Hacker-Proof Your Password (Jennifer Waters)

22 Tháng Mười Hai 201212:00 SA(Xem: 19811)
Hacker-Proof Your Password (Jennifer Waters)

Hacker-Proof Your Password

How to create one you’ll remember, and computers won’t guess

image001_14
By Jennifer Waters 


image002_141-content 

















Yahoo! Finance/Thinkstock 
 

Don’t believe proclamations that the password is dead. Even with increasingly sophisticated software programs able to rapidly burn through an endless array of possible character combinations, the password is not only alive, but as important as ever.

“Passwords are the bane of our existence, but they’re here to stay,” says Hilary Schneider, president of LifeLock, an identity-theft protection company.

Think of the password as a mouse trap. As simplistic as it seems, there’s nothing out there more effective and straightforward for accessing sites likes your bank and favorite retailer. “A better system can be developed but it needs to be easy to use before it can have the widespread adoption to abolish the use of the password,” says Cameron Camp, a security researcher for ESET, an antivirus and Internet security provider. “If it’s not convenient, you won’t transact with the bank as much and the bank loses revenue.”

We’ve been told time and again how important it is to have tricky, unique passwords that are known to no one but ourselves. We should make them long and add numbers and symbols to fool the fraudsters combing the Internet for access to our records.

And we should always, always have different passwords for each site.

But apparently, we’re not listening very well. The annual compilations of “worst passwords ever” are numerous but remarkably similar in their results. Moreover, the top 25 or so passwords are held by an alarmingly large number of people.

If you have any one of these as your supersecret word, consider yourself a hacker’s target: password, qwerty, 123456, abc123, admin, 111111, shadow, letmein, trustno1, iloveyou, love, football, baseball, monkey, master, batman and common names like michael, jordan, even jennifer.

Why do we do it? It’s just too hard to remember so many different passwords. Our memory function doesn’t grow as our list of password-protected sites does. We want a system that will make sense to us and that we can use again and again without putting much thought into it.

“People don’t do this because they’re dumb and want to be hacked,” says Markus Jakobsson, a security-research expert and an adviser to the newly formed Council for Identity Protection. “It’s a matter of mental overload. Nobody can remember 150 passwords.”

So what we do instead is take a word, say “happy,” and add a number to it, giving us a password of “happy1.” If a password-strength checker says that’s weak, we then capitalize the first letter and add a symbol, ending up with “Happy1!”

“It’s fairly easy for the attackers to guess this,” Jakobsson says. And changing the 1 to a 2 when phishing on another bank or social site requires little extra effort.

In big breaches where passwords are stolen from major companies, hackers typically write a short computer program to sort all the passwords out. They find a number of common passwords and start applying them to random bank accounts with your name. For example, if the password on your LinkedIn account is “letmein1,” the hacker will run that password and your user name against accounts at Bank of America, Chase Bank, Citigroup and Wells Fargo, for starters — just to see if maybe you have an account there.

If that doesn’t work, they may change the password to “letmein2” and then “letmein3” and so forth.

“If a fraudster knows that one out of 10,000 people has one of these very common passwords and he does this to 10,000 people, he will get access to an account,” Jakobsson says. Remember that the bad guys aren’t physically typing your name and your lame password onto the banks sites; a software program is doing it.

Jakobsson, who has analyzed and written about the passwords of consumers whose accounts were compromised at large companies, thinks the best way to remember large numbers of passwords is to develop a system to compartmentalize them. Think of a story — say, a situation or an experience that is unforgettable — and come up with three or more words to describe it. Let’s say you were at an outdoor concert and it poured rain, creating mud puddles as big as ponds throughout the area. You slipped in the mud, face first and lost your cell phone in the process. Your password can then be “Mudcellconcert.”

Now use that password on all of your social-media sites, but mix it up with a code. For Facebook, the code could be “Red,” so your password becomes “MudcellconcertRed.” And the Twitter account code could be “Periwinkle,” so that password then is “MudcellconertPeriwinkle.”

Use different stories for different groups of accounts. Your financial accounts, for example, could be tied to a time when you mistakenly double-paid on a bill and thought you had a windfall on the account. Your password could be “TwoX$$justdumb” with the code to your bank account as “Maple” for “TwoX$$justdumbMaple,” and as “Birch” for your 401(k) account for “TwoX$$justdumbBirch.”

Jakobsson scoffs at the contention that the longer the password, the better it is, or that all passwords need numbers and symbols. It depends instead on what the contents are. A “Mudcellconcert” password is only 14 characters, compared with the 18-character “Mississippiburning.” But it is far more secure because it has more components — three vs. two — and with parts that aren’t easily associated with one another.

“Length by itself is not a surefire way to measure the strength,” he says. “A password is secure if it’s hard to guess and not common.”

There, of course, are companies like Kaspersky Password Manager, KeePass Password Safe and myLock Password Managers springing up to help you manage the myriad of passwords. They work by encrypting the data through software that’s installed on your computer or smartphone. But that will cost you.

Eventually, we’ll all have layers of password security, Camp predicts. It could be a one-time password that comes to a keychain or fob plus your own password or biometric for authentication. “It will be something you know and something you have,” he says.

Until then, come up with a story — and stick to it.

(Source: finance.yahoo.com)

 

Gửi ý kiến của bạn
Tên của bạn
Email của bạn
02 Tháng Ba 2018(Xem: 8959)
"Bên cạnh những nhân chứng còn sống, bên cạnh những lời ghi chép để lại trong lịch sử vẫn chưa đầy đủ, thì âm nhạc là nơi lưu giữ, là 1 thực thể hiển hiện rõ nhất sự thật về biến cố Mậu Thân 1968."
11 Tháng Hai 2018(Xem: 10020)
"Kế hoạch tổng tấn công của địch qui mô lớn lao như thế, chuẩn bị công phu như thế, mất nhiều ngày giờ như thế, chẳng hiểu vì lý do nào cả tình báo của Mỹ và tình báo của ta không thấy được, hoặc không thấy đủ và hiểu sai, diễn dịch sai ý đồ của địch. "
10 Tháng Hai 2018(Xem: 9681)
Khi quân Bắc Việt mở cuộc tấn công cuối cùng tiến tới thống nhất đất nước hồi 1975, hàng trăm ngàn dân thường ở miền Nam Việt Nam đã bỏ chạy. Dường như trong tâm trí nhiều người, câu chuyện về "những vụ thảm sát ở Huế" vẫn còn đậm dấu ấn.
22 Tháng Giêng 2018(Xem: 9644)
"Những phát biểu sai trái và phóng đại vẫn không ngừng tuôn ra từ tài khoản Twitter, các bài phát biểu và các cuộc phỏng vấn của ông Trump, đại đa số những tuyên bố này nhằm thỏa mãn cái tôi của ông."
21 Tháng Mười Hai 2017(Xem: 9872)
"Những người nào đã giảng dạy tại Viện tất không thể quên được hình ảnh của một vị Viện Trưởng, tuy tuổi cao, đầu bạc, nhưng cực kỳ nhũn nhặn và khéo léo. Chưa từng để mất lòng ai." (Gs Nguyễn Cao Hách)
SINH HOẠT
MINH XÁC QUAN ĐIỂM
- Website do một ít Thụ Nhân chung sức, dù rộng mở đến tất cả đồng môn trong tình thân hữu, nhưng không nhân danh hay đại diện tập thể nào.

- Quan điểm của bài viết trong Diễn Đàn là của cá nhân tác giả, không hẳn phản ánh quan điểm chung của Ban Biên Tập và những người tham gia Diễn Đàn.
KHÁCH THĂM VIẾNG
99,468