How to ... Select a Safe Password

Password Security is Important!

Applying the techniques outlined below make the length of time required to break a password prohibitively long.

Time required to break a password drops significantly as each letter is guessed, or other information is known about a password.

• Trent's IT Department including the IT Service Desk will NEVER ask you to send or update your password in an email link.
• To ensure the speedy recovery of your password, if you have forgotten it, update/complete your profile for the Self-Service Password Reset tool. Instructions on how to update/complete your profile can be found in our Self Service Password Reset User Guide at: https://www.trentu.ca/it/services/user-guides/self-service-password-reset

Password Standards and Complexity

As per the NIST Digital Identity Guidelines:  http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf

1. A password should never be reused.
2. The longer the password, the harder it is to crack.
3. While the new NIST standard does recommend the move away from comprehension rules (special characters, numbers, and upper and lower case letters), the recommendation is that this be done in conjunction with automated screening of new passwords (section 5.1.1.2: Memorized Secret Verifiers).  So, new passwords created would run against algorithms that attempt to crack them versus working against a set of comprehension rules.  The issue with the implementation of the standard, is the state of technology today.   Most username and password systems, including Trent’s, does not function this way yet.  So, removing the password comprehension rules would allow a password to be “aaaaaaaa” and in the absence of automated screening, this would pass.  This is problematic, but the software vendors will catch up and comprehension rules will be replaced with screening rules in software in time. 

Trent’s current standard calls for passwords that are;

• at least eight characters long,
• contain at least one upper case letter, and
• contain at least one number.

How to Select a Good Password?

1. Think of a sentence that is memorable, eg.  I usually take my daughter to the zoo on Sunday to see the elephants.
2. Create a passphrase from this sentence that can be used as your password eg.  daughterzooSunday4elephants.  Remember that Trent’s current standards still calls for one number and one upper case letter.
3. Test your password with a verified password checker eg.  The Password Meter: http://www.passwordmeter.com/

You can see that there are a LOT more DO NOT's than DO's, but following these recommendations will keep your data as safe as possible.