Password Security – You Need To Care

I thought I would take some time to explain why password security is critical on any Internet account, despite it’s importance.

The Internet is a powerful tool.  Any person can say anything and interact with anyone, anywhere.  The more it’s used, the more seemingly unrelated items get tied together.  Most don’t realize this…they just check their email , see if anyone posted anything funny on Facebook , maybe play a quick game of FarmVille, and then go about their business.

Now, let’s set up a scenario where an evil hacker cracks your email password of “ qwerty “, then logs into your email account:

In five steps, our resourceful hacker person gained access to your bank account due to a weak password.  It’s almost like playing Six Degrees of Kevin Bacon with your bank account.  Granted this is an extreme case, but some version of it happens thousands of times a day to people with weak passwords.  Leaving poor safeguards on any Internet account invites abuse.

A lot of people I know picture Internet hackers as fat kids with pimples and glasses, wearing a black concert t-shirt and tapping away cryptic codes while swigging Mountain Dew.  Yes, 20 years ago that might have been the case (I don’t think I wore black concert t-shirts though).  Today’s hacking crowd is a much more sophisticated and greedy bunch.  Often they’re groups based out of chaotic areas like Nigeria, China, and Russia, and if they’re attacking someone’s account, there’s a payoff attached to it.  These guys know a thing or two about human behavior and computer practices, and if you fall into their guidelines, you’re vulnerable.  How do they “guess” passwords for accounts?  There’s many different techniques:

Social Engineering-   One of the top ways of getting you password stolen is caused by you giving it  to the hacker.  Those seeking your password might find it on a piece of paper you have on your desk, or even going as far as going through garbage bins and dumpsters to find login information.  Sometimes they’ll even find personal information about you to guess potential passwords.  If they see a website that lists your daughter’s name as “Samantha”, they may try variations of that name to gain access.

Intercepting Data- A keylogger is a small program that gets installed on your computer and records your keystrokes.  These are then sent to hacker’s computer, and they’ll be able to see anything you typed.  These programs can be installed via “trojans”, or programs masquerading as legitimate software.

Cracking – Cracking involves trying to guess a password by using common words, phrases, and names.  More sophisticated attacks involve using “brute force” software.  This involves using a program that generates every possible combination of letters, numbers, and characters.  Passwords with names and words found in the dictionary are usually found rather quickly, while capital letters, numbers, and special characters add complexity.  With enough time, any password can be discovered with this method, but every character added can change the cracking time from hours to weeks.

Theft- If your password is secure, that doesn’t mean that the sites that require it are secure.  Hackers often target corporate databases to gain usernames and password for accounts.  Cracking a database often has a large payoff, but also has the most risk of being caught.

Password Recovery –  People have a hard time remembering their passwords, and rely on password recovery systems frequently.  Unfortunately these are a weak link in website security.  If an email account is compromised, any site that sends a “reset your password” link to your email account is also vulnerable.

OK, you’re now convinced that you need to use more secure passwords, but how?  Simply changing your password from “ dave123 ” to “ dave1234 ” isn’t going to cut it, so you’ll want to follow these quick tips to keep prying eyes out of your business:

This  should minimize the possibility of your accounts being compromised.  It’s also important to run excellent AntiVirus software on your computer to prevent keyloggers and other types of programs that can collect personal data.  One compromised account can bring down your house of cards, but keeping your information secure is your ace in the hole.