Your passwords are not safe enough!

Image credit: Shutterstock

Please read this article on password storage before proceeding.

Your passwords aren’t as safe as you thought they would be…

“But wait, you mean anyone can crack my passwords?”

Well, yes and no.

It all depends upon you. If you have made the password good enough, it will not be easy to crack it.  If your password is something like your date of birth, your phone number, or something else like 1234 or qwerty or the ever famous “password”, then STOP reading this article, go back and CHANGE your password to something stronger RIGHT NOW. Who knows, maybe someone is in the process of cracking your password right this instant……

What makes a good, strong password?

A strong password is one with atleast 6 letters, 2 numbers and one symbol, adding up to a minimum of 10 characters. 

How are passwords cracked?

Password cracking can be divided basically into 2 categories:

1.    General Methods.

2.    With access to Database.

3.    With access to the Password Hash.

Let’s look into the first one:

1.Cracking a password without access to the database:

·       Shoulder surfing

·       Guesswork

·       Dictionary Attack

·       Brute Force Attack

·       Keylogging

·       The “Forgot Password” option

1. Shoulder surfing:

This means the intruder simply peeps at the display when you type in the password.

Solution:  Always use the “Hide password” option. Try to type fast.

2. Guesswork:

The intruder tries to make guesses on what the password might be. (Remember, the intruder might have your personal info like date of birth and phone number with them.)

Solution:  Keep a complex, un-guessable password. Never share your password with anyone. NEVER EVER set your personal info (like vehicle’s registration number or your date of birth) as the password.

3. Dictionary Attack:

The intruder uses a special program to insert every common password and your personal info until they get the right password.

Solution:  Keep a complex, un-guessable password. Never share your password with anyone. NEVER EVER set your personal info (like  your vehicle’s registration number or your date of birth) as the password.

4. Brute Force attack:

The intruder tries every possible key combination in a password. Usually common with 4-digit PIN codes, where the intruders can try all numbers from 0000 to 9999, and one of them is going to be the right one. This process is usually computerized.

Solution:  In various locations where you require a pin to login, you can enter the incorrect PIN only for a limited number of times. This can be seen with smartphones.

5. Keylogging:

The intruder places a particular malware program on your computer, usually via email or bad software. This malware reads every key you press on the keyboard and sends them back to the intruder. So, when you type a password, the password is also sent to the intruder.

Solution: Never download software from mysterious/untrustworthy sources. Also don’t open attachments from emails which you can’t identify.

6. The “Forgot Password” option:

Intruders can always hit the “Forgot Password” found in most websites. Then, they may answer the security question you set up (if he knows you) or receive an SMS with OTP on their phone (if they stole/duplicated your phone’s SIM card.)

2. Cracking a password with access to the Database:

An intruder can steal your password if the site has poor security by stealing its log. (A “log” is a record of the processes the software goes through during an operation. This is usually saved on the disk. ) Once, Twitter users’ accounts were reported to be hacked because the usernames and passwords were stored in a log by accident. Such occurrences as rare, as the security of such sites are usually high. But this is probable very much on low end sites all the same.

3. Cracking a password with access to the Password Hash:

If you don’t know what a Password Hash is, read this.

You know that Hashes can’t be converted back to passwords. But Passwords can be Hashed.  So, how do intruders figure out your password with its Hash?

Rainbow Tables

Rainbow tables are actually tables with the most common password hashes. So, if you’re your password is rather common, or it is way too simple, it’s bound to be in some Hacker’s Rainbow Table.

To make a Rainbow Table, the Hacker types in common passwords (like “password” or “abcdefgh”) into the site, hacks into its database and steals the Hash. Then they create table with the password on one side and the Hash on the other.

To get into an account, the Hacker steals the victim’s Hash from the database and check whether the Hash is there on the Rainbow Table. If it is there, then the Hacker laughs at the victim’s foolishness and gets into their account.

SOME WORDS OF WISDOM

·       REMEMBER: NEVER EVER make your passwords easy to crack.

·       Have atleast 10 characters in your password. (6 letters, 3 digits, and 1 symbol)

·       Also, NEVER use the SAME PASSWORD in multiple places. You are giving Hackers an easy time in cracking your passwords.

·       And NEVER forget to LOG OUT of your accounts!

I hope you now know the importance of keeping complex passwords, and how easy it is to crack easy ones. Stay Alert, Stay Safe.

Cheers,

Nikhil

PS: Suggestions are always welcome. Don’t forget to Subscribe!