Adding 'fudge' to your passwords

The challenge of enforcing a secure password policy is that the passwords can be difficult to remember. Most users will write them down. But that's not the problem — the problem is where the passwords are stored. Too many people store passwords in an unencrypted file or in unprotected places. If you are not going to require users to use an encrypted password safe, you should at least instruct them on how to mix some "fudge" into their passwords to provide an extra layer of security.

Fudge characters are characters that the user randomly inserts into every password that he/she writes down, so if anyone discovers the password list, they still won't have the real passwords.

Let's look at some examples. Assume you are using the following REAL passwords:
2va,nilla
5S,c,r,ty
UR1drful+
chok-lutt3
(you do use strong passwords, don't you?)

Also assume that your fudge characters are 8 and *. When you write down these passwords, you insert your fudge characters and write them like this:
28va,nilla
5S,c,r,*ty
UR1drful+**
*8chok8-lutt3

When you log in to an application or a website, mentally drop the fudge characters as you type the password. You'll get used to it after you do it a few times.

Tell users to vary the locations of fudge characters in their passwords, and to mix and match the fudges so that they appear random. Don't always put them at the beginning or the end of passwords, and don't fall into any patterns. If a user always puts an asterisk at the beginning of each password and an intruder cannot get any of the passwords to work, he might try dropping the asterisk – and be successful.

How do you pick which 'fudges' to use?

To pick fudge characters, tell users to choose letters, numbers and symbols that they rarely use in passwords anyway, simply because they don't like typing them. When those characters appear in the written passwords, they tend to stand out, which makes it easier to remember why those characters are there.

You should use at least two fudges, but I'd recommend three – one fudge in each of the character types (letters, numbers and special characters). Three fudge characters give users more to mix and match. More than three tends to foster confusion.

Users that already have a large number of passwords written down might find that some of their newly-picked fudge characters already appear as part of a real password. They can either change those passwords or just enclose those written passwords in parentheses (5S,c,r,*ty) to remind them that fudges don't apply to these passwords — type them exactly as written.

I am not suggesting that fudge characters will give your users the freedom to post passwords in plain sight. Nor am I suggesting that fudge characters are cousins to cryptography -- they're not even related. I'm just suggesting that your users add a little noise to their written passwords so that if they're found, they don't fall freely at the finder's feet.

About the author
T. Martin Brown is a security officer for a Fortune 500 company and a contributing writer of The Certified Security Professional Online Magazine, a free resource dedicated to an open exchange on security and certifications. Contact Martin at www.certifiedsecuritypro.com or at tmart500(at)hotmail.com.

For other dos and dont's regarding passwords, see Writing Down Passwords Right.