O'Reilly - Practical UNIX & Internet Sec... 7015KB

[Chapter 3] 3.6 The Care and Feeding of Passwords
●
●
●
●
●
●
●
●
●
Other information easily obtained about you (e.g., address, alma mater).
Words such as wizard, guru, gandalf, and so on.
Any username on the computer in any form (as is, capitalized, doubled, etc.).
A word in the English dictionary or in a foreign dictionary.
Place names or any proper nouns.
Passwords of all the same letter.
Simple patterns of letters on the keyboard, like qwerty.
Any of the above spelled backwards.
Any of the above followed or prepended by a single digit.
3.6.2 Smoking Joes
Surprisingly, experts believe that a significant percentage of all computers without password content
controls contain at least one account where the username and the password are the same. Such accounts
are often called "Joes." Joe accounts are easy for crackers to find and trivial to penetrate. Most computer
crackers can find an entry point into almost any system simply by checking every account to see whether
it is a Joe account. This is one reason why it is dangerous for your computer to make a list of all of the
valid usernames available to the outside world.
3.6.3 Good Passwords: Locked Doors
Good passwords are passwords that are difficult to guess. The best passwords are difficult to guess
because they:
●
●
●
●
●
Have both uppercase and lowercase letters.
Have digits and/or punctuation characters as well as letters.
May include some control characters and/or spaces.
Are easy to remember, so they do not have to be written down.
Are seven or eight characters long.
Can be typed quickly, so somebody cannot determine what you type by watching over your shoulder.
It's easy to pick a good password. Here are some suggestions:
●
●
Take two short words and combine them with a special character or a number, like robot4my or
eye-con.
Put together an acronym that's special to you, like Notfsw (None Of This Fancy Stuff Works),
auPEGC (All UNIX programmers eat green cheese), or Ttl*Hiww (Twinkle, twinkle, little star.
How I wonder what...).
file:///C|/Oreilly Unix etc/O'Reilly Reference Library/networking/puis/ch03_06.htm (3 of 6) [2002-04-12 10:44:35]