iGeneration

Charlie Osborne
Home / News & Blogs / iGeneration

How do I create a secure password? (infographic)

By | January 17, 2012, 12:07am PST

Summary: With cyber-crime rising rapidly, how can you take individual steps in preventing online data theft? The easiest way is to choose a strong password.

We’re finally beginning to see the true repercussions of cyber crime, with every day highlighting yet another hacktivist attack or the theft of personal information online.

From Zappo’s security breach to phishing scams, autorun software and the theft of Norton’s anti-virus code, there seems to be a global trend of gaining personal information through digital networks rather than relying on more ‘traditional’ means.

Killer Infographics recently put together a security-based infographic for Lifehacker, which offers a number of tips for online users who are concerned about increasing cyber-attacks. Focusing on strong password choices, it is an interesting take on how to show users the ways in which they can put online security in to their own hands. Tips on creating a strong password include:

  • Keeping your passwords varied, and not re-using them for at least one year.
  • Avoid Querty-based patterns (for example, 12345).
  • Mix capital and lower-case letter formats.
  • Substitute letters and mix in numbers whenever possible.
  • Switch word orders.

Infographic source: Killer Infographics

Related:

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

More from “iGeneration”

Topics

Security, password, Charlie Osborne

London-based medical anthropologist Charlie Osborne is a journalist, graphic designer and former teacher.

Disclosure

Charlie Osborne

I have no current affiliations or relationships that are worth noting.

Biography

Charlie Osborne

Charlie Osborne, Medical Anthropologist who studied at the University of Kent, UK, is a journalist, graphic designer and former teacher.

After studying Anthropology at university, she spent several years travelling and working across Europe and the Middle East, living for periods of time in Italy and Spain. She has been involved in the running of several businesses ranging from University media and events to b2b sales, and works currently as a freelance website designer and mobile development specialist.

She has particular interests in social media, intellectual property law, data protection and online hacker organisations.

Related Discussions on TechRepublic

Did you know you can take part in these discussions with your ZDNet membership?
Ask a Question Start a Discussion
21
Comments
Add Your Opinion

Join the conversation!

Just In

Disagree on the 10 character vs 8 character
p0figster 29th Feb
Um - 26^10/52^12 1, so I don't know how you figure that a 10 character password of just lowercase letters is stronger than a mixed case 8 character password. Length trumps character mix, but just adding two characters of a limited set doesn't do you much good. I don't know how most people crack passwords, but I'd be suprised if they all had non-informative priors for each character.
View in thread
0 Votes
+ -
Calm down with the font sizes/styles!
R_Connelie@... 17th Jan
It may have visual flair, but I found it challenging to read. The mix of fonts styles and sizes make much of the content difficult to read, especially when sentences mix BIG BLUE LETTERS and ittybittywhitetext. If you're going to call out certain ideas, at least highlight/emphasize coherent phrases. (Lookin' at you, "Microsoft, how secure is my password, free", "Vowel", and "Before")

The most interesting stuff was also the most legible - the sections "10 Worst Passwords of 2011" and "Password Statistics". The were also the only sections that DIDn't have the FUNKY MIX of CaSe, FONT, siZe, and STyLE.

At least, those are my thoughts.
0 Votes
+ -
RE: How do I create a secure password? (infographic)
Natanael_L Updated - 17th Jan
@R_Connelie@... Some more tips:

PASSWORDS MUST NOT BE GUESSABLE! I repeat, NOBODY must EVER be able to guess it! "I think it's safe" is NOT enough, you must KNOW that nobody can figure it out!

Always use passwords longer than 12 characters! Random 8 character passwords can already be cracked by botnets of moderate size today at a fairly high rate, and even 12 character passwords will be in trouble soon. But for most not-so-sensitive things, 12 characters are safe enough. But I always go for 20 characters nowadays for new passwords. Password length is king!

Go ahead and make sentences if you want. But NEVER EVER AT ALL use any existing phrase or saying. ANYTHING THAT EVER HAS BEEN SPOKEN OR WRITTEN are likely to be in *some* database somewhere or be found by a persistant attacker (somebody might try every phrase in your diaries), and is INSECURE.

Make it as random as possible. Going for phrases? Screw up the grammar, intentionally. Use misspellings. Make them sound strange. Make it sound like Yoda. MIX LANGUAGES! Know several languages? Use it to your advantage! And better yet, use other languages too that are close to the ones you know and mix words from them in, because you'll remember those.

Don't shorten them down. If you've got a good sentence, DO NOT SHORTEN IT! Do NOT turn something like "the moon is blue and crazy" to "tmibac", because that's "lossy compression" and thus *throws away* data that an attacker otherwise would have to get correct. With the shorter password, he only need the first characters right while he otherwise would need to get everything right. Because the attacker could also guess for the mouse is boxed and cool" and he'd get the same shortened password, which proves that it's a bad idea (he don't need to make a correct guess, only a good-enough guess).

Bad passwords - and why:
l33tsp33k - short and easy to guess
password - the first an attacker will test
youcan'ttouchthis - well known phrase

Good passwords:
this r4ndom Be, a MUCH ranDOm - Strange grammar, more then 5 words, letters are NOT consistently replaced with numbers, not a known phrase, upper and lower case mixed
cant cant cant be gueeeeesed cant be guessed - Is repetition really bad? Only if the attacker *knows* you're using repetition. Otherwise he won't know if the first three words are unique or identical, and so he must try all possibilities.
crackelyCkrackety KRACK thIS - now we're making up words.
This lsenord is very mycket sfert - mixing languages (swedish and english) and even mixes up words ("skert" and "safe") (edit: Crap, ZDNet don't allow those extra swedish characters...)
0 Votes
+ -
RE: How do I create a secure password? (infographic)
Vapur9 17th Jan
Comparison:
A) thisisasentence
B) MoNk3Y

Even though (A) consists of dictionary words, (B) is still easier to hack through brute force trial-and-error due to the number of characters (15 vs 6). Don't over-complicate your passwords; otherwise, the only person you're making it difficult for is yourself.
0 Votes
+ -
Better than that even
p0figster 29th Feb
Assume in example (a) that the attacker knows you have sentence made up of 4 words and that they use a dictionary of 60000 words to brute force attack. There are then approximately 60000^4 = 1.3x10^19 combinations to consider.
In example (b) assume the attacker knows nothing, then there are approximately 90^6=5.3x10^11 combinations.
The weak sentence is over 24 million times more secure than the second example. Even if the second example had 8 characters, the sentence would still be 3000 times more secure. Make it a 5 word sentence and it's stronger still than a 12 character 'complex' password.
0 Votes
+ -
RE: How do I create a secure password? (infographic)
lewiscb Updated - 17th Jan
Or use lastpass (or keepass)?

For the user that doesn't access critical information with it (or rely on one of them to access them) then you should be fine and don't have to worry about methods to create secure passwords or even remember them.
0 Votes
+ -
RE: How do I create a secure password? (infographic)
hforman@... 17th Jan
@lewiscb Not true. Especially if you are connected to a corporate network. Or even to the Internet. Unless you really don't mind YOUR PC being used as a botnet to access other systems that you would be allowed to access yourself.
0 Votes
+ -
RE: How do I create a secure password? (infographic)
kraabeasa 18th Jan
@lewiscb This is only true if the user in question is not in any way connected to other users who access sensitive information. If they are connected via network, e-mail or social media they can inwittingly infect everyone they know.
0 Votes
+ -
My PC asked for a password of at least 8 characters ...
johnfenjackson@... Updated - 17th Jan
... so I chose SnowWhite&The7Dwarves ...
... but this is apparantly not PC, so I changed it to ...
... SnowCaucasianComplexion&7Height-ChallengedIndividuals wink
0 Votes
+ -
RE: How do I create a secure password? (infographic)
hforman@... 17th Jan
@johnfenjackson@... That's pretty cool. If you are a good typist though. I had a passphase that was over 150 characters including puntuation. I could never remember it nor type it but, since it was one of those corporate mottos that was found everywhere in the company, it was easy to copy and paste into a decryption engine. (Not good for login though).
0 Votes
+ -
RE: How do I create a secure password? (infographic)
celticshaun 17th Jan
Easy, just go on to maidsafe.net and all your stuff will be secure for ever.
0 Votes
+ -
RE: How do I create a secure password? (infographic)
ejhonda 18th Jan
@celticshaun So if you have chosen a weak password for your maidsafe.net account, and use it for all your other online accounts, and then one of those sites is compromised, maidsafe.net is going to protect you how?
0 Votes
+ -
RE: How do I create a secure password? (infographic)
Ndiaz.fuentes 17th Jan
I think you meant "Avoid QWERTY-based patterns", instead of "Querty".
0 Votes
+ -
RE: How do I create a secure password? (infographic)
michael.dodd 17th Jan
I can create secure passwords all day long, the issue is many web sites do not support all special characters, or limit you to xx characters, or some other querky limit
0 Votes
+ -
One more important tip
trophygeek 17th Jan
Don't use the same password everywhere!

It's very common for a secure password to be stolen from an insecure site then reused to get into sites like banks. A good tip is to have 3 tiers of passwords:
- Password for bulk sites.
- Password for sites with personal information.
- Password for sites with financial or medical information.
0 Votes
+ -
RE: How do I create a secure password? (infographic)
Natanael_L 17th Jan
@trophygeek: The easy way to accomplish this is with software like KeePassX. It's 100% free (as in free beer and as in freedom) and it uses the well known and well tested AES encryption algorithm. You only need to remember ONE password, KeePassX stores the rest encrypted.
Your single "master password" is "transformed" using SHA256 into the encryption key that it uses for AES to protect your stored passwords.
There are no known methods to crack SHA256 or AES, so if nobody can guess your master password, the stored passwords are safe (assuming your computer is secure, if you've got spyware then it can steal your passwords!).
0 Votes
+ -
RE: How do I create a secure password? (infographic)
hforman@... 17th Jan
@Natanael_L Thats why there are security systems that don't completely rely on typing something as a keylogger can get those. It all depends on how secure YOU really need to be assuming you can't be made into a botnet at a corporate-level.
0 Votes
+ -
RE: How do I create a secure password? (infographic)
john.medcalf@... 17th Jan
Only reason for upper lower case and numbers and punctuation is if people are watching you enter it. Save yourself some grief if it's only going to be entered in private and use several unrelated words. Isn't going to be guessed in your lifetime. Making passwords that don't need writing down will greatly increase your security versus passwords requiring sticky notes,
0 Votes
+ -
What are the real odds?
Shefftini Updated - 17th Jan
If a site locks one out after three guesses how can any cracking software beat that without having access to the hash file?
Why change a strong password every year? It does not reduce the probability of it being hacked one bit. But it does promote folks falling back to easier to remember passwords. This applies to the archaic mandatory change of passwords every couple of months still promulgated by IT departments. Even Microsoft says it is a bad idea.
11122 is just as strong as 73972.. the odds of it being hacked is exactly the same.
I do support using different passwords on accounts, and all should be at least eight characters long, twelve is better (if the program allows long passwords).
A ten character password of just lowercase letters is more than twice as strong as an eight character one with a mix of upper and lower case, and much easier to remember.
The key to a good strong password is length and rememberability... unrelated words with a length over twelve characters will do most folks just fine.
0 Votes
+ -
Disagree on the 10 character vs 8 character
p0figster 29th Feb
Um - 26^10/52^12 1, so I don't know how you figure that a 10 character password of just lowercase letters is stronger than a mixed case 8 character password. Length trumps character mix, but just adding two characters of a limited set doesn't do you much good. I don't know how most people crack passwords, but I'd be suprised if they all had non-informative priors for each character.
0 Votes
+ -
RE: How do I create a secure password? (infographic)
fm-usa Updated - 18th Jan
Another suggestion:
_________________________
You can use the same password for dozens of sites and not use the same password twice. GEE, how is that possible?
________________________
Take any 8 to ?? letter word that you can easily remember. Add your initials (XYZ) within that password.
Example word, "automobile". Now add your initials.
aXuYtZomobile (every other)
auXtoYmoZbile (every second letter)
autXomoYbilZe (every third letter)
Make it more secure include your first cars model year, say 1989.
Now you have...
aXuYtZo1m9o8b9ile (17 letters) VERY easy to remember but VERY difficult to hack.

You can use the establishments name as your password.
You bank at "Bank of Lyons" and opened an account in 2003.
Use password: lyonsbank
lXyYoZn2s0b0a3nk

Happy Anti-Hacking!
.
0 Votes
+ -
RE: How do I create a secure password? (infographic)
gschneyer 18th Jan
Where can I get this so I can put this up in my office? I tried to make a Word document, only shows the top fourth. Is it possible you can make a Word document or break that up into chunks?

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

Blog Roll

Blog Archive

White Papers, Webcasts, & Resources
ie8 fix