Take Control of Passwords

8/16/2019 Take Control of Passwords

1/121

$10

Check for Updates Make sure you have the latest information!

Help Catalog Feedback Blog Order Print Copy

TidBITS Publishing Inc.

Take Control of

PasswordsMac OS X

v2.1

Joe Kissell

in

S E C O N D E D I T I

O N

http://www.takecontrolbooks.com/checkforupdates?mw=passaru&bt=0044&bv=2.1http://www.takecontrolbooks.com/checkforupdates?mw=passaru&bt=0044&bv=2.1http://www.takecontrolbooks.com/faq?pt=INTERNALhttp://www.takecontrolbooks.com/catalog?pt=INTERNALhttp://www.takecontrolbooks.com/checkforupdates?mw=passaru&bt=0044&bv=2.1&fb=1http://www.takecontrolbooks.com/checkforupdates?mw=passaru&bt=0044&bv=2.1&bl=1http://www.takecontrolbooks.com/checkforupdates?mw=passaru&bt=0044&bv=2.1&pr=1http://www.takecontrolbooks.com/checkforupdates?mw=passaru&bt=0044&bv=2.1&bl=1http://www.takecontrolbooks.com/checkforupdates?mw=passaru&bt=0044&bv=2.1&pr=1http://www.takecontrolbooks.com/catalog?pt=INTERNALhttp://www.takecontrolbooks.com/checkforupdates?mw=passaru&bt=0044&bv=2.1&fb=1http://www.takecontrolbooks.com/faq?pt=INTERNALhttp://www.takecontrolbooks.com/http://www.takecontrolbooks.com/checkforupdates?mw=passaru&bt=0044&bv=2.1


2/121

2

Table of Contents

READ ME FIRST 4 Updates and More................................................................... 4

Basics ................................................................................... 5

What’s New in Version 2.1 ....................................................... 6

What Was New in Version 2.0................................................... 7

INTRODUCTION 8

PASSWORDS QUICK START 10

ASSESS YOUR PASSWORD NEEDS 11 Consider Your Risk Level.........................................................11

Use an Ounce of Prevention ....................................................13

LEARN PASSWORD BASICS 14 Understand Password Security.................................................14

Understand the Two Password Types........................................17

Figure Out the Right Password Type .........................................18

Learn the Pros and Cons of Reusing Passwords ..........................20

Understand Optimal Password Length.......................................21

CHOOSE A PASSWORD STRATEGY 25 Strategy A: Rely (Mostly) on Technology...................................25

Strategy B: Rely (Mostly) on Your Brain....................................28

Choosing a Strategy: Joe’s Recommendation.............................30

GENERATE GOOD PASSWORDS 32 Create Security Passwords ......................................................32

Devise a Pattern for Identity Passwords ....................................35

Use Password Assistant ..........................................................39

Take Action!..........................................................................41

UNDERSTAND MAC OS X’S PASSWORDS 42 Login Passwords ....................................................................42

Master Password....................................................................49

Root Password ......................................................................52

Firmware Password ................................................................53

Email Password .....................................................................56

Wireless Network Password.....................................................56

File Sharing Password ............................................................57

Keychains .............................................................................58


3/121

3

USE KEYCHAIN ACCESS 62 Understand Common Keychain Types .......................................63

View Your Passwords..............................................................64

Change Access for a Password.................................................67

Add or Change Passwords .......................................................68

Delete Passwords...................................................................69

Change Your Keychain Password..............................................70

Change Keychain Settings.......................................................70

Change the Default Keychain...................................................71

Add or Delete a Keychain........................................................72

Add Notes to a Keychain.........................................................74

Repair Damaged Keychains .....................................................76

Solve the “login” Keychain Prompt Problem ...............................77

Use the Keychain Menu ..........................................................79

USE PASSWORDS ON THE WEB 80 Choose Good User Names .......................................................81

Fill Out Forms Automatically....................................................83

USE THIRD-PARTY PASSWORD TOOLS 88 1Password ............................................................................88

Other Password Generators.....................................................93

Other Password Managers.......................................................94

Biometric Devices ................................................................ 102

KEEP YOUR PASSWORDS SECURE 105 Avoid the “Weakest Link” Problem..........................................105

Use Wireless Networks Safely................................................107 Change Your Passwords........................................................110

Recover Forgotten Passwords ................................................111

Back Up Your Passwords....................................................... 113

Prepare an Emergency Password Plan.....................................114

ABOUT THIS BOOK 117 Ebook Extras.......................................................................117

About the Author ................................................................. 117

Author’s Acknowledgments ...................................................118

Shameless Plug ...................................................................118

About the Publisher..............................................................118

Production Credits ...............................................................118

COPYRIGHT AND FINE PRINT 119

FEATURED TITLES 120

1PASSWORD COUPON 121


4/121

4

Read Me First Welcome to Take Control of Passwords in Mac OS X, Second

Edition, version 2.1.

If you’re overwhelmed with too many passwords to remember orconcerned that your passwords may not be safe, help is on the way.

This book tells you everything you need to know about choosing,

remembering, and managing passwords of all kinds—with special

attention to those used when accessing Web sites with a Mac, iPad,

iPhone, or iPod touch. This book was written by Joe Kissell, edited by Caroline Rose, and published by TidBITS Publishing Inc.

Copyright © 2009, 2010, Joe Kissell. All rights reserved.

If you have an ebook version of this title, please note that if you

want to share it with a friend, we ask that you do so as you would

a physical book: “lend” it for a quick look, but ask your friend to buy

a new copy to read it more carefully or to keep it for reference.

Discounted classroom and Mac user group copies are also available.

UPDATES AND MORE You can access extras related to this book on the Web (use the link

in Ebook Extras, near the end of the book; it’s available only to pur-

chasers). On the ebook’s Take Control Extras page, you can:

• Download any available new version of the ebook for free, or

purchase any subsequent edition at a discount.

• Download various formats, including PDF and—usually—EPUB

and Mobipocket. (Learn about reading this ebook on handheld

devices at http://www.takecontrolbooks.com/device-advice.)

• Read postings to the ebook’s blog. These may include new infor-mation and tips, as well as links to author interviews. At the top

of the blog, you can also see any update plans for the ebook.

• Get a discount when you order a print copy of the ebook.

http://www.takecontrolbooks.com/class-copies.htmlhttp://www.takecontrolbooks.com/device-advicehttp://www.takecontrolbooks.com/device-advicehttp://www.takecontrolbooks.com/class-copies.html


5/121

5

BASICS

In reading this book, you may get stuck if you don’t know certain

fundamental facts about using your Mac or if you don’t understand

Take Control syntax for things like working with menus or finding

items in the Finder.

Please note the following:

• Menus: Where I describe choosing a command from a menu in

the menu bar, I use a compact description. For example, to create

a new folder in the Finder, you choose New Folder from the Filemenu; I’d abbreviate this as “File > New Folder.”

• Finding System Preferences: I sometimes refer to settings in

System Preferences that you may want to adjust. To open System

Preferences, click its icon in the Dock or choose Apple (!) > SystemPreferences. In the System Preferences window, click the icon of the

pane whose settings you want to adjust. I refer to these panes with

an abbreviated notation such as “the Network preference pane.”

• Finding an application’s preferences: I often refer to prefer-ences in an application that you may want to adjust. Don’t confuse

an application’s preferences with the system-wide settings found in

System Preferences.

To access an application’s preferences, choose Application Name >Preferences. For example, in Disk Utility, you would choose Disk

Utility > Preferences. Within some applications, all preference

controls appear in a single window. In others, a bank of buttons

is located across the top, or a list of categories along the side; in

those cases, click a button or category to display a pane with a

corresponding range of preferences. Instead of providing detaileddirections each time, I may use an abbreviated notation such as

“go to the General preference pane.”

• Path syntax: I occasionally use a path to show the location of

a file or folder in your file system. For example, Mac OS X storesmost utilities, such as Terminal, in the Utilities folder; the path to

Terminal is /Applications/Utilities/Terminal.

A slash at the beginning of a path tells you to start from the

root level of the disk. You’ll also encounter paths that begin with


6/121

6

~ (tilde), which is a shortcut for the current user’s home folder. Forexample, if the person currently logged in has the user name joe and

wants to install fonts that only he can access, he’ll put them in his

~/Library/Fonts folder, which is just another way of writing /Users/ joe/Library/Fonts.

• Volumes and partitions: I follow Apple’s terminology in refer-ring to any disk or partition on a disk as a volume. So if a hard disk

has not been partitioned, it has just one volume. If a disk has beenpartitioned, each partition is a volume.

• Passwords and passphrases: You may sometimes hear the

word passphrase used instead of password ; this implies a longer

set of characters, perhaps a series of words. For the purposes ofthis book, I generally stick with the term password, with the under-

standing that it’s not necessarily a word as such but any string of

characters (which could, certainly, include a phrase).

• iOS devices: The iPhone, iPod touch, and iPad (as well as, per-haps, future devices) all run Apple’s iOS operating system (known

as iPhone OS before version 3.2.1). In some contexts, I use the

shorthand “iOS device” to refer to any of these devices. Note,

though, that some apps I discuss here work only on some iOS

devices—so if I spell out device names, that’s usually why.

WHAT’S NEW IN VERSION 2.1

In this minor revision, I’ve updated the book to reflect the latest

information about Mac OS X 10.6 Snow Leopard, iOS devices,

1Password, and other third-party products. Among the most

significant changes are these:

• Revised the discussion of 1Password (p. 88) to reflect the latest

version (3.x) at publication time, as well as current versions for iOS

• Updated the list of Desktop Password Managers (p. 95) with the

latest facts, and added mention of the popular LastPass service/

software

• Corrected information in Biometric Devices (p. 102) about usingUPEK’s Eikon fingerprint scanners with 1Password


7/121

7

What Was New in Version 2.0

Version 2.0 was a major revision to the book, with many changes

scattered throughout. The book was thoroughly updated with

information on Mac OS X 10.5 Leopard, had all new graphics, and

contained numerous small corrections and adjustments.

Among the other significant changes were these:

• A new chapter, Choose a Password Strategy , that outlines two broad

approaches to thinking about and using passwords

• Division of the chapter previously titled “Generate Good Passwords”

into two parts: Learn Password Basics, which provides background

information, and Generate Good Passwords, about the nuts and

bolts of creating passwords (with or without the help of software)

• Instructions on changing an administrator password even if you

don’t have a Mac OS X Install disc in Reset an Administrator

Password

• Coverage of password managers that sync data between your Mac

and iPhone or iPod touch in Use Third-Party Password Tools

• A significantly expanded discussion of 1Password

• Revised and expanded discussion of Other Password Managers

• Information on using the UPEK Eikon fingerprint scanners in

Biometric Devices


8/121

8

Introduction

I have a love-hate relationship with passwords. Well, mostly hate. Iunderstand that passwords help keep my computer, my private data,and my money safe, but for many years, every time I was asked to

come up with yet another password (for a Web site, a Mac OS X user

account, or any of a dozen other purposes), I’d grumble. I felt, as many

people do, that it took too much mental effort to produce and remem-

ber all those passwords.

On the other hand, I didn’t want to take the easy way out—choosing

a simple, memorable password and using it everywhere—because I

worried that I was putting my valuable information at risk. I didn’t want to sacrifice security for convenience.

In addition, I lacked a clear understanding of how to go about selecting

good passwords, and I was unsure what the security implications were

for each of the contexts in which passwords are required. For example,

Mac OS X requires passwords for a bewildering array of purposes:

logging in, securing a computer’s firmware, encrypting home folders,checking email, connecting to MobileMe, and more. What are all those

passwords for? Do I need to use them all? What sorts of passwords canI use in which places? Even computer geeks like me wonder about

these things.

I decided to get to the bottom of this whole password business once

and for all. This book is the result of my research and experiments. In

it, I show you how to choose good passwords without overtaxing your

brain. I explain when you need heavy-duty passwords and when you

can get away with less secure ones. I cover all the kinds of passwords

an average Mac OS X user will encounter, and describe how and whento use them. And I discuss a variety of tools and methods you can use

to simplify your interactions with passwords. In short, this book

enables you to take control of your passwords once and for all!


9/121

9

To keep this book from being unreasonably long, I’ve made some

assumptions:

• I’m writing for ordinary computer users, not technical wizards

or security experts. If you’re looking for detailed information on

encryption algorithms or the like, this isn’t the place.

• Along the same lines, I assume that you’re not protecting statesecrets or billion-dollar fortunes with your passwords. For that

sort of security, you’ll need more password mojo than I offer here.

Also, I only skim over certain topics related to passwords, such as user

accounts, wireless networks, keychain synchronization, and file shar-ing. For more information on these topics, I refer you to other Take

Control titles.

For this edition of Take Control of Passwords in Mac OS X, I’ve taken

a long look at what has happened since the book’s original publicationin 2006. I’ve significantly modified my thinking on a few topics,

adopted some new techniques, and begun to use hardware and soft-

ware products that weren’t available when I wrote the first edition.

And I’ve watched Mac OS X evolve through a couple of major revi-

sions, seen Apple complete its shift to Intel processors, and witnessed

the birth and growth of the iPhone, iPod touch, and iPad. So I’veupdated the book with the latest in technology and my current advice.

This version of the book is written primarily for users of Mac OS X10.6 Snow Leopard or Mac OS X 10.5 Leopard. Nearly all of this book

also applies to 10.4 Tiger, with some minor differences in wording andthe like, which I’ve called out in most cases. However, I no longer cover

earlier versions of Mac OS X at all.

To keep up to date with any significant changes to this book’s advice,

click Check for Updates on the cover.


10/121

10

Passwords Quick Start You can read this book in any order, since I’ve included plenty

of cross-references to help you find the information you need.

However, I urge you to begin with Assess Your Password Needs and read at least up through Choose a Password Strategy , to get valuable background information that will help you understand

everything else better. Beyond that, skip to whichever part of the

book addresses the issues you’re most concerned about.

• Gauge the level of password security you likely need by reading Assess Your Password Needs.

• Read Learn Password Basics to learn the fundamentals of passwordsecurity, including the difference between passwords that truly

protect something and those that merely identify you.

• Decide on the best overall approach to password management for

your needs: read Choose a Password Strategy .

• Learn painless ways to create your own great passwords in Generate

Good Passwords.

• In Understand Mac OS X’s Passwords, find out how to choose anduse all the major kinds of passwords in Mac OS X, including login,firmware, and email passwords.

• Read Use Keychain Access to learn about a tool Apple includes with

Mac OS X that lets you secure, repair, and optimize the keychains in

which your passwords are stored.

• In Use Passwords on the Web, learn how to select, store, and fill in

user names and passwords for Web sites.

• If the password programs included with Mac OS X provide too little

oomph, turn to more-capable utilities from other developers. See

Use Third-Party Password Tools.

• Read Keep Your Passwords Secure for tips on protecting yourpasswords from thieves and hackers.


11/121

11

Assess YourPassword Needs

We’re all at different points on a continuum of password needs. Although I do have strong opinions about passwords and do make

numerous recommendations in this book, I want to begin by putting

those opinions and recommendations in context. Only you can

decide which choices are best for you. To help you do that, I’d like

to say a few words about ascertaining how much password-related

risk you have and how that should guide your decisions.

CONSIDER YOUR RISK LEVEL

I live in a major city, in close proximity to my neighbors. Although

there happens to be a police station on my block (making me feel a

bit safer), thefts and robberies are not at all uncommon in this area.I own several computers, use wireless networks extensively, do most

of my banking and bill paying online, and work at home. On a daily

basis, automated programs try to infiltrate my computers to send

spam, run chat servers, and scan for personal information. In short,

when it comes to the kinds of things I use passwords for, my levelof risk is fairly high. I have excellent reasons to take significant pre-cautions with my computers and with the resources they access—

everything from my bank accounts to the servers that keep my

business online.

In contrast, consider a hypothetical person I’ll call Scott. Scott livesin a rural area where the biggest crime in the last year was someone

running a red light. People in Scott’s community don’t lock their doors,

and their home security systems are noisy dogs. Although Scott surfsthe Web frequently, it’s only for recreation; he does his banking in per-

son or over the phone and pays his bills by mail. He has a single Mac,

and no particular harm would come from a stranger looking at all thefiles on his hard disk or reading his email. Scott’s risk level is extremely

low, and therefore he has no need to take precautions that in my case

would be common sense; for Scott, they’d be unnecessary effort.


12/121

12

Most of the recommendations in this book are based on what I do

personally. I err on the side of caution; my anxiety level about protect-

ing my money and my information is based on past experience and the

facts of my situation. I feel confident that the amount of effort some-one would have to expend to figure out my passwords, get past the

security measures I’ve used, and access my accounts is so far out of

proportion to what they could gain from it that I’m as safe as I need to be. By using a few simple techniques, I’ve made the process of creating

and using good passwords reasonably easy; for me, that’s the right

trade-off between convenience and security.

Your situation may differ. On the one hand, you might be charged

with protecting highly confidential records or managing vast sums

of money. You might live or work in an especially insecure place. You

might have well-funded enemies who are intent on destroying your

reputation or your business. If so, you should use the strongest andmost paranoid options I offer; the extra effort, in your case, is justified.

On the other hand, you might be more like Scott. You might have little

to lose, and it might be almost unthinkable that a stranger would get

physical access to your computer. You’d suffer, at worst, minor incon-

venience if someone got past your passwords. If this describes you, youshould opt for the simplest and least awkward options.

In any case, I want to make it very clear that it’s up to you:

If you feel that some of my recommendations are inappropriate for your situation, please don’t hesitate to ignore (or modify) them.

Choose a shorter or more memorable password than what I sug-

gest. Use the same password in more than one place. Keep your

passwords written down in a notebook beside your computer.

Or, at the other extreme, memorize a long list of insanely complex passwords and don’t entrust them to any other person or machine.

Just make your decisions carefully and thoughtfully after consider-

ing the safety factors I describe and your specific situation.

Having said that, I should point out that the level of risk you perceiveand your actual level of risk may be two different things. I’ve known

lots of people who didn’t think they needed to back up their hard disks

until they’d lost their data somehow, and people who didn’t take out

adequate insurance until after they’d suffered a physical loss. The same

thing is true when it comes to your passwords; threats can come


13/121

13

from unexpected places—and your password needs could change

unexpectedly. For example:

• A vengeful ex-spouse who knows your passwords decides to clean

out your bank account or send nasty email messages in your name.

• Someone watches over your shoulder as you type the password for

your bank account at a computer in the library.

• Your computer spends most of its time in a college dorm room,

where people come and go frequently, and someone decides to take

the opportunity to access your student records.

• A geeky neighbor hacks into your Wi-Fi network and starts reading

the email you send and receive.

I mention these things not to frighten you but to help you think soberly

and sanely about risks. If you’re unsure how easily someone couldaccess one of your password-protected accounts or how much damage

they could do if they did, it pays to be more cautious.

USE AN OUNCE OF PREVENTION

You know the old saying: an ounce of prevention is worth a pound

of cure. If there’s one concept I want you to take away from this book,

it’s this: you can achieve a tremendous amount of security with sur-prisingly little effort.

For example, coming up with and remembering lots of passwords,

although it may seem daunting, is actually not hard at all. In most

cases, you can let your computer generate and remember passwords

for you, requiring no thought whatsoever. Alternatively, if you follow

my suggestions for using patterns, you can almost instantly come up

with (and recall) strong passwords whenever they’re needed—even if you don’t have access to the computer you normally use.

Either way, the difference in effort between low security and high

security is often tiny. When it costs so little to gain so much peace

of mind, you may choose to take greater precautions than you mightneed, in the hope of saving yourself significant problems later.


14/121

14

Learn Password Basics A goal of this book is to teach you how to choose good passwords.

All passwords are not created equal; you should understand a bit

about how passwords work and what makes one password better or worse than another. The circumstances in which a password is usedalso have implications for its security. Even if you ultimately rely on

a password generator to make good passwords for you, you should

be aware of things like how the number and types of characters

correspond to the level of security provided.

UNDERSTAND PASSWORD SECURITY

Before you can choose an appropriately secure password, you should

know the basics about how passwords work. Imagine that you need

to protect something valuable from a hypothetical thief who wants to

get to it, and that a password functions as the lock that stands between

the thief and your valuables. For starters, let’s say the password is just

a single character, limited to digits (0 through 9). No matter whichpassword you chose, it’s clear that any thief could figure it out in a

maximum of ten tries—meaning it’s not very secure.

Suppose, though, that the single-character password could use not

only digits but also all 26 letters in the English alphabet. Then thereare 36 possible passwords, which is more secure because it would take

significantly more tries to guess the right character—although the thief

might, of course, get lucky and guess correctly sooner rather than later.

Next, imagine a case-sensitive context, in which capital letters andlowercase letters count as different characters, so that if the password

is A , entering a won’t work. Now there are 62 possible passwords.

Add the option of using any of 33 common punctuation characters(such as #, %, or /) and the number of possible combinations rises to

95. Although statistically this is a far cry from the original 10, it still

wouldn’t take terribly long to try 95 characters, especially if the thiefused a computer to try them all instead of entering each one manually.


15/121

15

But add a second character to the password, and the number of options

goes way up, to 9,025 possibilities (95 x 95). With eight characters in

the password, the number of possible combinations rises to

6,634,204,312,890,620 (958)!

Of course, a thief doesn’t have to type all these combinations manually.

A determined culprit might resort to a brute force attack, in which acomputer generates and attempts every possible combination of char-

acters in sequence. Brute force attacks can take a long time but areguaranteed to succeed eventually.

However, “eventually” could be so long that you need not worry. If the

thief used a very fast desktop computer that could check ten million

passwords per second, and if your eight-character password containedalphanumeric and punctuation characters (95 possible choices for each

character), it could take up to 21 years for the computer to guess it—

though on average it would take half that time (since the correct password probably wouldn’t be the very last one it tried). If the thief had a

large supercomputer (or a thousand fast desktop computers networked

together), this time would drop to a little more than a week. But if youadded just one more character to the password, even a supercomputer

would need nearly 4,000 years to figure it out! (I say more about the

computational effort required to crack passwords ahead, in Length of

Random Passwords.)

So for all practical purposes, a nine-character password with alpha-numeric and punctuation characters is effectively uncrackable—but

only if it’s random, because thieves (and their computers) are likely to

try more predictable passwords before deploying a brute-force attack.

Most of us don’t select completely random passwords, though, because

they’re hard to remember—but easier-to-remember passwords are alsoeasier to guess. For this reason, you would be unwise to choose as a

password the name of your spouse, pet, or best friend. Similarly, using

common numbers (your date of birth or anniversary, your phone num-

ber, your Social Security number) is a bad idea, because those stringsof characters may be among the first a thief would try.

Another common tactic (employed in both manual and computer-

generated attacks) is to try sequences of characters that form easy-

to-remember patterns on your keyboard. For example, the string


16/121

16

rfvujm may appear random at first glance, but it’s made by pressingtwo parallel diagonal rows of keys on an English QWERTY keyboard.

Any such pattern makes a password less secure.

If those simple attempts fail, a thief might move on to a dictionary

attack, in which a computer runs through every word in a long word

list as a possible password and then, failing that, tries combinationsof words. (Despite the name, a dictionary attack isn’t necessarily

restricted to words from a real dictionary; it can include slang, mis-spellings, non-English words, and other common combinations of

characters.) Since you’re far more likely to choose a password using the

word dog than the string ogd, chances are that this approach will yieldresults faster than a brute-force attack.

A typical dictionary attack in a case-sensitive context might start with

words in all-lowercase letters (since they’re the easiest to type) and

move to capitalized and then all-capital words. Later it might try wordsin combination with numbers, but trying every combination of lower-

case and capital letters for every word makes the attack much more

time-consuming.

Taking all this into consideration, you might choose an entirely ran-

dom combination of characters, such as 8hj#1Qf9. No thief would everguess it, and a computer would have to resort to a hopelessly long

brute-force attack. But such an odd mixture of characters might be

hard for you to remember, so you’d be tempted to write it down somewhere. If the thief were to find it written down (or stored in a file on

your computer)—and he’d surely search thoroughly—he’d be able to

break in almost instantly.

D!cti0n@ry: Modern dictionary attacks also try common varia-

tions on standard spellings, such as replacing a with @ and E with 3 .

What should you take away from this discussion? When choosing a

password, keep in mind the following:• Never use names or numbers that are obviously connected to you.

• Avoid words that can be found in a dictionary (any dictionary).

• If a password is especially easy to type or forms a pattern on the

keyboard, it’s not secure.


17/121

17

• Longer passwords are more secure than shorter passwords—and

more secure still if they’re random.

• If you write down your passwords, keep the paper on which they’re

written in a safe place, and jumble the characters in a memorable

way to slow down anyone who might find your list. (I discuss

writing down passwords further in Strategy A: Rely (Mostly) onTechnology and in Prepare an Emergency Password Plan.)

• Always use a combination of all the character types available for the

password. (But don’t worry, these passwords aren’t as hard to create

or remember as you might think, even if you’re generating them

manually; read Create Security Passwords and Devise a Pattern for

Identity Passwords for more details.)

Character study: Some programs and Web sites exclude punctua-

tion from the allowable character types, while others accept foreign-language characters (such as ç or æ, which you can enter usingOption-key combinations on a Mac). When choosing a password, find

out which types of characters the system supports, and use all avail-

able types. However, I suggest avoiding the space character and the

' and " characters (single and double straight quotation marks),

which can confuse some computer systems.

UNDERSTAND THE TWO PASSWORD TYPES

Passwords fall into two broad categories: those designed to secure

something (as in our ongoing example in the previous section) and

those designed to identify someone. Although this distinction is oftensubtle, it’s something you should understand before delving into the

nuts and bolts of working with passwords.

Security Passwords

When most of us think of passwords, we assume their function is toprotect something, such as information (email or documents), access

(programs on a computer or entry to a building), or money (a bankaccount or other assets). Many passwords do serve such a purpose; I

refer to these as security passwords. Like a key to a safe or a building,

this sort of password enables the holder to reach what’s inside.


18/121

18

Also like a key, a password can be lost (forgotten) or stolen (discov-

ered), and if hidden it can be found. An otherwise terrific password has

no value at all if it falls into the wrong hands. Likewise, just as a lock

can be physically broken if someone has no key, some kinds of infor-mation in the virtual world can be accessed without a password by

cracking, or circumventing security systems with clever programming

or manipulation. So it pays to bear in mind that choosing an excellentpassword is only one part of keeping something secure.

That said, I can’t overstate the importance of choosing security pass-

words wisely. Just as you wouldn’t protect a bank vault with a suitcase

padlock, you shouldn’t take unnecessary risks with your electronic

valuables by using an insecure password.

Identity PasswordsOf the hundreds of passwords I’ve created, most exist not to protectanything but merely to identify me. For example, say I register for

a free account at the New York Times Web site so I can read news

stories there. The site asks me to supply (among other things) a user

name and a password. My user name might be my real name, a varia-

tion, or a nickname—something someone else could guess. To ensure

that only I can log in with my user name, the site asks for a password:information that only I know. (They may do this for several reasons,

one of which is to verify that only people who have agreed to their

terms of service get access.) I call such passwords identity passwords.

This type of password doesn’t necessarily protect anything. Someone who guessed or stole my New York Times password could log in as me

and read articles, but not drain my bank account or access my email.

For this reason, in most cases identity passwords need not be as

strong—as difficult to guess or break—as security passwords. The

loss or inconvenience you might suffer if someone discovered your

identity password would, in most cases, be extremely minor.

FIGURE OUT THE RIGHT PASSWORD TYPE

When the time comes to create a password, your first step is to

consider its purpose: security or identity. This is trickier than it

sounds, because all security passwords also help identify you, andsome passwords that seem only to identify you turn out to protect


19/121


20/121

20

LEARN THE PROS AND CONSOF REUSING PASSWORDS

A friend of mine had to supply the password for her Mac OS X loginaccount to a technician repairing her computer, which concerned her

greatly because it was the same password she’d used in more than 100

other places. Although that particular technician was trustworthy, the

sad truth is that plenty of people aren’t. Someone else learning that

password might have used it to access all sorts of private information,

perhaps even stealing my friend’s identity and making fraudulentpurchases in her name.

You might decide that you should never use the same password in

more than one place, because varying your passwords greatly limits

the damage that can occur if someone learns any single password. At

the other extreme, you might decide to keep only certain (especiallyimportant) passwords unique, while freely using a single identity

password that could result in little trouble if it were compromised.

I grant that coming up with an endless series of completely newpasswords is a hassle that no one should endure. On the other hand,

suppose you have a single password that’s used in 100 relatively

unimportant places, and that password somehow becomes public.

Most likely you’ll still want to change it, because some ne’er-do-well

with too much time on his hands could do unpleasant things like post-ing bulletin board messages as you, bringing the wrath of media giantson you by violating their service agreements, and so on. To avoid all

such consequences, you’d eventually have to go to 100 different Web

sites and enter a new password on each one. That, too, is a hassle no

one should endure.

I advocate a compromise approach:

• For identity passwords, I suggest that you either use a password

utility (as I discuss in Use Third-Party Password Tools) or follow apattern for creating passwords (described later in Devise a Patternfor Identity Passwords) so that all your passwords are different

while still being easy to create and remember. A pattern-based

system requires almost no expenditure of brainpower after you

devise the initial template, making it virtually as easy as—but much

safer than—reusing one password everywhere.


21/121

21

• Security passwords require more care, but you’ll have fewer of

them, so there will be less to remember; I discuss how to deal

with them (even without a password management tool) in Create

Security Passwords.

UNDERSTAND OPTIMALPASSWORD LENGTH

Having read Understand Password Security , earlier, you may be think-

ing that you should construct and memorize completely random 64-

character security passwords to thwart any cracking method available

to current or hypothetical future computers, but that’s probablyunreasonable. Consider these factors:

• The value of what you’re protecting. If the treasure is someone’s

life or millions of dollars, for example, an insanely long password

is worth it. But if you’re protecting only $100 in your checkingaccount, the effort of memorizing and entering such a long pass-

word is out of proportion to its value.

• The likely effort someone would be willing to expend to break your

password. The people who have the computing resources to cracka long, random password within a reasonable period of time aren’t

going to waste their effort unless they have something significant

to gain, and that may not include anything on your computer.

In other words, there’s a range within which a password is adequatelysecure for ordinary mortals but not so complex that you’ll never be

able to memorize it—or that it will take too long to enter.

The important thing to remember is that length alone does not a

secure password make. As I described earlier, using characters froma wider palette makes shorter passwords more secure, while using

guessable patterns makes longer passwords less secure. So there

are trade-offs. The fewer kinds of characters you include and theless random it is, the longer your password must be; the broader

the character range and more random it is, the shorter it can be.


22/121

22

Touch typing: Most password fields display only bullet or asterisk

characters as you type—not your actual password—so that someone

looking over your shoulder can’t see what you enter. For this reason,it pays to choose passwords that you can easily type accurately with-

out being able to see them, and this can become tricky with long,

multiple-word passphrases, especially if they include seldom-used

special characters. This is one more reason why a shorter (but more

complex) password may be better than a longer one.

Length of Random PasswordsI performed some rough calculations to figure out how long it wouldtake to break random passwords of various lengths and character

ranges. For example, with a password containing a mixture of capital

and lowercase letters and numbers, a single desktop computer could

guess a six-character password in about an hour and a half; a super-computer could do it in less than 6 seconds.

In Table 1 (shortly ahead), I list several character ranges and for each

one, the number of characters at which a password becomes long

enough that it would take an attacker at least twice as long as my total

life expectancy to test all the possible combinations—meaning that,

on average, the probability of a given password being cracked whileI’m still alive approaches zero. For a medium-security password, I

base this hypothetical statistic on an attack by a single well-equippedhacker; for a high-security password, I base it on an attack by a mas-

sive supercomputer (or a botnet , a network of hacked computers

working together as a single attacker). Either way, I figure that if the

attacker can’t crack my password during my lifetime, it’s as safe as itneeds to be.

I’ve highlighted the row in the table that shows the alphanumeric

character ranges because these characters can be used safely in virtu-

ally any password. Although I encourage you to use punctuation andspecial characters when you can, and doing so can result in shorter

passwords that are just as secure, the “sweet spot” for your average

random password turns out to be 10 or 11 characters.


23/121

23

Table 1: Recommended Lengths for Random Passwords

Character Ranges

Used in Password

Recommended

Password Length for

Medium Security

Recommended

Password Length

for High Security

0–9 17 20

a–z 12 14

a–z, 0–9 11 13

a–z, A–Z 10 12

a–z, A–Z, 0–9 10 11

a–z, A–Z, 0–9,

punctuation[1]

9 10

a–z, A–Z, 0–9,

punctuation[1]

,special characters[2]

7 9

[1] Punctuation includes the 32 visible characters that can be typed on a

standard Mac keyboard (using the U.S. English layout) without modifier

keys or with the Shift key only (! @ # $ % ^ & * ( ) _ + - = ` ~ [ ] { } \ | ; : '" , . / < > ?), plus the space character. However, some systems can’t handlespaces or single or double quotation marks (' or "), so I suggest avoiding

those.

[2] Special characters, sometimes known inaccurately as “high ASCII” or

“upper ASCII,” are the 126 characters that, on a standard Mac keyboard

(using the U.S. English layout), can be typed using the Option key with

other keys:

Ä Å Ç É Ñ Ö Ü á à â ä ã å ç é è ê ë í ì î ï ñ ó ò ôö õ ú ù û ü † ° ¢ £ § • ¶ ß ® © ™ ´ ¨ ! Æ Ø " ± # $ ¥ µ % & ' ! ( ª º " æ ø ¿ ¡ ¬ ) ƒ * + « » … À Ã Õ Œœ – — “ ” ‘ ’ ÷ , ÿ Ÿ / - ‹ › fi fl ‡ · , „ ‰ Â Ê Á ËÈ Í Î Ï Ì Ó Ô Ò Ú Û Ù ı ˆ ˜ ¯ ˘ ˙ ˚ ¸ ˝ ˛ ˇ

Length of Non-Random Passwords

For non-random passwords, you’ll need even longer strings. If yourpassword uses names and words from a dictionary (even assuming

that you choose multiple-word phrases), you’ll need 28 characters

to get the same (medium) level of security as a 10-character randomalphanumeric password, and 33 characters to get the higher level

of security provided by an 11-character random password.


24/121

24

Pronounced differences: Some people prefer pseudorandom

pronounceable passwords, which aren’t actual words but can be

sounded out as a memory aid. (In fact, the Mac OS X Password Assistant offers pronounceable passwords with its FIPS-181 option.)

These passwords aren’t vulnerable to dictionary attacks but are

easier to crack than truly random passwords. Examples of pro-

nounceable passwords are peilajooseft and imdudabondif . With

this type of password (assuming only lowercase letters), you’d

need 14 characters for medium security and 17 for high security.

If ease of memorization is important to you, by all means go with a

longer but non-random password. But if you want to save yourself

some typing (and have fewer characters to memorize, even if they’reharder to learn), choose a shorter, random password.


25/121

25

Choose a PasswordStrategyIf you read the preceding chapter, you know about the difference

between identity passwords and security passwords, as well as how

long and complex passwords should be in order to avoid manual

or automated attacks. But when it comes to the nuts and bolts of

creating and using these great passwords, many people get stuck

between wanting an unguessable password on the one hand, and wanting a memorable password on the other. These two goals aren’t

contradictory, though. You only need a good strategy.

In my view, the many methods of creating and using passwords

can be distilled into two broad approaches. In one, you rely prima-rily on technology to generate, store, and enter passwords for you

(although you must also take a few steps to remember certain pass-

words and perform some other tasks). In the other approach, you

assume that your brain will do most of the work of creating and

entering passwords, though you may use software tools to help you

with certain tasks (for example, selecting random characters).

Before you worry about the details of how to construct passwords,

it’s good to have in mind what your overall approach will be. Then you can choose appropriate tools and techniques and not concern

yourself with those that don’t apply to your strategy.

STRATEGY A:

RELY (MOSTLY) ON TECHNOLOGY

One approach to dealing with passwords is to decide up front that you’ll let the computer do as much of the work as possible. You’ll use

one or more programs to generate passwords for you automatically

(most likely long, complex, random passwords), to securely store

those passwords, and to enter them for you in most cases. I call thisapproach Strategy A (A for automated!).


26/121

26

A great thing about Strategy A is that you need not make a distinction

between identity passwords and security passwords, or fret over the

minimum length and complexity for various passwords. Since they’re

all generated by software anyway, you can make all your passwordsequally secure.

Even if you choose to rely on technology, though, you’ll still need toput your brain to work from time to time. For example, there are some

passwords that, by their nature, can’t be entered automatically, suchas your keychain password (see Keychains) and your Mac’s Firmware

Password, if you’ve set one. Since you must remember these pass-

words, you might prefer to create them manually too, using one of the

methods I describe in Create Security Passwords.

If you have hundreds of passwords stored on your computer (pre-

sumably in a safely encrypted form), it behooves you to back them up

liberally—that is, frequently, in multiple ways, to multiple destinations.If all your eggs are in one digital basket, you could be setting yourself

up for a world of hurt. Consult Back Up Your Passwords.

In addition, you may encounter situations when you’re away from your

main computer but still need a password. For instance, you may want

to check your email from a public computer while you’re on vacation,

or log in to PayPal to transfer money while you’re at a friend’s house.

In cases like these—or when your computer is in the repair shop or

otherwise inaccessible—you need an alternative means of viewing yourpasswords. For some people, this could be an iPhone or iPad app that

syncs to a password management utility on your Mac. For others, a

better choice may be a Web-based password manager or an encrypted

Web page such as the one 1Password can create.

Dual-purpose backups: If you use a backup method that stores

your data in an encrypted, Web-accessible form using a program

such as Backblaze, SugarSync, or SpiderOak, your backup itself can

potentially serve as a means of remotely accessing your passwords,as long as they’re stored in a format you can read on another

computer.

As an extra precaution against getting stuck without a password, youmight write down your most crucial passwords and keep them on your

person always. To keep them safer in case someone steals your wallet


27/121

27

or otherwise stumbles on them, jumble them according to a method

you can easily remember—for example, writing them backwards or

writing down the next higher letter or number for each character.

To put it all together, Strategy A includes the following elements:

• Random password generation: Use software to create all your

passwords. See Use Password Assistant, 1Password, and OtherPassword Generators.

• Secure password storage: Use your keychain (see Keychains),

1Password (see 1Password), some other tool (see Other Password

Managers), or a combination of these to store all your passwords inan encrypted form.

• Automatic password entry: Using your keychain (in conjunc-

tion with applications that support it) or a third-party password

manager, let your Mac enter your passwords as needed. See Safari,1Password, and Use Passwords on the Web.

• Rigorous backups: You can never have too many backups of your

passwords. Whether you use Time Machine, CrashPlan, Carbon

Copy Cloner, or any of 100 other programs, make sure your passwords are thoroughly and frequently backed up.

• Remote accessibility: Make sure you can get at your passwords

in one way, or preferably several ways, when you’re away from yourmain computer. This could include any or all of the following:

! A mobile app: Many Mac password managers have companion

apps for the iPhone, iPod touch, iPad, or other mobile gadgets

that enable you to keep your private information in sync with

your computer and safely encrypted. If you carry such a device with you all the time, one of these may be the path of least

resistance. See 1Password and Other Password Managers.

! A Web-based password manager: Although passwordmanagers hosted on Web servers aren’t as flexible or convenientas programs that run directly on your Mac or mobile device, they

do enable you to get at your passwords easily wherever you have

an Internet connection. See Web-Based Password Managers.


28/121

28

! An encrypted Web page: 1Password lets you export your

passwords as a special encrypted Web page that you can put on

your own server, your MobileMe iDisk, a USB flash drive (see the

next point), or somewhere else where you can access it remotely.Unlike Web-based password managers, this solution requires no

software to be running on the server. See 1Password.

! A portable app: If you don’t want to carry an iPhone or other

small computer with you, you could put your passwords on atiny USB flash drive that you keep on your keychain or in your

pocket. Several password managers that run on multiple plat-

forms are designed to be stored on, and run directly from, these

drives. See Portable Password Managers.

• A cheat sheet: I suggest making a short list of the top five or ten

passwords you rely on the most and which you might be unable to

remember when you most need them—an emergency or a trip inthe distant future, for example. This list might include passwords

for your email account, keychain, bank account, or anything else

that’s especially important. Be sure to modify the passwords on thislist in some easy-to-remember way so that they wouldn’t be imme-

diately useful to anyone who happened upon them, and keep this

list with you at all times (in your wallet, for example). Also include

on the paper the URLs for any online locations where you’ve stored

the rest of your passwords.

STRATEGY B:

RELY (MOSTLY) ON YOUR BRAIN

A different approach to password management is to forgo automated

solutions and put your confidence primarily in your brain’s compu-

tational and memory capabilities. This strategy costs nothing, doesn’t

require you to install or learn any software, isn’t affected by bugs or

program revisions, and protects you from the risk of a lost or stolengadget. It does, however, require considerably more thought and effort

than Strategy A. If you want to be entirely in control of your passwords

yourself—rather than putting your computer in control—Strategy B

(B for brain!) is the way to go.


29/121

29

You may, of course, choose to employ a bit of technology here and

there for the sake of convenience. For example, if you decide to come

up with a random password, you might use a password generator to

offer suggestions (see Use Password Assistant and Other Password Generators), because randomness isn’t something human brains are

good at. You may also decide to use your keychain or other password

manager to store a few carefully chosen passwords, simply to save yourself the bother of retyping them all the time. But this would be

in addition to, rather than instead of, keeping them in your head.

Unless you have a photographic memory or enjoy the mental challenge

of learning and regurgitating complex strings of characters on demand,

Strategy B requires you to use mnemonic techniques. That is, you must

come up with patterns or other methods that enable you to create pass-

words that appear to be random but that you can recall or reconstruct

when needed. (I describe some of these techniques in Create SecurityPasswords and Devise a Pattern for Identity Passwords.) Even so, for

the average person this strategy may tend to break down a bit once

your password list grows into the hundreds, and in any case it’s worth

writing down at least your most important passwords and keeping

them in a secure place.

Limitations of the brain also mean that the distinction between

identity and security passwords becomes much more important with

Strategy B. Because a password’s security increases with its random-

ness and length, you want your most important passwords to be asrandom and long as feasible. But because longer and more random

passwords are harder to remember (and to associate with a particular

resource), you’ll inevitably want to follow a simpler system for creating

identity passwords, which will probably be much more numerous.

To summarize, Strategy B involves the following:

• Identity and security passwords handled differently: For

security passwords, choose long(ish), random(ish) passwords that

a machine or another person wouldn’t easily be able to guess (seeCreate Security Passwords). For identity passwords, use a pattern

(read Devise a Pattern for Identity Passwords). Either way, the

process is normally manual, perhaps supplemented by suggestions

from a program for more secure applications.


30/121

30

• Non-volatile CRAM (cerebral random access memory)

storage: Learn your passwords using rote memorization,

mnemonic clues, or the template that you reuse for identity

passwords.

• (Mostly) manual password entry: Type your passwords

manually when needed—though you might use your keychain ora password manager occasionally for convenience. Read Keychains

and 1Password.

• A cheat sheet: Even if you trust your memorization skills

implicitly, you could someday be in a situation where stress, the

impact of a falling coconut, or some other random occurrence

prevents you from remembering a crucial password. So as inStrategy A, I suggest keeping a short list of your most crucial

security passwords with you all the time—perhaps obfuscated

slightly to prevent them from doing a thief any good.

CHOOSING A STRATEGY:JOE’S RECOMMENDATION

I used Strategy B for many years, and it worked reasonably well for me.But my list of passwords grew dramatically over time, and as password

management software evolved I began to realize that I was putting

myself to a lot of unnecessary work and aggravation, while at the sametime taking shortcuts that led to many of my passwords being less

secure than they should have been. So I gradually shifted to Strategy A.

Today, 100 percent of my passwords are generated by software, and

perhaps 99 percent are stored and filled in automatically as needed.

I use my brain to store the remaining 1 percent or so, and I’ve taken

precautions to ensure that I never get stuck without access to a needed

password.

My use of Strategy A reflects a certain amount of faith in technologyand in a few very smart software developers in particular—I trust that

the methods I use to store and retrieve passwords will still work years

from now and with new versions of the applications that I rely on,although I do have alternative means of getting at my passwords if

necessary. (See the sidebar Should You Trust a Password Manager? for

further discussion on this point.) It also reflects a degree of paranoia


31/121


32/121

32

Generate GoodPasswordsEarlier chapters of this book discussed the principles that governa password’s security and the general strategies you might employ

to manage your passwords. Now it’s time to get down to specifics:

how do you go about constructing a secure yet memorable pass-

word? And what special techniques can you use for the seemingly

endless number of identity passwords most of us must maintain?

If you’ve decided on what I’m calling Strategy A—using automated

tools to create and store passwords—you can skip lightly over most

of this chapter. However, even the most technologically dependent

person may have to set good passwords manually from time to time,and you should be familiar with some of the basic methods for doing

so. Toward the end of this chapter, I also introduce you to Password

Assistant, a feature built into Mac OS X that can help you create

passwords of several types, with varying length and complexity.

In this chapter, I sometimes refer to passwords that I haven’t dis-

cussed in detail yet, such as the login and firmware passwords, as

well as the password for your Mac OS X keychain (itself a password

repository); I get into details about these passwords later.

CREATE SECURITY PASSWORDS

Taking all the previously discussed facts into account, I’d like to make

suggestions for creating security passwords. (In the next section, I give

advice for identity passwords.)

When faced with the need to create any new security password, ask yourself this question: “Will I ever need to remember it on my own?”

The answer may not be as obvious as you think.

On the one hand, the Mac OS X keychain can remember passwords

for you (see Keychains), and third-party Mac OS X and iOS tools canhelp too (see Use Third-Party Password Tools). If a certain password


33/121

33

will be used only when you have access to such a program, you needn’t

also store it in your brain. (You may, however, need to give another,

trusted person access to such a password; read Prepare an Emergency

Password Plan for details.)

On the other hand, as mentioned earlier, you may find yourself in a

situation where you must recall a password without help. If you havenot committed important passwords to memory, such a situation can

leave you stranded (but see Strategy A: Rely (Mostly) on Technology for more advice). In addition, you must remember your Mac OS X

login, firmware, and keychain passwords, since you may not be able

to access your computer until you’ve entered them!

So, choose one route or another for creating security passwords:

• The random route: If you’re sure you can let the computer

remember a security password for you (or if you’re willing tomemorize it by rote), use Password Assistant (see Use Password

Assistant) or another password generator (see Use Third-PartyPassword Tools) to create a random 10- or 11-character string that

includes numbers and capital and lowercase letters, and store it

in your keychain or other password manager. Choose the length

according to your desired level of security (per Table 1) and the

restrictions on password composition (see Table 2, shortly ahead).

• The non-random route: If you might need to recall a security

password yourself, use one of the following techniques (or devise

something comparable) to create a secure yet memorable password:

! Use Password Assistant’s Memorable type to create a password

that’s at least 17 characters long. (Some other password genera-

tors have comparable options.) You may think that 17 characters

is a lot to remember, but you’ll easily recall passwords like

Turkish1%teenaged, Bronx18\munches, or send78*obediently .

!

Create a 10- or 11-character string that appears to be random but that has an underlying pattern that only you know. For

example, start with a movie quote you like, and write down the

first letter of each word. So, “No matter where you go, there you

are” becomes nmwygtya . Insert numbers within the string; forexample, since this quote is from a movie released in 1984, you

might have nm1wy9gt8ya4. Finally, capitalize some letters, such


34/121

34

as the vowels or the first and last letter: Nm1wy9gt8yA4. (Formore ideas on creating pseudo-random passwords, see the next

section, Devise a Pattern for Identity Passwords.)

Whichever procedure you follow, note that not all character types can

be used in all situations; Table 2 lists some of the restrictions.

Table 2: Password Restrictions

Password Restrictions More Information

Login

(including

administrator)

Avoid special characters

typed using Option key.

http://docs.info.apple.com/

article.html?artnum=302231

Firmware • Avoid special characters


• For PowerPC Macs, also

avoid the capital letter U.



AirPort 3.0 or

later• Avoid special characters


• WEP passwords (but not

WPA passwords) should

have either 5 or 13 char-

acters (5 for 64-bit WEP,

13 for 128-bit WEP).• WPA passwords can have

8 to 63 characters (or 64

hexadecimal digits).





Keychain None

Master None

Root Avoid special characters


Web sites Varies by site. In general,you’re safe with a–z, A–Z,

and 0–9; some sites

require a combination of

letters and numbers, some

restrict password length.

http://docs.info.apple.com/article.html?artnum=302231http://docs.info.apple.com/article.html?artnum=302231http://docs.info.apple.com/article.html?artnum=107666http://docs.info.apple.com/article.html?artnum=107666http://docs.info.apple.com/article.html?artnum=107434http://docs.info.apple.com/article.html?artnum=107434http://docs.info.apple.com/article.html?artnum=108058http://docs.info.apple.com/article.html?artnum=108058http://docs.info.apple.com/article.html?artnum=108058http://docs.info.apple.com/article.html?artnum=107434http://docs.info.apple.com/article.html?artnum=107666http://docs.info.apple.com/article.html?artnum=302231


35/121

35

DEVISE A PATTERN FORIDENTITY PASSWORDS

For passwords that serve only (or mainly) to identify you, I suggest building them out of two components: one that’s always the same

and another that varies from one place to the next. To use a trivial

example, if you needed one password to open a door and another to

open a safe, you might take your recurring personal segment of a1b2 and add it to door and safe to get a1b2door and a1b2safe. (But thoseare not good passwords; read on to see how to overcome that prob-lem.) Each component of a good identity password appears to be

random, as does the password as a whole, but in reality they follow

a pattern that makes it easier for you to remember them.

Don’t Panic!The advice here may seem like too much effort for too little gain.

But it’s not difficult: you go to the small effort of creating two pat-

terns just once, and then, after you use them a few times, they’re

burned into your memory and their use becomes automatic.

In fact, it can be even easier than that! As I explain later in

Keychains, Use Keychain Access, and Use Third-Party Password

Tools, in most cases your computer can remember passwords for

you, and if you prefer, it can create the passwords too, requiring

almost no effort on your part. You may, however, fall back on thetechniques described here when you need to remember passwords

without the aid of a software tool—so don’t skip this section even

if you plan to let your computer remember your passwords.

Whatever you do, resist the temptation to take the lazy way out

and reuse just one password everywhere. You might get lucky and

encounter no problems, but I’d be irresponsible if I suggested it

was safe or wise—even for these low-security identity passwords.

Password Part 1: Your Personal SegmentLet’s begin with the part of the password that will be the same each

time it’s used. It should follow the guidelines mentioned earlier, such

as avoiding words in a dictionary and numbers someone might guess,

and mixing numbers with capital and lowercase letters. But it need not

be long—five to seven characters should be plenty.


36/121

36

If you want to generate a completely random set of characters and

don’t mind memorizing it, that’s fine—and for help doing so, you can

use Password Assistant (see Use Password Assistant, a bit later in this

chapter). But to make memorization easier, I suggest obfuscating afamiliar string. There are innumerable ways you might do this; here

are a few strategies, to give you some ideas:

• Start with a word—ideally one that’s obscure or from a foreign

language—and replace the vowels with numbers. For example, ifthe word is aquatic, you might replace the vowels with consecutivenumbers, to get 1q23t4c, or reverse the numbering to get 4q32t1c.Or use 1 for a, 2 for e, and so on: 1q5lt3c.

• Instead of starting with a word, use the first letter of each word ina phrase you can remember (such as a movie, book, or song title).

For example, The Long, Dark Tea-Time of the Soul could become

TLDTTotS. Play with the case of the letters to disguise their origin.

• Reverse the order of any word or numerical string you choose, toobfuscate it further. Instead of aquatic, choose citauqa ; instead of90210, choose 01209.

• Intersperse a string of numbers with a word to disguise where both

came from. If your favorite movie is Star Wars and you rememberthat it was released in 1977, you could produce strings like s1t9a7r7 or (in combination with reversal) 77sraw91.

• To mix case, capitalize all the consonants (aQuaTiC), all the vowels( AqUAtIc), every third letter (aqUatIc), the first and last letter( AquatiC), or some other combination you can remember.

• Combine several of these techniques. If you start with “A rolling

stone gathers no moss” and use the first letters, you get Arsgnm.Replace the vowel with a number, and you get 1rsgnm. Capitalizeevery other letter to get1RsGnM. Reverse that and it’s MnGsR1.

These are only a few of the techniques you can use to devise a patternthat appears to be a random string of letters and numbers and yet is

easy to remember (or at least easy to reconstruct, even if it doesn’t rolloff your fingertips). Before moving on, take a few minutes to come up

with a five-to-seven-character string to use as the unchanging part of

your identity passwords. It will become easier to remember as you get

into the habit of using it.


37/121

37

Shared Passwords

You may have to come up with passwords for other people

(coworkers or family members, say) or create a single password

that will be shared by several people (such as the password for

a shared network volume). In these cases, you should not follow

the patterns you use for your own passwords, because that

reduces their security. Come up with a separate pattern for any

password that must be shared and used regularly by other people.

Password Part 2: The Usage-Specific PortionThe second part of your identity password is specific to the place in

which it’s used. The idea, as with the first part, is to follow a pattern

so that it takes little or no mental effort to figure out what a given

password should be, while obscuring that fact from someone who

might obtain one of your passwords and try to guess the rest.

Let’s say that my personal password segment is 9t3vQd (and that,as random as it looks, it’s actually based on a pattern I can easily

recall). If I want to use this to create a password for the New YorkTimes Web site, I could make it 9t3vQdNYT or NYT9t3vQd. Theproblem, though, is that the NYT part of the password is prettyobvious. A hacker learning this password and noticing the origin of

NYT might guess that CI9t3vQd could be used to access my account

at Cook’s Illustrated. (Great recipes are a hot commodity, you know!)The goal, then, is to come up with a usage-specific pattern that’s

immediately obvious to you, so that you can instantly reproduce

a password simply by looking at the name of the Web site or other

resource, yet other people won’t be able to decode your pattern easily.

Many of the tricks for creating the personal password segment couldapply here, but the system needs to work equally well with single short

words, long phrases, varying capitalization, and so forth. Once again,

I’d like to offer a few suggestions to spark your creativity:

• Take the last six characters of the resource and reverse their order;put the first three in the middle of your personal segment and the

last three at the end. So, if your personal segment is 9t3vQd andthe password is for the New York Times, you’d take the last six

characters (ktimes), reverse them (semitk), put the first half inthe middle of your password (9t3semvQd), and put the other half


38/121

38

at the end (9t3semivQditk). If the resource’s name has fewer thansix characters (for example, Pogo.com), add zeroes (or some other

character) to each half to pad it (9t3og0vQdop0).

• Count the characters in each word of the resource’s name (New

York Times = 345), and add up the digits (3 + 4 + 5 = 12). Append

all those numbers to your personal segment (9t3vQd34512). If youhave too few characters to make a password of your desired length,add zeroes (or some other character) to the beginning of the stringto pad it (ZZ9t3vQd34512).

• Using only the vowels in the resource’s name, add half (up to three)

to the beginning of your personal segment and the rest to the end.

(I recommend, for this purpose, counting w and y as vowels!) Forthe New York Times, you’d use the letters e-w-y-o-i-e. Put the first

three at the beginning of your personal segment and the other three

at the end: ewy9t3vQdoie.

Whether you use one of these techniques or devise your own, the keyis to be consistent. If you always use the same strategy to derive your

password, remembering the password for any given site will be a cinch.

But if you change the rules sometimes, you’ll have a hard time remem-

bering your passwords. Decide up front whether you’ll base Web site

passwords on the site’s name or its URL and whether you’ll include

elements like “the”, “of”, “www”, and “.com” in a password derivation.

Using the system I describe here, you can be relatively confident that

anyone who discovers one such password won’t be able to divine the

passwords for any other of your accounts without considerable effort

and luck. However, if someone were to discover two (or more) of thesepasswords, the job would become much easier. If you learned that my

New York Times password is tkro9t3vQdywen and my Cook’sIllustrated password is llis9t3vQdkooc, you’d immediately notice thecommon pattern, drop out the middle, and arrive at tkroywen andlliskooc, which are easily decoded. This is one reason I recommendagainst using this type of pattern for security passwords.

Warning! Please don’t use the example passwords in this book! Lots

of other people have read it too, so those passwords are easy to guess.

Likewise, never use a password that appears in any book or movie;

hackers make a hobby of collecting, and trying, those passwords.


39/121

39

USE PASSWORD ASSISTANT

Hidden behind an obscure icon in a few Mac OS X dialogs is a useful

tool called Password Assistant. It can help you generate various kinds

of random passwords, with adjustable length and character type. It

even shows you how secure each option is. It’s a shame Apple didn’t

make it more accessible, but even that problem is easily solved (see“Password Assistant” under Other Password Generators).

Note: Password Assistant is just one of many automated pass-

word generators; see 1Password and Other Password Generators.

Whenever you see the button by a password field, you can click it

to display Password Assistant. Among the half-dozen or so places you

can find this button are: the dialog that appears when you create a user

or change a user’s password in either the Finder or the Accounts pref-erence pane; the dialog for adding or changing a master password in

the Security preference pane; and the login window when you reset auser’s password.

When you click the button, a small, floating window (Figure 1)

appears.

Figure 1: Password Assistant creates several kinds of passwords foryou and gives you a visual indication of any password’s strength.

As soon as you open this window, a password suggestion appears.

Changing any of the options immediately results in a new suggestion.


40/121

40

The options you can adjust are as follows:

• Type: From this pop-up menu, choose the type of password you want. In this context, type refers to both the range of characters and

the way the password is constructed. Your choices are:

! Memorable: The default setting, Memorable combines

multiple words (from a dictionary) with numbers and onepunctuation character.

! Letters & Numbers: This choice includes numbers and capital

and lowercase letters.

! Numbers Only: This is the least secure option, which in my

opinion you should always avoid.

! Random: This option includes capital and lowercase letters,

numbers, and punctuation characters, but not characters youtype using the Option key.

! FIPS-181 compliant: FIPS-181 is a standard used by the U.S.

Department of Commerce to create (mostly) random yet pro-

nounceable strings. It uses only lowercase letters.

! Manual: Enter your own password, and Password Assistant

indicates its quality.

To learn about the relative strength of these types, see the sidebar

Strength in Numbers (and Letters), shortly ahead.

• Suggestion: As soon as you change the Type or adjust the Lengthsetting, the Suggestion field offers a suggested password meeting

your criteria. If it’s not to your liking, you can click the arrow at the

right of the field to open a pop-up menu with more choices. If those

aren’t enough, choose More Suggestions from the pop-up menu.

• Length: Drag this slider left or right to adjust the length of the

passwords generated. The minimum is 8 characters and the max-

imum is 31 (though if you enter a shorter or longer passwordmanually, Password Assistant still measures its quality).

• Quality: This gives a rough estimate of the password’s quality.

If the bar is more red or yellow than green, the password is less

secure; if it’s mostly or all green, it’s more secure. A longer green

bar is more secure than a shorter green bar. The method used to


41/121


42/121

42

Understand Mac OS X’sPasswordsIn the course of using Mac OS X, you’ll often encounter the needfor passwords: when you set up a new computer, install new soft-

ware, connect to a wireless network, and more. Many Mac users

become aggravated at having to type passwords so often. Because

such frequent demands to enter a password are annoying, they

might lead you to choose less secure passwords so that they’re easierto enter. Apple’s perspective is that requiring passwords regularly

helps keep your computer and its data safe and secure. In this

chapter, I discuss the various situations in which passwords are

needed in Mac OS X, how to enter and change them, and how securethey should be.

Change the locks: Many passwords—including all the ones

described in this chapter—are case-sensitive, which means thatif you accidentally have the Caps Lock key activated, you’ll type

an incorrect password. Some Mac OS X password dialogs display

a symbol next to the password field when Caps Lock is activated.

On a laptop, the Num Lock key can also lead to typing incorrect passwords—though no visual cue appears. If your password is

repeatedly rejected and you’re sure you’ve typed it correctly, make

sure both Caps Lock and Num Lock are deactivated.

LOGIN PASSWORDS

Every computer running Mac OS X has at least one user account—a

means of identifying the person using the Mac at any given time. Inthe Accounts preference pane, you can set up additional users if you

like. Each user gets a separate virtual (and private) space in which to

work; this includes access to the user’s own preferences, documents,

and Finder settings. The password for a user account is called the login

password. It’s what you use to log in, thus gaining access to your per-

sonal space, but it has other uses too (as I explain a bit later).


43/121

43

Basic training: For more detailed information, consult Kirk

McElhearn’s Take Control of Users & Accounts in Snow Leopard.

When you set up a new Mac or install Mac OS X for the first time,

you’re asked to enter your real name, a user name (typically shorter

than your real name; all lowercase and without spaces), and a pass-

word. In so doing, you set up a user account for yourself with admin-istrator privileges—meaning that you have the authority to add and

delete other user accounts, make changes anywhere on your disk, and

install and run any application. Each Mac has one or more administra-

tor accounts. The login password for such an account is also known as

an administrator password. Mac OS X asks you for an administrator

password when you take certain actions that can have far-reachingconsequences—for example, installing or using software that makes

changes to the /Applications, /Library , or /System folder.

How Many Administrator Accounts?

As an administrator, you can give other users administrative

privileges (by checking Allow User to Administer This Computer

at the bottom of the Password view in the Accounts system

preference pane). Because administrators could inadvertently

make changes that would erase important data or prevent the

computer from working properly, some experts suggest avoiding

administrator accounts for day-to-day use. (In my opinion, using

an administrator account as your main account is reasonable if

you’re the computer’s only user, and it is only slightly less safe

than using a non-administrator account.)

Even if you’re the only one using your Mac, I strongly recommend

setting up a second administrator account, with a different pass-

word, for your own use. You can log in with this second account

for troubleshooting or, should your computer ever require service,

you can supply the second user name and password to the repair

shop instead of divulging your main password.

http://www.takecontrolbooks.com/snow-leopard-users?pt=INTERNALhttp://www.takecontrolbooks.com/snow-leopard-users?pt=INTERNAL


44/121

44

Choose and Set a Login Password Your login

Documents

Take Control of Passwords