The Golden Rule Pt 2

I will try and keep this explanation as simple as I can, it is an easy topic to get all tecko and mathematical about, so I’ll do my best. 

Recent testing by cyber security experts has discovered that a long simple password is more secure than a short complicated password. The reason behind this is that every extra character that is added, multiplies the possible combinations that an attacker would have to try, and as you add more characters the multiplication increases in greater proportions. Remember what I told you before, someone trying to break the password doesn’t know when they have each letter one by one, to them it works or it doesn’t work. If a password is stored correctly in a database, you can’t even tell how many characters have been used, it is just a gibberish pattern.

Yes, I know “How am I supposed to remember a long password, let alone different long ones!”

I am not insisting that you have a different password for every single site, you can have one password that you use for all those random sites that just require you to give one so you can access something. The password for these sites doesn’t need to be too secure because all you are supplying is a user name, or email and password, no personal details are required.

For the sites where you have supplied personal information, access to financial records or funds, credit card details etc, you need to find out what the maximum number of allowed letters, numbers, or symbols are, and use a password appropriate to the allowance. Some sites will allow you to use letters and numbers but no symbols (!@$*+,etc) some will not allow you to use the same character in a row. A certain bank that I know of only allows a 16 character password with only letters and numbers, no symbols are allowed, this is very poor security for a bank. In this situation you must always make sure you use the all of the 16, and mix it up with numbers, letters, and upper and lower case.

I will show you two easy methods to come up with long passwords, it is best to pick one method and stick to it, that way it is easy to recreate your password if you forget it. Try and have at least 12 to 16 character passwords. The first method is to pick a word that you remember easy (probably the password you are using now) and simply add letters, numbers or symbols before and after it. An example of this would be if you used Womble for your word, well then this could become ******W0mble^^^^^^   

This method is known as Password Haystacks and was devised by Steve Gibson, From Gibson Research. He has a page https://www.grc.com/haystack.htm where you can type in your password and it will give you an idea how long it would take to crack that combination. The above example would take over a thousand trillion centuries to crack in a brute force attack, based on the combination and number of characters. You may have noticed I changed the letter o to a zero so that we had a number included.

One way that you can make this method unique to each site is to use the same number of “fill characters” as the number of letters in the name of the site, eg: if the site is “Google” you would add 6 characters each side of your middle word, if it was “apple” it would be 5 each side. You need to come up with your own style or plan and stick to it, that way you can always work out what your password is, if you can’t remember it. If the site has two words, you may put the number of letters in the first word in front of your word and the number of letters in the second word after. If the site has a long name, you could do something like always just use the first 6 characters. Remember, it can be any combination of characters that the site allows. 

On Wednesday I will give you another idea for remembering long passwords and wrap up our password chat.

There was a report on 60 minutes last night about cyber crime, and while the big stuff is out of our control, the experts stated that the average home computer is still mainly taken over because the user clicked on fake links, videos, or sites. So remember to stay Alert Online.

The Golden Rule Pt 1

Before I get into today’s topic, I will just do a bit of housekeeping. I want to let you all know that the contents of this blog are purely my own opinions, views and ideas, though these have come from a lot of study and research (and experience!). Secondly, I am in no way linked to, or receive money or products from any brand names or companies. 


Just to add a quick piece to the Facebook scam in the last post: The computer doesn’t need to shut down, the link may just open another page, if it is a link for a video and it opens a page, this is usually a sure sign that it is a scam. 


Okay, 
 A topic that nearly everybody I talk to who isn’t tech minded laughs off, is Passwords. That word that strikes frustration in the minds of even the most organised amongst us. I have helped a lot of family and friends where I have needed to know their password for the task, and have received the usual names of kids, dogs, husbands, wives etc, I even got the reply abc 123 once. I have learned over time to pick my battles, some people refuse to be educated on the topic, while most know they should be, but don’t bother. The funny thing is, the same people would not leave their house or car left unlocked, To be honest I would rather have my car stolen, than have my information and personal details stolen, at least our cars are insured!. 


While simple passwords may be easy to remember and quick to login with, they are an open invitation and a ticking time bomb to having your accounts compromised. Here is some figures on what is termed a “Brute Force” attack, this is when a computer has a database of 100s of 1000s of possible password combinations, and a program is run that can try every password in a matter of seconds. The average computer that we all work with today has the power to easily run up to 500000 combinations a SECOND, and no I didn’t add too many zeros. To put that into plain English Most of the passwords that you are using would be cracked in less than 1 second. 


You may be thinking: well this is all Hollywood Russian spy type stuff, Wrong!!! The age of technology we are in, has produced its own generation of “script Kiddies” young kids that do this kind of stuff just because!. There are also groups that “harvest” personal information and then sell it on to the bigger fish who then do the damage. Massive Databases of passwords and the programs to run them are easily found via a Google search and easily downloaded. Once someone has retrieved one of your passwords, they will then try it on other accounts that they’ve discovered you have, hence the reason to have different passwords for different accounts.

I know what you are all thinking, what a massive pain, how would I ever manage that? Well don’t panic, there are ways where it is quite easy to make hard to crack passwords for each account you have.


 Another myth that Hollywood has taught us, is that passwords are cracked 1 letter at a time, and they get closer and closer the more letters that are discovered. This is not true at all, the only information a hacker knows is “it worked” or “it didn’t work”. You will see why this matters over the next few posts where I will be discussing what makes a secure password and how to easily make them unique for each account.