Gordon Woolf's Blog

Are you giving your password away?

"I wouldn't do that" would probably be your answer to the suggestion that you could be giving your password away.

But think about it. Do you have passwords on scraps of paper? Do you use the same password for many sites on the web where you have to log in?

As someone involved in publishing, have you ever given out your password for someone to upload a file to your website or FTP site? Maybe you can change that afterwards, but does it bear any similarity to the password you use for online banking?

There have been many warnings that you should never believe the phone caller who says they are from your bank or some other payment processing service, but it continues to happen, and last year TechWeb reported how a security firm has used official-looking pollsters in New York's Central Park to ask questions from the mundane -- "Is this your first visit to New York City?" -- to the personal -- "What's your mother's maiden name?"

More than 70 percent of those polled gave up their mother's maiden name -- a potential goldmine, since it's often used to confirm identities or demanded in a password reset -- while over 90 percent handed over their place and date of birth. More than half told the pollsters how they come up with online passwords.

I should add that I have always wondered about why banks use that mother's maiden name question. But then I've lived in small towns where everyone would know the family name of just about everyone else's mother. "George Smith? Oh, yes, he married the girl of Green!"

How many of the readers of this use as all or part of password their place of birth, favorite sports team, pet's name, spouse's petname or name for you. Or used any of those words backwards? How easily would you give that information in an answer to a phone or street poll? Especially if you were promised a gift or discount of some kind.

Whether you do or not, it may be a good time to change your password. Today.

Change the clock, change the passwords

I can't understand how people use birthdates, pet names, children's names and so on as passwords on accounts which matter. Sure, I use a pet's name on some anonymous technical forums I've had to sign in for where I don't use my real name ayway but such passwords can be broken in minutes on email and web access. And how many of you are still using the initial password given by a financial advisor, share broker etc and which could have even been sent to you originally in an open email. And then there are people who'd get a shock if they opened their security dialog in a common web browser to discover that a couple of clicks away are all their passwords in plain view if they've chosen to let the computer remember it -- and therefore in plain view to anyone who ever has access to your computer. We have a common promotion here that when you change the daylight savings time settings on your clocks is the time to change the battery in your smoke alarms. I'd add that twice a year, when the clocks change, is also the time to change all your passwords.