Sunday, June 17, 2007

Create new passwords, as a rule

If you're anything like I am, you have dozens and dozens of user names and passwords. Right now, I have over 80 different accounts. I've got Hotmail, Yahoo! mail, Google Mail, AOL mail, Time Warner mail and various other web services, as well as traditional services, like online banking or credit card company accounts.

With so many different accounts, there is a big temptation to use the same password for every time you set up a new one. When you use the same user name and password everywhere you sign in online, if someone figures out your password they instantly have access to everywhere else you go online.

I recommend you use a different password on every site for which you have an account. Of course, you may be saying, "There's no way I can remember over 80 different passwords." I totally understand how you feel, but it can be done.

Would you believe me if I told you that I have a different password for practically every account I have online? I do.

Instead of making an arbitrary decision about what my password is going to be, I use a "password rule" that I made up myself to help me generate unique passwords for every place I have an account. In my case (now I'm not going to share my exact rule, because if I did, then you'd be able to generate all my passwords), I use a multi-part rule.
  1. Something unique about the site I'm visiting (maybe reverse the letters of the site name, "Yahoo" might be "oohaY")

  2. Something unique about me, like "browneyes" (this might stay the same across many sites)

  3. Some other unique factor (maybe a color that starts with the first letter of the URL, in this case that would be "yellow.")
When you add up Part 1, Part 2, and Part 3, you'll get a password that is fairly long, in this case we would get, "oohaYbrowneyesyellow," a 19-character password. Many of my passwords are more than 22 characters, but because I know my rule, I can quickly recreate my password without having to carry around a piece of paper.

Note: There's also a temptation to use the same user name for each account, though it's less dangerous if your passwords are different. You could use a similar strategy to create unique user names for each site.

No comments: