Authored by: @hetty-rowan

^SOURCE

Shall we talk about safety today? And no, I don't mean physical security. I know what's going on! And yes, of course I sympathize with everyone. But I don't want to talk about that. Today I wanted to talk about online safety. Because that is increasingly important.

Why is a secure password important?

I don't know if you've ever dealt with someone who isn't much of a star when it comes to handling a PC? I do, and I don't claim to know a great deal about technology, but I do understand the importance of a strong and unique password. Many people fail to see why a secure password is important. As a result, they also use the same password for every account. You get the idea, that's just very simple and to put it mildly, NOT safe! The moment your password has been hacked on 1 site, a hacker can log in everywhere. And if you already tell them, they will answer you. “Who thinks my data is important now?” Or even worse, “I have nothing to hide, they like me”.

This can sometimes make me despondent, because those people who say that, they seriously don't think far enough. We live in a time of increasing digitization. More and more is done via the internet. And so you secretly soon have more accounts than you realize. Using the same password everywhere because it's so easy, and it gets hacked, would be like having someone put up a camera in every room of your house and watch you. Maybe not a big deal if you have little to hide. But it will certainly not be nice when a stranger has access to everything and can view everything.

And that's exactly what could happen if someone has your passwords. Hackers can then see what you are doing. Not only what you do on an account, but also what you actually do. When a hacker has access to your accounts, it is no longer that difficult to get you to install software that also allows the hacker access to your online life, and possibly even your offline life.

Besides that, a lot of damage can also be done by people who incorrectly access your passwords. For example, they can perform actions on the internet on your behalf, which can result in bills that you suddenly have to pay even though you have never ordered anything. Also think about sending messages to people you know, or selling your data to third parties who are very interested in your data.

Why not use the same password everywhere?

A password is something personal. If you don't tell anyone, no hacker will know your password, right? Unfortunately, I have to disappoint you. That thought is a utopia. Most passwords are stolen when a website that you have an account on is hacked. Now, suppose you have an account on Netflix. You use a password for this, which you also use for Facebook, e-mail and the IP cameras in your home for your convenience. Can you feel it already?

Now suddenly there is news about a major data breach at Netflix, through which hackers got their hands on your password. Often these hackers do nothing with this themselves, but they sell it on to third parties. These third parties then receive your password, after which they use software to check on which websites and applications you have an account that is registered with the same email address at Netflix. Bingo! Your Facebook page, email, and IP cameras come up piece by piece.

Malicious persons could then do everything on your Facebook and view, copy and send sensitive emails. But they can also watch what is happening at your home via the IP cameras. And all because you used the same password everywhere.

And unfortunately it has been known for a long time, this is happening! And on an ever-increasing scale!

Password cracking

Password cracking is better known as password cracking. When hackers engage in password cracking, they have already stolen the password from the database. A password is never simply stored in a database. Then everyone who has access to the database would be able to see the passwords. In principle, website administrators never know what your password is. Unfortunately, not all websites are equally well secured, so this will sometimes be possible. That is why it is extra important to never use the same password.

The moment a hacker has retrieved passwords from a database, he sees them as a piece of code. This is the hash of the password. When a password is hashed, the word is converted into a piece of code according to a certain algorithm. What this code looks like differs per algorithm. The best known algorithms are MD5 and SHA-256.

The password “LeoFinance” would look like this with the MD5 hash:

8cc5c1dca6485f25e766cd87348d8282

And with the SHA-256 hash it would look like this:

1F9BB42872279E7F397E952FEC1BB55236D3F7D6E89E702D3E9077BFB6879040

Passwords are thus encrypted by means of cryptography. Cryptography is one of the most widely used security. Passwords are encrypted (converted into a code according to a certain algorithm). Only when you have the key can you decipher the password according to a certain algorithm.

As a result, passwords that are stolen from a man in the middle attack, for example, cannot be read, because the hacker does not have a key.

However, a hacker can still crack the password with three different attacks:

• Dictionary attack
• brute force attack
• Rainbow table attack
  
  

In a dictionary attack, all kinds of common passwords are hashed in a list, and then compared with the hashed password. When there is a match, this is visible to the hacker. A brute-force attack tries any combination of letters, numbers, and special characters. This is one of the most common ways to crack passwords, but it also takes the longest. Rainbow table attacks are similar to dictionary attacks but use existing databases in which all common passwords have already been hashed, saving a lot of time for the hacker.

Ideally, your password should meet the following three conditions:

• It cannot be guessed based on personal information
• It is unique
• It is as long as possible.
  
  

This is why you need a long password

As mentioned, a brute-force attack is the most commonly used technique for cracking passwords. The software then goes to work to find the right combination of letters, numbers and special characters. This takes a very long time. But not if you have an easy and short password.

A password like 'welcome' is found very quickly. This password consists of 6 characters, which means that (if we assume that the password may only contain lowercase letters, uppercase letters and numbers) 56,800,235,584 combinations are possible. It would take an average computer about 10 minutes to crack this password.

If we add a letter or number, for example 'welcome1', there are 62 times as many combinations, so it takes a computer 10 hours to crack the password. If we bring the number of characters in the password to 12 and make it "welcome welcome", the number of combinations will be more than 3,000,000,000,000,000,000,000. That same computer would now take 12 million years to crack the password, and a supercomputer or a botnet about 1 year.

So now you understand why it is important to use a long password. The chance that a hacker will crack your password is almost equal to zero.

How do you remember a difficult password?

Of course, it is not easy to use different difficult passwords for each account. You simply cannot remember that. Fortunately, there are a number of solutions. The first solution is that you could use a passphrase. This is basically a sentence that you use as a password. This makes the password long and easier to remember.

Suppose you like dogs, a passphrase could be: 3DogsAreBetterThan2. Not hard to remember right? Hard to crack! It would take 2,613,801,170,210,656,824,066,048 hours before a computer cracks this password with a brute-force attack.
It is important that you only use this password in one place.

Password Manager

Fortunately, there is also another way to save passwords. Nowadays, you have plenty of password vaults. This is a piece of software that stores your password. When you come to a page where you have saved a password in the vault, the software will automatically log you in. In most cases, the software can also come up with passwords for you that consist of various lowercase letters, uppercase letters, numbers and special characters.

There are several password managers on the market that you can use to store your passwords. Think Dashlane, 1Password, KeePass, LastPass and Bitwarden. But Google also has its own password manager these days. If you are a Google Chrome user, you can save your passwords in the web browser. (Although I would never recommend this to anyone to do, it is possible)

The only thing I found useful about this password manager is that it also scans if your password has ever been stolen in a data breach. Google does this by comparing your email address and password with accounts that have been involved in a data breach in the past. You can then immediately change your password.

But Apple also offers you the option to save your passwords. Handy if you have multiple Apple devices, because you don't have to log in again on each device.

Two Factor Authentication

And it will be known to everyone here, it is also not wrong to use Two-Factor Authentication. This makes logging in even more secure. When you use Two-Factor Authentication, someone cannot immediately log in if they have stolen your password.

If you have enabled Two-Factor Authentication, you must first enter a code when logging in, which is displayed in an application (usually your phone). You must then enter this code in addition to your username and password in order to log in.

What is the advantage of Two-Factor Authentication? Isn't it just getting harder to log in? Uhm yes, you have to go through an extra step, but the advantage is that when someone has your password, they can't log in with it as long as they don't also have your phone. The chance that someone will get both at the same time is very small. That is why it is wise to use Two-Factor Authentication, especially for most important accounts. For your crypto always I would say. After all, you want to minimize the chance of it being stolen, right?

FunFact, I even put 2FA on my Facebook… and when I switched from my old Samsung to my new phone, I moved all 2FA accounts to my new phone EXCEPT Facebook. I hadn't even thought about that anymore, it was also stated in another 2FA app ... which I deleted from my phone. As a result, I locked myself out of my own Facebook account. And yes, I can recover this, IF I would send my ID to Facebook. And that … I'm not going to do that. I don't think it's necessary for Facebook to have my data, and I don't miss it at all. I just like having fun without Facebook.

Happy Sunday LBI'ers!