Passwords 101

Zimbu · #1 09-25-2005, 11:52 AM

Since our beloved forum was recently hacked, we've all become much more sensitive to security issues.. and since they originally got in by cracking the password on my account I've suddenly become a major advocate of Strong Passwords...

The hacker claimed to have gotten in using a brute force technique, which means he tried every possible password until he found the right one (using a computer program, of course). It sounds scary, but it's really not that hard to protect yourself, if you know how.

Easy to Remember = Easy to Hack
Traditionally, we've all wanted to use passwords that we can easily remember, because we're afraid of forgetting them and being locked out. Unfortunately, in this day and age of cyber-thieves, we can't afford that convenience. A password is easy to remember if it follows a pattern or if it's made of real words and phrases. Both of these attributes make them very easy to crack by a computer. Pattern matching is one of the things that computers do best, and a Dictionary Search uses lists of known words to speed up the cracking process, so real words leave you open to hacking. Like it or not, you need to use a random password.

Re-using Passwords is Suicidal
These days you need passwords for just about everything you do online, and one can quickly feel overwhelmed by all those crazy character strings. There's a strong temptation to use a single password at multiple sites, just to keep things simple. Remember, simple for you means simple for a hacker. If just one password is compromised, every account that uses that password is compromised. That's an opening the size of the Holland Tunnel, and a hacker WILL go through it. Again, it's not convenient, but you must use a unique password for every single account you create.

Short, but Not So Sweet
Another error many folks make (and a major reason why THF fell victim) is to use short passwords. Again, this is more convenient for humans, but again it's more convenient for hackers as well. In my case, I used a password that was only 6 characters long. With just lower case letters, that allows about 309 million possible passwords. Seems like a lot, but it only took 'a few hours' for the hacker to guess it. If I'd used 8 characters instead, there would have been 209 billion possible passwords.. See what a difference just adding 2 characters makes?!!

Character Symbols - The More, The Merrier
Merrier for you, not the hackers... My THF password used only lower case letters. That means there were only 26 characters available. That played into the hacker's hands by cutting down on the number of possible variations. If I'd used a mixture of upper case and lower case letters, the character set doubles in size, and instead of 309 million variations, there would have been 19.8 billion variations, even with a password only 6 characters long. Clearly there's a benefit to using a larger character set. Add in all ten available numerals (0 throuh 9) and you add even more strength to your password.

What I Did Wrong
Many, many, things... I used a short password with a small character set made of real words and re-used it for other accounts. SHAME ON ME!!! I violated every rule in the book, and unfortunately THF and its members suffered along with me. But I've learned my lesson, and now I use long, random, multi-character set passwords, and every one of them is unique. I won't say how long, but it would now take the fastest computer in the world over 30 billion years to crack my passwords using brute force!! I think that's fairly safe...

for now

**forwardone** · #2 09-26-2005, 06:05 AM

Zimbu, thanks for introducing this thread to our members. It should almost be compulsory reading, especially for the newbies among us, although it`s good for all of us to be reminded that complacency can be dangerous.

I thought I`d add some guidelines that one email provider has written on the same subject.

Quote:

To create a strong password that is easy for you to remember but hard for someone else to determine, try one of these techniques:

Merge two or more words, and combine the words with numbers and symbols. For example: Walk[My]Dog, Po#34tato, Champions=1995.
Abbreviate a phrase you'll remember. It could include numbers and symbols, or words that you can substitute with numbers or symbols. For example: I ride my bike 5 miles each Saturday could become the password Irmb5meS.
Use punctuation and numbers to combine the initials of people or objects from a familiar group, such as your favorite athletes, friends, movies, books, or historical figures. For example: Gandhi, Abraham Lincoln, and Joan of Arc could become the password 1G,2AL,JA.
Drop all vowels from a favorite saying, and then add numbers or symbols. For example: Walk three dogs could become the password Wlk3Dgs.
To be strong, a password must:

Contain at least seven, but no more than 16, characters.
Combine three of the four different types of characters:
Uppercase letters (for example: A, B, C).
Lowercase letters (for example: a, b, c).
Numerals (for example: 1, 2, 3).
Symbols (` ~ ! @ # $ % ^ & * ( ) _ + - = { } | [ ] \ : " ; ' < > ? , . /).
Not be a common word or name, or a close variation.
Some service providers require that a strong password also:

Not be the same as any of your four previous passwords.
Not be a minor variation of your old password. For example, if your old password was Champions=1995, a new password of Champions=1996 would not be acceptable.
Important

Don't use one of the above examples as your password.
Don't write down your password.
Never give out your password in an instant message conversation or share it with anyone else. You should never be prompted for your password in an e-mail.
If you have more than one e-mail account, for instance, one for work and one for personal use, you should use a different password for each account.

Because of the importance of this topic I`ll sticky it.

Zimbu · #3 09-26-2005, 03:02 PM

Good stuff, Geoff... But I still feel I should use completely random passwords for maximum security, which reminds me to add a few items to my previous post:

KeyLoggers - The Ghost in Your Machine
Having a good strong password is a great idea, but even then there's a chance that your security may be compromised without your even knowing it, and right under your nose (or more accurately, fingers..). Your passwords could be stolen by a KeyLogger program. KeyLoggers are virus or spyware style programs which hide in your computer and secretly watch you type. They gather all kinds of information, including your passwords, e-mail and home addresses, phone numbers, credit card and checking account numbers; anything you type on your keyboard can be collected then sent back to the hacker using your own internet connection.. It's obscene to be violated so, but you don't have to accept it. Firewalls and antivirus and antispyware are a must, of course.. but should a KeyLogger slip by you could still be compromised. You need another line of defense...

RoboForm = RoboCop for Your PC
RoboForm is a wonderful utility that not only protects your passwords and other sensitive information, it makes them much more convenient to use as well. With RoboForm, you don't need to type your sensitive information into login screens, order forms and the like - you just click a button and RoboForm automatically inserts the data into the proper place. That way, a KeyLogger sees nothing, and your data is secure.
As an added - and very important - benefit, RoboForm makes it easy to keep track of a large number of passwords by storing them all in encrypted files, ready to access whenever you want, just by clicking the button. When you browse to a website login screen, RoboForm recognizes the website and automatically selects the correct login information! This is exactly what we need these days when unique, long, random passwords are so important. No longer must we worry about making passwords easy to remember, RoboForm remembers them all for us! It will even generate long, twisted, random passwords whenever you need one, again at the click of a button...
There's still more, but you should go to the The RoboForm Website and see for yourself. There's a free trial version that will let you manage up to 10 passwords for about 30 days, but even the full version only costs $30, so it's well worth buying. You'll wonder how you ever lived without it!!

#4 09-26-2005, 11:41 PM

Does the RoboForm helps to fill up applet entry pages as well?

I mean those special type of fields which are generated by applet, not forms, java or html.

Zimbu · #5 09-26-2005, 11:45 PM

Quote:

Originally Posted by chaoren

Does the RoboForm helps to fill up applet entry pages as well?

I mean those special type of fields which are generated by applet, not forms, java or html.

I'm not sure, but my guess is no. It installs as a plug-in for the browser, so I suspect it only works with HTML/PHP type stuff. There might be more info on the RoboForm site, though....

Trinary · #6 09-27-2005, 12:07 AM

Nice one, Zimbu

MoneyDuck · #7 09-27-2005, 12:09 AM

Quote:

Originally Posted by chaoren

Does the RoboForm helps to fill up applet entry pages as well?

I mean those special type of fields which are generated by applet, not forms, java or html.

It does NOT work for applets or java.

Zimbu, very good information.

**forwardone** · #8 09-27-2005, 07:37 AM

A salutary tale comes from another forum where I`ve been watching a thread on a member who had his e-gold account hacked, with the loss of over $200.

Once inside his e-gold account the hacker had his way, and took complete control over it, changing security settings and so on.

The part that amazes me is that he used the same password for his e-gold account as he does for at least one HYIP he`s in. He may have also used the same p/w for his-email account, I don`t know.

If he was lax in using the same p/w the chances are he also used a `weak` password.....

Coincidence that someone hacked into his e-gold account? I doubt it. Sadly he learnt the hard way, but at least now he`s cleaned up his computer, and reset his passwords so hopefully he won`t get caught out again.

hawkman95 · #9 10-21-2005, 12:47 AM

I was wondering how often you change your passwords or would suggest others to change their passwords?

#10 10-21-2005, 06:28 PM

What I've been wondering is if Roboform stores passwords, how secure is Roboform itself?

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode