Sunday, January 6, 2008

the perfect password: a checklist

My passwords are pathetic, according to the article “How Pathetic is your Password?” posted on Yahoo! Tech this week. I have two passwords which I use for my so-called important accounts such as my two “official” e-mail addresses. No, my passwords are not my crushes' names, nor is it the name of our street, or whatever one can think may be associated with me. Plus, not all characters there are letters. Hence I always thought that my passwords are secure. Apparently not.

Password recovery done by hackers may be a hit-and-miss method, but is not manual as I would be doing it. Rather, it would require programs that can run by themselves until they get the password right. In a password recovery speed data from a website, my password, the one which uses only letters, would take as long as 447 years for a class A hacker (which can guess up to 10,000 passwords per second) and as short as 39.25 hours for a class F hacker (which can guess up to 1 billion passwords per second; these are supercomputers already) to hack and hence, access my e-mail account. Not that anyone is interested now but, who knows? When I become a killer lawyer (killer or lawyer? haha), my opponents just might be interested in checking out my mail and may be smart and rich enough to use a class E hacker.

According to the same article, the key to security is not just length, but adding more non-traditional letters. Check how secure your password is by grading it according to this criteria. A great password should have: (1) eight characters or more, (2) at least one number, (3) at least one uppercase letter, and (4) at least one special character. My grade is just two out of four, for one of my passwords, and a measly one out of four, for my other password. How about you? I invite my classmates to post their scores in the comments section.

To change or not to change passwords? Maybe, but not now. Until then, I will just hope that no one will hack my accounts.


sources:
http://tech.yahoo.com/blog/null/44
http://tech.yahoo.com/blog/null/13353
http://www.lockdown.co.uk/?pg=combi&s=articles

No comments: