Improve your passwords now! Understand the risks, take action and create excellent passwords

Cyber Criminals: What we are up against.

How are passwords cracked and accounts hacked?

Brute Force

A brute force attack is as it sounds. Once one computer can attach itself to another ie via a login screen, an API or other method it can (in theory) keep attacking the login area and trying multiple usernames and passwords over and over again.

In reality, there are rate limiters in place, that all too familiar “too many failed login attempts, you must wait 5 minutes” message but that isn’t always true. 

Your average medium-powered business computer is capable of running 40 Billion operations per second.  That’s just one, one single computer capable of trying 40 Billion options a second. So let’s assume for a second there is just one computer trying to attack ours.

How long would it take to crack?

5 years you say. Great! Nope….

This is assuming just one computer. You could go to Digital Ocean or Amazon AWS right now and buy 100 computers and have them running in 20 minutes and it would cost less to run them than buying a computer

A password that took 1821 days (5 years) with1 computer now takes 18 days.

And this is exactly how viruses are designed to work. Infecting millions of computers at a global level then turning them against systems to work as a unified code-breaking machine with trillions and trillions of processes per second.

Then there is the fact that every year computers get more powerful.  Moore’s Law refers to Gordon Moore’s (CEO and Co-Founder of Intel) perception that the number of transistors on a microchip doubles every two years, though the cost of computers is halved. Moore’s Law states that we can expect the speed and capability of our computers to increase every couple of years, and we will pay less for them.  

Have you been making your passwords twice as hard to crack each year?

Phishing & Spear Phishing

Unlike brute force attacks Phishing and Spear Phishing is more sneaky and tactical. Phishing attempts to get users to submit their credentials into a system that is under the attacker’s control. The most familiar of these are emails from your bank or service provider asking you to log in for a security message or urgent action.

Sometimes these emails, texts, phone calls can be more targeted (Spear Phishing). They may already know something about you or your company such as a Director’s name or employees personal email address.

A common Spear phishing tactic is to find the Managing Directors name and email then spoof the email address whilst messaging the accounts department asking them to pay somebody urgently.  For this reason its important to have an internal system of approving payments.

Phishing and Spear Phishing can be easier to avoid by not sharing your credentials or trusting messages asking to enter or re-enter credentials.

If you believe it is true then go directly to the website or system in question, without following a link and when you log in you will see any actions you need to take. 

Data breaches and leaks

Vigilante has records showing there have been 4,522 reported breaches with almost 4.5 billion records exposed. This means hackers have a vast library of passwords to try.

Passwords that would be secure under brute force can be hacked almost instantly and to make matters worse the passwords are usually linked to email accounts. Many people use the same passwords across their email accounts as well as their systems which means that once they are in your email they can reset all of your passwords and lock you out or gain access to anything else they can detect.

And…becase they have your email address they can utilise Spear Fishing tactics.

“Hey, Jon. The password “mrbiggles” you use to login with your account at Amazon.com with email address mrjonbiggles@email.com has expired. Click here to reset it”

They know my name, they now my password, they know my email address. It must be real!!! Wrong. You are being redirected to a fake website that is gathering more information or collecting your new password.

Passwords you should not use

These are the top 25 passwords that are used. They are the first to be tried and are cracked instantly. You should NEVER use anything on this list.

1. 123456
2. password
3. 12345678
4. qwerty
5. 12345
6. 123456789
7. letmein
8. 1234567
9. football
10. iloveyou
11. admin
12. welcome
13. monkey
14. login
15. abc123
16. starwars
17. 123123
18. dragon
19. passw0rd
20. master
21. hello
22. freedom
23. whatever
24. qazwsx
25. trustno1

How to be awesome at passwords

Now we understand the types of attacks, how hackers use our information and what not to do let’s take a look at how we can secure ourselves without making life difficult.

Creating secure passwords

• We’ve seen that a 10 character password is insecure. 
• We know that computers can be combined into code-breaking machines.
• We also know there are roughly 7 billion people in the world and that there are approximately 3 devices per person (Tech Crunch).
• So we need a password that if all the computers in the world combined forces to try and hack it, they couldn’t.

32 characters are the optimum

Here is a 32 character password generated by our password management tool Lastpass Z@Xv180s!xmbsAvfurcbyPr5CjGF%Q

But what about if you don’t have a password management system that remembers complex passwords and types them for you?

*Z@Xv180s!xmbsAvfurcb*yPr5CjGF%Qmay be practically impossible to be cracked, however, it is also practically impossible to be remembered

Password length is the key

• tkccslgf – 5 seconds
• tkccslgftkccslgf – 35,000 years
• tkccslgftkccslgftkccslgftkccslgf – 2 octillion years

We can, therefore, put four/five random words together and make a long and easy(er) to remember password. This is possible due to the high number of words in English that are in common usage. Lets use these four words

• Fancy
• Librarian
• Politician
• hesitation

Fancylibrarianpoliticianhesitation

This easy to remember password would take 1,000,000,000,000,000,000,000,000,000,000 years to crack by a single computer and 2.5 hours if every person on the planet had as many computers as there are grains of sand.

Tools for managing your passwords

Our favourite tool for managing passwords is Lastpass.  We can create a folder per client or project and share it through our business with control over who can use, see and edit passwords. Each team member also has a personal account for storing credentials for them.

It’s easy to use on mobile devices as well will autocomplete from the keyboard and also Mac and PC apps available.

3 Password manager recommendations:

• Lastpass
• 1Password
• Dashlane

Everyday password how-to

How to give an agency/freelancer access to your Magento Store

How to share your passwords with somebody at Rixxo

There should be little or no need to share details with us. An account should be made specifically for each user at Rixxo.

Where possible instead of sharing password details with us either;

1. Create an account of our own
2. Reset our existing account password

Telephone

Sometimes the easiest way to get secure details across is by phone. It’s always best to double-check the details whilst on the call. Call us.

SMS or Whatsapp

1. Email the username
2. SMS or Whatsapp the Password to your account manager.

Confidential Email (GSuite)

1. Put the details into the email
2. Send the email in confidential mode requiring the user to get a mobile unlock code
3. Send the SMS passcode to your account manager