(This post was written during the COVID lockdowns.)
We’ve slowed down a bit. The situation is hard, that’s for sure, but many of us have more time on our hands. A lot depends on how we spend it: the more useful we manage to be, the better the rest feels.
Most of us know what we should pay attention to, but few manage to keep their passwords in order. If that’s not you, here’s a big high five, and I’m curious what you think of my tips! If you feel there’s room for improvement, don’t put it off any longer – get the security of your accounts together! Spend half an hour on it and you’ll sleep more soundly.
It’s no secret that passwords can be cracked. Websites do their best to make this as hard as possible, but it will never be impossible. If you follow a few rules, though, you can get close. ;)
I’ve tried to order my tips by how much effort they take – I hope you get as far down the list as possible!
Take it seriously
If someone can see into the programs you use, it’s not hard to imagine the power they’ll have over you. I recommend the series Mr. Robot to everyone: it’s about an IT superhero who catches criminals by hacking. I won’t say it’s easy viewing, but it’s well worth it. And you don’t even need an enemy – automated hacker attacks are happening all over the world all the time. There’s an interactive map of the attacks happening right now; take a look, you’ll be surprised. And if you want to follow the spread of the coronavirus, don’t use this app, because it’s after your passwords. All I’m saying is that there are people who want to get hold of your passwords, so at least don’t leave the door open for them.
Stop for a moment and think about what would happen if someone scrolled through your chats, leisurely went through what you spent money on last month, what films you watched, where you walked, what photos you took. The list is long, and everyone considers different things sensitive, but everyone has something. Only your password decides whether someone you haven’t given permission to can access all this. Make it clear to yourself that this matters to you, and be careful! The easiest way to get a password is still for the hacker to spare no effort, use decades of know-how – and simply ask for it by email. Don’t give your password to anyone. If someone absolutely needs access to your account, create a temporary password for them and change it back as soon as you can. By the way, there are great websites for testing password strength – I suggest you stay well away from them, because it’s hard to resist typing in your real password, and you know: never give your password to anyone!
Have a method
Perhaps the most important thing is the shape of the password. This xkcd comic sums it up perfectly. I swear by long passwords: more than 10 characters, made of several words. Easy to remember, hard to crack.
Every year a list of the most commonly stolen passwords (in Hungarian) comes out, and they tend to look like this: 123456, password, qwerty, 111111, abc123. They’re easy to remember, they take no thought, and best of all, password-cracking algorithms eat them for breakfast. On top of that, the simpler a password is, the more people use it – so it’s worth trying them if you want to break into someone’s account.
Have a well-practised method for coming up with new passwords, because when the moment comes, you won’t want to spend time on it. I pick four random words and put them next to each other. For example, in Hungarian: “palotazöldzegzugszeplő” (palace-green-nook-freckle) – and hackers aren’t fond of accented characters. ;) To remember it, I suggest making up a little story – though you probably don’t need me to explain; if school taught us anything, it’s how to memorise things.
Upper case, lower case, special characters? If the sign-up form insists, you have to put them in, but the first thing a cracking algorithm does is swap every i for a 1 and try every first letter in upper case too. I’ll rant about these password requirements at the end of the post. What matters much more is that your password contains no personal information – your year of birth, your username, your daughter’s name. Make those four words truly random. I’m not saying this is the best method, but I think being able to remember your password matters more than it being impossible to crack. After all, if you can’t remember it easily, you’ll write it down everywhere you can so you don’t lose it.
A separate password for every account
If someone gets hold of one of your passwords, they get into all your other accounts too. This is completely obvious, and yet it’s so hard to make ourselves come up with new passwords. I only switched to this for all my accounts two years ago – which shows nicely how little time I wanted to spend on the topic, even as someone in the industry. I only managed it once I started using a password manager.
Use a password manager
Don’t. Stick. Your. Password. On. The. Safe. A bank card PIN stuck to the wallet, passwords on a sticky note on the monitor or collected in an Excel sheet – none of that is funny. I’ve seen too much of it; I’ll never be the same person again.
If nothing else, the most obvious software will do (your browser remembering them, your phone’s built-in password manager). Personally, I’m not keen on handing this data to a third party. That’s why Orsi and I use the open-source KeePass. The idea is that your passwords are stored in an encrypted file on your computer, and you only need to remember one master password (on your phone you can open it with your fingerprint too). KeePass is free, but it has no cloud service to store your passwords for you, so you have to sort out access from all your devices yourself. You can, however, upload the password file to Drive without any worry and sync it to every device. You can also use other password managers that store your passwords in their own cloud and are very easy to use, such as LastPass (the personal version is free) or 1Password. If you’ve got this far and copy-paste your passwords anyway, use the built-in password generator! Your password will be random characters (e.g. 0a1ba340ee574b75654225d6155927b8), but you won’t need to remember it – ideally you’ll never even see it – and it certainly won’t be cracked.
Check whether your password has leaked
The Hacker News collects its articles about the latest big password thefts here. In these, hackers break into a website with lots of users and sell the passwords for good money on the black market. You may not even know it, but your account has already been hacked. On Have I Been Pwned you can check whether your email address appears in known data breaches. If it does, change that password immediately, and everywhere else you used the same one.
Regular password changes for no reason, however, are no longer recommended by experts (the US standards body NIST among them): frequent changes lead us to pick weaker, more predictable passwords. It’s enough to change a good password when you have a reason to.
Two-factor authentication
Phone confirmation, a key fob that generates a new code every thirty seconds – these all make sure that, beyond your password, some physical action is needed as well. That way the system can be one step more certain that it’s really you trying to log in. Of course these don’t give 100% protection either, but the big companies already support them. At Google, this page walks you through turning it on. On Facebook you can set it up here (Use two-factor authentication), and on the same page you can also see when and from which device someone logged into your profile.
Idiotic password rules
Forcing users to include special characters, numbers and upper and lower case only means that every “o” becomes a “0” and every password ends with “!”. And it really gets on my nerves when I have to type my password three or four times because it needs a special character, but it can’t handle the one I’m trying to use. These rules don’t make passwords harder to crack, but they do make them hard to remember, so the user ends up with one password for everything – posted on their Facebook so they can always find it. It’s not entirely unjustified: there are excellent algorithms that try words even from foreign languages, so if you want to be sure, you need to choose from as many kinds of characters as possible to make it hard to crack. But don’t use the typical letter swaps, because they don’t get you anywhere.
Summary
If you listen to me, you’ll use KeePass with a generated password for every account – that way you can sleep soundly for now. But if you become even a little more mindful about your passwords, writing this post was worth it. 🙂