{"id":258,"date":"2016-07-11T14:58:28","date_gmt":"2016-07-11T21:58:28","guid":{"rendered":"https:\/\/blogschapman.wpenginepowered.com\/information-systems\/2016\/07\/11\/pass-phrase-vs-password\/"},"modified":"2016-07-11T14:58:28","modified_gmt":"2016-07-11T21:58:28","slug":"pass-phrase-vs-password","status":"publish","type":"post","link":"https:\/\/blogs.chapman.edu\/information-systems\/2016\/07\/11\/pass-phrase-vs-password\/","title":{"rendered":"Pass"},"content":{"rendered":"

Hello Fellow Panthers,<\/p>\n

I hope everyone is having a fun and relaxing summer break thus far.\u00a0 As we begin to approach the Fall 2016 semester, I wanted to take a moment to remind everyone of the importance of resetting your password.\u00a0 Over the summer we have had several attempts by cyber scammers to access several campus accounts.\u00a0 Fortunately, we have an amazing information security and network operations team that is continuously and diligently working to stop attackers before they do any damage, but there are things you can do to stop them as well.<\/p>\n

One of the best methods for stopping cyber attackers is to have a secure password.\u00a0 Now I know what you are thinking and that is \u201cI really like my current password\u201d or \u201cI\u2019ve had this password forever and I don\u2019t want to learn a new one\u201d.\u00a0 While I do empathize with you, it is also that same reasoning that makes it so easy for attackers to access your accounts.<\/p>\n

A great example of the importance of having a good password is the incident back in 2012 where the social media site LinkedIn was breached<\/a> by cyber attackers.\u00a0 This attack impacted over 6.5 million user accounts.\u00a0 A study released shortly after the incident, by LinkedIn, revealed a very startling truth about how easy it was for the attackers to break into user accounts.\u00a0 The big issue found during the study was that a high number of users were using the same passwords or same password structures.\u00a0 Below is a list of the top 20 passwords that were being used when the accounts were compromised:<\/p>\n

(Dataset publicly released by Linkedin)<\/p>\n

Rank | Password \u00a0| \u00a0Frequency<\/p>\n

1 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0123456 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0 \u00a0753,305<\/p>\n

2 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 linkedin \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0 172,523<\/p>\n

3 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 password \u00a0 \u00a0 \u00a0 \u00a0\u00a0144,458<\/p>\n

4 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0123456789 \u00a0 \u00a0 \u00a0 \u00a094,314<\/p>\n

5 \u00a0 \u00a0 \u00a0 \u00a0 \u00a012345678 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 63,769<\/p>\n

6 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 111111 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 57,210<\/p>\n

7 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 1234567 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a049,652<\/p>\n

8 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 sunshine \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a039,118<\/p>\n

9 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 qwerty \u00a0 \u00a0 \u00a0 \u00a0\u00a0 \u00a0 \u00a0\u00a0 37,538<\/p>\n

10 \u00a0 \u00a0 \u00a0 \u00a0 654321 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0 33,854<\/p>\n

11 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0000000 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0\u00a032,490<\/p>\n

12 \u00a0 \u00a0 \u00a0 \u00a0 password1 \u00a0 \u00a0 \u00a0 \u00a0 30,981<\/p>\n

13 \u00a0 \u00a0 \u00a0 \u00a0 abc123 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a030,398<\/p>\n

14 \u00a0 \u00a0 \u00a0 \u00a0 charlie \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0 28,049<\/p>\n

15 \u00a0 \u00a0 \u00a0 \u00a0 linked \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0\u00a025,334<\/p>\n

16 \u00a0 \u00a0 \u00a0 \u00a0 maggie \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0\u00a0 23,892<\/p>\n

17 \u00a0 \u00a0 \u00a0 \u00a0 michael \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a023,075<\/p>\n

18 \u00a0 \u00a0 \u00a0 \u00a0 666666 \u00a0 \u00a0 \u00a0 \u00a0\u00a0 \u00a0\u00a0\u00a0 22,888<\/p>\n

19 \u00a0 \u00a0 \u00a0 \u00a0 princess \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0\u00a022,122<\/p>\n

20 \u00a0 \u00a0 \u00a0 \u00a0123123 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a021,826<\/p>\n

 <\/p>\n

So how do we move forward?<\/p>\n

Instead of creating a new password, consider the idea of a new pass-phrase.\u00a0 Not a single word, but a combination of two or more words mixed together. Doing this and incorporating numbers and special characters will make it exponentially more difficult for attackers to compromise your accounts.\u00a0 Below are a couple examples of some easy to remember passphrases:<\/p>\n

Phrase<\/u>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Pass-phrase<\/u><\/p>\n

\u201cHello There\u201d\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Hell0Th3re!<\/strong><\/p>\n

\u201cPanther Pride\u201d\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 P@nth3rPride!<\/strong><\/p>\n

Note these examples are very common phrases and can easily be encrypted to become a strong password used to protect your account.<\/p>\n

Where can you reset your password?<\/p>\n

Online:\u00a0 Password.chapman.edu<\/a><\/p>\n

Service Desk:<\/p>\n