pattern of how it is typed through the keyboard, especially when the characters are quite far from each other. It is also better to add symbols, but some password policies prohibit the use of symbols for some reason. As much as possible, use a combination of letters, numbers and symbols.

3. Irrelative. Your password MUST NEVER be composed of any series of characters or numbers that are somehow related to you. For example, your SSS number, birthday, anniversary or something like that. A lot of people have made a mistake with this, especially on their credit cards. With their credit cards stolen and their Facebook account exposing their birthdays which itself is their passwords, they had to pay for something they didn't even know.

4. Use Passphrase. If you find it tiring to memorize alphanumeric passwords, you may just use a Passphrase. Passphrase is the term used on passwords that are somewhat a phrase or a sentence itself. For example, "The Big Brown Fox kills". This is quite easy to memorize but is more prone to being known, but you can always do safety precautions just like using phrases that are not familiar to you, or a passphrase written in a foreign language. Take note that there is always a limit to the length of your password, so keep your sentences not too long, but not too short.

5. Constant change. If possible, change your password every other time. For example, every other month so you don't have to do the same pattern everytime. This also makes your password harder to be guessed, in case you'd still use short passwords after using this post.

     Be wary however, that there exists programs such as Keyloggers, which can record every keystroke that you do without your consent, so however long or whatever the combination of characters you choose, there is still and will always be a chance that you'll get compromised. To protect yourself from these Malware, I'd suggest you use the latest AV's and of course, be vigilant.

     Now if you are tardy enough to think of a safe password, here's a simple java password generator for you. It's an executable jar file and the source files are just inside in case you wanna make sure it's not backdoored.


Java Password Generator can be downloaded here.

3 comments:

wewitsky said...

Hmmm. I haven't uploaded our talk at the 1sT Cyber Warfare Summit yet. We showcased there how easy it is to bruteforce a password when it is something related to your target. We used 3 tools to get inside the root account. This article is cool but lacks something that will prove your claim. Perhaps we should include that talk. Right? :D

Mysterious Letter said...

Yeah. We really should include that. Kinda a little busy to setup some proof so it's some kinda lousy isn't it? :D

wewitsky said...

Nope. It ain't lousy. Just incomplete.