Passive Passwords

I must admit that I'm a little disappointed to read the latest story concerning the top ten most common passwords in PC Week. Here they are:

1. 123456
2. 12345
3. 123456789
4. Password
5. iloveyou
6. princess
7. rockyou
8. 1234567
9. 12345678
10. abc123

I would like to think that the people I know generally have strong passwords, but, I have to admit that entering my strong password each and every time I want to check my email on my Droid is a pain. I know some people who protect their phone email with something a lot easier, but we should avoid doing that. Mobile devices and phones are easy to lose of snatch.

Did you ever wonder how strong your password is? Microsoft has a good password checker that will help you to understand how good yours is. Check it out - Microsoft Password Checker. My opinion, if you aren't green, make a new password.

The one big complaint I have is the requirement that we change our passwords. If I have a really hard password, is it any stronger if I have to change it every 90 days? This is just a theory, but I suspect that the fact that many organizations require that a user change his or her password every so often actually creates a higher risk situation. Because I must change my passwords so frequently I must write them down because I lose track of which password works for which service. The fact that my password is written down necessarily introduces risk because I could lose what I wrote it on.

I did review a potential hardware solution to this problem, the Logio Secure Password Organizer. I won't say that it was an epic fail, but it was not a winning solution. No, I must say that the solution to this problem is in better policy, not hardware or software.