Page Comparison

Purpose

Unique user names and secure passwords and passphrases are used by systems to distinguish between authorized users and unauthorized individuals. Weak passwords can be cracked by a threat actor within a matter of seconds or minutes, merely delaying their access to your systems and data, rather than preventing it.

Audience

On this page

Initial considerations

Follow the University’s safe password practices when protecting institutional accounts and systems.

• https://securitymatters.utoronto.ca/resources/safe-password-practices/

What can I do?

Consider the following principles when choosing a password.

Unique

New account, new password (or passphrase).

• For every account you have, you should use a unique password or passphrase to help limit the exposure caused by a breach or theft to just one account.

Use passphrases.

Long

• Create a passphrase made up of 5 or more words.

Random

• Avoid common phrases or words which are closely correlated with each other. A limited dictionary size reduces the possible complexity of a passphrase.

Use complex passwords, when passphrases are not possible.

Long

• Create a password with 14 or more characters, where allowed.

• Brute-force attacks, wherein all character combinations are attempted in order to guess a password, are most successful for short passwords.

  • Whereas a password made up of 8 characters could take only hours to crack, passwords over 14 characters would take centuries.

Random

• Avoid common phrases, words associated with your identity (e.g.; name, username, job, family members, hobbies, interest) and other easily guessable words or strings of characters.

Complex

• Use a combination of uppercase and lowercase letters, numbers, and special characters.

Enroll in the University’s multi-factor authentication (MFA), if you haven’t done so already.

• https://isea.utoronto.ca/services/utormfa/

Use a password manager to help prevent password reuse.

• When passwords are reused across multiple accounts, a single data breach or successful phishing attempt could result in malicious individuals gaining access to the various accounts where that password was used.

Where possible, use passkeys over passwords.

• Passkeys are digital credentials, stored on a device and generated through public-key encryption, whereby authentication is performed by nature of the device being trusted, rather than you providing a password.

  • https://theconversation.com/what-are-passkeys-a-cybersecurity-researcher-explains-how-you-can-use-your-phone-to-make-passwords-a-thing-of-the-past-196643

Be aware of known phishing attempts and report suspicious emails to help protect your and others credentials.

• https://securitymatters.utoronto.ca/category/phish-bowl/