recommended reading

Advice from a hacker on picking a good password


As mass hacks abound, it's hard to know the best way to handle our Internet security, so we went to a password expert to figure out how best to protect ourselves. Alex Horan is a proclaimed "white hat hacker," meaning he hacks "for good, not evil" in the words of the public relations liason for CORE Security, where Horan is a product manager. He, like us, believes the password system these days isn't ideal for people trying to protect their online info. Though hacks are happening more often for various reasons (as discussed here), there is one part of the dysfunctional system we can control: Our own password habits.

But Horan does not blame us for not using ideal passwords. One of the biggest problems with passwords is the glut of sites that require them. "The end users are really in a bind," Horan said. "More and more things are online and there is no ability yet for me to have a single online ID where I can use the same user name and password to authenticate to some central database." Right now, people are asked to create new usernames and new passwords for everything. When our creativity wanes (and our memories dim) we often resort to reusing the same password. But that's unsafe. The biggest danger of a password hack is that a password found at one site can be used to get into other, more important accounts. (That's what happened to James Fallows' wife, as he explained in The Atlantic.) The other option is to have different codes for everything, which is unreasonable and annoying. A recent survey found 38 percent of respondents would rather clean a toilet than think of new combinations. Another 38 percent said they would rather tackle world peace. So what to do? Here's what Horan suggests.

Save brain space for the really important accounts. For the stuff that really matters, like bank accounts, for example, Horan suggests we use unique passwords for each and every one of them. For the less important stuff, it might make sense to choose a "dumb password," a suggestion we had a few weeks ago. That doesn't totally eliminate the so-many-things-to-remember issue, but it compartmentalizes things. Also, I sometimes forget which passwords I picked for what sites, this system would help me remember, at the very least, what type I picked. 

Forget password, think passphrase. A password indicates some intricate combination of letters and numbers (and maybe symbols) that looks hard to guess. Those are hard to remember, and not always impenetrable. A passphrase, instead, consists of a string of whole words. Like, a line of a book, or a song lyric, Horan suggests. "The first line of my favorite book is very hard for someone to guess and also very hard for a computer to brute force." (A brute force attack is when a computer program does hyper-speed password guessing, which is what happened with LinkedIn.)

Read more at The Atlantic Wire.

(Image via mkabakov/

Threatwatch Alert

Network intrusion / Software vulnerability

Hundreds of Thousands of Job Seekers' Information May Have Been Compromised by Hackers

See threatwatch report


Close [ x ] More from Nextgov

Thank you for subscribing to newsletters from
We think these reports might interest you:

  • It’s Time for the Federal Government to Embrace Wireless and Mobility

    The United States has turned a corner on the adoption of mobile phones, tablets and other smart devices, outpacing traditional desktop and laptop sales by a wide margin. This issue brief discusses the state of wireless and mobility in federal government and outlines why now is the time to embrace these technologies in government.

  • Featured Content from RSA Conference: Dissed by NIST

    Learn more about the latest draft of the U.S. National Institute of Standards and Technology guidance document on authentication and lifecycle management.

  • A New Security Architecture for Federal Networks

    Federal government networks are under constant attack, and the number of those attacks is increasing. This issue brief discusses today's threats and a new model for the future.

  • Going Agile:Revolutionizing Federal Digital Services Delivery

    Here’s one indication that times have changed: Harriet Tubman is going to be the next face of the twenty dollar bill. Another sign of change? The way in which the federal government arrived at that decision.

  • Software-Defined Networking

    So many demands are being placed on federal information technology networks, which must handle vast amounts of data, accommodate voice and video, and cope with a multitude of highly connected devices while keeping government information secure from cyber threats. This issue brief discusses the state of SDN in the federal government and the path forward.

  • The New IP: Moving Government Agencies Toward the Network of The Future

    Federal IT managers are looking to modernize legacy network infrastructures that are taxed by growing demands from mobile devices, video, vast amounts of data, and more. This issue brief discusses the federal government network landscape, as well as market, financial force drivers for network modernization.


When you download a report, your information may be shared with the underwriters of that document.