[转载]怎样创建安全的密码

eapass

怎样创建安全的密码 \r\n\r\nBy Peter H. Gregory \r\nJULY 14, 2003 \r\nTranslated by tjfan \r\nJULY 23, 2003 \r\n\r\n使用安全的，难以猜出的密码可以使恶意黑客入侵你的电脑很困难。一定要避免使用容易猜到的密码，并且要使用不同的方式来变化密码，这使得你可以很容易就记住它，而使其他人很难猜到它。 \r\n\r\n这里是创建安全密码的一些提示： \r\n\r\n使用与某一主题相关联的密码，比如选择一个普通却具有重要意义的事件：蜜月、孩子的出生、新车、新工作，等等。 \r\n\r\n这里的关键是使用与某一事件相关联的各种词语作密码，这样其他人很难猜测到。记住在创建密码时你可以将大小写字母和数字混用。比如：“hurry” 可以变化成 hUrry66 或者 Hur5ry 。 \r\n\r\n用数字来替换字母可以基于它们外观上的相像，发挥你的想象，你会发现数字与字母之间的相似之处： \r\n\r\nNumber Letter \r\n1 L \r\n2 Z \r\n3 E \r\n4 A \r\n5 S \r\n6 b \r\n7 Z \r\n8 B \r\n9 g \r\n0 O \r\n\r\n当你创建密码时，想要用数字代替字母，可以参考上面的表。 \r\n比如：scuba 变成 5cu8a \r\nwater 变成 w4t3r \r\nicecream 变成 1c3cr34m \r\n\r\n字母与数字间的互相变化还可以依据字母在键盘上的位置。键盘上最上面的一行字母是：Q W E R T Y U I O P，就在他们上面与之相对应的数字是：1 2 3 4 5 6 7 8 9 0 \r\n这样，你就可以用下面的表所对应的数字来替换密码中的字母： \r\nNumber Letter \r\n1 Q \r\n2 W \r\n3 E \r\n4 R \r\n5 T \r\n6 Y \r\n7 U \r\n8 I \r\n9 O \r\n0 P \r\n\r\n也就是说，你只要按照表中所列的对应关系变换密码，就可以创建出比较安全的密码。 \r\n比如： \r\nscuba 变成 sc7ba \r\npurple 变成 07r0l3 \r\nrocket 变成 49ck35 \r\n\r\n一贯的坚持将你密码中的第 n 个字母用大写表示。一些系统要求密码中至少要有一个大写字母，而许多人习惯将第一个字母大写，很显然这样做太容易被猜到了！比较而言，经常的将第1个、第2个或第3、4个字母大写，也可以总是把最后一个或倒数第二个字母大写，这样的密码就相对难以猜到了。例如：huRry、roCky、puRple、roCket。 \r\n更进一步，你可以大写两个以上的字母，比如第1个和第3个，第2个和第4个。 \r\n\r\n如果某人碰巧曾经看到过你的密码，相信你不会希望他可以预测你以后所用的密码吧？因此要避免容易预见的“星期—星期”或“月—月”变换，下面列举了需要避免的容易猜测到的编码习惯，比如一月你用eyesJan01，二月用eyesFeb02，以此类推，这样的密码变化太容易猜到了！ \r\n\r\n建议将密码存储在Counterpane Labs的密码安全工具里(http://www.counterpane.com/passsafe.html)，这个工具使用Blowfish编码加密密码词条。该工具有一个极好的功能，当你双击一个已存储的密码条目(并非密码本身)，它会将密码复制到剪贴板中，这样即使有人在看着你操作，你也可以安全的使用密码。 \r\n\r\n你还可以在SecurityStats.com网站检验你密码的安全性。该网站对你密码的复杂性和可猜测性进行计算，从而告知你该密码的可靠性。但请注意，你的密码在互联网上是明文传送的，因此你应该用一个近似的密码来代替你实际要用的那个。这样通过检验你就会了解到可靠密码具有什么特征，以便于更好的创建密码。 \r\n\r\n采取 ISO17799 密码安全质量指南的标准。创建密码时要养成良好的习惯，与通过广泛认证的 ISO17799 安全标准相一致。下面列举了该标准的一些密码指南： \r\n*密码至少要6位； \r\n*避免使用连续的同一字符； \r\n*不要只使用数字或只使用字母； \r\n*要求密码要定期更换； \r\n*禁止用户在下次登录时改变临时密码； \r\n*对已用过的密码作记录，避免再次使用； \r\n*改变所有系统默认的密码； \r\n*去掉或锁住共享用户账号； \r\n\r\n注意：不要使用任何本文中提到的密码！ \r\n\r\n对密码长度的争论：一些专业的安全资料可能对ISO17799标准只采取6位长的密码表示怀疑，而且一些人告诉我以目前破解密码的速度来看6位长的密码是不够的。我的回答是：一般来说，黑客在打算破解一个计算机的账户时很少考虑密码的长度。 \r\n\r\n你所在的机构中充满了guest用户、组用户、空密码用户、没有使用期限的密码、容易猜到的密码以及利用技术漏洞或通过交际获取密码的途径，等等。有了这么多的捷径，8位的计算机密码并不比6位的密码安全多少。我的观点是你应该将重点放在提高密码的保密性上，而非单纯依靠密码的长度。 \r\n\r\n\r\ntjfan 翻译

eapass

Secrets to the best passwords\r\n\r\n\r\nBy Peter H. Gregory\r\nJULY 14, 2003\r\n\r\n\r\n\r\n\r\n\r\nThe use of good, hard-to-guess passwords can make it difficult for a malicious hacker to break into your computer account. Avoiding predictable keywords and using different methods to introduce variety into your passwords makes it easy for you to remember them but virtually impossible for others to guess them. \r\nHere are some tips on creating winning passwords.\r\n\r\nUse keywords related to a theme. Choose a common, significant event: a honeymoon, the birth of a child, a new car, a new job.\r\n\r\nExample phrases associated with a birth might be blueeyes, hurry, onemorepush, crankyRN, coldbracelet, roomsix and icechips. Ideas associated with a new car could be deepblue, 6CDs, 5speed and TiresThatGrip.\r\n\r\nThe idea here is that you use a variety of words associated with an event that other people would not readily guess. Remember that you may also need to mix in uppercase letters and numbers when you create a new password. For instance, \"hurry\" could become hUrry66 or Hur5ry.\r\n\r\nSubstitute numbers for letters based upon their appearance. With a little imagination, you can visualize numbers that bear resemblance to letters.\r\n\r\nNumber Letter \r\n1 L \r\n2 Z \r\n3 E \r\n4 A \r\n5 S \r\n6 b \r\n7 Z \r\n8 B \r\n9 g \r\n0 O \r\n\r\n\r\n\r\n\r\nWhen you create a password, substitute a number where a letter would appear, according to the chart above. Some examples: \r\nscuba becomes 5cu8a \r\nwater becomes w4t3r \r\nicecream becomes 1c3cr34m\r\nSubstitute numbers for letters based upon their location on the keyboard. The uppermost row of letters on the keyboard, QWERTYUIOP, has a row of numbers right above it: 1234567890. You can substitute a number for a corresponding letter according to this chart. \r\n\r\nNumber Letter \r\n1 Q \r\n2 W \r\n3 E \r\n4 R \r\n5 T \r\n6 Y \r\n7 U \r\n8 I \r\n9 O \r\n0 P \r\n\r\n\r\n\r\nSo when you create a password, carry out the substitution from the chart. Some examples: \r\nscuba becomes sc7ba \r\npurple becomes 07r0l3 \r\nrocket becomes 49ck35 \r\nConsistently capitalize the nth letter(s) of your password. Some systems require that at least one character be uppercase. Many people capitalize the first character, but this is too predictable. Instead, always capitalize the second, third or fourth letter, or perhaps always the last or next-to-last. Some examples: huRry, roCky, puRple, roCket. \r\nFor further interest, you can capitalize more than one letter, for instance the first and third, or the second and fourth.\r\n\r\nAvoid predictable week-to-week or month-to-month changes. One example of a predictable pattern to avoid: eyesJan01, eyesFeb02, eyesMar03, etc. If someone was lucky enough to discover your password long ago, you don\'t want him to be able to predict what it will be in the future.\r\n\r\n\r\n\r\n\r\nPeter H. Gregory, CISSP, CISA, is an information technology and security consultant, a freelance writer and an author of several books, including Solaris Security, Enterprise Information Security, and CISSP for Dummies. As a consultant he provides strategic technology and security services to small and large businesses.\r\n\r\nHe can be reached at p.gregory@hartgregorygroup.com.\r\nHis Web site is www.hartgregorygroup.com. \r\n--------------------------------------------------------------------------------\r\n\r\nStore passwords in Counterpane Labs\' Password Safe tool. All passwords are encrypted with the robust Blowfish algorithm. A nifty feature of Password Safe is that when you double-click on a previously stored password entry, it silently copies it to the clipboard so you can paste in the password even if others are watching you type.\r\n\r\nCheck the quality of your password at SecurityStats.com. This Web site performs calculations based on the complexity and \"guessability\" of your password and tells you how good your password is. Remember that your password is transmitted over the Internet in the clear, so you should try similar passwords instead of your actual passwords to get an idea of the characteristics of a good one.\r\n\r\nAdopt ISO17799 password quality guidelines. Ask the IT department to implement best practices for password management in accordance with ISO17799, a widely recognized information security standard. According to the standard, here are some guidelines for passwords: \r\n\r\nThey should be at least six characters long. \r\nThey should be free of consecutive identical characters. \r\nDon\'t use all numbers or all letters. \r\nAvoid reusing or recycling old passwords. \r\nRequire that passwords be changed at regular intervals. \r\nForce users to change temporary passwords at the next log-on. \r\nMaintain a record of previous user passwords and prevent their reuse. \r\nChange all vendor default passwords. \r\nEliminate or lock shared-user accounts. \r\nWarning: Don\'t use any of the password examples that appear in this article! \r\nA note about password length: Some information security (infosec) professionals will bristle at ISO17799\'s recommendation for a mere six characters in a password. Some have told me that six characters are insufficient, based on the time it takes to crack a password. My response is this: Typically, hackers don\'t care about the length of passwords when choosing to crack open a computer account.\r\n\r\nOrganizations are rife with guest accounts, group accounts, accounts with no passwords, a lack of password expirations, passwords that can be easily guessed and opportunities to exploit technical weaknesses or perform social engineering. With all of these easy opportunities, computer accounts with good six-character passwords are only a trifle weaker than those with eight-character passwords. My point is that infosec professionals need to focus more on the compliance of good user-account hygiene than on the length of passwords.