Passwords

We’ve all been through it. One inconsequential aspect of your life is now going to be administered online so you immediately have to come up with a password.

Our lives are now run by passwords. There are those who insist on ensuring that passwords are so complicated and random generated making them impossible to remember, so you write it on a post it note and stick it on your computer. Then there are those so simple and easy to remember that it makes it to the list of most easily cracked passwords.

There are numerous password manager applications and sites that many have found useful, but if you aren’t using these and still relying on managing your own passwords, here are a few suggestions.

If you are in a role where you are responsible for someone else’s data, you are most likely still called upon to come up with a password instantly but need to heed the instructions of your employer or applicable entity. Make sure you are familiar with the ICT and privacy policies and aware of your responsibilities. The data we manage is more often far more valuable than the hardware we are using.

There are different levels of passwords and the security needed in each instance. Recent Cybersecurity scares have taught us that we cannot afford to be too lax in our approach. Even those inconsequential software platforms can contain information that we wouldn’t want to fall into the wrong hands. However, the time spent agonizing over creating a password for some administrative purpose that only takes up about 5 minutes of our life can usually be better spent. I would suggest not using your favourite pet’s name for all of these, because once one of them falls into the wrong hands, more significant data held on other platforms can be in jeopardy.

This is where established patterns that can in some way be personalized to each software platform can be helpful.

Finance, banking and other high level data should be treated with a much higher level of security, with 2 Factor authentication used where possible. These passwords should not be your pet’s name. They should be of a more obscure and distinct nature from usual passwords and, as is the advice of banks on pin numbers and the like, should not be shared with others.

Then there are the midrange passwords for data that can be used for identity theft or other malicious intent. In my opinion. these passwords should be distinct from the finance passwords but still complicated enough to prevent hacking. A blog on the most hacked passwords in the world revealed the amazing commonalities across numerous countries. The most commonly hacked password in Germany, Italy, Spain and collectively, the world is 123456. This is also the second most commonly hacked password in the U.S. (just behind the word ‘password’).

Then there are the passwords for inconsequential, recreational sites. You know, the sort you would have used your pet’s name. These are the sort you really don’t want to waste mental energy on, but even these could be used for identity theft. Care is always needed.

The lists of frequently hacked passwords rarely contain symbols, so use them well. An ! when you could have used a 1 or an i, An @ when you could have used an a, 3when you could have used an e, 5 when you could have used an s, and so on. You could also use a standard symbol to attach to each level of password.

In establishing patterns however, don’t have each password the same, or even the same for different groups. If a hacker is able to ascertain your password for one insignificant site, but determines that this is the same password for more significant sites, the problems are multiplied. Where possible, use some feature of that particular entity to incorporate into your passwords.

This is where we come back to patterns.

Say you need to establish a password for your health fund, ABC Health Fund. Your name is Mary Smith and your favourite pet was Fred. If your username was your email of Mary.Smith@domain.com and you regularly used the password of Fred, if another site with these details was hacked, all your information on that site and every other using the same username and password is vulnerable.

However if your password was created for ABC Health Fund using:

• some components of the name of the site,

• some components of your name or email,

• some components of Fred,

• and using a regular pattern of symbols incorporated into the password,

it is less likely to be hacked but still possible for you to remember.

Also try to make it as long as possible. Some sites require passwords of 8 to 10 characters, so In the example of the Health Fund, if you were to use Fr3dABC, it would not be long enough. A phrase of your favourite song title like SheLovesYou#ABC (and could be even better with substitute characters) could be used. And remember it doesn’t have to actually be your favourite, just something memorable enough so you won't forget it.

Make sure your patterns are distinct but memorable.

Care still needs to be taken to maintain a high level of security. If you write them down, do so in code and keep them in a safe place, Try to make the patterns as complicated as you are able to, while still remembering them. That way when a password requires the use of capital, lower case, number and symbol, you already have that incorporated into your pattern.

Prepare in advance a few password patterns for different levels of security. Chances are you already have them in your collection so take the time to analyse the passwords you have used to date and create consistency for core components of some password patterns to use. It will save you time and headaches when you are next asked to come up with a password instantly.