I have 3 levels of username/password for the 3 lev...

2010-02-08T08:17:27.017-08:00

I have 3 levels of username/password for the 3 levels of websites that I use. They are all based on one of 3 phrases that I have in my head and then plying a first character from the phrase. So long as I remember the phrase, I can pretty much always remember my password. An example which I often used while instructing the lawyers who used our legal software was: "We the people of the united states in order to form a more perfect union." became wtPotU5mpU or something like that. As long as its over 10 characters, has a nice mix of stuff in it and isn't dictionary recognizable, it's a decent password.

But the onus of protection is on the website itself. There are many layers of protection to use, but I think a great thing to do (and we did this on our legal website which required high-levels of security) was to publish a 3rd party report of a penetration test of our security. A double-edge sword, to be certain, but it showed that we took security seriously and were proactive in that.

It's one thing to say, "I'm secure". It's another to actually show it.

Additional

Comments on EHR Bloggers: Annals of Security: Don't Pass the Password

I have 3 levels of username/password for the 3 lev...