Amidst the recent PSN debacle, I have come yet again to doubt in any information I give to third parties. You would think a huge company like Sony could at least have some basic security measures covered. But from the recent reports, it seems they stored every account’s password in unencrypted form. This is—aside bat-shit crazy—a basic security faux-pas even non-security folk know by heart.

So it made me rethink again the basic method I use to protect what in turn protects my online data: passwords. I won’t mention other alternative forms of authentication, because I don’t deal with them on a daily basis.

Here are some of the main rules I follow when it comes to passwords:

• Never use the same password with more than one account. I have actually broken this rule on a few occasions, but mostly for throwaway accounts. However, if what you need protecting is important and you wouldn’t want it to get into anyone else’s hands, make sure to use a unique password for every site/system you access.
• Always use a complex combination of letters, numbers and symbols as your password, at least 8 characters long. Make sure not to include any word available in the dictionary, any personal information (dates, names, etc.), or anything related to the specific account (same username/password >.<). Alternate between capitalization, number sequences (never in order) and special characters. Some might even suggest using characters outside of the ASCII set, but this might give you problems with certain systems, so YMMV. Good password: #-slUpfoLu!9. Bad password: 123abbey.
• If possible, use a memorable sequence of characters. A random string such as “\sVSS’rEXsO-1cL$Z3jF” is a pretty damn secure password, but how convenient would it be to have to type that some time? Or how hard would it be to memorize? I have been using this mnemonic password generator for the past few years, and it’s been great. It generates fairly complex strings, that are easily remembered through practice. It gives you the actual pronunciation of the string to help you with that. I usually spice up the generated string by setting some letters uppercase and changing or adding a few special characters and numbers. I can easily remember several passwords generated by this tool in case I need to login manually somewhere. But I rarely do, because I…
• Use a password manager. All the above rules would be pretty hard to follow if you didn’t use a password manager. I’ve been using KeePass for several years now, and have been pretty happy with it. It runs on all major OS’ (including smartphones), and it supports several authentication mechanisms to access your password database. If you just use a single master password, though, make sure it’s very, very, hard to crack, as you definitely don’t want this slipping into anyone’s hands. Another great password manager that gets security right (but fails terribly at UI) is LastPass. I’ve been using it mostly for web sites and it’s been an invaluable tool for me. It has a plugin for all major browsers and even a mobile app. Definitely worth the $12 yearly price for the Premium upgrade.

There are plenty more considerations when it comes to security, but these are the major ones I follow for passwords.

Anything I missed / could do better? Let me know in the comments.