ILNews

Start Page: Protecting those pesky passwords is necessary evil

Kim Brand
January 4, 2012
Back to TopCommentsE-mailPrintBookmark and Share

StartPageBrand.jpgYou are bad at managing passwords. You may be a good attorney – but you share your passwords with other people, you use the same password on multiple systems, your password is too short or too simple or written on a Post-it note under your keyboard. The truth is: you don’t like passwords or complicated password policies and you don’t think a secure password is worth the trouble.

That was, until the consequences of a data breach made it worth the trouble. That day has come. In fact, that day came long ago. You’ve just been lucky.

Some data breaches are not the result of compromised passwords. Faulty software can expose private data. Your PC can get infected with a virus that delivers your files into the clutches of a server operated by organized crime. Your laptop can get stolen or an emBrand-010612.gifployee may lose your backup on the “thumb drive” he keeps with his keys. All these troubles may lead to data leaks – but cracked passwords are too common and indefensible; you can actually “fix” this source of leaks if you set your mind to it.

By changing your password often you can prevent someone who had access to your account today from having it tomorrow. Passwords that last forever may outlast relationships. Pick a cycle: change of seasons, start and end of school, national holidays or some other easily memorable way to mark the passage of time and use that event as a reminder to change your password.

Complex passwords don’t have to be complicated. With a few simple tricks you can make up passwords that are nearly impossible to guess but easy to remember.

• Use a mix of capital and lower case letters

• Use at least eight characters

• Use numbers and punctuation marks

• Use symbols: %, $, @, etc.

Tech Tip: you can substitute symbols that have a similar appearance:

@ = a

$ = s

0 (zero) for o (oh)

! or 1 for i

3 for e (note that it is just backwards, like: z for s

• Don’t use a word you could find in a dictionary

• Don’t use your name or anyone else’s

• Don’t use a sequence of numbers or letters: 1234 … or abcd … or a phone number

There are 70 times more combinations of nine characters than eight – so pick a longer password if possible.

Analysis of a data breach at a web services provider with millions of users uncovered that the most popular password used was “123456” – the second most popular: password. Don’t be a statistic!

One simple scheme to create a complex password is to join common words separated by special characters. The first part might be “Winter,” “Summer,” “Football,” or “Baseball.” The “season” will be obvious based on the time of year. Then separate them with a special character. For added security, substitute symbols for letters. Here is an example:

W!nter$2o12 – This substitutes 1 for i and o for 0.

If you use the same password everywhere then someone who guesses it will have access to everything. One trick is to add a prefix to identify which device or service the password is for. This way you don’t need to remember lots of passwords, but each one will still be unique.

• For your email: EMail#W!nter$2o12

• For your bank: Bank#W!nter$2o12

• For your computer: PC#W!nter$2o12

• For your Facebook account: FB#W!nter$2o12


Other password strategies include using the first initial of words in a short phrase or breaking up a phrase into parts. Here are five passwords based on a common phrase:


N!tTime4 Now is the time for

Allg00d$ All good

M3n2C0m! Men to come

2the@id0F To the Aid of

The1rC0untry Their Country

Safeguard your passwords. We’ve seen passwords written on whiteboards and collected in spreadsheets shared by everyone in a firm. The problem with shared passwords goes beyond information that may be shared with the wrong people. If someone has your password they can pretend to be you. One of our customer’s email accounts was hacked simply for the purpose of sending tens of thousands of messages that appeared to come from him.

Use a strong password for every system. Even a compromised Facebook account can lead to embarrassing consequences. If you employ people who use passwords make sure they comply with these rules too; and that goes double for IT consultants and other contractors that touch your systems.

Bill Gates famously decreed in 2004 that passwords were dead. There have been inroads made by so-called “two factor” solutions – those that combine something you “know” like a password and something you “have” like a digital “token” (the Yubi Key is my favorite) or something you “are” like a fingerprint – but logins and passwords remain ubiquitous and probably will for a long time.

Make a New Year’s resolution to create a simple password policy that protects your reputation and confidential materials – before you regret it!•

__________

Kim Brand is a technology expert and president of Computer Experts Inc., a 27-year-old IT services company in Indianapolis. He has presented to local and state bar audiences and written for West Publishing and the ILTA. Kim contributed to the “On-Premises” section of the recently released ILTSO.org legal technical standards, and he is the inventor of the FileSafe Server used by many law firms. He may be reached at Kim@ComputerExpertsIndy.com or by phone at 317-833-3000. The opinions expressed are the author’s.

ADVERTISEMENT

Post a comment to this story

COMMENTS POLICY
We reserve the right to remove any post that we feel is obscene, profane, vulgar, racist, sexually explicit, abusive, or hateful.
 
You are legally responsible for what you post and your anonymity is not guaranteed.
 
Posts that insult, defame, threaten, harass or abuse other readers or people mentioned in Indiana Lawyer editorial content are also subject to removal. Please respect the privacy of individuals and refrain from posting personal information.
 
No solicitations, spamming or advertisements are allowed. Readers may post links to other informational websites that are relevant to the topic at hand, but please do not link to objectionable material.
 
We may remove messages that are unrelated to the topic, encourage illegal activity, use all capital letters or are unreadable.
 

Messages that are flagged by readers as objectionable will be reviewed and may or may not be removed. Please do not flag a post simply because you disagree with it.

Sponsored by
ADVERTISEMENT
Subscribe to Indiana Lawyer
  1. I have been on this program while on parole from 2011-2013. No person should be forced mentally to share private details of their personal life with total strangers. Also giving permission for a mental therapist to report to your parole agent that your not participating in group therapy because you don't have the financial mean to be in the group therapy. I was personally singled out and sent back three times for not having money and also sent back within the six month when you aren't to be sent according to state law. I will work to het this INSOMM's removed from this state. I also had twelve or thirteen parole agents with a fifteen month period. Thanks for your time.

  2. Our nation produces very few jurists of the caliber of Justice DOUGLAS and his peers these days. Here is that great civil libertarian, who recognized government as both a blessing and, when corrupted by ideological interests, a curse: "Once the investigator has only the conscience of government as a guide, the conscience can become ‘ravenous,’ as Cromwell, bent on destroying Thomas More, said in Bolt, A Man For All Seasons (1960), p. 120. The First Amendment mirrors many episodes where men, harried and harassed by government, sought refuge in their conscience, as these lines of Thomas More show: ‘MORE: And when we stand before God, and you are sent to Paradise for doing according to your conscience, *575 and I am damned for not doing according to mine, will you come with me, for fellowship? ‘CRANMER: So those of us whose names are there are damned, Sir Thomas? ‘MORE: I don't know, Your Grace. I have no window to look into another man's conscience. I condemn no one. ‘CRANMER: Then the matter is capable of question? ‘MORE: Certainly. ‘CRANMER: But that you owe obedience to your King is not capable of question. So weigh a doubt against a certainty—and sign. ‘MORE: Some men think the Earth is round, others think it flat; it is a matter capable of question. But if it is flat, will the King's command make it round? And if it is round, will the King's command flatten it? No, I will not sign.’ Id., pp. 132—133. DOUGLAS THEN WROTE: Where government is the Big Brother,11 privacy gives way to surveillance. **909 But our commitment is otherwise. *576 By the First Amendment we have staked our security on freedom to promote a multiplicity of ideas, to associate at will with kindred spirits, and to defy governmental intrusion into these precincts" Gibson v. Florida Legislative Investigation Comm., 372 U.S. 539, 574-76, 83 S. Ct. 889, 908-09, 9 L. Ed. 2d 929 (1963) Mr. Justice DOUGLAS, concurring. I write: Happy Memorial Day to all -- God please bless our fallen who lived and died to preserve constitutional governance in our wonderful series of Republics. And God open the eyes of those government officials who denounce the constitutions of these Republics by arbitrary actions arising out capricious motives.

  3. From back in the day before secularism got a stranglehold on Hoosier jurists comes this great excerpt via Indiana federal court judge Allan Sharp, dedicated to those many Indiana government attorneys (with whom I have dealt) who count the law as a mere tool, an optional tool that is not to be used when political correctness compels a more acceptable result than merely following the path that the law directs: ALLEN SHARP, District Judge. I. In a scene following a visit by Henry VIII to the home of Sir Thomas More, playwriter Robert Bolt puts the following words into the mouths of his characters: Margaret: Father, that man's bad. MORE: There is no law against that. ROPER: There is! God's law! MORE: Then God can arrest him. ROPER: Sophistication upon sophistication! MORE: No, sheer simplicity. The law, Roper, the law. I know what's legal not what's right. And I'll stick to what's legal. ROPER: Then you set man's law above God's! MORE: No, far below; but let me draw your attention to a fact I'm not God. The currents and eddies of right and wrong, which you find such plain sailing, I can't navigate. I'm no voyager. But in the thickets of law, oh, there I'm a forester. I doubt if there's a man alive who could follow me there, thank God... ALICE: (Exasperated, pointing after Rich) While you talk, he's gone! MORE: And go he should, if he was the Devil himself, until he broke the law! ROPER: So now you'd give the Devil benefit of law! MORE: Yes. What would you do? Cut a great road through the law to get after the Devil? ROPER: I'd cut down every law in England to do that! MORE: (Roused and excited) Oh? (Advances on Roper) And when the last law was down, and the Devil turned round on you where would you hide, Roper, the laws being flat? (He leaves *1257 him) This country's planted thick with laws from coast to coast man's laws, not God's and if you cut them down and you're just the man to do it d'you really think you would stand upright in the winds that would blow then? (Quietly) Yes, I'd give the Devil benefit of law, for my own safety's sake. ROPER: I have long suspected this; this is the golden calf; the law's your god. MORE: (Wearily) Oh, Roper, you're a fool, God's my god... (Rather bitterly) But I find him rather too (Very bitterly) subtle... I don't know where he is nor what he wants. ROPER: My God wants service, to the end and unremitting; nothing else! MORE: (Dryly) Are you sure that's God! He sounds like Moloch. But indeed it may be God And whoever hunts for me, Roper, God or Devil, will find me hiding in the thickets of the law! And I'll hide my daughter with me! Not hoist her up the mainmast of your seagoing principles! They put about too nimbly! (Exit More. They all look after him). Pgs. 65-67, A MAN FOR ALL SEASONS A Play in Two Acts, Robert Bolt, Random House, New York, 1960. Linley E. Pearson, Atty. Gen. of Indiana, Indianapolis, for defendants. Childs v. Duckworth, 509 F. Supp. 1254, 1256 (N.D. Ind. 1981) aff'd, 705 F.2d 915 (7th Cir. 1983)

  4. "Meanwhile small- and mid-size firms are getting squeezed and likely will not survive unless they become a boutique firm." I've been a business attorney in small, and now mid-size firm for over 30 years, and for over 30 years legal consultants have been preaching this exact same mantra of impending doom for small and mid-sized firms -- verbatim. This claim apparently helps them gin up merger opportunities from smaller firms who become convinced that they need to become larger overnight. The claim that large corporations are interested in cost-saving and efficiency has likewise been preached for decades, and is likewise bunk. If large corporations had any real interest in saving money they wouldn't use large law firms whose rates are substantially higher than those of high-quality mid-sized firms.

  5. The family is the foundation of all human government. That is the Grand Design. Modern governments throw off this Design and make bureaucratic war against the family, as does Hollywood and cultural elitists such as third wave feminists. Since WWII we have been on a ship of fools that way, with both the elite and government and their social engineering hacks relentlessly attacking the very foundation of social order. And their success? See it in the streets of Fergusson, on the food stamp doles (mostly broken families)and in the above article. Reject the Grand Design for true social function, enter the Glorious State to manage social dysfunction. Our Brave New World will be a prison camp, and we will welcome it as the only way to manage given the anarchy without it.

ADVERTISEMENT