Please enter a password*
*Password must include at least eight characters, one capital, one number, one special character, and may not use your birthday, first born’s name, current car, or favorite food. Good luck remembering this one.
With the number of news stories about hacked accounts and compromised passwords on the rise, you’d be forgiven for thinking people are doubling down on strengthening their passwords.
They’re not.
According to SplashData, last year’s top five worst passwords were 123456, password, 12345, 12345678, and qwerty.
Part of the problem seems to be that fine balance between creating a password strong enough to keep you secure, but memorable enough that you won’t have to change it each time before you log in. And God help you if you’re forbidden from using one of the passwords that you’ve chosen in the past year.
Enter the password manager. Using third party software to maintain all your passwords, you can auto-generate secure and unique creations and simply copy/paste them into password fields. But now all your eggs are in one basket, and you still need a password to access your treasure trove.
So how do you create that one password to rule them all? Unless you’re saving passwords in a plain text file or on a sticky note attached to your monitor, it’s likely the only way someone will acquire your password is by brute force attack—guessing it randomly.
XKCD, a webcomic, points out that computers don’t really care about the difference between capital letters and special characters as much as the length. That means correcthorsebatterystaple is considered more secure than Tr0ub4dor&3 because the number of guesses needed increases significantly with each character, despite the limited character set.
Now you’re armed with a password manager holding strong, unique passwords for all your accounts and a memorable—but reasonably secure—password to lock them up. What happens when you don’t have access to your password manager on a friend’s computer? That’s where a hybrid approach can be useful.
Take your easy to remember password and add a few characters that makes it unique to the site you’re signing into. Logging into banking? Now your password is CITIcorrecthorsebatterystaple. Checking where your recent purchase is? Try AMAZONcorrecthorsebatterystaple. Heck, through in your Aggie class year and an exclamation point for good measure.
Now when people ask what your wifi password is, you can proudly recite WIFIcorrecthorsebatterystaple2005WHOOP!.
Phew!
Don’t worry if you forget it though—it’s really easy to change. Your router settings are still protected by the default password admin, aren’t they?
Want to check the strength of your password? Be careful using online strength checkers. Simply typing your password into the box can be enough for less-than-honest sites to capture it. If you really want to know, pull up a site like HowSecureIsMyPassword.net, unplug your network cable, then burn your computer after you check—you know, just to be safe.
SplashData’s list of the worst passwords of 2014
Lifehacker’s choice list of password managers.
XKCD: Password Strength