The WHCCD Password Policy

WHCCD's password policy is generally in line with current NIST password guidelines. It has the following requirements:

Length: Your password be at least 16 characters long.

Complexity: There is no complexity requirement (no need to use different types of characters).

Expiration: There is no expiration date to your password.

History: You can't reuse any of your last five passwords.

There are some caveats to the complexity rule:

• Your password cannot contain your first or last name
• Overly simplistic passwords like "1111111111111111" or "1234567812345678" may be rejected by Microsoft's proprietary algorithms.

Choosing a Good Password

While a password comprised of 16 or more random letters (like "dfh4jsmv83nsad!43rfda") is a strong password, it is not a good password, because it is very hard to remember. Passwords that are hard to remember encourage bad habits, like writing them down on post it notes and sticking them under your keyboard.

A good password is a password that is both strong and memorable and the best way to accomplish this is to use a combination of words instead of characters, or a passphrase.

Here is famous (famous among IT nerds) comic about using passphrases instead of random strings for passwords. Feel free to skip past the comic to the next section if it is hard to follow:

Making Your Passphrase Even More Secure

Using the comic as the example, let's say you've decided to use the phrase correcthorsebatterystaple as your password. Let's examine some ways you can make it even more secure, while keeping the password memorable.

Note: Please do not use this well-known example as your password! Choose your own words!

A simple way to make the password more complex is to capitalize every word:

CorrectHorseBatteryStaple

Even better would be to capitalize every second (or third, fourth, last, etc) letter of every word:

cOrrecthOrsebAtterysTaple

You can keep it simple and easy to remember by capitalizing only one of the words:

correcthorsebatteryStaple

You could add some punctuation to a part or parts of the password:

correct.horse.battery.staple?

You can replace letters with numbers or symbols:

c0rrecth0rsebatterystaple

Or a combination of the above:

C0rrect.H0rse.Battery.Staple

Remember not to get too complex! The key is to make it something that is memorable. Just adding one small variation is enough to make your pass phrase nearly impossible to guess.

Remembering Your New Password

After you've created a new password, it can still take some time before you remember it. A good strategy for remembering a new password is to write it down on a small piece of paper and to keep that paper in a secure physical location, such as your wallet or purse. Once you are confident that you have your password remembered, destroy the piece of paper using a secure method, such as a shredder, or if the law permits, fire.