Start Page: Protecting those pesky passwords is necessary evil

Kim Brand
January 4, 2012
Back to TopCommentsE-mailPrintBookmark and Share

StartPageBrand.jpgYou are bad at managing passwords. You may be a good attorney – but you share your passwords with other people, you use the same password on multiple systems, your password is too short or too simple or written on a Post-it note under your keyboard. The truth is: you don’t like passwords or complicated password policies and you don’t think a secure password is worth the trouble.

That was, until the consequences of a data breach made it worth the trouble. That day has come. In fact, that day came long ago. You’ve just been lucky.

Some data breaches are not the result of compromised passwords. Faulty software can expose private data. Your PC can get infected with a virus that delivers your files into the clutches of a server operated by organized crime. Your laptop can get stolen or an emBrand-010612.gifployee may lose your backup on the “thumb drive” he keeps with his keys. All these troubles may lead to data leaks – but cracked passwords are too common and indefensible; you can actually “fix” this source of leaks if you set your mind to it.

By changing your password often you can prevent someone who had access to your account today from having it tomorrow. Passwords that last forever may outlast relationships. Pick a cycle: change of seasons, start and end of school, national holidays or some other easily memorable way to mark the passage of time and use that event as a reminder to change your password.

Complex passwords don’t have to be complicated. With a few simple tricks you can make up passwords that are nearly impossible to guess but easy to remember.

• Use a mix of capital and lower case letters

• Use at least eight characters

• Use numbers and punctuation marks

• Use symbols: %, $, @, etc.

Tech Tip: you can substitute symbols that have a similar appearance:

@ = a

$ = s

0 (zero) for o (oh)

! or 1 for i

3 for e (note that it is just backwards, like: z for s

• Don’t use a word you could find in a dictionary

• Don’t use your name or anyone else’s

• Don’t use a sequence of numbers or letters: 1234 … or abcd … or a phone number

There are 70 times more combinations of nine characters than eight – so pick a longer password if possible.

Analysis of a data breach at a web services provider with millions of users uncovered that the most popular password used was “123456” – the second most popular: password. Don’t be a statistic!

One simple scheme to create a complex password is to join common words separated by special characters. The first part might be “Winter,” “Summer,” “Football,” or “Baseball.” The “season” will be obvious based on the time of year. Then separate them with a special character. For added security, substitute symbols for letters. Here is an example:

W!nter$2o12 – This substitutes 1 for i and o for 0.

If you use the same password everywhere then someone who guesses it will have access to everything. One trick is to add a prefix to identify which device or service the password is for. This way you don’t need to remember lots of passwords, but each one will still be unique.

• For your email: EMail#W!nter$2o12

• For your bank: Bank#W!nter$2o12

• For your computer: PC#W!nter$2o12

• For your Facebook account: FB#W!nter$2o12

Other password strategies include using the first initial of words in a short phrase or breaking up a phrase into parts. Here are five passwords based on a common phrase:

N!tTime4 Now is the time for

Allg00d$ All good

M3n2C0m! Men to come

2the@id0F To the Aid of

The1rC0untry Their Country

Safeguard your passwords. We’ve seen passwords written on whiteboards and collected in spreadsheets shared by everyone in a firm. The problem with shared passwords goes beyond information that may be shared with the wrong people. If someone has your password they can pretend to be you. One of our customer’s email accounts was hacked simply for the purpose of sending tens of thousands of messages that appeared to come from him.

Use a strong password for every system. Even a compromised Facebook account can lead to embarrassing consequences. If you employ people who use passwords make sure they comply with these rules too; and that goes double for IT consultants and other contractors that touch your systems.

Bill Gates famously decreed in 2004 that passwords were dead. There have been inroads made by so-called “two factor” solutions – those that combine something you “know” like a password and something you “have” like a digital “token” (the Yubi Key is my favorite) or something you “are” like a fingerprint – but logins and passwords remain ubiquitous and probably will for a long time.

Make a New Year’s resolution to create a simple password policy that protects your reputation and confidential materials – before you regret it!•


Kim Brand is a technology expert and president of Computer Experts Inc., a 27-year-old IT services company in Indianapolis. He has presented to local and state bar audiences and written for West Publishing and the ILTA. Kim contributed to the “On-Premises” section of the recently released legal technical standards, and he is the inventor of the FileSafe Server used by many law firms. He may be reached at or by phone at 317-833-3000. The opinions expressed are the author’s.


Post a comment to this story

We reserve the right to remove any post that we feel is obscene, profane, vulgar, racist, sexually explicit, abusive, or hateful.
You are legally responsible for what you post and your anonymity is not guaranteed.
Posts that insult, defame, threaten, harass or abuse other readers or people mentioned in Indiana Lawyer editorial content are also subject to removal. Please respect the privacy of individuals and refrain from posting personal information.
No solicitations, spamming or advertisements are allowed. Readers may post links to other informational websites that are relevant to the topic at hand, but please do not link to objectionable material.
We may remove messages that are unrelated to the topic, encourage illegal activity, use all capital letters or are unreadable.

Messages that are flagged by readers as objectionable will be reviewed and may or may not be removed. Please do not flag a post simply because you disagree with it.

Sponsored by
Subscribe to Indiana Lawyer
  1. I think the cops are doing a great job locking up criminals. The Murder rates in the inner cities are skyrocketing and you think that too any people are being incarcerated. Maybe we need to lock up more of them. We have the ACLU, BLM, NAACP, Civil right Division of the DOJ, the innocent Project etc. We have court system with an appeal process that can go on for years, with attorneys supplied by the government. I'm confused as to how that translates into the idea that the defendants are not being represented properly. Maybe the attorneys need to do more Pro-Bono work

  2. We do not have 10% of our population (which would mean about 32 million) incarcerated. It's closer to 2%.

  3. If a class action suit or other manner of retribution is possible, count me in. I have email and voicemail from the man. He colluded with opposing counsel, I am certain. My case was damaged so severely it nearly lost me everything and I am still paying dearly.

  4. There's probably a lot of blame that can be cast around for Indiana Tech's abysmal bar passage rate this last February. The folks who decided that Indiana, a state with roughly 16,000 to 18,000 attorneys, needs a fifth law school need to question the motives that drove their support of this project. Others, who have been "strong supporters" of the law school, should likewise ask themselves why they believe this institution should be supported. Is it because it fills some real need in the state? Or is it, instead, nothing more than a resume builder for those who teach there part-time? And others who make excuses for the students' poor performance, especially those who offer nothing more than conspiracy theories to back up their claims--who are they helping? What evidence do they have to support their posturing? Ultimately, though, like most everything in life, whether one succeeds or fails is entirely within one's own hands. At least one student from Indiana Tech proved this when he/she took and passed the February bar. A second Indiana Tech student proved this when they took the bar in another state and passed. As for the remaining 9 who took the bar and didn't pass (apparently, one of the students successfully appealed his/her original score), it's now up to them (and nobody else) to ensure that they pass on their second attempt. These folks should feel no shame; many currently successful practicing attorneys failed the bar exam on their first try. These same attorneys picked themselves up, dusted themselves off, and got back to the rigorous study needed to ensure they would pass on their second go 'round. This is what the Indiana Tech students who didn't pass the first time need to do. Of course, none of this answers such questions as whether Indiana Tech should be accredited by the ABA, whether the school should keep its doors open, or, most importantly, whether it should have even opened its doors in the first place. Those who promoted the idea of a fifth law school in Indiana need to do a lot of soul-searching regarding their decisions. These same people should never be allowed, again, to have a say about the future of legal education in this state or anywhere else. Indiana already has four law schools. That's probably one more than it really needs. But it's more than enough.

  5. This man Steve Hubbard goes on any online post or forum he can find and tries to push his company. He said court reporters would be obsolete a few years ago, yet here we are. How does he have time to search out every single post about court reporters and even spy in private court reporting forums if his company is so successful???? Dude, get a life. And back to what this post was about, I agree that some national firms cause a huge problem.