Safe and Secure

---

Many years ago, I got a book called The Hacker's Handbook for my birthday. It was full of rather vague suggestions - presumably highly censored - about breaking passwords, finding backdoors, and exploiting common weaknesses in the human element of computing.

Have you ever used one of these as your password?

• 12345 (or some variation)
  
• 111111 (or some variation)
  
• Stonehenge
  
• Hypodermic
  
• God (yes, "God" is an amazingly common password - though I've never heard of "Jesus" being used)
  
• Sex (hah)
  
• Fred (four letters next to each other on the QWERTY keyboard)
  
• Secret (a common default password)
  
• Password / Pass (another common default)
  
• Blank / Empty
  
• LetMeIn
  
• [An actual empty password] (I did use this one once, but only by accident)
  
• [Your pet's name]
  
• [Your significant other's name]
  
• [Your mother's maiden name] (some people think they're being really crafty with this one)
  
• [Your mother-in-law's name] (very common, for some bizarre psychological reason)
  
• [Your own fucking name] (I've seen seasoned professionals do this)
  

If the answer's yes, I hope you're not in charge of any computer security.

Anyway, one message came across loud and clear from that little book: Perfect security may be impossible, but you can get as close as humanly possible by:

(1) Avoiding obvious passwords
(2) Not having computers unnecessary networked
(3) Proper physical security - a strong lock and a single key with you at all times saves a lot of trouble, and finally...
(4) A team of highly trained, highly paid computer security experts, working in shifts so someone's there at all times.

Guess which of these get treated by banks as "unnecessary expense"...until they get hacked?

Oh, and there's one other measure you can take - something so obvious only a professional consultant could miss it. Don't write anything down unless you really have to. Use your memory.

The British government may think it's okay to leave state secrets in taxis and lose CDs of everyone's personal details with the access codes written on the disc several times a year...but you don't have to.

Now, for the single user, or even the small business, security comes down to firewalls, virus scans...and, yes, passwords. And if you're anything like this single user, you've been using the same set of passwords for years - because they're the ones you first thought of, you're used to them now, you can't think of new ones, and you reckon no one else could guess them anyway. Although they probably have.

And because it's a lot of bother to change them. I changed all my passwords last night - Ten email addresses, five forums, ebay and (the typically unhelpful) paypal. It took three solid hours, none of which were remotely enjoyable.

The now replaced passwords were, amongst others:

• A numerical character from my favourite TV show
  
• A lovely band I once did a remix for
  
• A screaming painting by Francis Bacon
  
• A character from a James Bond movie - played by Lotte Lenya
  
• The inevitable drugs reference
  
• The registration number of a car my father used to own
  

The new ones are alphanumeric, longish, in three languages, and...ah, erm...

...I haven't memorised them yet. Which is why they're on a post-it note stuck to the laptop.

---