Introduction

The challenge we all face is that cyber attackers have developed sophisticated methods to guess or brute force passwords, and they are constantly getting better at it. This means they can compromise your passwords if they are weak or easy to guess. An important step to protecting yourself is to use strong passwords. The more characters your password has, the stronger it is and the harder it is for an attacker to guess. However, long, complex passwords can be difficult to remember. So instead, we recommend you use passphrases. Passphrases are simple phrases or sentences that are easy to remember, but hard to hack, for example Gue55Wh@tI5MyPa55w0rd.

What makes a Strong Passphrase?

1. What makes this passphrase so strong is that not only is its total number of characters longer than typical password (generally 20 characters or more as compared to a short six- to ten-character password), and it also uses capital letters and symbols. (Remember, spaces are nothing more than another symbol.)
2. You can make your passphrase even stronger if you replace letters with numbers or symbols, such as replacing the letter ‘a’ with the ‘@’ symbol or the letter ‘o’ with the number zero. If a website or program limits the number of characters you can use in a password, use the maximum number of characters allowed.
3. If you're are thinking of secret question to augment passphrase recovery in case you forget your passphrase, it is not going to help very much. In fact, it can be its Archilles' heel instead. We choose (most of the time) very straightforward question that have simple and guessable answers (assuming they are true) like your father's middle or last name. Avoid this; it's too easy for thieves to find who your friends and family are. If really required, go for safer questions that are more difficult for even ourselves to recall. These need an answer unlikely to be guessed or found online by attackers.

Good Practices for handling Passphrases

1. Be sure to use a different passphrase for every account or device you have. For example, never use the same passphrase for your work or bank account that you use for your personal accounts such as Facebook, YouTube or Twitter. This way, if one of your accounts is hacked, the other accounts are still safe. If you have too many passphrases to remember (which is very common), consider using a password manager. This is a special program that securely stores all of your passphrases for you. That way, the only passphrases you need to remember are the ones to your computer and the password manager program. 
2. Never share a passphrase or your strategy for creating them with anyone else, including co-workers. Remember, a passphrase is a secret. If anyone else knows your passphrase, it is no longer secure. If you accidently share your passphrase with someone else or believe it may have been compromised or stolen be sure to change it immediately.
3. Just like passwords, avoid easy-to-guess or commonly used passphrases. For example, the phrase, “Four score and seven years ago,” is not a good passphrase, because it is so well known. In other words, try to make your passphrases as meaningless and random as possible. Consider the suggestions below:
   
   • Don't use names or numbers associated with you (such as your child’s birth date or your spouse’s name).
   • Don't use your user name or login name in any form.
   • Don't use a derivative of names or numbers associated with you.
   • Avoid using a solitary word in any language.
   • Avoid using easily-obtained personal information. This includes your telephone numbers, identification card number, car’s license plate number, and street address.
   • Don't answer “yes” when prompted to save your password or passphrase to a particular computer. Instead, rely on a passphrase committed to memory or stored in a dependable password management program.
4. Do not use public computers, such as those at hotels or libraries, to log in to a work or bank account. Since anyone can use these computers, they may be infected with malicious code that captures all of your keystrokes. Only log in to your work or bank accounts on trusted computers or mobile devices.
5. Be careful of websites that require you to answer personal questions. These questions are used if you forget your passphrase and need to reset it. The problem is that the answers to these questions can often be found on the Internet, or even on your Facebook page. Make sure that if you answer personal questions, you use only information that is not publicly available or fictitious information you have made up. Password managers can help with this, as many allow you to store this additional information.
6. Many online accounts offer something called two-factor authentication, also known as two-step verification or 2FA. This is where you need more than just your passphrase to log in, such a passcode sent to your smartphone. This option is much more secure than just a passphrase by itself. Whenever possible, always use these stronger methods of authentication.
7. Mobile devices often require a PIN to protect access to them. Remember, a PIN is nothing more than another password. The longer your PIN is, the more secure it is. Do not be complacent with this. Many mobile devices allow you to change your PIN number to an actual passphrase.
8. Change your passphrases regularly. Set up a routine (e.g. changing your passphrase on the first of each month).
9. Finally, if you are no longer using an account, be sure to close, delete or disable it.

One key takeaway for you, minimally, and hopefully you remember, this is not just another article that I asked you not to just read and forget, practice it now (if possible). In simple terms - this is not about just choosing complex, hard-to-crack or strong passphrases that hackers will not be able to guess. But it is about making sure that each of our own password use online need to be unique and different. If one of your account is broken into, it does not means all account are broken into. 

However, I recommend to always go beyond single factor passwords or passphrases and opt for stronger means such as multi-factor authentication. where there is additional out of band security, such as a SMS one time password (something you have) to augment your existing password/passphrase. Also, read Bruce Schneier's advice on his methods in the choice of passwords. We do want to balance out being short-changed due to security fatigue if the effort to remember complex passphrases backfires by denying your access.