If your password is short and/or only uses words, then you are an easy target.
My clients often ask me, ‘Why would they want to hack my website, my email or social network account?’ Here are the reasons.
‘They’, in this article, refers to the hackers.
They want to hack your website to use the mail server to send anonymous spam.
They want to hack your website to add links on pages to their dodgy products.
They want to use your email account to send spam, to find out more information about you, like the bank you use, your date of birth, your mother’s maiden name, etc.
They want to use your username and password combination from one account login to try to log in to another unrelated service.
They want to reset your bank password by using your recovery email address so that they can then log in and take all your money.
They want to pretend to be you on Facebook, to then message your friends and try and scam your friends, acting like you.
If you can’t see the reasons why someone may benefit from hacking your account, then ask yourself, “Why is there a password in the 1st place?”
There are many reasons, even if they are not immediately obvious.
How to create a good, safe password
1. Make your password long
You are not fighting against a person. A person who you think is never going to guess the combination of your dog’s name and the year you were born. Because how would they know, how could they guess that? They don’t know this information!
You are fighting against a machine, a computer. A machine that can try every combination of numbers, letters and symbols and is VERY fast.
So a long password is safer. Any 8-character combination can be cracked by brute force, very quickly.
Once the hacker has tried every 8-character combination, it then moves on to 9 characters, then 10, then 11-character combinations and so on. Each extra character makes things a lot harder for the hacker.
2. Make your password easy for you to remember
‘thisismyveryhardpassword’ is better than a single dictionary word plus a number (e.g. Arsenal67), simply because it’s longer. Both are as easy to remember for a human.
3. Use upper case, lower case & numbers
‘THISismyveryhardpassword7’ is better, but it’s still easy for a human to remember but hard for the hacker.
4. Don’t put the numbers at the end
The ‘word’ then ‘number’ combination is a known method to hackers, so try the numbers in the middle somewhere like ‘THISismyvery7hardpassword’
5. Use some symbols
‘THIS!ismyvery7hardpassword’ is getting to the point where the hacker has no chance.
6. break a word
‘TH-IS!ismyvery7hardpassword’ really is getting to the point where the hacker has no chance as you have stopped simply using whole words, which hackers often try.
Obviously, don’t use the above password; it’s just an example. Think of something easy for YOU to remember. Then mix it up a bit, swap letters, add numbers, etc. You need an easy method for you, but a hard method for the hacker.
Then test it using https://howsecureismypassword.net/.
And then test your old one! You will be surprised and horrified.
Dictionary & Brute Force attack methods used to crack passwords:
These are ways that the hacker tries to guess your password using commonly known methods.
The hacker has a list to save time. They will go through the list as follows…
- Is the password a single word from the dictionary? Why not try them all, one by one? It won’t take long. There are only 171,476 words in the English language.
- Is the password in the top 10000 commonly used passwords? Why not try them all? It won’t take long. 30% of all passwords are in the top 10000.
- Is it a word number combination? Why not try them all? It won’t take long.
- Is it 8 characters or fewer because EVERY (yes, every) combination of 8 characters (upper/lower/symbols every combination) can be tried in a few hours. Why not try them all? It won’t take long.
If your password falls into one of the above categories, you should think about changing your password.
Don’t be consistent
NEVER use the same combination of email address and password (no matter how hard you make the password) for different logins and websites.
The same combination is the Achilles Heel of all logins.
Just imagine that your username and password combination are stored somewhere. Stored in a database of an old website you once signed up to, many years ago. Then imagine that the site gets hacked and they obtain all the logins.
The hackers now have loads of logins, and these logins are known pairs of information. The hacker will then try these pairs of usernames and passwords on Facebook, Google, Twitter, Hotmail, PayPal, EVERYWHERE, and once they get into any of these, the ball is rolling, and they can do a lot of damage.
FORGET ALL OF THE ABOVE…
Use a Password Manager
Download a password manager. Create an account. Make the password hard. Let the password manager change all your existing passwords to new 30-character randomly generated passwords. Forget all other passwords except the one you use to log in to the password manager.
I use BitWarden, it’s great. I know ONE password; LastPass knows the others. I don’t care what the others are, they are all uncrackable. If I need to, I can reset any password.
Use 2 Factor Authentication
2 Factor Authentication (2FA) is an extra layer of security used to make sure that people trying to gain access to an online account are who they say they are.
You will need to enter your username and password. If this is correct, another layer of security will need to be passed.
This can be something you know, like a pin number or an answer to a secret question. It could be something you have, like the payment card you are using, a card reader or your mobile phone.
Using 2FA, if your password is stolen, then the chances of someone else knowing the additional information is highly unlikely.
Good Luck. You may not need it, but it’s better to know your options.
