Page Comparison

Purpose

Unique user names and secure passwords and passphrases are used by systems to distinguish between authorized users and unauthorized individuals. Weak passwords can be cracked by a threat actor within a matter of seconds or minutes, merely delaying their access to your systems and data, rather than preventing it.

Audience

On this page

Initial considerations

\uD83D\uDCD8 What can I do?

Follow the University’s safe password practices when protecting institutional accounts and systems.

• https://securitymatters.utoronto.ca/resources/safe-password-practices/

What can I do?

New account, new password (or passphrase).

• For every account you have, you should use a unique password or passphrase to help limit the exposure caused by a breach or theft to just one account.

Use passphrases.

Long

• Create a passphrase made up of 5 or more words.

Random

• Avoid common phrases or words which are closely correlated with each other. A limited dictionary size reduces the possible complexity of a passphrase.

Use complex passwords, when passphrases are not possible.

Long

• Create a password with 14 or more characters, where allowed.

• Brute-force attacks, wherein all character combinations are attempted in order to guess a password, are most successful for short passwords.

  • Whereas a password made up of 8 characters could take only hours to crack, passwords over 14 characters would take centuries.

Random

• Avoid common phrases, words associated with your identity (e.g.; name, username, job, family members, hobbies, interest) and other easily guessable words or strings of characters.

Complex

• Use a combination of uppercase and lowercase letters, numbers, and special characters.

Enroll in the University’s multi-factor authentication (MFA), if you haven’t done so already.

• https://isea.utoronto.ca/services/utormfa/

Use a password manager to help prevent password reuse.

• When passwords are reused across multiple accounts, a single data breach or successful phishing attempt could result in malicious individuals gaining access to the various accounts where that password was used.

Where possible, use passkeys over passwords.

• Passkeys are digital credentials, stored on a device and generated through public-key encryption, whereby authentication is performed by nature of the device being trusted, rather than you providing a password.

  • https://

  securitymatters

  • theconversation.

  utoronto.ca/protect

  • com/what-are-passkeys-a-cybersecurity-researcher-explains-how-you-can-use-your-

  passwords/

• • phone-to-make-passwords-a-thing-of-the-past-196643

Be aware of known phishing attempts and report suspicious emails to help protect your and others credentials.

• https://securitymatters.utoronto.ca/category/phish-bowl/