Perfect Passwords: Selection, Protection, Authentication

by Mark Burnett

User passwords are the keys to the network kingdom, yet most users choose overly simplistic passwords (like password) that anyone could guess, while system administrators demand impossible to remember passwords littered with obscure characters and random numerals. Author Mark Burnett has accumulated and analyzed over 2,000,000 user passwords, and in this highly entertaining and informative book filled with dozens of illustrations reveals his findings and balances the rigid needs of security professionals against the ease of use desired by users. All of us remember when we first started with computers or the internet. We quickly learned that everything seems to need a password so to cope with that, we develop a password strategy. But statistics show that most password strategies aren't that great and are in fact so often predictable that crackers too often crack them in a matter of minutes. Some companies might assign you completely random character sequences but how many of those do you ever remember without writing them down? Some companies might force you to select complex patterns that include numbers and symbols, but a dictionary word followed by one or two numbers is the most common password pattern. Some companies force users to change their passwords so frequently that users end up with highly predictable patterns. But users aren't to blame, it's just that no one has taught them how to cope with strict password policies. This book will teach you how to cope with the world of password policies, password crackers, and human predictability. It teaches specific password patterns that will meet even the most unyielding security policy requirements but that users will remember in a snap. If you deal with passwords, you need this book.

Genres: Reference, Nonfiction

200 pages, Paperback

First published December 11, 2005

About the author

IT security analyst and author in South Weber/Ogden, Utah.

Reviews

[S.P. · Rating 3 out of 5]

The perfect password is a long password, that is the conclusion of this book. It doesn't matter if it is complex (though it helps!) or simple lower case, what matters is the number of characters the password has. Probably better to refer to is as a pass-phrase as one is encouraged to construct a password from multiple, unrelated words.

At least 16 - 20 characters long.

If you can incorporate some punctuation, spaces (if allowable), upper case characters and, sparingly, numbers, then the password becomes stronger still.

Mark Burnett explains his reasoning for all this simply and with examples. Most instructive is the list of the 500 most used passwords, as gleamed from various sources of real-world passwords. If your password (or variation thereof) is included, you are advised to change your password immediately.

I thought my passwords were pretty good (and they are!) however Mark demonstrates that you are better off with a longer yet easier to remember password. His top tips are summarised in the last chapter proper. This list is probably the best takeaway from the book as it is short and easily digestible - perfect for password advice.

Only down side really is the padding of unnecessary word lists and code tables at the back of the book. I guess password construction isn't really a 200 page discussion!

Overall very useful book. Since I have just had my own 'Password Day' I probably won't be applying until next year, but I think I might just give it a go when it comes around.

[Remo · Rating 4 out of 5]

Easy book to blast through, I read it online. He's got some great tips for making passwords easy to remember and hard to crack. Other reviewers have summarized his main points, and that is probably enough for most people. The book is 10 years old, so I wouldn't buy it as cracking capability has progressed. Still, I learned quite a bit. One example, I didn't know the space key was a valid character, very cool. If you are interested in passwords and how to increase your security this is a good, fast read.

[Yash · Rating 3 out of 5]

Most part of the books could be summarised in a few sentences. The author has elongated these points to articles giving several examples, to "convince" people about his arguments. Besides, this there is also some scientific evidence. This is a short and quick read but failed to grasp my interest. This is however an eleven year old book and the security scenario has changed much within this time. So, you can't completely trust this book for the security provided by your password. Despite all this, it contains a few pieces of valuable advice.

[Mark · Rating 4 out of 5]

Eye-opening.