Bruce Schneier on how to choose a secure password — forget taking a common word, substiting some numbers for letters, and sticking a year with some punctuation on the end. Not good enough:
PRTK also runs a four-character-string exhaustive search. It runs the dictionaries with lowercase (the most common), initial uppercase (the second most common), all uppercase and final uppercase. It runs the dictionaries with common substitutions: "$" for "s," "@" for "a," "1" for "l" and so on. Anything that's "leet speak" is included here, like "3" for "e."
The appendage dictionaries include things like:
* All two-digit combinations
* All dates from 1900 to 2006
* All three-digit combinations
* All single symbols
* All single digit, plus single symbol
* All two-symbol combinations
