May 21st, 2016 – Only idiots, we know, use “password” as their password. Or “123456”. Or “football” (the seventh most common password in the world). Maybe you carefully add an upper case letter, an unusual character or two, plus a few numbers to your Pa$swOrd.
But with hackers using “brute force” software to make as many as 8m password guesses a second, don’t kid yourself you are safe. This week LinkedIn told users to reset their accounts after more than 100m passwords appeared for sale online.
So how can you better protect yourself? First, find out how exposed you are, and then follow some easy steps towards creating easily memorable passwords that are different for every site you visit – so even when the hackers behind LinkedIn sell your password, you know you are safe.
Check your existing password
The most foolish thing is to use a single word as your main password. So-called “dictionary attacks” run through every word in a language at lightning speed. On the dark web, hackers share the millions of passwords that have been stolen in data breaches, which are then added to the default dictionary and searched. Single-word passwords are often the first to be broken in a brute force attack.
Let’s take the word “guardian”. As a password it would be cracked instantly, according to website howsecureismypassword.net. Adding an upper case letter – changing it to “Guardian” – does absolutely nothing to make it more secure. Swapping a letter for a number isn’t much help either. “Guard1an” will take hackers about two hours to discover, it says. But adding a number does help a bit – so “Guardian1” will take hacking software four days to crack, or possibly less. Words with one or two digits added at the end are usually easily tested by software and take little extra time to crack.
But estimates of how quickly passwords can be cracked should be treated with caution, say experts. And, while it can be a useful exercise to help understand how poorly some passwords might perform, never type your actual password(s) into an online checker.
Make it long
Security experts agree that a password should have a minimum of 12-14 characters. Richard Cassidy, technical director of cyber security company Alert Logic, says a 14-character password could take 811 trillion guesses to crack. “Length is the thing that gives you protection, not complexity,” he says, adding that even eight-digit passwords can be cracked in a matter of hours.
Very few people have passwords of 12 characters or more, and that’s understandable: they are difficult to remember and laborious to type in. So what do you do?
Passphrase not password
While the password “Guardian” will be cracked instantly, changing it to “IReadTheGuardian” might take upwards of two years to crack. Change it to “EveryDayIReadTheGuardian” and it will take billions of years to bust open, according to the password checking sites.
“If there’s one thing people should be doing, it’s using passphrases not words,” says Fraser Kyne of Bromium, a company that fights viruses and malware. “Take a line from a favourite film, or a poem you know, or a children’s rhyme, then maybe swap a word. Phrases are much easier to remember than random strings of text.”
As an example, he says, use “Nellie the elephant packed her trunk” but change “Nellie” to another memorable name. “It will be very easy to remember, but very, very hard to crack.”
Use versions of the same password on multiple sites
The conventional advice is to have a different password for every site that you visit.
Morgan Slain of SplashData says that, ideally, you should use different passwords for each site since it’s inevitable that, over time, some of your logins will be compromised. “At a minimum you should use a different password for each financial account, email account and social media account,” he says
But remembering a wide variety of passwords is beyond most people. Two of the experts we approached recommended an alternative approach: remembering a core, long and safe passphrase, then prefixing or suffixing it with the name of a specific site. For example, “Nellietheelephant” becomes “NelliethelephantAmazon” or “NellietheelephantLinkedIn”.
Richard Cassidy from Alert Logic says: “It is perfectly OK to use something like ‘thisismypasswordforNatWest’ or ‘thisismyBritishAirwayspassword’, but change one or two of the characters into numbers. It’s about keeping it simple and memorable.” Crucially, it means that when your password is compromised during an attack, such as at LinkedIn, it can’t be used elsewhere.
Be clever about your ‘special’ characters
Lots of people like to exchange an “a” for an “@” and an “i” for a “1”, so “Guardian” becomes “[email protected]”. The trouble is, hackers know they do this and search accordingly. “[email protected]” takes only 19 minutes to crack with standard software. In one notorious case, a Dutch certificate authority company was hacked because an employee had “production/administrator” as a username with the password “[email protected]”. A 21-year-old hacker broke in and caused so much mayhem the company later filed for bankruptcy.
Maintain your digital hygiene
Don’t use your dog or cat’s name, or a variant, as your password, and then post up fluffy pictures on Facebook naming them. What Cassidy calls APTs, advanced persistent threat groups, will scour the internet for personal information that will guide them in attacking bank accounts. Avoid using passwords that may be connected to family and pet names, or past addresses.
Consider a password manager
When researching this article our first stop was the Guardian’s tech reporters. They nearly all use password managers. These are the downloadable apps that will encrypt and store passwords for all your online accounts and profiles, saving you from having to remember them and input them on each visit. Most will flag up a poor password and help you create a more robust one.
But some people will feel uneasy. What if your password manager is hacked? “It’s the ‘keys to the kingdom’ worry – break the master lock and you’re in,” says Kyne, though he reckons the benefits outweigh the risks.
Password manager LastPass detected an intrusion last year, prompting it to ask users to change their master passwords, although it said the stores of encrypted passwords were not compromised. Users have also been targeted with sophisticated phishing attacks aimed at grabbing master passwords.
Write it down on paper
If you create a very long password and worry about remembering it, then write it down on paper and secure it somewhere safe at home, such as a locked drawer. It’s far safer than storing it on your computer.
The worst passwords
Article found here.