Quote:
Originally Posted by bello
Secondly, email and host password are the same
|
A good security practice to follow is to use different passwords for (if possible) everything. An easy methodology to follow, I have found, is to define two or possibly 3 base passwords and 2 or 3 numeric pins and then mix them all.
For example:
Base 1 = One
Base 2 = Lame
Base 3 = Password
Pin 1 = 1234
Pin 2 = 6789
Pin 3 = 5678
Note: Remember to choose bases and pins that mean something to you but would not be easily guessed by someone else. (i.e. your birthday, your wife or girlfriends name) I mention this only because the sysadmin at my job uses his wifes name as his one and only password. From the backup servers to the finance and accounting database, all the same password. So you can see that if one password is compromised the entire system is compromised.
I digress, so back to this method of password "compilation" as it were. You can then take a combination of the Bases or Pins (OneLamePassword, Password1234LameOne5678, etc.) and as long as you remember your Bases and Pins you shouldn't have a hard time with assigning different passwords for everything.
If you are one of these people who can't remember passwords and usually store them all in a txt file , I hope you can see an advantage to this method. Now you can store the password broken down into Bases and Pins, not the password itself. So you still have to remember the Bases and Pins themself but not the password.
For example:
Your password (using the Bases and Pins described above) to gmail.com is
Password1234LameOne5678
You haven't signed on to gmail in a while and you forget this password, but you have a txt file on your pc with the following information in it.
gmail = Base3Pin1Base2Base1Pin3
As you can see your password isn't in plain text and this "trick" serves only as a reminder. If possible I would stay away from storing any sort information regarding usernames or passwords locally. On that note, whenever your browser prompts to remember passwords select NO. I may get into this in another post or article later but for now I am just saying NO.
Using this method to assigning passwords is only one of many ways I personally choose passwords and is by no means the most secure means of doing so.
Either way, you should change your passwords frequently (every 60 to 90 days if possible) I would also recommend, vehemently, to change your passwords now that you have been compromised.