Secure Passwords: Educate Yourself, Educate Your Students

News of a recent rash of password thefts from major online services such as LinkedIn and Yahoo! remind us that understanding online safety and how to set a secure password is a vital piece of digital literacy. As Adult Basic Education and ESL teachers, we must first educate ourselves and model good habits, and then instruct our students and help them develop good password habits, too.

As the article from the PBS NewsHour shows, a hacker who has obtained your encrypted password can break it in minutes if it's a simple dictionary entry like "orange" (or the oft-used in ABE "school"). Here are some tips to creating a stronger password - and one you can remember.

1. Start with something you will remember, like a word or phrase. "School" is easy to remember and lots of people use it. But it's a terrible password by itself. How can we make it safer? Try turning it into a phrase instead of a single word. Maybe "weloveschool."
2. Add a capital letter (or two or three). This is particularly helpful if you add them in unexpected places. So let's make our new password, "wEloveschooL."
3. Add numbers - and even better! - non-alphanumeric characters, like $, #, &.  But that can make a password hard to remember. So let's replace some of the letters in our phrase with numbers and characters. We'll make it "wEl0ve$ch00L." Here all the letter Os have been replaced with zeroes, and the letter S has been replaced with a dollar sign.

Is this harder to remember than plain old "school?" Yes, of course. Something that's complex is undoubtedly harder to remember than something simple. But its difficulty rating for hacking is orders of magnitude higher. A hacker could run his brute-force password breaking program against this for months or even years before it would come up with the correct combination of letters, numbers, and characters. In that extra time, you'd have been notified of a security breach and would be able to access your account and change your password before the hackers could do anything with the information they stole.

All of this might seem unnecessary for something ordinary like a Gmail or Yahoo! mail account. But it's not. A friend and ABE colleague of mine had her password stolen and hacked in this latest Yahoo! breach. And immediately, she has lost access to her account, and everyone in her contact list has been hit by scam emails phishing for money, under the lie that she's in Spain on vacation, has had her purse stolen, and needs money to settle the hotel bill. I spotted it for a scam immediately (I happen to know for a fact that she's not in Spain on vacation, and have heard of similar scams before), but what if I was an ABE or ESL student, with limited English, literacy, and/or critical thinking skills? Might I have fallen for it? Would I have sent my hard-earned money to a criminal network believing I was helping out my beloved teacher?

Don't risk putting your friends, family, coworkers and students in that position. Beef up the security on your passwords. And teach your students to do so, too.