2019 02 02: Protect your Password

[JoelR 8,200]

A reminder to securely store your password.  Here are some common-sense safety tips for strong passwords:

Never give out your password to anyone. Never give it to friends, even if they’re really good friends. A friend can – maybe even accidentally – pass your password along to others or even become an ex-friend and abuse it.  

Don’t just use one password. It’s possible that someone working at a site where you use that password could pass it on or use it to break into your accounts at other sites.

Use a pass phrase. Security experts are now recommending a  “pass phrase” rather than simply a password. Such a phrase should be relatively long – perhaps 20 characters or so and consist of seemingly random words strung together along with numbers, symbols and upper and lower case letters. Think of something that you can remember but others couldn’t guess such as YellowChocolate#56CadillacFi$h. that’s relatively long – perhaps 20 characters or so — using seemingly random words strung together along with numbers, symbols and upper and lower case letters. Think of something that you can remember but others couldn’t guess such as YellowChocolate#56CadillacFi$h.  Avoid using famous quotations that might be easy to guess.

Make the password at least 12 characters long. The longer the better. Longer passwords are harder for thieves to crack.

Include numbers, capital letters and symbols. Consider using a $ instead of an S or a 1 instead of an L, or including an & or % – but note that $1ngle is NOT a good password. Password thieves are onto this. But Mf$J1ravng (short for “My friend Sam Jones is really a very nice guy) is an excellent password.

Consider using a password manager. Programs or web services like RoboForm (Windows only) or Lastpass (Windows and Mac) let you create a different very strong password for each of your sites. But you only have to remember the one password to access the program or secure site that stores your passwords for you.

Consider using multi-factor authentication. Many services offer an option to verify your identity if someone logs on to your account from an unrecognized device. The typical method is to send a text or other type of message to a mobile device registered to you with a code you need to type in to verity it’s really you. In most cases, you will not be required to use this code when logging on from a known device such as your own computer, tablet or phone.  Our website supports Google Authenticator.  To set-up, go to your Account Settings > Account Security.  

[Tomster 562]

7 hours ago, JoelR said:

Consider using a password manager. Programs or web services like RoboForm (Windows only) or Lastpass (Windows and Mac) let you create a different very strong password for each of your sites. But you only have to remember the one password to access the program or secure site that stores your passwords for you.

KeePass Password Safe is the password manager I use. It's free and open source. 

Supported operating systems: Windows Vista / 7 / 8 / 10 (each 32-bit and 64-bit), Mono (Linux, Mac OS X, BSD, ...).

There are also Contributed/Unofficial KeePass Ports available for iPhone/iPad, Android and so on.

KeePass is the recommended password manager in the BSI Cyber Security Recommendations BSI-E-CS 001/003 1.5  by the German Federal Office for Information Security 
KeePass is recommended  by the Swiss Federal Office of Information Technology, Systems and Telecommunication (FOITT/BIT) and the Federal IT Steering Unit (FITSU/ISB). It is installed by default on all PCs of the federal administration of Switzerland.
KeePass has received the Certification de Sécurité de Premier Niveau (CSPN)  by the French Network and Information Security Agency (Agence Nationale de la Sécurité des Systèmes d'Information, ANSSI).
 

https://keepass.info/index.html

Edited February 3 by Tomster
additional links removed