It’s easy to make a password that’s hard to crack.
- Make your password at least 12 characters long (longer is always better); and
- Include caps, numbers, and special characters (most people use all lowercase letters).
The challenge is to make a password that is also easy to remember. The best passwords contain a lot of apparent randomness (unlikely character combinations), but these usually make them harder to remember.
The harder a password is to remember, the more likely that a customer or employee will save the password into a computer file, which presents its own security risk!
- Terrible: Poodle
- Bad: Fuzzydog
- Better: Mypoodleisafuzzydog!
- Best: MyFuzzyDogCostsBIG$$$24/7
Traits of a Bad Password
Hackers know the most common themes that people use. Avoid these common password themes:
- Personal information (birthday, postal code, names, etc.)
- Sports teams
- Typical letter substitutions (“p@$$word”).
- Keyboard paths (for example: qwerty is one of the most common passwords in the world)
Password Sharing & Protection
Keep these security measures in mind at all times:
- Do not use the same password for multiple accounts (regardless of the password’s strength) because if one account gets compromised, then they’re all compromised.
- Don’t share personal account passwords.
- Don’t click an email link to change a password, unless you initiated the request.
- If a password must be shared, do not send it using clear-text (i.e., unencrypted) email.
Additional Security Measures
Even with a great password, security can be compromised in countless other ways, so take these additional measures:
- Change your passwords regularly, and
- Use multi-factor authentication wherever possible.
Typical Attack Methods
These days, most hackers use programs to do the hard work for them. A good hacking program can try 1000 words a second, so time is not an issue. Every attack is different, but attacks fall into two broad categories:
- Dictionary: This attack uses an extensive list of common passwords as well as words found in the English dictionary. One example comes from 2016. Hackers tested every IP address on the internet using the factory-default passwords of the world’s largest surveillance manufacturers. Millions of systems were compromised because users had never secured their systems.
- Brute Force: This attack does the alphanumeric equivalent of counting. It tests passwords starting with a–z, then aa–az, then ba–bz, eventually working its way to longer passwords. This is very time-intensive, but it will inevitably work… unless the hacker gets tired and gives up (lengthy passwords can literally take a lifetime).