Are your passwords as strong as they can be? For many users, self-created passwords are not nearly as secure as they should be.
Trustwave, a Chicago-based information security firm, recently revealed that a massive security breach compromised nearly 2 million websites and social media accounts in more than 100 countries.
In the breach, 1.58 million website login credentials and 320,000 email account credentials were stolen, including those of Facebook, Google, Twitter, LinkedIn and Yahoo. Payroll service provider ADP was also affected.
Although the breach was likely due to malware installed on individual computers, the report also analyzed the stolen passwords and found that many users have become careless when creating passwords. Despite best practices and security advice frequently provided by account providers, the top two stolen passwords are “123456” and “123456789,” the report states. Furthermore, thousands of people are still using similarly simple passwords, such as “password” and “admin.”
When it comes to password strength, the report found that only 5 percent of stolen passwords were classified as “excellent.” While 44 percent of passwords were considered to be of medium strength, at 34 percent were considered weak passwords.
Creating stronger passwords, however, isn't rocket science. Here are five tricks to making safer, more secure passwords to better protect private accounts.
1. Be unique — avoid recycling passwords
“Never reuse the same password for multiple accounts,” saidDodi Glenn, senior director of security intelligence and research labs atThreatTrack Security, a malware analysis and anti-virus software company. “It's a bad habit to get into.”
Although it's easier to use the same password for several accounts, the convenience can result in exponentially more damage if compromised, Glenn said.
“For example, if malware records only Gmail account information, but the same password is used across a variety of sensitive sites, such as an online banking or retail site, cybercriminals can easily hack into all accounts and obtain personally identifiable information (PII) for nefarious purposes,” he said.
To keep track of passwords, Eduard Goodman, chief privacy officer at Identity Theft 911, wrote in a blog post that users should store passwords in a secure place. Goodman recommends password managers such as PasswordBox, LastPass and RoboForm.
2. Be creative — use uncommon, nonsensical combinations
While using the names of loved ones, pets, favorite sports teams and other personal details may help users remember their passwords, doing so also makes it easier for hackers to access their accounts.
“We may think we are clever, but with the billions of password users on the planet, the likelihood is someone has come up with the combination before,” said Tom Smith, vice president of Identity and Access at Gemalto, a digital security provider.
Due to the rise in security breaches over the last few years —most notably Adobe and Facebook hacks in 2013 — millions of passwords are available in databases for criminals to leverage in cyberattacks, Smith said.
“This type of attack is referred to as a ‘Dictionary Attack,' or an attack where a password is searched systematically against all other passwords in a ‘dictionary' or specified list of existing passwords,” Smith said. Because these passwords are derived from past breaches, using them increases the likelihood of the so-called “unique” password being compromised once again, he said.
To come up with more creative passwords, Goodman advised users to “shake things up a bit.” One way to do so, he wrote, is to combine upper- and lowercase letters, numbers and symbols. For instance, users can turn a simple password like “happy777” into a stronger one like “H@pea!931.” Another way is to take a lyric, line or saying and shorten it into an acronym, such as turning “‘Twas the night before Christmas and all through the house” into “TtnbCaatth.”
3. Be lengthy — make your passwords long
Most services require a password that is at least eight characters long. In reality, users will need more than that to have a truly secure password.
“The longer the password, the harder it is and longer it takes cybercriminals to crack the password,” Smith said. “The typical rule of thumb has been eight characters, [but] this is no longer sufficient. As with all things in the realm of technology, password-cracking programs have become faster, and some boast the ability to make 350 billion guesses per second, which means they can crack an 8-character password in seconds. For users to protect themselves, experts now recommend passwords containing at least 13 to 20 characters.”
Read more: How to Create a Strong Password
