George Brown Polytechnic is located on the traditional territory of the Mississaugas of the Credit First Nation and other Indigenous peoples who have lived here over time. We are grateful to share this land as treaty people who learn, work and live in the community with each other.
Strong passwords & single sign on
As more services become available online, good password hygiene and practices are more necessary than ever. Where passwords are used, they should be strong and unique while keeping user experience in mind to help keep your services safe.
Passwords prevent unauthorized access. Passwords limit access to systems and information, ensuring that the right users have access to the right resources at the right time.
With single sign-on (SSO) becoming the norm, one password provides access to multiple services.
How to create and manage strong and effective passwords
Your passwords or passphrases should be easy to remember but difficult to guess.
A passphrase is the same as a password but consists of a sequence of words or other text that a user can more easily memorize. For added security, a passphrase is typically longer than a password. The terms “password” and “passphrase” are often used interchangeably.
Strong passwords and passphrases should always be balanced with user experience to avoid forcing users to write down their password/passphrase or pick an overly simple one that is easy to memorize.
Password Management Dos & Don'ts
Dos
- Use complex passwords or passphrases. Complexity helps thwart password crackers or brute force attacks that attempt to guess your password.
- Use upper and lower-case letters, numbers and special characters.
- Use a unique password/passphrase for each system, device or platform.
- If using a passphrase, pick a phrase that you can remember but replace some of the letters with numbers or special characters. For example, “the quick brown fox” becomes “Th3Qu!ckBrnFX#”.
- Ensure security questions for password resets are difficult to answer.
Do not
- Include words that can be found in the dictionary. Use random characters instead.
- Use proper names or popular slang — these often appear in custom attacker dictionaries.
- Reuse passwords/passphrases for multiple accounts. If one website gets hacked and you’ve used the same password for other sites, a threat actor can use the breached password to gain access to your other accounts.
- Update your password/passphrases according to an easy-to-detect pattern (e.g., the practice of incrementing one portion in a password in succession). If an older password/passphrase is ever compromised, using patterns will make it easier for someone malicious to guess your new one.
- Share your password/passphrase with friends, colleagues, or even your manager. Your organization may also have rules against this.
- Write down your passwords/passphrases.
- Use ‘remember password’ or ‘remember me’ functions for systems, services, or software.
- Create security questions that rely on information easily found on social media, such as a pet’s name or your date of birth.