Tips for a more secure password

By Thomas Schoerner Jul 19, 2010, 11:56 GMT

Berlin - What do online social networks, online banking and email accounts have in common? They all require passwords.

These passwords act like sentinels, keeping snoops and data pirates away from one's personal data. But bad passwords are as easy to crack as cheap locks. That means one can't be careful enough when picking a password.

'A good password should include a lot of the different options available on most keyboards,' says Lutz Neugebauer of Bitkom, a German technology industry association.

But most passwords are not particularly creative, with many people opting for phrases like 'Honey,' 'Hansmueller1978' or 'qwerty.' Those have the advantage of being easy to remember, but the drawback of being easy to crack for online thieves.

One might ask how online thieves might guess a password if it's not an everyday phrase. Simple. They can employ brute-force attacks, which try out thousands of words and combinations of letters and numbers within seconds. Customer accounts at online shops and banks are favourite targets for such attacks.

There are some taboos when picking out a password, reports Germany's Federal Office for Information Security BSI. One should never use the name of a family member, pet or friend as a password.

Criminals are usually not stopped either by strings of letters like 'asdf,' which happen to lie next to one another on the keyboard. It's also best to avoid passwords based on existing words, since any word that can be found in a dictionary can be summoned up by a hacker's programme.

The more characters in a password, the more time it will take for a hacker to try out every possible combination and crack it. Arne Arnold of PC Welt, a German computer magazine, recommends having at least 12 characters, since it would take an attacking programme several thousand years to figure it out.

Adding special characters like $, !, ?, or #, as well as mixed lower and upper case letters, adds another layer of security.

But who can remember a password with so many twists and turns? There are tricks.

'You think of a sentence and used the first letter of every word, or just the second or the last letter,' says Nora Basting, a BSI spokeswoman. 'Then you change certain letters into numbers or special symbols.'

Thus, the sentence 'And at 6 am sharp the sun will rise,' would turn into 'Aa6astswr.' It becomes even harder once 'and' is replaced with an ampersand and the 'sharp' becomes an equals sign. Then you have '&a6a=tswr'.

Anyone who uses variants of the same password for a variety of sites as a safety precaution should take heed. 'Variants of a password is a way to remember multiple passwords, but is not the most secure,' says Neugebauer.

People trying to spy - co-workers or the person at the next desk - will just need a little time if they see the password once before they can figure out other variations.

Arnold recommends applications like Keepass for managing passwords.

'It acts like a container and manages various password data files - the user only has to make note of a master password.' The tool can be saved on a USB stick along with all the most important passwords, meaning it can be accessed while underway.

Other similar features include Password Safe and Lastpass. Nonetheless, it remains a must to pick a hard-to-guess master code.

In Germany, only four of 10 people ever take the basic step of changing their password, according to a study by Bitkom.