How To Choose a Password...

Your passwords are the keys to many computers, from a bank machine to a multiuser mainframe to a server on a network. Your password helps to prove that you are who you say you are, and ensures your privacy.

Compromised passwords are the means by which most unauthorized (and unscrupulous) people gain access to a system. Someone logging on under your name has access not only to your computer files, but to most of the facilities of the computer system. Since tampering can have far-reaching and serious consequences, it's important to take to heart the following guidelines for choosing a password.

Do choose:

*Something easy for you to remember with at least six characters.

*Something obscure. For instance, you might deliberately misspell a term or use an odd character in an otherwise familiar term, such as "phnybon" instead of "funnybone." Or use a combination of two unrelated words or a combination of letters and numbers.

*A combination of letters and numbers, or a phrase like "many colors" and then use only the consonants "mnYc0l0rz."

*An acronym for your favorite saying, for example, "L!isn!" (Live! It's Saturday Night!)

Don't choose:

*Your name in any form - first, middle, last, maiden, spelled backwards, nickname or initials.

*Your userid, or your userid spelled backwards.

*Part of your userid or name.

*Any common name, such as Joe.

*The name of a close relative, friend, or pet.

*Your phone or office number, address, birthday, or anniversary.

*Your license-plate number, your social-security number, or any all numeral password.

*Names from popular culture, e.g., spock, sleepy.

*Any word in a dictionary.

*Passwords of fewer than four characters.

Mum's the Word

Never tell anyone your password -- not even your system administrator or account manager -- and don't write it down. Make sure you have chosen a password that you can remember. And, finally, change your password at regular intervals

Reprinted from i/s, Vol. 4, No. 9,

May 1989. Revised March 1993.

Copyright C 1993 MIT Information Systems

Send comments or questions about this publication to

<comment-ispubs@mit.edu> or call x3-5150

Before You Begin...

Remember that passwords are case-sensitive, and note whether your keyboard has Caps Lock on. Leash is not programmed to inform you about the state of your Caps Lock key.

How To Use Change Password...

1.In Leash, click on the Change Password button (the one that says abc and has a green arrow), type your username in the first field of the dialogue box that opens, and press Enter or click OK. You may start over anytime by clicking Restart, stop at any time by clicking Cancel, or get help at any time with the Help button.

2.Type your current password in the second field and press Enter or click OK.

The program checks the username and password you entered and notifies you if either is invalid.

3.Type your new password in the third field and press Enter or click OK.

4.Retype your new password, to verify it, and press Enter or click OK.

Once you have entered the new password twice with consistent spellings, the Leash program replaces your old password with the new, if it is a strong password. If Kerberos determines the password is weak, a message notifies you, and you need to repeat steps 1 through 4 with a strong password, as described by the "How To Choose a Password" guidelines above.

How Change Password Works...

When you type into the password fields of the dialog box, neither characters nor sounds echo back, thus keeping secret even the number of password characters. The program accepts only printable characters for new passwords, i.e., characters between ASCII codes 0x20 and 0x7E.

When you have entered the new password twice consistently, the program attempts to change the password via a dialogue with the Kerberos administrative server. Some Kerberos sites, including MIT's Athena environment, check the password's strength before allowing the change to take place and notifies you if it determines that the password is weak.