Password Security: Are you making yourself vulnerable?

Password security is a complex problem.  When sharing, accessing, creating or even just viewing data on the Internet we typically need a password for something.  Whether it’s your Wall Street Journal Subscription or your Facebook account you need it ‘secured’ with a personal and complex password.  Problem is we are at the mercy of individuals who are dishonest, greedy and seeking to prove their hacking and cracking prowess on the Internet.  Why should we be concerned?

Hackers use several methods to steal account information.  The one that directly challenges the security of your password is a brute force attack.  The attacking computer is programed to come up with all the combinations of given parameters (length, complexity, salt).  If you only use letters you may as well kiss your account “security” goodbye.  To make your account passwords more secure use a combination of letters, numbers and symbols with an overall length greater than 11 characters. I’m not sure how true this is but a commenter on a Gizmodo post a couple of years ago says they were able to crack a password within a few hours regardless of complexity.

Another method of hacking into and stealing your account information and identity is to crack the overall security of the network where your information is hosted.  Once they are in they can harvest usernames, passwords, real names, emails, birthdates and anything else they might want.  Clark Howard, financial expert for CNN, suggested not putting your real birthdate into sites that really don’t require your exact date for any legal reasons (just remember what you put in should you ever need to verify your identity on the site using that info).   Like JoeTech mentions in the article cited above, hackers will then use this information and start trying to log into other cloud or financial services across the Internet.  If you don’t use the same string as a password on all your sensitive data then you will be OK.  BUT if you do then you have some work to do.  Once you find out about a security breach at a network where you have an account, like Evernote, you will need to change any passwords that may be identical across the Internet.  Granted, this is inconvenient, but much more secure than having a standard password that leaves ALL your information to the open once it is stolen even one time.  Check out the rest of Joe’s article for more tips.