Best Practices
The Challenge: Finding ways to create effective passwords that foil hackers but are easy to remember.
The CRT Solution: The first-ever CRT Best Practices section, loaded with simple, yet sophisticated, tips on choosing better passwords.
You’ve heard it all before. Don’t use personal information that’s easy to access—your mother’s maiden name or even worse, your own name. Make your password at least 8 characters, combining numbers and letters. Change your password frequently. And never write your password down. Sounds smart.
Then reality sets in. You either give up and hope that hackers don’t find you, or you spend your life hitting the “Forgot My Password” button on Web sites.
Now there’s a better way. Try these easy options for creating hacker-resistant passwords. For an additional list of Password Dos and Don’ts, use this link to the CRT best practices web page.
Password Strategies
Method 1: License plate. Take a phrase and squeeze it into eight letters as if you wanted to put it on a vanity plate. The easiest way is to leave out the vowels and compress multiple letters that create one sound (here the ck) into one letter with the same sound.
Ex. Computers rock becomes cmptrsrk
Method 2: Acronym. Create a password by making an acronym out of the initial letter of each word in an easily remembered phrase.
Ex. Most people enjoy mustard and relish on hotdogs would translate into mpemaroh.
Method 3: Interleaving. Combine two easily remembered words or a word and a number.
Ex. Orwell and his most famous book, 1984, would give you 1or98we4ll.
Notice here that the numbers are interleaved around the letter, making the password more difficult to guess. You won’t get confused if you always use the same pattern for interleaving, such as one number, then two letters, then two numbers, etc.
The next step in interleaving is to mix upper- and lower-case letters, numbers, and/or symbols into your letter-based password. Some passwords actually require a combination of letters and numbers, and even when it isn’t essential, adding letters and symbols makes the password more difficult to hack. Remember not to use the same numbers or symbols every time.
Variation 1. Looks like/sounds like. An easy way to remember what symbols or numbers you’ve substituted is to develop a password using methods one or two and then substitute a number or symbol that physically looks like the letter.
Ex. For the password cmptrsrk, substitute a < symbol for the c since the two look alike to get <mptrsrk. Similarly, you could substitute a 3 for an e. A variation on the idea is to use a symbol that you can associate with a letter, like a $ for d (as in dollar) or a # for an n (as in number).
Variation 2. Patterned response. Develop a substitution pattern for adding different cases, numbers, or symbols to your passwords. To substitute uppercase letters, create a password that capitalizes the first and fourth letters. Then when you change the password, capitalize the second and fifth letters, and so on.
You can also use similar patterns for adding numbers or symbols. To help you remember which numbers you’ve substituted, chose a combination of numbers you can remember easily, perhaps the year you moved into your last house or bought your first car. Avoid birthdays, anniversaries, or other numbers that will be accessible to hackers. Use some of the date as numbers and substitute the symbols that appears on the typewriter key over them for the other numbers, such as the # sign for number 3 and so forth.
Ex. If you begin with the password, mpemaroh from Method 2, you could capitalize letters two and five to mPemAroh. Next, choose the date you first bought a car, 1978. Then add these two letters and two symbols on either side of the capital letters. Then you’d have 1P(e7A*oh.
Note: Do not use any of these sample passwords. Once you’ve learned these easy password builders, you’ve taken a big step toward safer data.
Learn More: To test out your password skills, go to http://www.securitystats.com/tools/password to test your passwords. Note that you must not type passwords you actually intend to use. The ones you type in will be out on the Internet unprotected.
Or follow these links for additional password methods and examples.
http://www.crt.realtors.org/passwordtips.html
http://www.symantec.com/homecomputing/library/pass_w.html
http://www.wm.edu/it/index.php?id=82
The Center for REALTOR
