How to create a secure password? The most common mistakes that you (probably) make too

“Wife’s name”, 12345, “I don’t know” or even “password”. Surveys show that these are the passwords Czech users have long been most fond of. Yes, you read that right. Even in 2018 there are tens of thousands of people who do not worry much about their internet security. And the consequences can be tragic. 

At home, and on the computer too

Can you imagine going on holiday and leaving your front door wide open? Probably not. But when it comes to internet security, we are not so careful.

And a lot is at stake. A weak password and a couple of clicks are all it takes – in the better case a colleague gets to read your e-mails, in the worse case your intimate photos appear on the internet and you find your bank account empty. Hackers and cyber criminals are simply getting more and more inventive. And nothing is safe from them: your e-mail, your photo storage, your social networks or your internet banking.
The biggest mistakes you (probably) make too

To get hold of your password, a person does not need any sophisticated technique. As security experts warn, if someone obtains your password, in most cases you can blame yourself. You are making some of the most common (and biggest) mistakes.

1. You use a password that is easy to guess

Your date of birth or that of your loved ones, the name of your dog, or perhaps “12345”. If you use any of these passwords, it is like leaving your front door key on the doormat – for anyone who happens to walk past to pick up.

And do you think only your loved ones know your date of birth? Think again. Anyone can find it either on your social networks, or perhaps on the website of the Commercial Register.

2. You write your password on a piece of paper

Whether you stick it to your monitor, hide it in your wallet or type it into your phone, one thing always applies: it is a very bad idea. 

3. You enter your password in front of other people

If you log in anywhere other than the safety of your own home, be careful: watch out for strangers and for any cameras. Watching your keyboard while you type is still one of the most widely used ways of finding out a password. Be careful.

4. You use the same password in several places

Yes, we know. It is simpler that way. And there are dozens of services that need a password. Even so, we urge you to stick strictly to the rule “each service, a different password”.

The reason is simple. If an attacker obtains your password for any service, they may gain access to a number of other places too. The original loss of the password may not even be your fault: unfortunately, it is still the case that not all internet service providers take care of their users' security as much as they should. 

By the way, do you remember the well-known cases in which the large services LinkedIn and Dropbox admitted that the data of millions of their users had leaked to the public? Passwords, among which might have been yours, were then sold on the black market. At the start, however, there was weak security on the servers where the services stored users' passwords.

5. You register on suspicious servers

Do you really know where you are logging in? And who can “see” all your sensitive data on the internet? Even if you are convinced that nobody can, be careful: you may, even if unknowingly, reveal your password and other details to an operator who does not necessarily have the best intentions towards you. 
How hackers get hold of your password

In the world of security – and internet security in particular – unfortunately nothing is simple. Because even when you make no mistake (or make only the smallest one), you can still lose your password (and access to important applications). Hackers know very well how to get hold of passwords. Especially other people's.
Phishing: cast the hook… and catch

TIP: Read the article How to recognise phishing and how to protect yourself from it.

Phishing – that is, fraudulent e-mails – is today the most common type of internet attack aimed at getting hold of your sensitive data. In the last two years alone, almost half of the Czech companies that reported a cyber attack encountered this kind of cyber crime. And attacks on mobile networks are on the increase too.

The word phishing comes from the English “fishing”, and it describes the activity of internet fraudsters very aptly. They send e-mail messages to all sorts of addresses, trying to “catch” as many victims as possible.

What does such an attack look like? Imagine opening your mailbox and, besides the usual post, finding a new e-mail from your bank. With alarming content: your password security has been breached, and to prevent you losing money, you must change your password immediately. The e-mail, of course, also contains a direct link to your internet banking page.

With one big “but”. Even though the page you are taken to after clicking looks almost exactly like your bank's page, if you look at the address bar you will find that you are in fact on a completely different website – albeit with an identical design.

Yes, you have understood correctly. It was a close call – you were just about to hand your internet banking password over to cyber criminals. It is enough to use common sense. Think about it – would a bank really want you to enter your sensitive details via e-mail?

Sniffing: beware of who is watching

The word sniffing comes from the English “to sniff”. It describes very well what sniffing actually involves. Put simply, it is a specific technique that makes it possible to “eavesdrop” on the flow of data communication – including passwords.

For you as a user this means just one thing: do not enter your passwords on public, unsecured Wi-Fi and, where possible, do not log in to services that do not use the secure HTTPS protocol. Otherwise, someone who should not be there may “listen in” on your password.

Dictionary attack: trying every possibility

Do you use a specific word as your password? Then you have a problem. The length of your password does not matter much. Using a so-called dictionary attack, hackers go through all words one by one (from the most used to the less common ones), and sooner or later they come across yours too. (To give you an idea: today's computers can find a simple password consisting of a specific word using a dictionary attack in just a few milliseconds!)

By the way, do you remember 2013, when huge text files containing 152 million user names and passwords, which hackers had obtained from poorly secured Adobe servers, began to spread across the internet? Hackers also use passwords obtained in this way as a new dictionary. And 150 million passwords – that is quite a sizeable sample.

Brute force: demanding on performance

The principle of the method simply called “brute force” is straightforward. Using a powerful computer, hackers try to “solve” your password like a secondary-school combinatorics problem. Put in human terms: they simply try all the possibilities, one by one.

In this context we have one good piece of news and one bad. The bad news first: thanks to this method, hackers can get to any password in the world. And the good news? If you have put some effort into your password, it may take them hundreds of years. The rule always applies: the more complicated the password, the more time cyber criminals need to crack it. (This is, by the way, why most services today require a minimum password length and the use of special characters when you enter a password.) 

This is a clear message for you: the more special characters, numbers and lower and upper case letters you use in your password, the harder you make life for hackers and cyber criminals. And the more you can be sure that your password (and your privacy) is safe.

Stay safe on the internet. Here are a few tips

After reading the previous paragraphs, do you feel that the fight for your privacy on the internet is lost before it starts? Fortunately, it is not all so bleak. Although hackers today have many tools for breaking your password, it is enough to follow a few principles and you will be safe.

1. Create a secure password

A secure password should contain at least eight characters, both lower and upper case letters, and a special character or characters (for example an at sign, a hash sign and so on). The word you use as a password should not appear in any dictionary. Avoid having the password contain your user name or the name of the service you are logging in to. And consistently follow the rule “each service, a different password”.

2. Activate two-factor security

Where the service you are logging in to allows it, also activate so-called two-step authentication for your login.

How does it work? Simply: whenever you try to log in to the service, you will be asked, in addition to your password, to enter a security code (which usually arrives on your mobile). The advantages are clear: even if an attacker gets hold of your password, it is very unlikely that they would also gain access to your mobile phone at the same time.

3. Forget about security questions

Your mother's maiden name, your favourite film or the name of your pet. If you have activated so-called security questions for any service you use, stop reading straight away and go and deactivate them. They are one of the biggest mistakes in the history of internet security, and also one of the biggest security holes of all.

Wondering why? Imagine you forget the password to your e-mail. No problem – you just enter your mother's maiden name. A few seconds later you are looking at your inbox again and sending e-mails to friends.

Except that it is not you – it is a hacker (or “just” someone who does not like you very much) who has got into your mailbox in this simple way. And they needed almost nothing: using social engineering alone, they found out what your mother's maiden name was. And in the age of the internet, that is not a particularly difficult task, is it?

4. Be careful where you log in

Internet security is a major topic of our time. Unfortunately, not all website and service operators have caught on to this. And they do not give your password (or the passwords of other users) anything like the care it deserves.

To ensure the security of their users, most internet operators today use so-called “hashed” databases to store passwords. Put simply: not even they can “see” your password, because it is stored in the database in an encoded (hashed) form. (This is also why, if you try to remember a forgotten password, the e-mail that arrives does not contain the password itself, but a code with which you can generate a new one. The operator does not know your password.)

Other operators, unfortunately, are not so responsible. How can you tell the first kind from the second? Simply: when you click “Forgotten password”, an e-mail arrives with the exact wording of your password. For you this is a clear message – that service does not bother about password security and stores passwords in unsecured databases. Get away from such a service as quickly as you can!

5. Do not save passwords in your browser

Yes, it is convenient. And individual browsers practically invite you to do so. One click and you no longer have to enter your password, because the browser remembers it for you and logs you in automatically on every visit.

However, saving your passwords directly in the browser is a very bad idea, for two reasons. Some attacks are aimed not so much at your password as at access to your computer. Once a hacker succeeds, along with access to your computer they also gain complete access to all the services whose login details you have saved in the browser.

What is more, breaking the security of passwords stored in a browser is much easier for hackers than breaking passwords commonly stored in various cloud services. Security experts recently pointed out scripts that can secretly extract stored data from browsers.

6. Use a password manager

First, a short recap. For your password to be truly secure, it must be sufficiently long, consist of different types of characters and, moreover, be unique for each service. Is that easier said than done? You are right. It is not humanly possible to remember such a large number of different combinations – which is why most users do not bother about security and store their passwords on their phone, or even write them on paper stuck to the monitor.

Fortunately, some developers have realised this too, and came up with so-called “password managers”. These are applications which remember all your passwords for you and, to make things even easier, can even help you come up with a password that is truly secure. All you then have to do is remember the master password with which you log in to your password manager.

Among the most popular password managers are LastPass, which, besides securely storing your passwords, offers synchronisation across devices, including mobile phones. Another popular password manager, 1Password, works in a similar way and also lets you upload your documents to the service (1 GB is available). Unlike LastPass, however, you cannot use it completely free of charge.

TIP: We recommend reading one of our most successful articles, Ten rules for staying safe online

A future without passwords?

Experts have long agreed that internet security will be one of the major topics of the coming years. And no wonder: our work and our lives are moving onto the internet, and the question of security and privacy will play an ever greater role.

The same experts are also coming up with a breakthrough view: our future could be a world in which all passwords disappear once and for all. For one reason: it is said to be a technology that has long since left today's world behind – a world in which biometrics is increasingly prevailing. According to them, the future lies in our biometric data.

And to be honest, it makes sense. Is there really a more secure access credential than your voice, a fingerprint or an iris scan? Experts today, and especially representatives of large technology companies, discuss this intensively. And they are slowly putting the results of their thinking into practice. 

In just a few years' time it may turn out that Touch ID or Face ID, which we are used to using today to unlock our phones, were in fact just the beginning of something much bigger. 

Besides carefully chosen passwords, internet security is also ensured by a reliable, protected connection. Connect to the internet with us at UVT, or you can also read the article Scare-and-invoice business practices of some antivirus companies are slowing down your internet.

Updated 5 March 2024