Patterns of thought: the psychology of weak passwords

In this article, I look at why webmasters, site administrators and their users choose and use weak passwords. Later, I recommend ways to create passwords that are reliable and resistant to brute-force attacks.

Warnings that the internet is increasingly an unsafe environment appear with alarming regularity in studies commissioned by companies specializing in information security. The growing number of web attacks and the increasing activity of the hacker community require a new discipline and focus on security.

But while cybersecurity experts are talking about high technology and advanced protection, it seems a rudimentary rule has been forgotten: the use of strong passwords. Unreliable passwords are a common cause of compromised corporate and retail systems. The 2015 study by Trustwave said that more than a quarter of security incidents happen because of weak passwords.

From my own experience in the field of information security, I agree that the problem of weak passwords on system administration sites and hosting accounts is important.

You can see that, when creating passwords, people think not about security but about being able to remember them. Certain key combinations have become popular among people who want to remember their passwords but haven't thought about the security implications.

Password are nearly always chosen and typed on a computer keyboard. (You can see some hint of that in the sample combinations above.) Such passwords are easy to remember and can be mechanically repeated. At some point, people began to think that adding numbers to the ends of passwords makes them stronger. But it doesn't, at least not much. Around 420,000 of the 10,000,000 sample passwords ended in numbers between 0 and 99. Almost every fifth password had added the single digit '1'.

Rules for a Better Password

Here is my list of rules to help you improve the security of your passwords.

1. Make it Longer. Cybersecurity experts say a password should be at least 10 characters long. According to the Trustwave 2015 study, an 8 character password can be guessed in one day by hackers with the right tools. But a password of 10 or more characters will take several months to crack with the same tools.
2. Make it Varied. A password should contain different characters, such as upper and lowercase letters, numbers, and symbols. Including them creates the least vulnerable passwords when generated at random. Using popular names, proper names, birth dates, or phone numbers in passwords makes them easy for intruders to crack using brute-force techniques.
3. Change it Often. You can never be completely sure that your current password has not been previously intercepted by an attacker. Frequent password changes reduce the risk that someone other than yourself has access to confidential information.
4. One System, One Password. Often, web administrators use the same password to log into different systems. In security terms, this means that an attacker knows enough to intercept a password and make a comprehensive data compromise. Always use different passwords to access different systems.
5. Don't Rely on Memory. It is nice to think we can remember all our passwords, but not all users are good with mnemonics, and memory can fade with time. There are more comfortable and modern ways to store passwords, for example, using secure password managers.
6. Beware Password Auto-Save. Some places should not be used to store passwords. For example, web browsers, unencrypted keychains, or FTP managers. Auto-saving passwords in this way makes them prey to hackers or Trojans.
7. Virtual Keyboard. If possible, do not enter passwords using a physical keyboard, but instead use a virtual keyboard, a software program that emulates a keyboard and accepts input with a mouse. These protect against 'keyloggers', programs that record keystrokes or mouse clicks and transmit them to hackers.
8. Restrict Admin Rights. Site owners often need the help of outside experts, and need to give them administrative access to make their jobs easier. This is an unsafe practice. Each specialist should have an individual account so you can track what actions they did. After completion of their work, change their passwords or remove their accounts.
9. Secure Networks. It is common to need to solve business issues while connecting to a network in public places. However, working in open Wi-Fi networks—cafes, shopping centers or airports—carries the risk of having your sensitive data intercepted with applications such as traffic analyzers (sniffers). A secure VPN connection should be used in such situations.
10. Secure Protocols. Working with unencrypted traffic can be the beginning of the end. Nowadays, intercepting and examining unprotected traffic and extracting personal data is easy for 'script-kiddies', young people with little or no technical knowledge, but with access to easily available off-the-shelf tools, and a motivation to use them to steal or inflict damage. For online communication, such as sending and receiving email, or sending data via FTP, you should always use a secure channel for your connections (i.e. SSL, TLS, HTTPS).
11. Two-Factor Authentication. A good way to improve the security of sensitive data and enhance access control is by using two-factor authentication. Under this system, a login operation is confirmed via a separate confirmation code on a mobile app or dedicated hardware device. Two-factor authentication is a reliable insurance against illegal access by hackers. Even if a fraudster can intercept a password, they cannot use it.

Conclusion