OS X Odyssey 635 - Passwords

857 I detest passwords, or more specifically: the necessity of typing them in to gain access to whatever. Unfortunately (or fortunately, depending on how you look at it in this security conscious world), the OS X experience is thick of passwords.

However, there are ways to mitigate the password hassle if, like me, you are the only user of your Mac and not on a network that gives others access to your computer (note that even using a modem dialup to the Internet poses a degree of potential security risk).

Basic is to set up your Mac so that it will boot into OS X without asking you to enter your password. In order to do that just check the "Automatically log in as ......" checkbox in the Accounts preference panel.

Actually, OS X will, somewhat grudgingly, allow you to leave the administrator password entry field blank when you install the system. You will be presented with dialogs protesting that you may have security issues, but if there really is little or nothing to worry about him that regard, feel free to ignore them, and enjoy being able to just click the OK button without entering a password when you install a program or some such.

One of my problems with passwords is remembering them, and which one applies to what. I am absent-minded, and remembering that sort of detail is not my long suit. Consequently, I tend to use only a few passwords and relatively short ones. This is not recommended by security experts, who advise that an ideal password should be:

One. A word that is not found in any dictionary, and not follow or preceded by random characters

1. A word that is not found in any dictionary, and not followed or preceded by random characters.

2. A combination of letters and numbers (not numbers only)

3. Not something obvious like your user name (whether straight up, reversed, or doubled), or your Social Security number

4. At least eight characters long and the longer the better.

5. A mixture of upper case and lower case letters, punctuation, symbols, and numbers.

6. Not the name of your child, wife, pet, favorite movie star, your license plate number, etc.

7. If you keep a bunch of passwords in the OS X keychain, it should not be the same as any of the passwords stored in the key chain.

OS X 10.3 Panther's new key chain creator dialog features a handy password check, which is available through the I button. To check a password using the password-check dialog, Open the Keychain Access application (in the Utilities Folder in the Applications Folder), select New Keychain from the File Menu, click Create, then click the "i" radio button, and the Password Assistant will appear. Enter the password in the password field and click OK. A security rating will appear in the password check window. One password I use a lot scored a pathetic 6.5 security rating (on a scale that goes at least as high as 134.4 - see below).




You can alter your password or try different passwords until you achieve the highest security rating (green.)




And what if you for get your OS X login password? Well, you don't need to worry about having to reinstall the system or anything drastic like that. At least as long as you have your original install CD handy. Boot the Mac from the CD, Open the install menu, and choose Reset Password.

A dialog will appear asking which disk you want to access, and you can enter a new user name and password. Click the Save button and reboot the Mac, whose system will now be available with the new user name and password.



Tags: OSX Odyssey ď

(0) Trackbacks ď

Login † or † Register † †

4. At least eight characters long and the longer the better (although OS X uses only the first eight characters to authenticated a user).

No longer true, as of 10.3.  Passwords can be longer, and all characters will be required to authenticate.

Hi Charles,

ever seen a “Mr. Memory” recite a list of hundreds of items they’ve only seen briefly a half hour or so beforehand? How do they do it? Well, from the explanation I once saw one of them give on the TV, they weave that list of objects into a story and remember that instead, so when it comes the time to recite the list, they tell themselves the story and therefore are able to remember not only the items, but also the order they appeared in… so what has that got to do with making a random, lengthy yet easily remembered password? Simple - whenever you need one just tell yourself a story, such as:

This is my really easy to remember yet lengthy and random password for my bank account!

convert that into your password and it becomes Timretrylrpfmba! (the first letter of each word)

Add in a few random characters and modify others in an easy to remember manner and you get e.g.:

T!mRe2RylRpfmba!31

In this instance I’ve changed the i to a ! as it prevents there being a “Tim” in the password and increases the number of non-alphanumeric characters; all the Rs are capitalised; the “to” in the original sentence is now a 2 and I’ve stuck a memorable number (someone’s age) at the end to add a few more numbers.

That scores a highly respectable 118.3 in Keychain Utility and yet it will be relatively easy to remember, especially after you have used it for a few times. Naturally, the only difficulty comes in typing the thing, but that’s why we have Keychain in the first place!

Cheers,

Jonathan

P.S. Obviously, that isn’t my bank account password and it is just an example! Rather worryingly, my bank won’t let me use a strong password like that as it has to be limited to a certain number of characters!!! Crazy, huh? wink

“Boot the Mac from the CD, Open the install menu, and choose Reset Password.”

Which defeats the security of a password…

Which is why Apple have two security solutions to this - one is Open Firmware password which requires you to enter your password before allowing you to boot from a CD (this can be circumvented easily if the person has physical access to your machine which is why Apple came up with...), the second is FileVault which encrypts your home folder with a Master Password which can’t be changed by anyone.

However, there is currently a flaw in this model too that could allow a savvy person to obtain your password from virtual memory and circumvent FileVault as well. One of the rumoured features of Tiger is the ability to choose to encrypt your memory as it is swapped to the disk, which presumably will overcome this flaw.

Hi Charles,

Do want to achieve a high security rating without challenging your memory, let’s say 132.9? Just type in forty 1s, or your preferred character, in a row.

I think that the Password Assistant needs to be revised.

Ciao,
Ricardo

Hi William;

Thanks for the correction. I’ve corrected the article.

Charles

*************************************************************

Hi Jonathan;

Easy for you perhaps. My mind just doesn’t work very efficiently that way. I would probably have trouble remembering the story. wink

I tend to perceive and remember the *gist* of things; I can usually rough-estimate a percentage within +/- 5 percent of the actual value off the top of my head; but have always been bad at verbatim quotes and precise detail. In school, I was usually top of the class in English, History, and Social Studies, poor in Science and flunking math. I’m still no more than borderline numerate. :-b

However, thinks for the mini-tutorial on memory jogging. I’m sure that the method you describe would work well for many people.

Charles

*************************************************************

Hi Judson;

Only if you have the CD wink

Charles

*************************************************************

Hi Ricardo;

Interesting

Easy to remember, but I really detest passwords longer than 5-6 characters if they’re ones I have to type frequently.

If I ever broadband ever becomes available in this neck of the woods, I’ll probably ne well-advised to beef up my security, but at present it’s a low-priority issue and mostly an anoyance for me.

Charles

Hi Charles,

alternatives to telling a story - surely you have a set of favourite quotes or set of song lyrics you can reel off at the drop of the hat (you are quite religious are you not - there must be a hundred biblical quotes you can spout with no effort at all)? Just use the first letters of one of those quotes or those lyrics, together with an element of randomness (a few easily remembered additional characters) and you will have a good if not great password.

Another tip for you - as you are on a Mac, to increase the effectiveness even further, simply hold down the option key as you create them and you now have a fully non-alphanumeric, very hard to crack password. This tip will even work for your shorter less secure passwords:

E.g.  having the word password as your password (which is surely the least secure it can possibly get and gives you a very low score of 10.4 I’m surprised it even gets that!) is pretty damn stupid, yet if you hold down option while typing the same word you get <snip> (that won’t resolve in html - but you can see what it looks like for yourself by typing it into TextEdit) which scores a not so bad 56 and would be far more difficult to crack than a longer but plain vanilla alphanumeric password.

The thing to realise is that a good password is NOT difficult to come up with… the unfortunate thing, however, is that a bad one is much, much easier to come up with. You do need to put in at least a little effort though if you want to make sure that things are secure.

Cheers,

Jonathan

Hi Jonathan;

I’m not trying to be argumentative, and I genuinely do appreciate your suggestions and will try them.

Song lyrics - a possibility.

Bible verses? As I said, I remember the gist very well and usually where to find it. Alas, I am dreadful at precise verbatim quotes off the top of my head.

Charles

Hi Charles,

“I’m not trying to be argumentative...”

and neither am I… I realise that not all people remember things in the same way. For some it is association with visual (colour) or spatial cues, others it is sound or smell and for some it is patterns. I’m just giving you and your other readers some pointers on how to turn something that is apparently hard into something that is easy (or at least easier) to do. What I am pointing out is that it is a cop out to say that you can’t remember complex passwords - it isn’t true as everyone on this planet can (severe or moderate brain damage in the wrong place notwithstanding). It just takes some effort to find the mechanism by which you can do it. What works for one person may not work for another, but there is always going to be a way that will.

Speaking of which here is another tip on a way you can generate something apparently random that you personally might be able to remember - visualise a pattern on your keyboard.

E.g. imagine two hexagons that encircle and centre on the d and k keys respectively and this can give you (on a QWERTY keyboard):

erfcxsiol,mj

by typing in a clockwise direction around both, starting with the d key and upper left of its encircling hexagon.

Once again, introduce a few bits of added randomness that you can remember (surround the string of letters with quotes or something; stick a number at the beginning or end; hold option down when you circle the d key and/or the k key; whatever) and once again you have a seemingly random and complex password that is formed from something that is not.

You could even do a block of nine such as:

qweasdzxc

etc, etc, etc.

Cheers again, and I hope all of this points you to your own way of remembering,

Jonathan

Edit:

Given your personal preference for the “spatiality” of things, I actually think that last technique could be the one for you - it also has the added advantage of being much easier to type than some of my other suggestions.

wink

Follow Us

Twitter Facebook RSS! Buzz

Most Popular

iPod




iPhone

iLife

Reviews

Software Updates

Games

Hot Topics

Hosted by MacConnect - Macintosh Web Hosting and Mac Mini Colocation                                                    Contact | Advanced Search|