Tip of the Week: How to Generate Strong Passwords That You Can Actually Remember

 Passwords are effectively the cornerstone of your business’ data security—if they aren’t up to muster, your protections could crumble. Unfortunately, many users shortchange their passwords to try to make them more convenient, also making them more convenient for cybercriminals. Let’s see how we could (and should) make passwords as effective as possible.

Threats Against Your Passwords

There are two different ways that an attacker will generally try to undermine your password:

1. Using trickery to fool your team members into sharing their password.
2. Using tools and malicious software to deduce and/or steal the correct credential.

Because of this, it is important that you ensure that all the passwords that your users have in place are strong enough to resist both methodologies.

Balancing Strength and Memorability

Considering this, it makes sense to keep the following ideas in mind as you put together your passwords and password policies:

• If a password cannot be guessed, stolen, or deduced, the hacker will likely try any and all possible combinations until they get a match in what is called a brute force attack.
• A password’s security and that same password’s resilience against being brute forced are two different things.

For an optimally secured password, you must consider both of these ideas.

Using This Information to Optimize Your Passwords

There are a few standbys when it comes to password best practices that are likely familiar to you:

• A password needs to be longer, ideally over 16 characters in length when allowed
• These characters need to include a combination of non-consecutive letters, numbers, and symbols
• These characters don’t represent any common words or numbers, private information, or any publicly accessible details

In addition to these precautions, we must consider how attackers break into passwords through brute force attacks. To help avoid that outcome, your passwords need to be sufficiently complex as well.

Approximately 40 percent of passwords in use only contain lowercase letters, which enterprising cybercriminals are well aware of and use to their advantage throughout their brute force attacks. They do so by first only checking combinations of exclusively lowercase letters, making their efforts much faster. Each additional variable adds to the difficulty the hacker will have decoding it, potentially convincing them to abandon their efforts before success.

Of course, you still need to remember these passwords, so if you can’t commit it to memory it isn’t going to help you, either.

As a result, an idea has come around that a truly ideal password is made up of a few randomized words with random alphanumeric substitution and capitalization sprinkled throughout them, padded out with symbols. After all, each variable we incorporate makes the hacker’s job that much more of a challenge and could foreseeably stymie any automated efforts to bypass the password long enough to render the search impracticable.

So, in light of this, a good password might look something similar to this:

++++g@rb@gE;;;br|ghtEn;;;sc0v|llE++++

Taking this password into closer consideration, we can see why it would be nigh impossible to guess, without being impossible for a user to remember. However, its varied construction also means that a brute force method would have to go through an extensive list of permutations before eventually landing on this precise combination.

So, if you’re up to the challenge, it makes sense to consider making your passwords look something like this from here on out.

The Matter of Remembering These Passwords

Of course, using a separate example of a password like this for each account you have is a considerable feat—daunting for most people. A password manager can make it much simpler to keep to these best practices.

A password manager is a specialized software that securely stores your active passwords for you to use, locking them behind a single master password. That way, you can keep to password best practices without having to remember dozens of different passwords.