Keeping Your Passwords Secure

A password is a key to a digital lock, and if it's worth putting a lock on it, it’s worth someone unscrupulous trying to get hold of it. If someone wants to steal whatever you’re keeping under lock and key, the best way to do that would be to grab the keys.

There are a variety of ways in which hackers and scammers might try to steal passwords and gain access to the accounts and systems they protect, and today we’re going to look at what they are and how to protect yourself from them.

Brute Force Attacks

Hacking is an activity that involves long stretches of nothing occasionally punctuated by brief moments of excitement as a hack succeeds. This is because a lot of hacking attempts are automated, they’re a computer crunching numbers for hours at a time hoping to find something useful.

The most primitive of these automated attacks is the Brute Force Attack. This is exactly what it sounds like. Hackers will take the most powerful computer they can get a hold of and have it make millions of guesses at a password until it gets it right.

These guesses incorporate every possible combination of letters, numbers, capitals, and symbols. If allowed to run for long enough, it will eventually find the correct combination to any password through sheer probability.

A more powerful computer can make more guesses quicker, meaning these attacks are actually growing more dangerous as computers evolve.

The best way to defend yourself against brute force attacks is to have a long password, more characters means more combinations that have to be guessed. Any password of under 8 characters can be cracked by today’s computers disturbingly quickly, and they don’t become super secure until they reach 12 characters.

Brute Force Attacks are also the reason every website in the world requires you to include numbers and symbols in your passwords. Each additional set of characters you add complicates the guessing process.

Dictionary Attacks

That’s automated attacks at their most basic, but what happens if we get a little more sophisticated? What you then end up with is a Dictionary Attack.

A dictionary gives up the thoroughness of the brute force approach in order to achieve results a lot faster. The computer will try word after word attempting to find the one you’ve used as your password. 

The solution to this is to add numbers, symbols, and capitals in places that make it impossible for the computer to guess. While it’s a lot faster than brute force if the target password is only a single word, using anything but one normal word allows you to immunise yourself against these attacks.

Phishing and Spear Phishing

Phishing is another attack that is often automated, except here it’s to be able to hit more targets at once.

Phishing is most commonly executed via email or phone call, usually using pre recorded messages and template emails. Hackers will contact victims claiming to be from their bank, telco, the ATO, or some other business or government department.

They’ll spin a story to attempt to “hook” you. It’ll be about how your account has been hacked, or overdrawn, or you owe taxes you’re about to be arrested over, before offering a solution. That solution is usually to follow a link they provide, which then takes you to a fake website they hope looks enough like the real thing that you’ll be fooled into entering your password.

If you do, they now have everything they need to go to the real Site, access your account, and wreak whatever havoc they have in mind.

To keep yourself safe from phishing, never click on links in emails, and keep a sharp eye out for inconsistencies. Most phishing emails will avoid providing too many specifics, for fear of saying the wrong thing. 

The more sophisticated spear phishing however will provide more targeted details in an attempt to fool you, don’t be taken in.

Social Engineering

The weakest part of any digital system is often the people using it, and hackers know this. This is where Social Engineering comes in, the act of taking advantage of that weakness.

Being forewarned about the ways in which hackers and scammers can exploit the unwary is the best way to avoid falling prey to them, so make sure you and your team are educated.

Don’t share your passwords, don’t recycle your passwords, and NEVER record them in a digital document. If you must write them down physically, keep that note hidden away, preferably under lock and key. Make sure everyone can recognise the signs of a phishing attempt, and that their passwords are sufficiently long and complex.

Investigate adding two factor authentication to all your important accounts, like bank accounts. This means anyone attempting to log in to those accounts will need both your password and your mobile phone.

Avoiding Social Engineering is all about doing a little work now to avoid a lot of pain later.

A secure password is essential to a secure account, keep yours locked up tight and be on the lookout for scammers.