As part of our continuing commitment to protecting confidential data (especially health-related information), Eagle's Landing enforces the use of what are called "strong" passwords. What is a "strong" password? Is it really that important? And how on earth is a non-geek supposed to remember something like that?

According to Wikipedia, a strong password is one that is "very difficult or impossible to guess." As computers get more and more powerful, it gets easier and easier for them to "guess" passwords. The shorter and simpler the password, the easier it is for a computer to guess. Let's say you think a six-character password with all lowercase letters is good enough to keep out a dedicated hacker. Guess again; it may take him 30 seconds or less to figure out your password.

You might think adding only two more characters wouldn't be a big deal, but all other things being equal, if you add two more characters to your password, the hacker may need more like five or six hours to crack your password. That's better, but not exactly comforting news.

What happens if you just mix both upper- and lowercase letters in your eight-character password? Now you're talking more than 28 hours. Much better. But truly secure? Not exactly. So let's just add numbers into the mix. Your hacker's job-length just jumped to almost 8 1/2 months. If you change your password even just twice a year, you're in pretty good shape.

So let's review: if your password has

• at least one uppercase letter,
• at least one lowercase letter,
• at least one number,
• and is at least eight characters long

then the odds of keeping hackers out of your system are greatly increased. Of course, there are other principles that make passwords "stronger."

• Never use a word from any dictionary (even foreign language); those are the first words a password-cracking program will try.
• Common names (especially your own or your family's) are a no-no.
• Don't use a keyboard pattern such as qwertyui.
• Do not repeat any character more than once in a row like zzzzzzzz.
• Never use your account name as its password.

So what CAN you use? Instead of thinking of a password as a word, think of it as an abbreviated phrase, even with punctuation. Here is a selection of good examples of using multiple words and phrases:

• gOt%L0st! - got lost!
• heLP4me$ - help for me (money)
• rsKf0myH - Raindrops keep falling on my head.
• wru2rxy? - Who are you to ask why.
• bWiIso3! - Beware the ides of March!

If you put your mind to it, you will find that having a strong password doesn't have to be all that hard. It may take some creativity and more than ten seconds of thought, but you can do it. Oh, and as a final note, all the sample passwords listed in this article are now known to the whole world (hackers and crackers included), so don't use them.

This story was cobbled together from these articles:

• Choosing good passwords (AusCERT)
• Password Recovery Speeds
• Choosing Good Passwords (P-Synch)
• Use Strong Passwords