% Copyright 1993 MIT Student Information Processing Board (SIPB)
% passwords.tex - version 2nov1993 rjbarbal

\documentstyle[simplemargins,nopagenumbers]{article}
% The styles in the above line require the following:
%       attach sipb
%       setenv TEXINPUTS .:/mit/sipb/lib/tex/macros:/usr/athena/lib/tex/macros

% Set margins to accomodate long lines and allow article to take only 2 pages
\setallmargins{.75in}

\title{\bf How to Choose a Good Password}
\author{\vspace{-0.4in}\\(and why you should)}
\date{}

\begin{document}

% Kludge so title takes up less space
\setbox0\vbox{\vspace{-.65in}\maketitle{}}\dp0=0in\ht0=.5in\box0
\vspace{-0.5in}

% No page number on first page - the nopagenumbers doesn't work on title pag
\thispagestyle{empty}

\section{Do not use:}
\begin{itemize}
\item Names:
\begin{itemize}
 	\item of yourself, including nicknames;
 	\item of your spouse or significant other, of your parents,
 	 	children, siblings, pets, or other family members;
 	\item of fictional characters, especially ones from fantasy or sci-fi
 	 	stories like the {\em Lord of the Rings} or {\em Star Trek};
 	\item of any place or proper noun;
 	\item of computers or computer systems;
 	\item any combination of any of the above.
\end{itemize}
\item Numbers, including:
\begin{itemize}
 	\item your phone number;
 	\item your social security number;
 	\item anyone's birthday;
 	\item your driver's licence number or licence plate;
 	\item your room number or address;
 	\item any common number like 3.1415926 or 1.618034;
 	\item any series such as 1248163264;
 	\item any combination of any of the above.
\end{itemize}
\item Any username in any form, including:
\begin{itemize}
 	\item capitalized (Joeuser);
 	\item doubled (joeuserJoeuser);
 	\item reversed (resueoJ);
 	\item reflected (joeuserResueoj);
 	\item with numbers or symbols appended (Joeuser!).
\end{itemize}
\item Any word in any dictionary in any language in any form.
\item Any word you think isn't in a dictionary, including:
\begin{itemize}
 	\item any slang word or obscenity;
 	\item any technical term or jargon (BartleMUD, microfortnight, Oobleck).
\end{itemize}
\item Any common phrase:
\begin{itemize}
 	\item ``Go ahead, make my day.''
 	\item ``Brother, can you spare a dime?''
 	\item ``1 fish, 2 fish, red fish, blue fish.''
\end{itemize}
\item Simple patterns, including:
\begin{itemize}
 	\item passwords of all the same letter;
 	\item simple keyboard patterns (qwerty, asdfjkl);
 	\item anything that someone might easily recognize
 	 	if they see you typing it.
\end{itemize}
\item Any information about you that is easily obtainable:
\begin{itemize}
 	\item favorite color;
 	\item favorite rock group.
\end{itemize}
\item Any object that is in your field of vision at your workstation.
\item Any password that you have used in the past.
\end{itemize}

There are programs (and they are easy to write) which will
crack passwords that are based on the above.

% Kludge to allign ``Do'' with ``Do Not''
%	- Ok, so I'm being perfectionist here. :)
\pagebreak
\setbox0\vbox{\vspace{-4pt}\section{Do:}}\dp0=0in\ht0=0pt\box0
\vspace{31.5pt}

\begin{itemize}
\item Change your password every three to six months.  Changing
 	once every term should be considered an absolute
 	minimum frequency.
\item Use both upper and lower case letters.
\item Use numbers and special symbols (!@\#\$) with letters.
\item Create simple mnemonics (memory aids) or compounds that
 	are easily remembered, yet hard to decipher:
\begin{itemize}
 	\item ``3laR2s2uaPA\$\$WDS!'' for ``Three-letter acronyms are
 	 	too short to use as passwords!''
 	\item ``IwadaSn,atCwt2bmP,btc't.'' for ``It was a dark and
 	 	stormy night, and the crackers were trying
 	 	to break my password, but they couldn't.''
 	\item ``HmPwaCciaCccP?'' for ``How many passwords would a
 	 	cracker crack if a cracker could crack passwords?''
\end{itemize}
\item Use two or more words together (Yet\_Another\_Example).
\item Use misspelled words (WhutdooUmeenIkan'tSpel?).
\item Use a minimum of eight characters.  You may use up to
 	255 characters on Athena, and generally the longer
 	the password, the more secure it is.
\end{itemize}


\section{Never!}
\begin{bf}
Finally, NEVER write your password down anywhere, nor    
share your password with anyone, including your best     
friend, your academic advisor, or an on-line consultant! 
\end{bf}


\section{``Why go through all the trouble?''}

Passwords are the primary defense and front-line security for
your personal data.  If someone obtains your password, then
they have complete access to your account and all its data,
and to all the privileges and abilities you have.  If you
give your password to anyone, you are giving them significant
power while keeping all the responsibility for their wielding
it.  There are always better and safer ways of doing anything
legitimate than giving away your password.

The Athena Rules of Use clearly state:
{\bf Do not let anyone know your password(s).}

Giving someone else your password -- including trusted friends, or
even IS/Athena staff members -- is like giving them a signed blank
check, or your charge card. You should never do this, even to ``lend''
your account to them temporarily. This is especially important now
that you can view certain private information online (e.g., academic
records through the Student Information Services program).

Your Athena username identifies you to the Athena user community --
anyone who has your Athena password can use your account and whatever
they may do that affects the system will be traced back to your
username; if your username is used in an abusive manner, you can be
held responsible.

Furthermore, there is never any reason to tell anyone your password:
every MIT student and faculty member who wants an account of their own
can have one; and if your goal is permitting other users to read or
write some of your files, there are always ways of doing this without
giving away your password.  (For example, see the document {\em Managing
Your Athena Account}.)

\section{``What if I forget my password?''}
Don't worry.  Just go over to Athena User Accounts
(Front Desk, Bldg N42, 211 Massachusetts Avenue)
with your picture MIT ID, and they will gladly change it for you.

\vspace{2\baselineskip}\noindent{\it Last updated \today.}

\end{document}