Hacker-Proof Your Password (Jennifer Waters)

22 Tháng Mười Hai 201212:00 SA(Xem: 19809)
Hacker-Proof Your Password (Jennifer Waters)

Hacker-Proof Your Password

How to create one you’ll remember, and computers won’t guess

image001_14
By Jennifer Waters 


image002_141-content 

















Yahoo! Finance/Thinkstock 
 

Don’t believe proclamations that the password is dead. Even with increasingly sophisticated software programs able to rapidly burn through an endless array of possible character combinations, the password is not only alive, but as important as ever.

“Passwords are the bane of our existence, but they’re here to stay,” says Hilary Schneider, president of LifeLock, an identity-theft protection company.

Think of the password as a mouse trap. As simplistic as it seems, there’s nothing out there more effective and straightforward for accessing sites likes your bank and favorite retailer. “A better system can be developed but it needs to be easy to use before it can have the widespread adoption to abolish the use of the password,” says Cameron Camp, a security researcher for ESET, an antivirus and Internet security provider. “If it’s not convenient, you won’t transact with the bank as much and the bank loses revenue.”

We’ve been told time and again how important it is to have tricky, unique passwords that are known to no one but ourselves. We should make them long and add numbers and symbols to fool the fraudsters combing the Internet for access to our records.

And we should always, always have different passwords for each site.

But apparently, we’re not listening very well. The annual compilations of “worst passwords ever” are numerous but remarkably similar in their results. Moreover, the top 25 or so passwords are held by an alarmingly large number of people.

If you have any one of these as your supersecret word, consider yourself a hacker’s target: password, qwerty, 123456, abc123, admin, 111111, shadow, letmein, trustno1, iloveyou, love, football, baseball, monkey, master, batman and common names like michael, jordan, even jennifer.

Why do we do it? It’s just too hard to remember so many different passwords. Our memory function doesn’t grow as our list of password-protected sites does. We want a system that will make sense to us and that we can use again and again without putting much thought into it.

“People don’t do this because they’re dumb and want to be hacked,” says Markus Jakobsson, a security-research expert and an adviser to the newly formed Council for Identity Protection. “It’s a matter of mental overload. Nobody can remember 150 passwords.”

So what we do instead is take a word, say “happy,” and add a number to it, giving us a password of “happy1.” If a password-strength checker says that’s weak, we then capitalize the first letter and add a symbol, ending up with “Happy1!”

“It’s fairly easy for the attackers to guess this,” Jakobsson says. And changing the 1 to a 2 when phishing on another bank or social site requires little extra effort.

In big breaches where passwords are stolen from major companies, hackers typically write a short computer program to sort all the passwords out. They find a number of common passwords and start applying them to random bank accounts with your name. For example, if the password on your LinkedIn account is “letmein1,” the hacker will run that password and your user name against accounts at Bank of America, Chase Bank, Citigroup and Wells Fargo, for starters — just to see if maybe you have an account there.

If that doesn’t work, they may change the password to “letmein2” and then “letmein3” and so forth.

“If a fraudster knows that one out of 10,000 people has one of these very common passwords and he does this to 10,000 people, he will get access to an account,” Jakobsson says. Remember that the bad guys aren’t physically typing your name and your lame password onto the banks sites; a software program is doing it.

Jakobsson, who has analyzed and written about the passwords of consumers whose accounts were compromised at large companies, thinks the best way to remember large numbers of passwords is to develop a system to compartmentalize them. Think of a story — say, a situation or an experience that is unforgettable — and come up with three or more words to describe it. Let’s say you were at an outdoor concert and it poured rain, creating mud puddles as big as ponds throughout the area. You slipped in the mud, face first and lost your cell phone in the process. Your password can then be “Mudcellconcert.”

Now use that password on all of your social-media sites, but mix it up with a code. For Facebook, the code could be “Red,” so your password becomes “MudcellconcertRed.” And the Twitter account code could be “Periwinkle,” so that password then is “MudcellconertPeriwinkle.”

Use different stories for different groups of accounts. Your financial accounts, for example, could be tied to a time when you mistakenly double-paid on a bill and thought you had a windfall on the account. Your password could be “TwoX$$justdumb” with the code to your bank account as “Maple” for “TwoX$$justdumbMaple,” and as “Birch” for your 401(k) account for “TwoX$$justdumbBirch.”

Jakobsson scoffs at the contention that the longer the password, the better it is, or that all passwords need numbers and symbols. It depends instead on what the contents are. A “Mudcellconcert” password is only 14 characters, compared with the 18-character “Mississippiburning.” But it is far more secure because it has more components — three vs. two — and with parts that aren’t easily associated with one another.

“Length by itself is not a surefire way to measure the strength,” he says. “A password is secure if it’s hard to guess and not common.”

There, of course, are companies like Kaspersky Password Manager, KeePass Password Safe and myLock Password Managers springing up to help you manage the myriad of passwords. They work by encrypting the data through software that’s installed on your computer or smartphone. But that will cost you.

Eventually, we’ll all have layers of password security, Camp predicts. It could be a one-time password that comes to a keychain or fob plus your own password or biometric for authentication. “It will be something you know and something you have,” he says.

Until then, come up with a story — and stick to it.

(Source: finance.yahoo.com)

 

Gửi ý kiến của bạn
Tên của bạn
Email của bạn
16 Tháng Sáu 2011(Xem: 30021)
Rõ ràng là Việt Nam không thẻ chống Trung Cộng nếu Việt Nam vẫn cứ tiếp tục duy trì guồng máy tham nhũng và chỉ biết lợi dụng thế cờ mâu thuẫn chiến lược giữa các siêu cường quốc để sống còn.
30 Tháng Năm 2011(Xem: 29642)
So vũ khí, thì kẻ nhược người cường, Đọ trái tim, coi ai gang ai sắt?
19 Tháng Tư 2011(Xem: 30522)
Cảm ơn anh gửi lên bài viết  Kể chuyện về một lá Cờ Vàng Tôi cũng đã… mắt nhòa, môi mặn khi nghe lời hát cũ lừng vang.
19 Tháng Tư 2011(Xem: 31345)
Thắp nén nhang tịnh độ, Hồn thiêng cõi thanh cao.
19 Tháng Tư 2011(Xem: 35492)
- Lời Cô Giáo Dạy Trẻ Nhạc : Bảo Tố Giọng ca : Bích Ngọc - Em Bé Việt Nam và Viên Sỏi (Vietnamese Baby and Gravel) Thơ : Trần Trung Đạo Phổ nhạc: Phan Văn Hưng
19 Tháng Tư 2011(Xem: 30931)
Lời Cô Giáo Dạy Trẻ Nhạc : Bảo Tố  Giọng ca : Bích Ngọc
19 Tháng Tư 2011(Xem: 32708)
Hình ảnh những ngày cuối tháng 4 ở Saigon vẫn chưa phai nhòa trong tâm trí. Không gian là mây đen, thời gian màu tím ngắt.
19 Tháng Tư 2011(Xem: 36147)
Dù có đôi khuyết điểm và giá bán hơi cao, Boat People là công trình sưu tầm tài liệu đáng khen của Carina Hoang về thảm trạng thuyền nhân ...
19 Tháng Tư 2011(Xem: 32603)
Thơ : Trần Trung Đạo  Phổ nhạc : Phan Văn Hưng
19 Tháng Tư 2011(Xem: 34336)
Sống Sót Trên Sóng Biển - The Lucky Few The Story of USS Kirk
SINH HOẠT
MINH XÁC QUAN ĐIỂM
- Website do một ít Thụ Nhân chung sức, dù rộng mở đến tất cả đồng môn trong tình thân hữu, nhưng không nhân danh hay đại diện tập thể nào.

- Quan điểm của bài viết trong Diễn Đàn là của cá nhân tác giả, không hẳn phản ánh quan điểm chung của Ban Biên Tập và những người tham gia Diễn Đàn.
KHÁCH THĂM VIẾNG
99,468