Elcomsoft, Adobe, and Strong Passwords

I couldn’t have said it better myself (although I’ve been saying it for a long time): Use strong passwords:

• At least 12 characters.
• At least one upper case letter.
• At least one lower case letter.
• At least one number.
• At least one special character (those things above the numbers on your keyboard, etc.).
• Never use a word from a dictionary, regardless of the language.

Turns out that Adobe has admitted that their passwords can be guessed faster in Acrobat 9 than in Acrobat 8. In a way, that’s a good thing for two reasons. First, their customers get better performance. Second, HOPEFULLY it will “encourage” people to use strong passwords. Just use the guidelines I outlined above and you should be fine (and with Acrobat 9, you can have up to 127 characters in your password — that’s almost more than Twitter will let you have!).

While most security pros don’t recommend that you write down passwords, I do recommend that you write them down — but with a STRONG caveat: Write them down on a small piece of paper (like a blank business card). Do NOT write down the account that the password belongs to with the password, though! Then take that piece of paper and put it in your wallet with your money and credit cards — and protect it just like you would protect your money and credit cards. This way you’re more likely to use a hard to guess (and hard to crack) password.

One word of caution: If your workplace policies don’t allow you to write down passwords, then follow those policies. While I encourage you to discuss this issue with those who are responsible for security at your company (and feel free to share this blog post with them), following their policies is more important than listening to me. The owner or CEO has ultimate responsibility for the security of their computers and networks, so always do what they tell you to do.

But on your computers, you have the choice, and I encourage you to consider using my system.

Even better: Get RoboForm and you only have to write down one password — the master password that protects your password “vault” (if you have multiple computers, get the “ToGo” version and put it on a small thumb drive). Just don’t forget to make that password hard to guess — and don’t forget to change it every couple of months.