Hacker-Proof Your Password (Jennifer Waters)

22 Tháng Mười Hai 201212:00 SA(Xem: 16699)
Hacker-Proof Your Password (Jennifer Waters)

Hacker-Proof Your Password

How to create one you’ll remember, and computers won’t guess

By Jennifer Waters 


Yahoo! Finance/Thinkstock 

Don’t believe proclamations that the password is dead. Even with increasingly sophisticated software programs able to rapidly burn through an endless array of possible character combinations, the password is not only alive, but as important as ever.

“Passwords are the bane of our existence, but they’re here to stay,” says Hilary Schneider, president of LifeLock, an identity-theft protection company.

Think of the password as a mouse trap. As simplistic as it seems, there’s nothing out there more effective and straightforward for accessing sites likes your bank and favorite retailer. “A better system can be developed but it needs to be easy to use before it can have the widespread adoption to abolish the use of the password,” says Cameron Camp, a security researcher for ESET, an antivirus and Internet security provider. “If it’s not convenient, you won’t transact with the bank as much and the bank loses revenue.”

We’ve been told time and again how important it is to have tricky, unique passwords that are known to no one but ourselves. We should make them long and add numbers and symbols to fool the fraudsters combing the Internet for access to our records.

And we should always, always have different passwords for each site.

But apparently, we’re not listening very well. The annual compilations of “worst passwords ever” are numerous but remarkably similar in their results. Moreover, the top 25 or so passwords are held by an alarmingly large number of people.

If you have any one of these as your supersecret word, consider yourself a hacker’s target: password, qwerty, 123456, abc123, admin, 111111, shadow, letmein, trustno1, iloveyou, love, football, baseball, monkey, master, batman and common names like michael, jordan, even jennifer.

Why do we do it? It’s just too hard to remember so many different passwords. Our memory function doesn’t grow as our list of password-protected sites does. We want a system that will make sense to us and that we can use again and again without putting much thought into it.

“People don’t do this because they’re dumb and want to be hacked,” says Markus Jakobsson, a security-research expert and an adviser to the newly formed Council for Identity Protection. “It’s a matter of mental overload. Nobody can remember 150 passwords.”

So what we do instead is take a word, say “happy,” and add a number to it, giving us a password of “happy1.” If a password-strength checker says that’s weak, we then capitalize the first letter and add a symbol, ending up with “Happy1!”

“It’s fairly easy for the attackers to guess this,” Jakobsson says. And changing the 1 to a 2 when phishing on another bank or social site requires little extra effort.

In big breaches where passwords are stolen from major companies, hackers typically write a short computer program to sort all the passwords out. They find a number of common passwords and start applying them to random bank accounts with your name. For example, if the password on your LinkedIn account is “letmein1,” the hacker will run that password and your user name against accounts at Bank of America, Chase Bank, Citigroup and Wells Fargo, for starters — just to see if maybe you have an account there.

If that doesn’t work, they may change the password to “letmein2” and then “letmein3” and so forth.

“If a fraudster knows that one out of 10,000 people has one of these very common passwords and he does this to 10,000 people, he will get access to an account,” Jakobsson says. Remember that the bad guys aren’t physically typing your name and your lame password onto the banks sites; a software program is doing it.

Jakobsson, who has analyzed and written about the passwords of consumers whose accounts were compromised at large companies, thinks the best way to remember large numbers of passwords is to develop a system to compartmentalize them. Think of a story — say, a situation or an experience that is unforgettable — and come up with three or more words to describe it. Let’s say you were at an outdoor concert and it poured rain, creating mud puddles as big as ponds throughout the area. You slipped in the mud, face first and lost your cell phone in the process. Your password can then be “Mudcellconcert.”

Now use that password on all of your social-media sites, but mix it up with a code. For Facebook, the code could be “Red,” so your password becomes “MudcellconcertRed.” And the Twitter account code could be “Periwinkle,” so that password then is “MudcellconertPeriwinkle.”

Use different stories for different groups of accounts. Your financial accounts, for example, could be tied to a time when you mistakenly double-paid on a bill and thought you had a windfall on the account. Your password could be “TwoX$$justdumb” with the code to your bank account as “Maple” for “TwoX$$justdumbMaple,” and as “Birch” for your 401(k) account for “TwoX$$justdumbBirch.”

Jakobsson scoffs at the contention that the longer the password, the better it is, or that all passwords need numbers and symbols. It depends instead on what the contents are. A “Mudcellconcert” password is only 14 characters, compared with the 18-character “Mississippiburning.” But it is far more secure because it has more components — three vs. two — and with parts that aren’t easily associated with one another.

“Length by itself is not a surefire way to measure the strength,” he says. “A password is secure if it’s hard to guess and not common.”

There, of course, are companies like Kaspersky Password Manager, KeePass Password Safe and myLock Password Managers springing up to help you manage the myriad of passwords. They work by encrypting the data through software that’s installed on your computer or smartphone. But that will cost you.

Eventually, we’ll all have layers of password security, Camp predicts. It could be a one-time password that comes to a keychain or fob plus your own password or biometric for authentication. “It will be something you know and something you have,” he says.

Until then, come up with a story — and stick to it.

(Source: finance.yahoo.com)


Gửi ý kiến của bạn
Tên của bạn
Email của bạn
03 Tháng Mười Hai 2021(Xem: 51)
"Hằng năm, vào thứ sáu sau ngày Thanksgiving, hội sinh viên công giáo người Mỹ gốc Việt miền Nam Caliornia đón chào những người vô gia cư tại nhà thờ tin lành Saint Anselm ở thành phố Garden Grove, vùng Little Saigon, để chia sẻ bữa tiệc thân mật trong không khí văn nghệ vui nhộn."
05 Tháng Mười 2021(Xem: 776)
"Đại sứ Ted Osius hồi tưởng: "Việc giúp có cuộc gặp của ông Trọng và Tổng thống Obama là thành tựu quan trọng nhất trong nhiệm kỳ của tôi. Chuyến thăm của tổng thống đến Việt Nam năm 2016 cũng quan trọng nhưng sẽ không đầy đủ, ý nghĩa nếu ông Trọng đã không thăm Mỹ trước."
23 Tháng Năm 2018(Xem: 11312)
"Nhận định rằng bộ luật này "chứa đựng những điều khoản đi ngược lại với những cam kết của Công ước Quốc tế về các Quyền Dân sự và Chính trị (ICCPR) mà Việt Nam đã ký", thông cáo của Liên hiệp quốc giải thích những điều khiến họ quan ngại”
23 Tháng Năm 2018(Xem: 12177)
"Vụ án Vũ “nhôm” được xem là một đại án về tình trạng lũng đoạn của bộ máy nhà nước, liên quan đến rất nhiều người, trong đó có cả sự tiếp tay của Tổng cục Tình báo, thuộc Bộ Công an, cho đến các quan chức lãnh đạo ở địa phương và báo chí."
23 Tháng Năm 2018(Xem: 11430)
"Khi chính quyền không thành công trong việc mang lại cuộc sống thịnh vượng cho dân chúng bằng thể chế và chính sách tốt, họ sẽ tìm cách thổi phồng thành tích hoặc thổi phồng lòng tự hào để dân chúng cảm thấy yêu nước hơn."
08 Tháng Năm 2018(Xem: 7099)
"Niềm hy vọng còn lại chỉ mong ở sự kết hợp của hai thế hệ trẻ rường cột trong và ngoài nước, như đã nói ở trên."
- Website do một ít Thụ Nhân chung sức, dù rộng mở đến tất cả đồng môn trong tình thân hữu, nhưng không nhân danh hay đại diện tập thể nào.

- Quan điểm của bài viết trong Diễn Đàn là của cá nhân tác giả, không hẳn phản ánh quan điểm chung của Ban Biên Tập và những người tham gia Diễn Đàn.