Scandinavian security blogger Anders Nilsson spent a little time with
the Pipal password analysing tool, running it against the 450,000
plaintext passwords snatched by hackers from Yahoo Voices.And what he found doesn't inspire much confidence that users are getting the message about password security.
Repeat after me.
"A password of 'password' isn't actually a password."And neither is "123456" or "welcome" or "qwerty" going to prove anything of a challenge to a hacker.The fact is that every time password lists are stolen and published on the internet, hackers add them to their own databases for their password crackers to try next time they want to break into an account or crack a hashed password.
Your passwords need to be unique, and hard-to-crack. That means not using dictionary words anymore, and not imagining that no-one else in the world has thought of "qwertyuiop" or "password1234". The typical response from the average internet user is "But how will I remember all these different, complicated passwords?"Simple. Use a decent password management program.
There are a few to choose from, and some of them are even free. Software like 1Password, KeePass and LastPass can remember all your different passwords on your behalf, store them securely, and even generate complicated passwords for the next website you join.
Clearly the responsibility isn't all in the court of the user, however.
Not only should websites take greater care about securing users'
information (for instance, not storing passwords in plain-text or as
unsalted hashes), but they could also do more to ensure that users
choose trickier passwords.I'd like to see more websites check the passwords chosen by their new
users, by running them against a database of commonly used passwords
and a dictionary.If the password users enter is too common, or an obvious sequence, or
doesn't obey sensible password rules about complexity or length, then
it should be rejected and the user told to try again.When websites tell you to change your password
following a security breach, they should also tell you to choose a
hard-to-crack, unique password. Otherwise, what's to stop the new
password being "abcdefg"?It would be a safer world if websites policed the passwords that are submitted by users, and weak choices thrown out.
If you already know this about passwords - great! But be a goodsamaritan, and share the advice with your family and friends.We need to get everyone to understand the importance of better password security.Yes, even the "princesses" and "ninjas".
liked this one dude ..
ReplyDelete