yossman.net - password creation help
document first created yossman/yoss.canweb.net/1996-10-25.
document last updated yossman/yossman.net/2005-07-29.
i suggest you change your password on a fairly regular basis using the
'passwd' command from your shell prompt. try to remember to change
your password any time you've been accessing your account from someone
else's computer, once you get back in front of the system you use most
often.
it is not a good idea to assume there are no viruses or spyware or
keyloggers running on a system you do not regularly use and control. these
types of software are designed to capture what people type into their
keyboards and forward the information to unknown third-party people, and
are usually designed to be quite good at hiding their presence.
though many people often wait years before changing their passwords, and
some never do, i recommend changing passwords on at minimum a yearly
basis, if not every 6 months.
users should keep in mind that if any server they are on is ever
compromised, it should be assumed the person who got into the server would
take a copy of the password file on the system. remember, no matter how
secure you've always been when connecting to a system, you can't always be
certain the system itself will always be hack-free. changing your
password more often decreases the chances your account will be used to
later get back into that system, should they try to come back using information
from that password list.
when you do make a new password, i suggest you keep the following in
mind:
1. make it at least eight characters long. older systems do not
look keep track of passwords longer than 8 characters under the encryption
methods currently employed by most password systems, as your password gets
longer, it becomes exponentially more difficult to crack (decode)
with software.
2. make it as random as possible. 'barney' is an example of
a stupid password. it is all lower-case, is an actual word (and a fairly
common one at that), and it contains no numbers. 'Q3ds7sAc' is a
pretty good password for the exact opposite reasons. see the pattern
here?