Fix your terrible, insecure passwords in five minutes.

Innovation, the Internet, gadgets, and more.
July 24 2009 7:05 AM

Fix Your Terrible, Insecure Passwords in Five Minutes

A foolproof technique to secure your computer, e-mail, and bank account.

Illustration by Robert Neubecker.

It's tempting to blame the victim. In May, a twentysomething French hacker broke into several Twitter employees' e-mail accounts and stole a trove of meeting notes, strategy documents, and other confidential scribbles. The hacker eventually gave the stash to TechCrunch, which has since published notes from meetings in which Twitter execs discussed their very lofty goals. (The company wants to be the first Web service to reach 1 billion users.) How'd the hacker get all this stuff? Like a lot of tech startups, Twitter runs without paper—much of the company's discussions take place in e-mail and over shared Google documents. All of these corporate secrets are kept secure with a very thin wall of protection: the employees' passwords, which the intruder managed to guess because some people at Twitter used the same passwords for many different sites. In other words, Twitter had it coming. The trouble is, so do the rest of us.

Your passwords aren't very secure. Even if you think they are, they probably aren't. Do you use the same or similar passwords for several different important sites? If you don't, pat yourself on the back; if you do, you're not alone—one recent survey found that half of people online use the same password for all the sites they visit. Do you change your passwords often? Probably not; more than 90 percent don't. If one of your accounts falls to a hacker, will he find enough to get into your other accounts? For a scare, try this: Search your e-mail for some of your own passwords. You'll probably find a lot of them, either because you've e-mailed them to yourself or because some Web sites send along your password when you register or when you tell them you've forgotten it. If an attacker manages to get into your e-mail, he'll have an easy time accessing your bank account, your social networking sites, and your fantasy baseball roster. That's exactly what happened at Twitter. (Here's my detailed explanation of how Twitter got compromised.)

Advertisement

Everyone knows it's bad to use the same password for different sites. People do it anyway because remembering different passwords is annoying. Remembering different difficult passwords is even more annoying. Eric Thompson, the founder of AccessData, a technology forensics company that makes password-guessing software, says that most passwords follow a pattern. First, people choose a readable word as a base for the password—not necessarily something in Webster's but something that is pronounceable in English. Then, when pressed to add a numeral or symbol to make the password more secure, most people add a 1 or ! to the end of that word. Thompson's software, which uses a "brute force" technique that tries thousands of passwords until it guesses yours correctly, can easily suss out such common passwords. When it incorporates your computer's Web history in its algorithm—all your ramblings on Twitter, Facebook, and elsewhere—Thompson's software can come up with a list of passwords that is highly likely to include yours. (He doesn't use it for nefarious ends; AccessData usually guesses passwords under the direction of a court order, for military purposes, or when companies get locked out of their own systems—"systems administrator gets hit by a bus on the way to work," Thompson says by way of example.)

Security expert Bruce Schneier writes about passwords often, and he distills Thompson's findings into a few rules: Choose a password that doesn't contain a readable word. Mix upper and lower case. Use a number or symbol in the middle of the word, not on the end. Don't just use 1 or !, and don't use symbols as replacements for letters, such as @ for a lowercase A—password-guessing software can see through that trick. And of course, create unique passwords for your different sites.

That all sounds difficult and time-consuming. It doesn't have to be. In Schneier's comment section, I found a foolproof technique to create passwords that are near-impossible to crack yet easy to remember. Even better, it'll take just five minutes of your time. Ready?

TODAY IN SLATE

Technocracy

Forget Oculus Rift

This $25 cardboard box turns your phone into an incredibly fun virtual reality experience.

The Congressional Republican Digging Through Scientists’ Grant Proposals

Renée Zellweger’s New Face Is Too Real

Sleater-Kinney Was Once America’s Best Rock Band

Can it be again?

Whole Foods Is Desperate for Customers to Feel Warm and Fuzzy Again

The XX Factor

I’m 25. I Have $250.03.

My doctors want me to freeze my eggs.

The XX Factor
Oct. 20 2014 6:17 PM I’m 25. I Have $250.03. My doctors want me to freeze my eggs.
Politics

Smash and Grab

Will competitive Senate contests in Kansas and South Dakota lead to more late-breaking races in future elections?

George Tiller’s Murderer Threatens Another Abortion Provider, Claims Free Speech

These Companies in Japan Are More Than 1,000 Years Old

  News & Politics
The World
Oct. 21 2014 3:13 PM Why Countries Make Human Rights Pledges They Have No Intention of Honoring
  Business
Moneybox
Oct. 21 2014 4:33 PM Walmart Is Killing the Rest of Corporate America in Solar Power Adoption
  Life
The Vault
Oct. 21 2014 2:23 PM A Data-Packed Map of American Immigration in 1903
  Double X
The XX Factor
Oct. 21 2014 3:03 PM Renée Zellweger’s New Face Is Too Real
  Slate Plus
Behind the Scenes
Oct. 21 2014 1:02 PM Where Are Slate Plus Members From? This Weird Cartogram Explains. A weird-looking cartogram of Slate Plus memberships by state.
  Arts
Brow Beat
Oct. 21 2014 1:47 PM The Best Way to Fry an Egg
  Technology
Future Tense
Oct. 21 2014 4:14 PM Planet Money Uncovers One Surprising Reason the Internet Is Sexist
  Health & Science
Climate Desk
Oct. 21 2014 11:53 AM Taking Research for Granted Texas Republican Lamar Smith continues his crusade against independence in science.
  Sports
Sports Nut
Oct. 20 2014 5:09 PM Keepaway, on Three. Ready—Break! On his record-breaking touchdown pass, Peyton Manning couldn’t even leave the celebration to chance.