Guidelines

Mathnet accounts are protected with passwords. In accord with PSU Policy AD20 the CSG asks that you change your password frequently. Once a month would be great. Once a semester is an absolute minimum.

You should not share your password with anyone. CSG staff will never ask you for your password. We don't need to know it. Sharing your password is a direct violation of PSU Policy AD20.

You should take reasonable precautions to make sure that your password never traverses the Internet unencrypted. You should never send your Mathnet password via email or put it into a web page that is not secure and on the Math Department network.

The CSG is working on turning off outside access to protocols that require that passwords be sent unencrypted over the Internet. Outside FTP is not allowed and unsecure POP from outside of Mathnet will soon be disabled. Until it is disabled, unsecure POP should be avoided if possible. Alternatives are secure POP and secure IMAP.

If it is suspected that your password has been comprimised, your account may be suspended until we can verify your identity in person and change your password.

Picking a Secure Password

When choosing a password, you should keep in mind that the bad guys will be using programs to try to find (or crack) your password. Some things that such programs might do include:

• try every word in various dictionaries (in various languages including technical terms)
• try words in reverse
• try words with symbol substitions (e.g., h3110 for hello).
• try concatenations of short words (e.g., thewin ).
• try words with a symbol added to the beginning or end (e.g., hello1 ).

You should definiteley not start with a word and try to transform it. If it's a simple transformation, it's probably already part of a password cracking program.

In general, the closer a password is to gibberish, the less likely it is to be cracked. Unfortunately, the closer a password is to gibberish, the harder it is for humans to memorize.

One good way to generate easy to remember passwords is to:

1. start with an easy to remember sentence (e.g., Because I could not stop for death, he kindly stopped for me. )
2. form a string based on the first letter of each word and punctuation (e.g., BIcnsfd,hksfm. ).
3. and finally transform the string, keeping at least 8 characters (e.g., B1cnsfd, ).

The result is usually a password that is reasonably difficult to crack. It should go without saying that you should not use B1cnsfd, or any other example password that you find on websites such as this as your password.

Changing Your Password

To change your password, login to one of the Solaris hosts (any of the Lab Workstations will do) and run the command:

    passwd

at a shell prompt. You will be prompted for your current password and then a new password. You can also change your password by following the Change Your Mathnet Password link on the Mathweb home page.

More Information

This page is a variation of the "how to pick a secure password" page which has been written many times by many authors. Here are some other versions:

• unix-manuals.com
• security.uchicago.edu
• Eric Wolfram - How to Pick a Safe Password

Privacy and Legal Statements Validate HTML Validate CSS