Password recommendations

As many of you will know, the first line of attack for trying to illegally access a computer is by discovering user account passwords.

Passwords, then, are a key part of the security barrier around any computer. If hackers discover a user password, they can enter the system without notice. This can be hard to detect and take a long time to trace.

This problem is magnified several times if the computers are networked, as in the case of the Facultad de Informática.

This document aims to provide some general tips on what passwords to use in different environments.

1.- Why should I be careful?

You will be asked to sign that you have read and accept the Computer Suite Access Policy and the Account Opening Application. They state:

As users have sufficient mechanisms to make their accounts secure, they shall be held responsible for any undue use of them.

The key word here is RESPONSIBLE. No matter how unfair it may seem, users must accept their responsibility for any irregularities. These regulations are being applied at both national and international research centres. We have not invented them. It is only logical that the Computer Centre cannot take responsibility for the consequences of user negligence, slovenliness or thoughtlessness.

One of the reasons why you should take care is that you will find it hard to prove that you were not the offender if anybody uses your account incorrectly.

2.-What is a good password?

A good password should meet the following requirements:

• It should be private, i.e. known and used by only one person
• It should be secret, i.e. should not appear unencrypted in any file, program or paper
• It should be easy to remember
• No program should be able to figure it out or deduce it in a reasonable time period (over a week).

Although it looks tough, it is actually quite easy to devise a good password.

3.- How can I choose a good password?

Password guessing programs do not try out all possible combinations. What they do is try out a lot of "possible passwords". If your password is not in the search space, then you have nothing to fear.

But let's take a look at what you should not do:

• Do not use your user name in any form, either as it is, spelled in reverse, in capitals, with a prefix, etc.
• Do not use your first name or family name, or any traceable and/or deducible personal data: initials, date of birth, car number plate, phone number, name of spouse, girlfriend, boyfriend, children's names, address, etc.
• Never use a word taken from a dictionary (even foreign language dictionaries), list of words, street names, car manufacturers, fictional characters, etc.
• Do not use a password with less than six characters or letters or digits only

Good passwords should comply with the following recommendations:

• Use a password with a mix of letters, digits and non-alphanumerical characters.
• Use long passwords containing more than eight characters

Also, there are methods to help you choose a good password:

• Take the lyrics of a favourite song, poem or text of yours and use the first letter of each word, e.g. "To be or not to be, that is is the question". The password would be: TbonttItq.
• Mix consonants and one or two vowels until you have at least eight characters. This method will usually produce pronounceable and memorable passwords: gamounitos
• Take two or three short words and join them with a punctuation mark: bread+wine

Remember that if you use letters only, do not use any of the following methods:

• All capitals or all small letters
• First or last character in capitals
• Only vowels in capitals
• Only consonants in capitals

4.- Passwords in different environments

All operating systems place restrictions on what character set you can use for your password:

• Unix accepts any printable character. It distinguishes capital from small letters. It recognizes the first eight characters only.
• Open VMS can use any alphanumerical character, plus the "_" and "$" signs. It does not distinguish capitals from small letters. The maximum password length is thirty-two characters.

5.- Why should I change my password?

No matter how good your password is, it still could be discovered. Someone may have seen you key in your password or capture it through sniffers (programs that listen to network traffic). Hackers may have set up a terminal server simulator and be capturing passwords or have installed a resident program on your personal computer that logs keystrokes and stores the password. Passwords are often discovered through "failed logins", as many users make the mistake of keying in the password instead of their user name.

For these and many other reasons, we recommend that you change your password every now and again and at least every three months.

6.- Can I use the same password for all my accounts?

The problem with using the same password for all your accounts is that anyone who discovers the password of one of your account's will have access to them all.

Another thing you should never do is use elementary algorithms to generate passwords, e.g. MhCfg101, MhCfg102, ... This is not the best option, as anybody could easily guess at them.

Also, if anybody enters your account, they could install a false Telnet and capture your passwords when you use it again.

For this reason, we recommend that you use a different password for all your accounts. Also make sure that they are not alike. If for any reason you are unable to use different passwords, be very careful about the one you do use and be sure to change it regularly (at least once a month).

Computer Centre