Protect Your Blog With a Solid Password
May 8, 2007 | By Lorelle VanFossen | Filed Under Blogging, Features, Security
I’m not going to name names, but I heard recently of some WordPress bloggers who had their blog’s “broken into” not because of a vulnerability in the WordPress code, but because their passwords were easily guessed and used.
Is yours?
I vaguely remember a television court drama from a few years ago against a gun safe company, won because a locked gun safe was easily broken into by a child. The combination was very simple like a phone number, 123456 or 654321. For one of these bloggers, their password was their name spelled backwards. The other used the password “wordpress”. Is the password on your blog just as simple?
The most common passwords are:
- Middle names
- Names spelled backwards
- Phone numbers
- The word “password”
- Birthdays
- Single or combination uses of love, god, sex, and money, such as lovemoney or sexgod
- qwerty
- abc123
- password1
- asdf
- car license
- letmein
- yourname1
- default
According to Wikipedia’s explanation of Password Cracking, “Repeated research over some 40 years has demonstrated that around 40% of user-chosen passwords are readily guessable by programs.”
With all of the hype over security vulnerabilities and patches, virus scanning programs, firewalls, and protecting passwords and usernames, people are still really stupid when it comes to choosing and disclosing their usernames and passwords. Wired reported on a MySpace phishing attempt to gain access to usernames and passwords with these results: “MySpace estimates that more than 100,000 people fell for the attack before it was shut down.”
They also reported that “while 65 percent of passwords contain eight characters or less, 17 percent are made up of six characters or less. The average password is eight characters long.” The eight character limit has been trained into us as that was the longest the earliest software programs could handle. It’s not true anymore, but it’s a habit. Is your password eight or less characters long?
Roger Grimes of InfoWorld got some of the information on the MySpace debacle and reported:
*Almost 1 percent of users had the word “password” as, or as part of, their password. Not real clever.
*Words, colors, years, names, sports, hobbies, and music groups were very popular. FYI, your girlfriend or boyfriend’s name isn’t that uncommon in most cases. I, too, luv Brandi, Bob, or Joe.
*The color red was twice as likely to be used in a password as blue. No other colors came close in popularity percentage-wise. I guess “chartreuse” is a relatively safe password choice.
*Other popular words include: angel, baby, boy, girl, big, monkey, me, and the.
*Cuss words were very popular. Boy, there’s a lot of aggression out there.
*I was surprised about how many Christian-sounding — for example, “Ilovejesus” — log-on names were associated with the worst cuss words.
*Names of sports — golf, football, soccer, and so on — were as popular as professional sports teams and college team nicknames.
The strongest passwords are created with letters and numbers, or even with characters such as !@#$%*(). There are also a variety of free online programs that will help you create a complex and not easily broken password. Unfortunately, remembering such passwords is more challenging.
Remembering such passwords for every password need you have, such as with your blog, email, web host, social networking services, social bookmarking services, blog registrations, software registrations, forums, chats, discussion groups…I don’t know about you, but I’m overwhelmed with passwords. I have a clipboard with 12 pages of all the passwords I’ve had with all the various online password accessed services for over the years! How can we remember all of these?
We can’t. Yes, there are now software and browser programs which will “remember” for us, but hit the road, borrow a computer away from home or office and that password program won’t help you then. Still, the passwords we use the most need a method to make them complex but memorable.
A popular technique is to work with acronyms based upon a favorite phrase of music, poetry, or quote, or a simple sentence. For example, “Oh, I just can’t wait to be king” from the Lion King could be abbreviated as:
- OIJCWTBK
- OiJcWtBk
- OeyeJcW82bK
- Oheyejustc8ntw82bking
- kbtwcjio
- 01j(W2bk
- hiuaaoei (using the second letter of each word)
- 01j(\/\/7B|Leet Speak Converter)
It also helps to not use the same password for everything you access. Some suggest using the name of the program or service within the password, spelled forwards or backwards or the first or last three or four letters, within their password.
Examples from above for a WordPress (WP) blog might be:
- OIJCWPWTBK
- WPOIJCWTBK
- OIJCWTBKWP
- OIJCWWordPressTBK
- OIJCWTBKWordPress
You could easily replace WordPress or WP with ebay, myspace, flickr, or whatever title you need to remember which is which.
Years ago, a security expert told me that if any part of your password is in the dictionary, it can be hacked. The two keys to protecting your password is making it difficult for others to figure out, and don’t tell others. No matter how “honest” their request may appear. According to Yahoo’s Security Password Tips: A password is like a toothbrush: Choose a good one and don’t share it.
Some articles with good tips on creating respectable and fairly foolproof passwords are:
- Strong passwords: How to create and use them
- Yahoo Security - How to Choose a Password
- Schneier on Security - Choose Secure Passwords
- Lockdown - Password Guide
- Bergen County Technology Center - A guide to passwords and password security
- Neomeme - Generating the Perfect Password
- LifeHacker - Get high security passwords from Perfect Passwords
- Redmond Mag - 9 Perfect Password Pointers
- Geek to Live: Choose (and remember) great passwords
Lorelle VanFossen blogs about blogging and WordPress on Lorelle on WordPress.
About the author: The author of Lorelle on WordPress, as well as several other blogs, Lorelle VanFossen has been blogging in one fashion or another for over 14 years, covering travel, nature and travel photography, web design, web theory and development, blogging, and WordPress extensively as web technologies developed. Lorelle is also the author of the fast-selling book, Blogging Tips: What Bloggers Won't Tell You About Blogging, available in the new Blog Herald Bookstore. Lorelle will be speaking at WordCamp Dallas March 29-30, the Alliance for Distance Education in California Summit April 2-5, 2008, and the Successful and Outstanding Bloggers Conference May 2-5 in Chicago.
Comments
35 Responses to “Protect Your Blog With a Solid Password”
Sponsors
News
What Do You Really Need to Know About a Blogger to Admire Their Work?May 15, 2008 | By Lorelle VanFossen | Leave a Comment
In an upcoming interview, you will read me say the following:
I hate labels and putting people in boxes. That’s why blogging and the web is so exciting to me and I’ve long been one of its stanchest fans and advocates. I don’t care if you are black, brown, green, yellow, or chartreuse. I don’t care […]
Partnering With a Larger Publisher - Week 3
May 15, 2008 | By Andrew G.R. | Leave a Comment
Knowing that I was robbing Peter to pay Paul, I tentatively entered into an agreement with US News and World Report to provide content for their “Outside Voices” career blog on a gratis basis.
So far, I do not regret this decision. I still think it’s a “resume” booster and increases blogosphere street cred. […]
New Plugin Collection Turns WordPress into Booking System
May 15, 2008 | By Thord Daniel Hedengren | 1 Comment
StayPress was announced yesterday (and pimped by none other than Matt Mullenweg), and it looks promising. In the words of the creator, Barry:
StayPress is a collection of plugins that will turn a standard vanilla installation of WordPress or WordPress MU into a property management and bookings system. Of course when I say Property, I actually […]
Amazon MP3 Widget lets you Make Money
May 15, 2008 | By Thord Daniel Hedengren | Leave a Comment
Amazon just released a MP3 widget featuring samples from selected music from their MP3 store, with buy buttons. That means money for you, since it’s an Amazon Associates thing. A must for music bloggers perhaps? That is, assuming you operate in an area where you can shop music from Amazon. That doesn’t include Europe, I’m […]
55 Bloggers Get Political Credentials for DNC
May 14, 2008 | By Andrew G.R. | Leave a Comment
As we told you last month, the Democrats are giving select bloggers access to be on the floor of the national convention in Denver this summer. Fifty-five lucky bloggers have been chosen. Here’s the full list of “State Blogger Corps”:
ALASKA: Celtic Diva’s Blue Oasis: divasblueoasis.blogspot.com
ALABAMA: Doc’s Political Parlor: www.politicalparlor.net
ARKANSAS: Under The Dome.com: www.underthedome.com
ARIZONA: […]
Vote for Google Doodles Yet Again
May 14, 2008 | By Thord Daniel Hedengren | 3 Comments
Here’s a way to get some buzz. Have kids doodle your logo, and then do a competition online, making people all over the world vote for their favorite Google Doodle logo. Google does this doodle-thing every year, and this is this year’s flavor.
Take a look at the submissions and finalist, starting with crayons (half-eaten), […]
Patrons
Sponsored Links
Recent listings from Blogger Jobs
MBA Blogger WantedWe got this from MBA Channel: MBA Channel is looking for passionate bloggers to write weekly posts for our new community MBA Channel Insider. You c [...]
A Slew of Blogger Openings
This batch is courtesy of our sister site, Performancing.com: Mom Blogger Openings — “Type-A Mom is currently hiring mom editors for a [...]
Horoscopes Writer Wanted
We got this from Jeffrey Kishner: Horoscopes Writer for astrology blog. Write 12 Sun sign horoscopes weekly, plus a General horoscope. $130/1300 wo [...]
Wanted: Tech Blogger
We got this message from from Veselin Nedeff: Hello folks, We need a tech orientated blogger to write on mobiletopsoft.com’s blog. We look for [...]
Call for Writers
Renowned Filipino problogger J. Angelo Racoma is looking from writers: Here’s a great income opportunity for individuals or teams looking for work [...]
More at Blogger Jobs
Contributors
- Andrew G. Rosen
- Andy Merrett
- Anne Helmond
- Arvind Satyanarayan
- Chris Garrett
- Darnell Clayton
- David Krug
- David Peralty
- J. Angelo Racoma
- Jason Kaneshiro
- Jonathan Bailey
- Lorelle VanFossen
- Matt Craven
- Thord Hedengren
- Valeria Maltoni
Latest Reviews
Submitted News
- BusinessWeek Says: Why Twitter Matters
- Free Story Theme For WordPress
- Why Performers and Entertainers Should Twitter
- What Do You Really Need to Know About a Blogger to Admire Their Work?
- Partnering With a Larger Publisher - Week 3
Our Blog Metrics
Good tip for passwords. people *always* forget that their passwords are as secure as the weakest site where they use the same password.
Leet speak works for me. Like your Lion King analogy, it could be 01jcwtbk or such. That way, you can also use symbols like @ or !, or numbers, and still not forget as easily. Unfortunately, sometimes those passwords are not as secure as truly random strings of text/characters. I usually attach some characters of the site URL or title in my mnemonic.
I blogged about “managing my passwords” last month — and in the post, I quoted Justin Kistner’s method of systematic digital life management.
We all can’t run away from memorizing passwords these days, huh? Every-freaking-thing we do online needs a password. I’d be delighted to chance upon sites that do not require you to register to enjoy the services/benefits :)
The problem with “strong” password is “one to many”: one user has many online services to mantain.
Do you have a suggestion?
[…] The indispensable Lorelle at Word Press says that these are the most commonly used passwords! But she also writes at length about how to make your password more secure. With all of the hype over security vulnerabilities and patches, virus scanning programs, firewalls, and protecting passwords and usernames, people are still really stupid when it comes to choosing and disclosing their usernames and passwords. The strongest passwords are created with letters and numbers, or even with characters such as !@#$%*(). There are also a variety of free online programs that will help you create a complex and not easily broken password. Unfortunately, remembering such passwords is more challenging. […]
A suggestion on remembering or keeping track of all the m any passwords and user names? I’ve tried many online and desktop password keepers and the only truly successful method I’ve found is paper. I keep mine on printed forms I typed up with the site name, username, password, and any other info I need to “remember”. It “hides” in plain sight on my desk, on a clipboard. I just have to tear my desk apart to find it each time I need it. ;-)
[…] The Blog Herald recently put up a quite solid post about Passwords […]
[…] SecurityStats.com password strength tester Blog Herald article on choosing blog passwords […]
[…] Blog Herald has an excellent piece on how to choose a strong password, with lots of references and links. Good stuff. […]
If you are going to use multiple strong and complex passwords you can’t remember all of them and you definitely need a password manager.
Using a password manager is not merely convenient, it’s an effective way to adopt better security practices without too much stress. It basically sums up to: 1) never re-use the same password, 2) use strong passwords.
Software products are certainly an option, but you could also consider a web based solution.
(Yes, I’m a tad biased …)
Clipperz is an online password manager that can do much more than simply storing your passwords.
- ubiquitous access
- direct login to online services
- offline version
- bookmarklet for quick data entry
- nothing to install or backup
- …
It’s free and completely anonymous.
Clipperz lets you submit confidential information into your browser, but your data are locally encrypted by the browser itself before being uploaded.
The key for the encryption process is a passphrase known only to you.
Clipperz simply hosts your sensitive data in encrypted form and could never actually access the data in its plain form.
For any further information refer to our website:
http://www.clipperz.com.
Marco
Clipperz co-founder
I always like to use a combination of word + number + symbols if allowed.
[…] would think that people would learn. MySpace bloggers were invited to share their passwords and usernames with a criminal phishing blog. About 100,000 people participated before MySpace shut them […]
[…] Protect Your Blog (or anything else) With a Solid Password […]
[…] article on The Blog Herald discusses common problems with user-generated passwords, specifically that they’re too easy to guess. According to the article, users often choose […]
[…] and Notes Don’t Choose Stupid Passwords Lorelle VanFossen has a helpful article on how to choose a good password, along with a few tips about how to remember all those passwords. Comments(0)Copyright and […]
[…] 19, 2007 in asides, blogging, quotations, computers Lorelle VanFossen, writing in The Blog Herald, has a list of the most commonly used […]
[…] “Protect Your Blog With a Solid Password” at Blog Herald (Great tips, and not just for blogs!) […]
[…] Do not use a simple password like your name or the word “password”. Use a complicated and strong password. […]
[…] is always a concern for bloggers, as I reminded everyone when I asked them to update or change the passwords on their blogs to ensure they are not easily broken or […]
[…] might be really handing over the keys to your personal life in the process. In an article last year on protecting your blog password and security access, I reported on the MySpace phishing attempt in which more than 100,000 people gave away their […]
[…] you might check lorelle’s article on blogherald called Protect Your Blog With a Solid Password, offering tips and tricks to help create a strong password that is also memorable, and how to deal […]
[…] Secure WordPress: Noupe wrote “WordPress Security Tips and Hacks” recently with a good round-up of tips on improving your WordPress blog security with sensible tips, techniques, and WordPress Plugins. Remember, the first step in blog security is a strong password. […]
[…] também o artigo de Lorelle no Blogherald, Protect Your Blog With a Solid Password, que dá dicas e truques para criar uma password complexa e fácil de lembrar, além de discutir […]
[…] também o artigo de Lorelle no Blogherald, Protect Your Blog With a Solid Password, que dá dicas e truques para criar uma password complexa e fácil de lembrar, além de discutir […]
[…] you might check lorelle’s article on blogherald called Protect Your Blog With a Solid Password, offering tips and tricks to help create a strong password that is also memorable, and how to deal […]
[…] também o artigo de Lorelle no Blogherald, Protect Your Blog With a Solid Password, que dá dicas e truques para criar uma senha complexa e fácil de lembrar, além de discutir ainda […]
[…] Oh and more thing: please use a decent password! If you feel unsure on how to pick a secure password, check out this excellent article by Lorelle. […]
[…] também o artigo de Lorelle no Blogherald, Protect Your Blog With a Solid Password, que dá dicas e truques para criar um password complexo e fácil de lembrar, além de discutir […]
[…] strength checker that you could check.Also you might check lorelle’s article on blogherald called Protect Your Blog With a Solid Password, offering tips and tricks to help create a strong password that is also memorable, and how to deal […]
[…] you might check lorelle’s article on blogherald called Protect Your Blog With a Solid Password, offering tips and tricks to help create a strong password that is also memorable, and how to deal […]
[…] também o artigo de Lorelle no Blogherald, Protect Your Blog With a Solid Password, que dá dicas e truques para criar uma password complexa e fácil de lembrar, além de […]
[…] several times in a week…” His recommendations: Update WordPress. Use common sense. Use strong passwords. Be […]
[…] security threats” to WordPress. His recommendations: Update WordPress. Use common sense. Use strong passwords. Be […]
[…] strong password for your wordpress […]
[…] security threats” to WordPress. His recommendations: Update WordPress. Use common sense. Use strong passwords. Be […]