How to Choose a Good Password

(and why you should)

1 Do not use:

• Names:

– of yourself, including nicknames;

– of your spouse or significant other, of your parents, children, siblings, pets, or other family members;

– of fictional characters, especially ones from fantasy or sci-fi stories like the Lord of the Rings or Star Trek;

– of any place or proper noun;

– of computers or computer systems;

– any combination of any of the above.

• Numbers, including:

– your phone number;

– your social security number;

– anyone’s birthday;

– your driver’s licence number or licence plate;

– your room number or address;

– any common number like 3.1415926 or 1.618034;

– any series such as 1248163264;

– any combination of any of the above.

• Any username in any form, including:

– capitalized (Joeuser);

– doubled (joeuserJoeuser);

– reversed (resueoJ);

– reflected (joeuserResueoj);

– with numbers or symbols appended (Joeuser!).

• Any word in any dictionary in any language in any form.

• Any word you think isn’t in a dictionary, including:

– any slang word or obscenity;

– any technical term or jargon (BartleMUD, microfortnight, Oobleck).

• Any common phrase:

– “Go ahead, make my day.”

– “Brother, can you spare a dime?”

– “1 fish, 2 fish, red fish, blue fish.”

• Simple patterns, including:

– passwords of all the same letter;

– simple keyboard patterns (qwerty, asdfjkl);

– anything that someone might easily recognize if they see you typing it.

• Any information about you that is easily obtainable:

– favorite color;

– favorite rock group.

• Any object that is in your field of vision at your workstation.

• Any password that you have used in the past. There are programs (and they are easy to write) which will crack passwords that are based on the above.

2 Do:

• Change your password every three to six months. Changing once every term should be considered an absolute minimum frequency.

• Use both upper and lower case letters.

• Use numbers and special symbols (!@#$) with letters.

• Create simple mnemonics (memory aids) or compounds that are easily remembered, yet hard to decipher:

– “3laR2s2uaPA$$WDS!” for “Three-letter acronyms are too short to use as passwords!”

– “IwadaSn,atCwt2bmP,btc’t.” for “It was a dark and stormy night, and the crackers were trying to break my password, but they couldn’t.”

– “HmPwaCciaCccP?” for “How many passwords would a cracker crack if a cracker could crack passwords?”

• Use two or more words together (Yet Another Example).

• Use misspelled words (WhutdooUmeenIkan’tSpel?).

• Use a minimum of eight characters. You may use up to 255 characters on Athena, and generally the longer the password, the more secure it is.

3 Never!

Finally, NEVER write your password down anywhere, nor share your password with anyone, including your best friend, your academic advisor, or an on-line consultant!

4 “Why go through all the trouble?”

Passwords are the primary defense and front-line security for your personal data. If someone obtains your password, then they have complete access to your account and all its data, and to all the privileges and abilities you have. If you give your password to anyone, you are giving them significant power while keeping all the responsibility for their wielding it. There are always better and safer ways of doing anything legitimate than giving away your password.

The Athena Rules of Use clearly state: Do not let anyone know your password(s).

Giving someone else your password – including trusted friends, or even IS/Athena staff members – is like giving them a signed blank check, or your charge card. You should never do this, even to “lend” your account to them temporarily. This is especially important now that you can view certain private information online (e.g., academic records through the Student Information Services program).

Your Athena username identifies you to the Athena user community – anyone who has your Athena password can use your account and whatever they may do that affects the system will be traced back to your username; if your username is used in an abusive manner, you can be held responsible.

Furthermore, there is never any reason to tell anyone your password: every MIT student and faculty member who wants an account of their own can have one; and if your goal is permitting other users to read or write some of your files, there are always ways of doing this without giving away your password. (For example, see the document Managing Your Athena Account.)

5 “What if I forget my password?”

Don’t worry. Just go over to Athena User Accounts (Front Desk, Bldg N42, 211 Massachusetts Avenue) with your picture MIT ID, and they will gladly change it for you.

Last updated August 11, 1999.