DIGITAL SELF DEFENSE:
how to create a
secure passphrase
Passphrase - the next generaon in passwords!
0
1
0
1
0
0
1
0
1
0
0
1
0
1
0
1
0
1
0
0
1
1
0
0
1
0
0
1
0
1
0
1
the easiest solution:
use a password safe
Password safes save your passphrases or passwords
securely, allowing you to save informaon on your
personal computer without giving away private
informaon inadvertently. They can also generate
random passphrases for each of your accounts.
These password safes store all of your passphrases in
a single account, which has a master passphrase you
need to remember. Password safes allow you to use
truly random combinaons in all other passphrases,
making them more dicult for malicious users or
bots to crack. Two examples of these services are
LastPass and Password Gorilla.
when to change your
passphrase
Passphrases should be changed:
• Whenever a malicious program such as a virus
is detected or a machine is compromised
• Whenever leaving a job or starng a new one
• From any default passphrases
• If they are shared with anyone at any me
get informed
Visit the UBIT website to read the security standards,
access security tools and soware, or nd out more
ways to protect yourself.
UB INFORMATION SECURITY OFFICE
www.bualo.edu/ubit/security
sec-oce@bualo.edu
(716) 645-6997
01
01
0
0
1
0
1
0
0
1
0
0
1
0
1
0
If you have forgoen your
passphrase or believe it has been
compromised, contact the
UBIT Help Center:
716-645-3542
Email: ubithelp@bualo.edu
Content used with permission from Rochester Instute
of Technology. Updated 8/1/17.
10
10
0
1
10
01
0
1
0
1
0
0
1
0
1
0
0
1
0
1
0
0
1
0
1
0
1
0
0
1
1
0
1
0
0
1
0
1
0
1
0
0
1
0
1
0
0
1
0
1
0
0
1
0
0
1
0
1
0
0
1
0
1
0
1
0
0
0
1
0
1
0
1
0
0
1
0
0
1
0
1
0
1
0
0
1
0
1
0
1
00
10
1
01
0
0
10
100
1
0
1
0
1
0
1
protect your passphrase
There are several dierent ways someone can acquire
your passphrase:
• Cracking: Password cracking programs are
designed to guess the most common passphrases
rst. Most current programs can make over one
million crack aempts per second.
• Malware: Password stealers and keyloggers are
oen packaged with viruses and spyware. Always
run up-to-date an-virus.
• Social Engineering: Never give away your
passphrase to anyone, even someone claiming to
work for a help desk.
• Phishing: Universies and companies will never ask
you to conrm your passphrase through email, so
don’t click on links in an email asking you to do so.
Type the URL into a Web browser manually.
why use a secure
passphrase?
If someone cracks your passphrase, they can:
• Obtain your personal informaon, which can lead
to identy the
• Gain access to your email account to read and send
email
• Access MyUB, HUB Student Center or other
services
• Access condenal UB informaon on the
university’s network
• Gain informaon about your registered
computers at UB and register their
own on your UB account.
what is a secure
passphrase?
A secure passphrase is the next generaon
in passwords. It uses a short phrase instead of
a single word, making it more dicult for someone
else to guess or use.
It should be virtually impossible for others to guess,
and not contain or be based on personal
informaon. Passphrases should never be wrien
down or given to anyone else.
what should I avoid?
There are many ways people try to make their
passphrases easier to remember. Password cracking
programs look for the most common passwords rst.
Passphrases should NOT:
• Contain your UBITName
• Be the same as other passphrases you are
currently using (including non-UB services)
• Be a single word, forward or backward, from an
English or foreign diconary
• Contain more than three sequenal characters
on a keyboard (ex: qwerty or 1234)
• Contain more than two consecuve repeang
characters (bbbb2bbb)
• Be all numbers such as birth or anniversary
dates (ex: 011551)
• Be shared with anyone for any reason
how do I create an easy
to remember
passphrase?
Here are three simple ways to construct a secure,
easy to remember passphrase:
1. Create a passphrase by taking a short phrase and:
• Change the capitalizaon of some of the leers
• Replace some of the leers with numerical and
symbolic substuons ($ for S, 8 for B)
• Misspell or abbreviate some words
(E.g., the phrase “iced tea is great for summer”
becomes “!cedTisgr84$umm3R”.)
2. Choose several shorter words and add some
numbers in the center, then change the
capitalizaon and substute symbols for leers.
(E.g., the phrase “book 451 Bradbury” becomes
“bO()K451BR^Dbury”.)
3. Choose a memorable quote or phrase and use
only the rst leer from each word. Vary the
capitalizaon.
Also include numbers and symbols, either as
substuons for leers or as a replacement for a
full word. (E.g., Wayne Gretzky’s “You will always
miss 100 percent of the shots that you never take”
becomes “ywAM100%ot$tyN+”.)
Requirements for passphrases can be found at:
hp://www.bualo.edu/ubit/password-safety
HINT: You can also use a password safe, a program that
generates and stores random, secure passwords.
www.buffalo.edu/ubit/security