Hi Everyone, I hope you’ve all had a great long weekend for those of you that have had it!

I just thought I’d write a quick post regarding general password security. We all know it’s important, but not everyone can be bothered with ensuring that their various accounts across the Internet (and not just here at Ennoverse) have long and complicated passwords which are unique to each site. This is off-putting for those of us that just want to login hassle free, it would be easier if we didn’t need long passwords but the world and especially the Internet is too dangerous for such simplicity.

In a lot of cases a username and a password is the only barrier to entry for an account. Making sure that this barrier is very difficult to penetrate can be a pain. Security experts commonly recommend that passwords now be at least 14 characters long and contain multiple upper and lower case characters as well as numbers and symbols. But how on earth do you go about remember these?

The ‘Phraseword’

Simple passwords are easy to guess.

One solution is to create a phrase (longer than 14 characters) that you remember and replace certain characters with upper case characters, digits or symbols. Look up ‘leet speak’ for some inspiration. For example the phrase: ‘The sea is very wet’ could become tH35eA1SV3RywEt!

But you then run in to another problem that security experts advise against. You may be tempted to use that same password on every site where you have a username and password. The problem here is that if that website is some how compromised and a hacker stole the user database, they then have your password and a means to access every other account that you used that password on.

So what can you do to have a complex password that you can remember and not duplicate it across web sites?

LastPass

Well there are a few answers out there. One I personally use is LastPass. This is a great system that allows you to use one password (preferably a complex one as described above) and acts as a secure directory of all of your usernames and passwords. It includes a password generation tool to automatically create random long complex passwords for each site that you register with, which means they can be all different passwords.

The great thing about LastPass is that it is free and very secure. The passwords are encrypted and stored locally as well as on the LastPass servers. They have plug-ins for most web browsers allowing for auto-login and auto-fill features. If you want even more security they also allow multi-factor authentication. This is where you as well as asking for a username and password (something you know), they will ask you for something you have, such as a key-fob or a number grid. As only you have these items the authentication is much stronger and safer since just knowing the password won’t help.

SuperGenPass

Another thing I have used before is a bookmarklet called SuperGenPass. This tool sits in your bookmarks toolbar and allows you to generate a long complex password that is different for each site that you visit. Cleverly it uses a combination of a master password and the website’s domain name to generate a different and unique password that only you can re-generate by entering the correct master password. It is by-far the simplest system. This doesn’t rely on storing your passwords anywhere although you can opt to store the master password (but I wouldn’t recommend this) and you can download it at any time or access the web-based version which is handy on a mobile browser or locked-down computer systems.

KeyPass

The last one I will write about is a program called KeyPass. This is a little different from the above two solutions as it is a fully-fledged program that runs on the desktop, separate from any web browsers. This works by storing passwords in an encrypted database file to your hard disk or any online or shared storage medium (if you wanted to share certain passwords perhaps..) Access is granted via a password, so make sure it’s a secure one! This is definitely aimed at people who have a large amount of sites and even offline systems that they access in a way that can be organised. While you can quite easily share a password database with people by giving them the encrypted database file, you’d end up sharing all of the passwords within it.

As this is not the intended use all I can say is that it makes quite a handy password utility. It has a nice feature that when you copy a password to paste in to a form field, the program starts a timer (12 seconds for example) which at its expiry will clear the clipboard contents to prevent accidental pasting of sensitive information. There are a lot of other cool things it can do too such as command-line execution but I won’t go in to too much depth there.

This is a Windows application but the developers say it can be run on various Linux flavours and Mac OSX when using Mono.

Final Thoughts

So as we see there are a lot of solutions out there for being secure with your passwords and having systems to remember them for you while not repeating passwords across site. Brute force attacks are common and processors are getting more powerful to crunch through passwords. If you have a dictionary based password you should think about using something more secure, maybe one of the above solutions.

For our customers’ web hosting accounts we do prevent brute force attempts quite successfully but you really can reduce password cracking success rates by securing your passwords on every site that you use.

If you know of other handy password management tools, we’d be interested to hear. Please post them in the comments! Thanks for reading.