Passwords and Password Etiquette

All forms of computer security involve passwords. Most likely, you have a university account that you access with a user name and password. When you set up that account, you were probably advised to use a "strong password." That's good advice, but what is a strong password? Probably not "sesame," but what then? Microsoft, a company that has many reasons to promote effective security, provides a definition that is commonly used. Microsoft defines a strong password as one with the following characteristics:

• Has seven or more characters
• Does not contain your user name, real name, or company name
• Does not contain a complete dictionary word, in any language
• Is different from previous passwords you have used
• Contains both upper- and lowercase letters, numbers, and special characters (such as -!@; #$% A &;* ()_+; - =;{} :

Examples of good passwords are:

• Qw37AT1bb?at
• 3B47qq<3>5!7b

The problem with such passwords is that they are nearly impossible to remember. And the last thing you want to do is write your password on a piece of paper and keep it near the workstation where you use it. Never do that! One technique for creating memorable, strong passwords is to base them on the first letter of the words in a phrase.

The phrase could be the title of a song or the first line of a poem or one based on some fact about your life. For example, you might take the phrase, "I was born in Rome, New York, before 1990." Using the first letters from that phrase and substituting the character < for="" the="" word="" before,="" you="" create="" the="" password="">

Once you have created a strong password, you need to protect it with proper behavior. Proper password etiquette is one of the marks of a business professional. Never write down your password, and do not share it with others. Never ask someone else for his password, and never give your password to someone else. But, what if you need someone else's password? Suppose, for example, you ask someone to help you with a problem on your computer.

You sign on to an information system, and for some reason, you need to enter that other person's password. In this case, say to the other person, "We need your password," and then get out of your chair, offer your keyboard to the other person, and look away while she enters the password. Among professionals working in organizations that take security seriously, this little "do-si-do" move-one person getting out of the way so that another person can enter her password-is common and accepted.

If someone asks for your password, do not give it out. Instead, get up, go over to that person's machine, and enter your own password, yourself. Stay present while your password is in use, and ensure that your account is logged out at the end of the activity. No one should mind or be offended in any way when you do this. It is the mark of a professional

Discussion Questions

1. Here are the first two lines of a famous poem by T. S. Eliot, "Let us go then, you and I, When the evening is spread out against the sky." Explain how to use these lines to create a password. How could you add numbers and special characters to the password in a way that you will be able to remember?

2. List two different phrases that you can use to create a strong password. Show the password created by each.

3. One of the problems of life in the cyber-world is that we all are required to have multiple passwords-one for work or school, one for bank accounts, another for eBay or other auction sites, and so forth. Of course, it is better to use different passwords for each.

But in that case you have to remember three or four different passwords. Think of different phrases you can use to create a memorable, strong password for each of these different accounts. Relate the phrase to the purpose of the account. Show the passwords for each.

4. Explain proper behavior when you are using your computer and you need to enter, for some valid reason, another person's password.

5. Explain proper behavior when someone else is using her computer and that person needs to enter, for some valid reason, your password.