Last week, I talked about passwords: the need to change them regularly, and how to make a strong password. This week I’d like to follow up by telling you about a useful tool that can help keep track of your 50+ complex, frequently-changing passwords.

The tool is Password Gorilla. Basically it’s a simple graphical interface to an encrypted database. The idea is that you have one master password to unlock the database, and inside that database are your other passwords. Here are the things I like about it:

• It’s free software: “free” as in “freedom”
• It runs on all major operating systems: Windows, MacOS, Linux, BSD…
• It has a menu option to automatically copy your password to the clipboard with one click
• It automatically times out and locks the database after a few minutes, which is handy if you absent-mindedly leave it running after you’ve logged in to whatever you’re logging in to

Now, visually, Password Gorilla is not very polished. Someone who is accustomed to packaged commercial software might say it looks “amateurish” or even “outdated.” What I say to that is, graphics aren’t everything. This and other free software is pretty well-designed and functional. That polished “look and feel” you’re used to from Windows or MacOS often comes from using proprietary libraries, and to a developer it’s not worth the compatibility headaches, costs, and licensing constraints to use those in a volunteer project.

Another year begins, and it’s time to change all your computer passwords.

(Howls of protest echo across the World Wide Web)

What’s that? Don’t you want to change all your passwords? Come on, you know it’s good for you!

The fact is, as the number of passwords continues to proliferate, even remembering all one’s passwords becomes an unbearable burden. Any regular Internet user will accumulate dozens of them for various blogs and forums, not to mention online stores. Mostly we have spammers to thank for this — people need to sign up for an account to post a comment on my blog, for example, because if I didn’t require that I would literally get hundreds of spam comments a day.

I have some suggestions that can make managing all your passwords bearable. For those who read the article about passwords on my old Web site, disregard everything I said 10 years ago. The ideas and advice I have now are much better.

Prioritize Your Passwords

My first piece of advice is to separate your passwords into categories: those that really protect access to sensitive information, and those that are just there because there’s no better way to keep out the spammers. It’s the first category that you really need to be concerned about.

The purpose of a password is something security experts call authentication — proving that you really are whom you claim to be, such as the owner of a certain account. It’s not just that a password lets someone into an account — the password says that person is you. Now, I hate to use the phrase “identity theft” (it’s not theft, it’s fraud) but passwords do more than protect information. They prevent other people from impersonating you.

There are a number of cases where someone impersonating you could lead to serious trouble. For example, if you do banking or investing online, an impostor could of course get his hands on your money. If you’re a student, an impostor could get access to your submitted term papers and plagiarize them, then claim that you copied from him. And if you’re still in high school (Heaven forbid) and an unfriendly classmate were to get into your Facebook account, there is no telling how much damage he or she could do to your fragile social position if he or she suddenly made you a fan of “Kicking Puppies” and “Sticking Chewing Gum Under Desks.” Depending on who you are, different passwords will be important. What you should do is decide which of your passwords are important, and change those. In fact you should change them every year, if not more frequently.

What About the Not-so-Important Passwords?

Then there are the “other” passwords: the ones to blogs and forums where no credit card numbers change hands and no one is going to get stigmatized and scarred for life if someone starts posting comments in your name full of quotes from Lyndon LaRouche. There are probably quite a number of sites like this that require a password.

My advice is to just pick one simple password (such as “Rosebud”) and use it for all these sites. Problem solved; let’s move on to the passwords that are worth protecting.

Creating a Strong Password

There are many self-styled experts out there who think they know how to make a strong password. A strong password is one that is difficult for an attacker to guess by simply trying words out of a dictionary. Just a few weeks ago I did an analysis of a password-generating system at work and what I found out surprised the heck out of me. Creating a strong password is a lot easier than most people think.

The method I was analyzing is quite simple; take three dictionary words and connect them with special characters (punctuation marks and the like). So for example a perfectly good password is “pasteurize$moribund+dahlia” or something like that. It turns out that even pulling words out of a small, 4,000-word dictionary, the number of possible passwords is 4000^3 * 29^2 (29 is the number of special characters on a typical keyboard), which works out to be on the order of 5E+13 — a number that is even bigger than the national debt. At a rate of 10,000 guesses per second, it would take an attacker 170 years to exhaust all the possible password combinations. Is that secure enough for you?

It turns out this password-generating algorithm comes from a Unix utility called passwdqc. I am not clever enough to have thought of this scheme on my own.

The advantage of this sort of password is that it’s a lot easier to remember than six or eight random letters and numbers.

Unfortunately, the sophomoric “experts” who think they know what makes a password secure are often in a position to impose rules on how you can make your password. You know the rules I’m talking about: your password must contain at least eight letters, including one upper-case letter, one numeral, and one Egyptian heiroglyph. Your password may not contain any dictionary words or sub-strings of dictionary words. If you try to do anything to make your password easier to remember it will be rejected by the system. Do not even think of writing it down.

Most people, when confronted by draconian (and ineffective) rules like this, find a way around them. Their methods — using the same password every time, writing them down on scraps of paper in a desk drawer — do more to weaken security than an all-lower-case password ever could. So not only are the strong-password Nazis wrong, they’re actually undermining good security practices.

Managing Passwords

If you’re like me, you have a lot of important passwords. I must have about 30 of them myself. Changing all of them, and keeping track of them, is a tall order. Yet the longer I leave them unchanged, the greater the chance of someone learning them through subterfuge.

My advice is to use a computer to help keep track of your passwords. The idea is to use a password-protected program to keep track of all your passwords. All you have to remember is one password and then you can unlock the file that contains all your other passwords.

There’s a catch, of course. If a foreign spy were to get his hands on your password-management program, and managed to guess the password, then you’d be screwed. If you use this approach, you really do have to choose a strong password for your password-management program, and you really do have to commit it to memory. It would probably be OK to write down this master password, but only if you kept the written copy in a safe deposit box in a bank (I am not kidding).

There are a number of programs you can use to manage your passwords. The Mozilla Firefox browser can do it, though I would not trust it with my bank passwords or investment accounts. Norton Internet Security can do it, too, if you’re a Windows user (that’s not to say I especially endorse Norton). It would be pretty cool to have a smart-phone app to do it but I am not sure I would want to lose all my passwords if some pickpocket swiped my phone.

A lower-tech solution is to write your important passwords down and keep them in a locked cabinet or, better yet, a safe. They’re that valuable. (Even after the financial crisis, your 401(k) is still probably worth more money than you would want to leave sitting out on your coffee table). The ones you use often, you’ll remember quickly enough.

If you were to set up a wireless network in your home, you would need to buy a wireless router. If you were to do that today, chances are the router would come pre-configured with some kind of password — probably a nonsensical string of gobbledigook.

There’s a good reason for this. A few years ago (for example, when I bought my wireless router in 2004), wireless routers didn’t come with preconfigured passwords. Out of the box, a wireless router used to have no security at all. It would create what is called an “open access point,” meaning anyone strolling by with a laptop could just connect to your wireless network. Depending on where you live, having someone stroll by with a laptop could as rare as having an ivory billed woodpecker fly past your house, or as common as seeing someone talking on a cell phone. I live in Cambridge, Massachusetts, so I happen to fall into the latter category.

The reason routers need to come with the passwords enable by default is that approximately 99% of users never used to bother to turn them on. Things are better today, and here’s why.

Ethernet is Ridiculously Easy to Eavesdrop on

I am taking a night class in computer networking because I really need to learn more about this stuff myself. What I found out is:

1. Wi-Fi is variation on the Ethernet networking protocol
2. the way Ethernet works has appalling implications for security

You might think when your computer sends data over Wi-Fi, it sends data straight to the access point. That would be incorrect. In fact the Wi-Fi card in your computer broadcasts data over a radio signal that can be picked up from anywhere nearby. But that’s not all! There’s more! If you actually read the above link about how Ethernet works, then you’d realize that all the data you send over Ethernet (or Wi-Fi) goes to all the other computers on the network. Each computer gets every piece (called a frame) of data and checks to see who is supposed to get it. If the data is intended for another computer, then the recipient throws it away.

In other words, a computer on an Ethernet or Wi-Fi network has to go out of its way not to eavesdrop on other members of the network. It is a pretty simple matter for an attacker to tell his/her computer not to go to the trouble, and just pick up everything.

Now, really sensitive data you send over the Internet is probably done using HTTPS, which is encrypted. Your bank account password and credit card numbers are probably safe. But there is still plenty of private stuff that could easily be picked up by the teenager next door. All your e-mail, for starters (incoming and outgoing). If you wouldn’t want the text of all your e-mail, and the contents of every Web site you visit, printed in the local newspaper, then Wi-Fi encryption is for you.

What To Do

If you bought your wireless router after 2006 or so, relax. It probably came with encryption pre-configured (encryption is what the WEP or WAP password is for).

If your router is a few years old, you probably remember setting up the encryption for it. Or not. In that case you would be well-advised to find or download the user’s manual for your router and find out how to enable encryption. I would love to tell you exactly how to do that, but the fact is it depends a little on what brand of router you have and what version of Windows/MacOS/whatever you are using, and if I were to research all that I would expect to get paid for it and you wouldn’t get the information for free anyway.

But I’ll give you a hint: you can try the time-tested troubleshooting method professionals use. Start by going to http://192.168.1.1 (If you get prompted for a username and password, try guessing. If you guessed right, then that’s another problem right there– change the admin password for your router. And write it down, and keep it under your mattress or something).

The Next Level

If all you do is turn on basic encryption, then I’ve accomplished my goal of informing the public and I can pat myself on the back. However, I cannot yet bring myself to shut up about this subject, so by all means, read on.

WPA instead of WEP

Many wireless routers use WEP for encryption. That’s an acronym for “Wired Equivalent Privacy,” meaning it’s as hard to eavesdrop on as if the data were flowing through a wire instead of broadcast through the air. As if. WEP was OK for a couple of years but now there are well-known programs that can defeat it. It’s still a lot better than nothing, but I think a more appropriate expansion for the acronym today is “Weak Encryption Problem.”

WPA is better, so use it if you have a choice. But even WPA can be broken.

There is a basic principle at work here: no encryption is perfect and can last forever. Sooner or later, someone will figure out how to break it. This is not to say encryption isn’t worthwhile: it will keep out an inexperienced or opportunistic intruder, but not a real professional. Using encryption is analagous to locking the front door of your house. You definitely want to do it, in spite of the fact that a really determined intruder can just break a window, or chop through the door with a fire axe for that matter.

Not Being Seen

There is another basic principle that covers a lot of flaws in your encryption, though: not being seen.

What you can do — and I think this is pretty slick — is configure your router to not broadcast your network’s name. In fact, it won’t announce its presence at all.

If you live in a condo or apartment building, or take your laptop to a public place like a railway station or hotel, you’ll probably notice in your wireless network configuration that there are a lot of other wireless networks around. Probably a lot of them have names like “linksys” or “default.” Others have names like “Steve’s Network” or “Jones.” All of these network names are set up by the router’s configuration. The wireless router broadcasts this name, which is technically called an SSID. This makes it easy for people to find and connect to the network.

That’s great for a coffee shop or other public network, but not so great for your home. Quick question: do you want people outside your home to easily find and log on to your home network? I didn’t think so.

Rule #1: For heaven’s sake, don’t put your own name or other identifying information in your SSID. That gets broadcast to the world. If anyone happened to be looking to break into your network in particular, you’d be practically giving them directions. My network SSID is something like “g45J87nwQ”. I can tell it’s mine, but damn if anybody else can.

Rule #2: You don’t need to broadcast your SSID at all. A network that doesn’t broadcast its SSID can still be connected to — by people who already know the SSID. So you can do what I do: write down the SSID, stick it under a mattress or somewhere, and then don’t broadcast. Yes, it’s a bit less convenient to connect to the network (you have to find the paper and type in the SSID). But that’s the whole point.