Passwords: Tips For Better Security

You can make your passwords more secure if you follow a few simple rules: Dont reuse passwords, make them long and random, and dont be afraid to write them down, say security experts.

Strategic Security Survey: Global Threat, Local Pain(click image for larger view and for full slideshow)
How safe are your passwords?
The LulzSec hacking group may have
ceased its 50-day hacking spree
, meaning that users of InfraGard, the U.S. Senate, and Sony websites, among others, can sleep more soundly at night. But people shouldnt let the apparent cessation of the latest laugh-seeking hacking campaign lull them into a false sense of security.
Theres a growing body of evidence--based on numerous LulzSec exploits, last years hack of Gawker, even a 10-year-old study of the password-picking habits of Unix users--that people prefer
short, non-random, and therefore unsafe passwords
. They also tend to reuse those same passwords across multiple sites. The underlying rationale is clear: it makes passwords easier to use.
Unfortunately, it also makes for poor security. For example, look at one of LulzSecs attacks against the Atlanta branch of FBI affiliate InfraGard, in which the hackers stole members username and password combinations. Those credentials then allowed LulzSec to
gain access
to Atlanta InfraGard member Karim Hijazis business and personal Gmail accounts. Hijazi is a somewhat controversial security consultant who is CEO and president of botnet monitoring startup firm Unveillance. But even he reused his passwords.
Password reuse, however, isnt the only issue. Another threat is that attackers will gain access to a websites password database and steal a copy. At that point, even if the database is encrypted, attackers can hammer away at it offline, using a tool such as Password Recovery Toolkit from AccessData to crack it in relatively little time. Processing power is no object. Indeed, researchers at Georgia Tech have tapped the graphics cards built into PCs to
crack even hashed passwords
with fewer than 12 characters, in short order.
Not coincidentally, the Georgia Tech researchers recommend using passwords that are at least 12 characters long, and which mix letters, numbers, and symbols. But whos going to remember a unique, randomized (aka highly entropic) 12-character password for every semi-critical website they use?
Thankfully, options abound for creating long and strong passwords. For example, people can use pass phrases--sentences, really--instead of passwords. Another option, meanwhile, is to build passwords using some kind of predetermined logic. The password mniE, for example, would be short for my name is Earl. (Ideally, of course, the password would be much longer.) Proponents of this approach often recommend using a variation that builds in the name of the website, so that one password can be altered to address various other websites. For Amazon.com, for example, the variation could be mAMAniE.
Despite the potential security improvement, according to Jesper M. Johansson, formerly the security program manager at Microsoft, and now the principal security architect at Amazon.com, its unclear if many people
bother to use pass phrases
. Furthermore, based on some rough estimates, he said that its likely that a person would need to use a six-word pass phrase--which is starting to get clunky--to attain the same level of entropy as a nine-character password. Finally, reusing parts of passwords across different websites means that attackers who steal username and password combinations might be able to reverse-engineer the logic.
(click image for larger view)
Slideshow: 10 Massive Security Breaches
Accordingly, the simplest and easiest way to increase password security might simply be to write passwords down, albeit preferably in a highly secure manner. The best investment you can make is to go out and get a [digital] wallet to keep your passwords in, said Thomas Kristensen, chief security officer of Secunia, a vulnerability information provider, in an interview. To reuse your password on different sites is just the worst thing you can do. Look at all of the compromises of websites this year--theres the risk that theyll lose your account, and once your password is out there and associated with your email address, you probably wont know its been stolen until theyve heisted something.
Another advantage of digital password wallets is that the software not only makes it easy to store passwords, but also to generate a strong, highly random password. That makes it trivial to maintain a different password for each and every website used. Accordingly, the next time hackers crack a Sony password database, even if it contains your username and password, hackers wont be able exploit that combination anywhere else.
Digital password wallets, however, do mean one more piece of software to download, install, and use. Its a nuisance, I know, said Kristensen, whos been using an open source application called
KeePass
for 10 years. But he said that using digital password wallets is simply a best practice. Its not the perfect solution, but its much better than reusing passwords.
When it comes to password management software that stores passwords securely, there are numerous options. For example, Bruce Schneier, chief security technology officer at BT, created PasswordSafe, an easy-to-use, open source password database for Windows. Such software is also available for the Apple OS X (for example, shareware
PasswordWallet
, which also works for Windows). Another option, the aforementioned KeePass, runs on both of those operating systems, as well as Linux.
Furthermore, many password wallets will synchronize passwords between your computer and mobile devices, meaning you can always carry a secure, password-protected copy of your passwords and PIN codes with you. (For the record, peoples
PIN-picking practices
are arguably even poorer than their password selection habits.)
To recap: secure passwords by creating a unique and random, long and strong password for every website that matters. Then keep these passwords secure by storing them in a digital safe. Do that, and dont fear the next LulzSec.
Small and midsize businesses are falling prey to cyberattacks that cost them sensitive data, productivity, and corporate accounts cleaned out by sophisticated banking Trojans. In this report, we explain what makes these threats so menacing, and share best practices to defend against them.
Download it now
. (Free registration required.)

Last News
▸ Website hacks happened during World Cup final. ◂ Discovered: 23/12/2024 Category: security	▸ Criminal Possession of Government-Grade Stealth Malware ◂ Discovered: 23/12/2024 Category: security	▸ Senate wants changes to cybercrime law. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Passwords: Tips For Better Security