Safer passwords and common tricks

Get Cyber Safe calls a password the key to your personal information, and says unique, complex passphrases and passwords for every account and device are one of the best protections you have. They recommend a passphrase when you can use one: a memorized phrase of mixed words, with or without spaces. Their recipe is a combination of four or more random words and a minimum of 15 characters. Random words are harder to guess than a pet’s name or a birthday.

If a site will not accept a passphrase, they describe a traditional password instead:

• at least twelve characters
• upper- and lower-case letters and at least one number
• at least one character that is not a letter or number, such as !, #, or $
• a series of letters that only make sense to you, such as the first letters of each word in a sentence

Do not invent a passphrase out loud in a public room, and do not type a real one into this course. Practise the *shape* of the idea (four random words, long enough) with words that are not your real secret. If you change a real password later, do it on the real sign-in page of the service, after you opened that page yourself.

A PIN is a shorter number used to unlock a device (Lesson 2). It is not a replacement for a unique password on an email or banking account. Google’s Android help, from Lesson 2, recommends a six-digit PIN if you choose PIN for the screen lock, and lists a strong password as the most secure of those lock types.

Many people reuse the same password everywhere. Get Cyber Safe says the problem is simple: if a criminal gets into one account, they can try that same secret on the others. Unique passwords are the easiest way to protect all of your accounts after one service has a breach. They also mention that you can try a password manager if remembering many secrets is hard. This course does not name or sell a brand.

Get Cyber Safe repeats, clearly: never share your password with anyone. Their laptops page also says not to write a password down and store it near the computer. A note on the monitor, a photo of a password, or a text that says “my password is…” hands the key to whoever picks up the device.

If you must write a hint while you are learning, keep it away from the device and make it a hint only you understand — or, better, use a password manager a tutor can help you choose later. Do not store real passwords in this course, in email drafts, or in a shared notes file on a library PC. A family member can help you remember *that you have an account*, but Get Cyber Safe is clear that they should not be given the password itself.

Signing in from a trusted place matters as much as the secret itself. The next chapter covers messages that try to collect a password you already created.

Get Cyber Safe describes phishing (email) and smishing (text) as messages that pretend to come from someone you trust so you will give up information. To get a password, a phishing email may look like a well-known company and ask you to log in or send you to a fake sign-in page.

Their rule is direct: legitimate websites will never ask you to send personal information or to log in through email or text. If you are unsure, log in from the home page of the organisation you are dealing with. Never click a link in a suspicious message, and never respond to a message that asks for your password.

That overlaps Lesson 7 and Lesson 8 on purpose. The extra point here is the password itself: even a strong, unique passphrase is worthless if you type it into the wrong box. Open the real site yourself (type a known address, use a bookmark, or search for the organisation’s name and check the result). If a pop-up or a text creates urgency, treat the urgency as a warning.

For a wider set of scam examples, tone, and reporting tips, use *Email & Online Safety Basics in Canada*. This lesson will not retell that course. If a message still worries you after you have paused, show it to a tutor rather than guessing. You can ignore an unexpected note; you cannot easily take back a password once you have typed it in the wrong place.

1. On paper, privately, practise the *shape* of a passphrase (four random words, at least 15 characters) — then keep that paper safe or destroy it. Do not write a real password you already use.
2. Say out loud (or to a tutor) why a unique password matters.
3. Walk through the strange-message practice above.
4. Do not type a real password into this course.

What makes a long passphrase easier to remember than a short jumble of symbols? What would stop you from writing it on a sticky note?