Log In
Complex Passwords and Why You Need Them
The other day we were trying to edit a client’s web site. This site is not hosted with us, and we were attempting to make routine changes. In the past, we had made several changes without problems, so we were baffled when we could not gain access to the site. It was not that our user ID and Password were being rejected, but rather once we got in, we were unable to upload new pages to the server.
We emailed the web host and asked if they were having any issues. Due to a 3-hour time zone difference, there was a bit of a lag in response, but eventually they replied. They informed us that they had turned off FTP access to this site for security reasons. In the future, we would need to contact them to have the FTP access turned on when we needed to make changes, and then tell them when we were done so it could be turned off immediately.
Aside from the major inconvenience and total lack of real world functionality to this idea, I was more curious as to the reasoning behind this. To be honest, my first impression was that they were trying to gain back the website work, as well as the hosting for this account. I was wrong, because it turned out that they had been hacked, and several sites were altered or defaced when the hackers gained access to the servers. I am known for having the right to remain silent, but not the ability, as Ron White says in his act, and this was one of those times. Another of those times of inability was when I was getting a ticket for “jay-walking” in Salt Lake City, but that is a different story! I told them, “If you used something a little more complex than 3 letter passwords, you would not have such a huge security hole.”
Needless to say, this comment did not win me any friends that day.
The sad fact was that the user IDs that we had been given to use for this account were exactly just that. The user ID was 4 letters long, and the password was 3 letters, both were in all lower case letters and formed a common word.
20 years ago, this might have been barely acceptable, but no longer. In today’s computing world, a properly formed user ID and Password should be made up of 3 of the 4 possible character types in a combination, and no less than 8 characters long.
The 4 possible types of characters that can make up a password are:
UPPER CASE letters
Lower case letters
Numbers
Special Characters such as: #$*&^
For increased “hacker discouragement”, you should avoid using words that are common to the site or the company, or easily identifiable to you. Examples of commonly used words that are identifiable to you would be your spouse or child names, or birthdates. If you feel the need to use one of the commonly used words for your password, be creative and use numbers and special characters to spell out the word.
A very good example would be to use @PriL17 for a birth date or anniversary date of April 17.
A Word to the Wise