Online Password Guessing - An Underestimated Threat

by 20:22 0 comments Online Password Guessing

By: Bhavini Sharma, BCA 4th Sem, 1^st Shift

We often fail to acknowledge the importance to secure our data by having strong passwords. People have a very basic to little knowledge about how essential it is to secure our accounts with an appropriate strong password. Lack of knowledge is what leads the hackers or crackers to obtain valuable information, making the data saved online vulnerable. So, before we let our data to be more prone to cybercrimes we should have the knowledge on how to make our accounts to be more secured and less susceptible to any sort of damage.

         According to the new researches, reusing similar passwords across many online accounts may make you more vulnerable to cyber criminals. Their results suggested that the currently used security mechanisms would be largely ineffective against the targeted online guessing threat, and this threat has already become much more damaging than expected. The prioritizing models were tested against 10 large real-world datasets from Chinese and English Internet users. The researchers found the attack models that benefited from multiple pieces of personal information were able to successfully guess the passwords of accounts for more than 73% of normal users, and about a third of security-savvy users with a limit of 100 guesses.

Now, let us take an example of different passwords to understand how online password guessing works and how long does it take hackers or crackers to guess it. A numerical password is the easiest password to guess through a brute force approach. If the password is 1231998, then the digits might be a combination of birthday, home address, or security number. So, we can say that having an only numerical password is not secure. If a user has a password of combination of lower and uppercase letters, then the brute force method will take millions of years to guess it. For such passwords, hackers have a password cracking method called a Dictionary Attack.  In a dictionary attack, the hacker tries using various combinations of upper and lowercase words that would be found in the dictionary. As long as the words are written in English, the password can be cracked significantly faster than a normal brute force approach. A password made up of only letters should also be avoided. If we were talking about 4-5 years back, then the passwords containing symbols were good to go. But, as the users were made more aware of the password threats the hackers or crackers also stepped up their game by being more efficient in guessing their passwords. The cases that arise are using of ! instead of i/I  or @ instead of a/A. So, it is safe to say that even the passwords containing symbols that are used for substituting letters is also not secure.

After looking at all the ways that a password can be cracked, you might be wondering that having a safe and secure password is impossible. For being one step ahead of the password guessers you will want to make a password that is easy to remember, but is not in a dictionary, has symbols that aren’t obvious substitutions, looks complicated, and is long. Choose a password that has a meaning only you could understand. Our safety is in our hands. Therefore, from now on we should spend more time in choosing our passwords more carefully.