Hi Sonalika

Passwords are strings of characters used to authenticate computer system users. Secret passwords are one of the most basic methods of network security. Passwords increase the integrity and confidentiality of a system by limiting access to the person or persons knowing the password. This method may be combined with other authentication methods like security tokens and biometrics to positively identify a person. Passwords are useless if they are distributed to other than to their intended users.

Methods to keep your passwords private.

* If you have a large number of passwords to remember, or you don't feel you can remember important ones, you can use your computer to assist you in the storage of passwords. You can encrypt your password list with an acceptable master password using reliable encryption software. Many password managers are available for this purpose. For experienced users Gnu Privacy Guard and Pretty Good Privacy are free for individual use. Ensure you know how to use encryption properly; improper use of encryption technologies may defeat the whole purpose of using encryption in the first place. Seek help from an encryption expert, or purchase commercial encryption software if understanding is not forthcoming. Do not store your encrypted passwords, or your encryption keys, somewhere that another person may gain access to them.

* Refrain from using the same password on multiple systems, especially systems that do not serve the same function. Never use passwords you use on Internet forums, games, websites, or otherwise for any important password. It is trivial for the owners of these systems to extract your passwords if they are willing.

* Never tell another a password through e-mail, instant messenger clients, chat rooms, forums or other shared environments. These conversations are almost never entirely private. Do not tell someone your passwords over a cell phone or cordless telephone, as these are insecure mediums for conversation, and may easily be monitored. If you must tell someone a password over a telephone land line, make sure the party you are speaking with is the only listener. You may want to validate that additional parties are not listening in by calling the original party on a number you know is owned by them.

* Do not use shared passwords unless it is entirely unavoidable. Passwords shared between multiple users prevents the determination of which user performed which actions.

* Of course, never tell your passwords to anyone. Once you tell someone else your password, you no longer have control over the scope of password knowledge. If you absolutely must share your account access to a computer system, change the password to a new password first before sharing it, and then change the password back to its original form once the other users are done performing the necessary efforts.

Regards

Answered by Suparna , an ibibo Master, at 1:44 AM on October 29, 2008

Secret passwords are one of the most basic methods of network security. Passwords increase the integrity and confidentiality of a system by limiting access to the person or persons knowing the password. This method may be combined with other authentication methods like security tokens and biometrics to positively identify a person. The security of a password is determined by these five elements:

1. The secrecy of the password - As a general rule, the security of a password is cut in half for each person who knows the password. This is one of the largest vulnerabilities exhibited in a password system, as social engineering or just plain old stupidity can compromise the security of a password.
2. Resistance to guessing - A good password should not be easily guessed. Passwords based on a person's name, address, family members, pets, birthday, or other commonly known facts about a person are by nature insecure. Other bad passwords are the infamous god, as well as the word password or the number combination 12345 (too many Spaceballs freaks out there).
3. Resistance to brute force and dictionary attacks - A good password will at least make the script kiddies work a little bit if they want to crack it. There are three ways to strengthen a password:
* Password length - the longer the better. The minimum recommended password length is six characters, although many network security professionals recommend nine or more.
* Use multiple types of characters. There are four character types: lowercase letters (a-z), uppercase letters (A-Z), numbers (1-9) and special characters (!,@,#,$, etc.). The more types of characters you use, the stronger the password will be. A good recommendation is to use at least three of the four types, and if password complexity is enabled on a Microsoft Windows server, this is mandatory.
* Avoid dictionary words and repetitions of characters, this makes the password much easier to crack. For security reasons, a randomly generated password is the most inherently secure, although this may result in a greater likelihood of a breach in the secrecy of a password, as it is more likely to be written down.
4. Password storage security - If there is a failure in this area, all the above steps are useless. Passwords should always be encrypted when they are stored on a server (as well as being encrypted in transmission). The preferred method for this is a one-way hash function, which encrypts the password in a way that cannot be conveniently decrypted. A server must also be physically secure, as an attacker gaining physical access to a server is likely to be able to circumvent normal security measures.
5. Password rotation - Passwords should be changed periodically. This reduces the chance of a password being cracked as well as reducing the potential for damage from a compromised password. The length of time between password changes depends on the need for security. A common password duration is one month, and anything less often than quarterly is effectively useless for business purposes.

The level of security applied to a password should be proportional to the value of the information assets the password protects. Obviously, a password protecting top secret information should be much stronger than the password for your World of Warcraft account. But don't forget, if you use the same password for multiple services, it dramatically increases the likelihood that the password will be compromised.

Answered by Ashish Yadav , an ibibo Wizard, at 9:00 AM on October 24, 2008

Password Secrecy

Passwords are useless if they are distributed to other than to their intended users. Below is a list of methods to keep your passwords private.

* If you have a large number of passwords to remember, or you don't feel you can remember important ones, you can use your computer to assist you in the storage of passwords. You can encrypt your password list with an acceptable master password using reliable encryption software. Many password managers are available for this purpose. For experienced users Gnu Privacy Guard and Pretty Good Privacy are free for individual use. Ensure you know how to use encryption properly; improper use of encryption technologies may defeat the whole purpose of using encryption in the first place. Seek help from an encryption expert, or purchase commercial encryption software if understanding is not forthcoming. Do not store your encrypted passwords, or your encryption keys, somewhere that another person may gain access to them.

* Refrain from using the same password on multiple systems, especially systems that do not serve the same function. Never use passwords you use on Internet forums, games, websites, or otherwise for any important password. It is trivial for the owners of these systems to extract your passwords if they are willing.

* Never tell another a password through e-mail, instant messenger clients, chat rooms, forums or other shared environments. These conversations are almost never entirely private. Do not tell someone your passwords over a cell phone or cordless telephone, as these are insecure mediums for conversation, and may easily be monitored. If you must tell someone a password over a telephone land line, make sure the party you are speaking with is the only listener. You may want to validate that additional parties are not listening in by calling the original party on a number you know is owned by them.

* Do not use shared passwords unless it is entirely unavoidable. Passwords shared between multiple users prevents the determination of which user performed which actions.

* Of course, never tell your passwords to anyone. Once you tell someone else your password, you no longer have control over the scope of password knowledge. If you absolutely must share your account access to a computer system, change the password to a new password first before sharing it, and then change the password back to its original form once the other users are done performing the necessary efforts.
http://www.tech-faq. com/passwords.shtml

Answered by Nishu's , an ibibo Master, at 10:55 PM on October 23, 2008

Password Secrecy

Passwords are useless if they are distributed to other than to their intended users. Below is a list of methods to keep your passwords private.

* If you have a large number of passwords to remember, or you don't feel you can remember important ones, you can use your computer to assist you in the storage of passwords. You can encrypt your password list with an acceptable master password using reliable encryption software. Many password managers are available for this purpose. For experienced users Gnu Privacy Guard and Pretty Good Privacy are free for individual use. Ensure you know how to use encryption properly; improper use of encryption technologies may defeat the whole purpose of using encryption in the first place. Seek help from an encryption expert, or purchase commercial encryption software if understanding is not forthcoming. Do not store your encrypted passwords, or your encryption keys, somewhere that another person may gain access to them.

* Refrain from using the same password on multiple systems, especially systems that do not serve the same function. Never use passwords you use on Internet forums, games, websites, or otherwise for any important password. It is trivial for the owners of these systems to extract your passwords if they are willing.

* Never tell another a password through e-mail, instant messenger clients, chat rooms, forums or other shared environments. These conversations are almost never entirely private. Do not tell someone your passwords over a cell phone or cordless telephone, as these are insecure mediums for conversation, and may easily be monitored. If you must tell someone a password over a telephone land line, make sure the party you are speaking with is the only listener. You may want to validate that additional parties are not listening in by calling the original party on a number you know is owned by them.

* Do not use shared passwords unless it is entirely unavoidable. Passwords shared between multiple users prevents the determination of which user performed which actions.

* Of course, never tell your passwords to anyone. Once you tell someone else your password, you no longer have control over the scope of password knowledge. If you absolutely must share your account access to a computer system, change the password to a new password first before sharing it, and then change the password back to its original form once the other users are done performing the necessary efforts

Answered by Sandeep , an ibibo Citizen, at 5:43 PM on October 23, 2008

Passwords are strings of characters used to authenticate computer system users.

Computer users are normally asked to enter their username (or login name) and their password (or pass phrase) before they are give access to a system.

If the person knows the username and the password, the computer systems trusts that they are the account owner and grants them access to their data.

Password crackers have many tools at their disposal to cut down the amount of time it takes to crack your password. Selecting a secure password will help to ensure that the password cracker must take as much time as possible to guess or otherwise identify your password. No password is ultimately secure, but if it takes the password cracker longer to crack the password than it takes for the password to become useless, you will have succeeded in thwarting the cracker's attack.

Answered by Gyan Singh , an ibibo Master, at 1:37 PM on October 23, 2008

well sonalika,
A password-based authenticated key exchange (PAKE) protocol in the three-party setting allows two clients com- municating over a public network to agree on a common session key with the help of a server. In the setting the users do not share a password between themselves, but only with the server. In this paper, we propose a new efficient password-based authenticated three-party key ex- change protocol and provide a rigorous conclusion of for- ward security for it in both the random-oracle and the ideal- cipher models under the gap Diffie-Hellman intractability assumption. It is a significant advantage that our proto- col is proved secure in a model that allows the adversary to make adaptive corrupt queries, in contrast to previous solutions.

Answered by Venkata , an ibibo Specialist, at 12:43 PM on October 23, 2008

well, Password-only authenticated key exchange (PAKE) protocols are designed to be secure even when users choose short, easilyguessed passwords. Security requires, in particular, that the protocol cannot be broken by an o-line dictionary attack in which an adversary enumerates all possible passwords in an attempt to determine the correct one based on previously-viewed transcripts. Recently, provably-secure protocols for PAKE were given in the idealized random oracle/ideal cipher models [2, 8, 19] and in the standard model based on general assumptions [11] or the DDH assumption [14]. The latter protocol (the KOY protocol) is currently the only known ef-cient solution based on standard assumptions. However, only a proof of basic security for this protocol has appeared. In the basic setting the adversary is assumed not to corrupt clients (thereby learning their passwords) or servers (thereby modifying the value of stored passwords). Simplifying and unifying previous work, we present a natural denition of security which incorporates the more challenging requirement of forward secrecy. We then demonstrate via an explicit attack that the KOY protocol as originally presented is not secure under this denition. This provides the rst natural example showing that forward secrecy is a strictly stronger requirement for PAKE protocols. Finally, we present a slight modication to the KOY protocol which prevents the attack and | as the main technical contribution of this paper | rigorously prove that the modied protocol achieves forward secrecy.
source site: http://oit.nd.edu/policies/itstanda rds/strongpassword.shtml

Answered by Romi , an ibibo Master, at 12:28 PM on October 23, 2008

Passwords are useless if they are distributed to other than to their intended users. Below is a list of methods to keep your passwords private.
• If you have a large number of passwords to remember, or you don't feel you can remember important ones, you can use your computer to assist you in the storage of passwords. You can encrypt your password list with an acceptable master password using reliable encryption software. Many password managers are available for this purpose. For experienced users Gnu Privacy Guard and Pretty Good Privacy are free for individual use. Ensure you know how to use encryption properly; improper use of encryption technologies may defeat the whole purpose of using encryption in the first place. Seek help from an encryption expert, or purchase commercial encryption software if understanding is not forthcoming. Do not store your encrypted passwords, or your encryption keys, somewhere that another person may gain access to them.
• Refrain from using the same password on multiple systems, especially systems that do not serve the same function. Never use passwords you use on Internet forums, games, websites, or otherwise for any important password. It is trivial for the owners of these systems to extract your passwords if they are willing.
• Never tell another a password through e-mail, instant messenger clients, chat rooms, forums or other shared environments. These conversations are almost never entirely private. Do not tell someone your passwords over a cell phone or cordless telephone, as these are insecure mediums for conversation, and may easily be monitored. If you must tell someone a password over a telephone land line, make sure the party you are speaking with is the only listener. You may want to validate that additional parties are not listening in by calling the original party on a number you know is owned by them.
• Do not use shared passwords unless it is entirely unavoidable. Passwords shared between multiple users prevents the determination of which user performed which actions.
• Of course, never tell your passwords to anyone. Once you tell someone else your password, you no longer have control over the scope of password knowledge. If you absolutely must share your account access to a computer system, change the password to a new password first before sharing it, and then change the password back to its original form once the other users are done performing the necessary efforts.

Answered by NIVEDITA , an ibibo Master, at 12:26 PM on October 23, 2008

Passwords are useless if they are distributed to other than to their intended users. Below is a list of methods to keep your passwords private.


If you have a large number of passwords to remember, or you don't feel you can remember important ones, you can use your computer to assist you in the storage of passwords. You can encrypt your password list with an acceptable master password using reliable encryption software. Many password managers are available for this purpose. For experienced users Gnu Privacy Guard and Pretty Good Privacy are free for individual use. Ensure you know how to use encryption properly; improper use of encryption technologies may defeat the whole purpose of using encryption in the first place. Seek help from an encryption expert, or purchase commercial encryption software if understanding is not forthcoming. Do not store your encrypted passwords, or your encryption keys, somewhere that another person may gain access to them.


Refrain from using the same password on multiple systems, especially systems that do not serve the same function. Never use passwords you use on Internet forums, games, websites, or otherwise for any important password. It is trivial for the owners of these systems to extract your passwords if they are willing.


Never tell another a password through e-mail, instant messenger clients, chat rooms, forums or other shared environments. These conversations are almost never entirely private. Do not tell someone your passwords over a cell phone or cordless telephone, as these are insecure mediums for conversation, and may easily be monitored. If you must tell someone a password over a telephone land line, make sure the party you are speaking with is the only listener. You may want to validate that additional parties are not listening in by calling the original party on a number you know is owned by them.


Do not use shared passwords unless it is entirely unavoidable. Passwords shared between multiple users prevents the determination of which user performed which actions.


Of course, never tell your passwords to anyone. Once you tell someone else your password, you no longer have control over the scope of password knowledge. If you absolutely must share your account access to a computer system, change the password to a new password first before sharing it, and then change the password back to its original form once the other users are done performing the necessary efforts.

Answered by Hem@nt .... , an ibibo Master, at 12:23 PM on October 23, 2008