Jim Calloway recently had a
useful blog about good passwords and bad.
Like most people, he recommends multiple passwords for different sites, which virtually makes a password manager mandatory. He also has a link to the “500 worst passwords” which are pretty amusing and a thorough article on good passwords and bad.
If you don’t want to go whole hog, there are a couple of lesser techniques that can be very effective. The first is to use a phrase rather than a single word. My favorite example at a client site was a user whose password was “idontgiveadamn.” A not-so-good example was “johnpaul17.” When I saw this, I asked the user: “let me guess, your kids names are John and Paul and you’ve had to change your password 17 times .” Right.
The second technique is substitution. Pick a password that will be easy for you to remember and then do a certain number of substitutions for non-alpha-numeric characters.
For example, change a to @
change o to 0 (zero)
change s to $
change I or L to 1 (one)
In addition, you can preface or follow the password by a character such as tilde (~) or exclamation point (!), or put the year the person started work in parentheses (08).
All these will make a password that is easy to remember and extremely difficult to break or for anyone else to guess. Here’s some examples (in addition to the one in the title):
roadrage could become ~R0@dr@ge
manicotti could become !M@n1c0tt1
instantaccess could become (09)1N$t@nt@cce$$
Note that you do not have to do every single substitution to be effective, just a couple. This is a much better solution than those imposed by overzealous IT guys where the password is random characters, can’t be remembered, and is consequently put on the monitor with a yellow sticky (I actually saw one user that had at least a half dozen stickies on his monitor with all his passwords).