By: Priyank Chopra, BCA 4th Sem, 1st Shift

People are terrible at picking passwords. According to an analysis by security firm Keeper of 10 million leaked passwords last year. There were several major data breaches in 2016 in which people’s login details were leaked online.

In cases like LinkedIn, the breach happened years ago, but the data only recently surfaced online. Both instances provided researchers with an exceptional look at the security habits of millions of people — it’s not pretty. The first and second most-used password was 123456 and 123456789, according to Keeper, followed by the qwerty. Then came 12345678, and in fifth place was the obvious 111111.
“Looking at the list of 2016’s most common passwords, we couldn’t stop shaking our heads,” the researchers wrote in a blog post. Website operators that allow such flimsy protection are either careless or lazy. Longer passwords can be harder to remember. But that’s not an excuse to just use qwerty.

Security experts recommend people to use a different, strong password for each service or website and storing their passwords with a password manager app. That way, if one service you used is breached, your accounts on others sites or services are not compromised as well and you should also activate two-factor authentication whenever possible so that even if your password is exposed, attackers still can’t get into your account without access to your phone. Passwords are a pain. Actually, they're more than that. They're becoming unmanageable.

The average person has various passwords they have to keep track of and that number is only growing as we sign up for more apps and online services.

The situation is made even worse by sites that require users to change passwords often and by general hacking attacks that necessitate replacing passwords.

Many people resort to simple tricks- using simple, easy to remember passwords, reusing favourite passwords over and over, or slightly altering some passwords by changing their order or substituting numbers for letters. But these passwords are often easy to guess, and if your password on one site is hacked by the hacker, then he can potentially gain access to your accounts on other sites.

As hopeless and frustrating as all this seems, there is a solution- using a password manager.

Password managers are programs that store all of your passwords in one place, on your computer or phone or in a secure space in the cloud. What's more, most of the password managers will generate complicated, hard-to-crack passwords for you. Many password managers will easily fill in passwords automatically when you go to a website. And some will do the same when you launch apps on your smartphone.

Most popular password managers are: LastPass, Dashlane, KeePass, 1Password, Roboform
If you are predictable or apply the simple and shortest password for all your accounts, you are going to get hacked. If you register to some sites that you know are risky, and you don’t put any effort to protect your information, you are going to get hacked. It is so easy for a hacker with skills to leave you without a thing. The cost of being lazy with your protection on the internet can be really high.
On a long enough timescale, everyone gets hacked. But by not using — and reusing — weak passwords, you can limit the damage.

By: Prabhmeet Kaur Dang, BCA 6th Sem, 2nd Shift

Increasing use of Internet in each and every activity of our lives accentuates the issue of security and privacy. Our personal account information and data even with password protection is quite prone to attacks by hackers. They use various types of attacks to crack our passwords but the most common type of attack is password guessing. Nowadays, a large number of passwords for online accounts ranging from banking, shopping to social media are vulnerable to online guessing. Targeted online guessing is when criminals guess a specific victim’s password for an account. We like keeping our passwords based upon our interests, hobbies, pets, family and password crackers  exploit knowledge of their victim’s personal information and make a few, often correct, password guesses. Attackers can guess passwords locally or remotely using either a manual or automated approach. Some common password guessing tools are Hydra for guessing all sorts of passwords, including HTTP, Telnet, and Windows logons, TSGrinder and SQLRecon.

Recently there have been a large number of data breaches, putting more personal information into the hands of criminals. Password guessing is a much underestimated threat which results in more damaging and serious consequences. To understand how to protect yourself from a password attack, you should become familiar with the most commonly used types of attacks.

·      Brute Force Attack: The most time consuming and most successful attack method. It is a type of password guessing attack and it consists of trying every possible code, combination, or password until you find the correct one. This type of attack may take long time to complete.

·   Dictionary Attack: A dictionary attack is another type of password guessing attack which uses a dictionary of common words to identify the user’s password.

·       Hybrid attack: Hybrid password guessing attack assume that network administrators push users to make their passwords at least slightly different from a word that appears in a dictionary.

Some of the prevention techniques are:

·        There are a number of techniques for preventing brute force attacks. The first is to implement an account lockout policy. For example, after three failed login attempts, the account is locked out until an administrator unlocks it.

·        Another complicated technique is progressive delays.
In this, user accounts are locked out for a set period of time after a few failed login attempts.

·        Another technique is to use a challenge-response test to prevent automated submissions of the login page.

·        Use of strong passwords. It requires users to choose passwords of eight letters or more with some letters and numbers, or requiring one special character.

·        Provide a good  password policy for the users in your organization. Warn them about the danger of telling their password to other users, writing their password down on paper, or even storing their password in a file.

·         Enable account lockouts as it will significantly slow, most password-guessing attacks, whether manual or automated.

·        Use upper and lowercase letters, special characters, and numbers. Never use only numbers. Such passwords can be cracked quickly.

·        Use punctuation characters to separate words or acronyms.

·        Change passwords every 6 to 12 months regularly.

·        Use different and variable length passwords for each system.

·         Don’t use common slang words or words that are in a dictionary.

·        Don’t reuse the same password within at least four to five password changes.

·        Test your applications to make sure they aren’t storing passwords indefinitely in memory or writing them to disk. 

“Privacy is not an option and it shouldn’t be the price we accept for just getting on the Internet.”

By: Bhavini Sharma, BCA 4th Sem, 1^st Shift

We often fail to acknowledge the importance to secure our data by having strong passwords. People have a very basic to little knowledge about how essential it is to secure our accounts with an appropriate strong password. Lack of knowledge is what leads the hackers or crackers to obtain valuable information, making the data saved online vulnerable. So, before we let our data to be more prone to cybercrimes we should have the knowledge on how to make our accounts to be more secured and less susceptible to any sort of damage.

         According to the new researches, reusing similar passwords across many online accounts may make you more vulnerable to cyber criminals. Their results suggested that the currently used security mechanisms would be largely ineffective against the targeted online guessing threat, and this threat has already become much more damaging than expected. The prioritizing models were tested against 10 large real-world datasets from Chinese and English Internet users. The researchers found the attack models that benefited from multiple pieces of personal information were able to successfully guess the passwords of accounts for more than 73% of normal users, and about a third of security-savvy users with a limit of 100 guesses.

Now, let us take an example of different passwords to understand how online password guessing works and how long does it take hackers or crackers to guess it. A numerical password is the easiest password to guess through a brute force approach. If the password is 1231998, then the digits might be a combination of birthday, home address, or security number. So, we can say that having an only numerical password is not secure. If a user has a password of combination of lower and uppercase letters, then the brute force method will take millions of years to guess it. For such passwords, hackers have a password cracking method called a Dictionary Attack.  In a dictionary attack, the hacker tries using various combinations of upper and lowercase words that would be found in the dictionary. As long as the words are written in English, the password can be cracked significantly faster than a normal brute force approach. A password made up of only letters should also be avoided. If we were talking about 4-5 years back, then the passwords containing symbols were good to go. But, as the users were made more aware of the password threats the hackers or crackers also stepped up their game by being more efficient in guessing their passwords. The cases that arise are using of ! instead of i/I  or @ instead of a/A. So, it is safe to say that even the passwords containing symbols that are used for substituting letters is also not secure.

After looking at all the ways that a password can be cracked, you might be wondering that having a safe and secure password is impossible. For being one step ahead of the password guessers you will want to make a password that is easy to remember, but is not in a dictionary, has symbols that aren’t obvious substitutions, looks complicated, and is long. Choose a password that has a meaning only you could understand. Our safety is in our hands. Therefore, from now on we should spend more time in choosing our passwords more carefully.