Passwords

The password problem
There is a big problem with passwords. They're reusable. This means that once I figure out your password or sniff it or get it through some other means I can use it again and again as many times as I want.

Alternatives
  • One-time password devices are a good alternative since it doesn't matter if you get my "password" because it will be different when you try to use it.

  • Secure Net Key (SNK). This is a one-time password device in that an authentication server will ask you a different challenge every time and you have to use your "magic calculator" to give the correct answer. This requires a $50 device and a secure authentication server.

    There are other devices such as s/key which are based on time or a pre-determined list of passwords. See the reference material for more information on one-time password devices.

    • Password tips
  • Don't use the same password in more than one place. Otherwise when they sniff or crack your password in one place they'll have it someplace else. (I have about 40 password memorized)

  • Make your high-security passwords hard to shoulder surf - meaning don't make it easy to view you type it.

  • Don't base them on any words in any language. There are dictionaries available for just about every language.

  • Make your password at least 6 characters. If the system allows it, make it more than 8.

  • Use mnemonics to remember your password.

  • Don't make your password have anything to do with you.

  • If you use words fudge the spelling so it won't appear in a dictionary. Some dictionaries have misspelled words in them as well.

    ACM@UIUC Main Page