Password Mistakes That Hackers Hope You’ll Make
Online security experts share the seemingly innocent habits that are putting your privacy—and even your finances—at risk.
Common mistakes, big problems
Password hacking is in the news with alarming regularity. Recently, thousands of Disney+ customers lost their accounts in a mass hack attack within days of the new streaming service’s launch. As reported by The Market Realist, those hacked accounts were then sold on the dark web. While large-scale attacks like this can make consumers feel helpless, there are steps we can all take to protect our passwords and our data. Some of them are common sense (don’t use the same password for every site!), and some aren’t quite as obvious. Read on to learn the most common password mistakes that hackers hope you’ll make.
Choosing an easy-to-guess password
“Common mistakes people make with passwords make them easily hackable. Those mistakes include using easy passwords like birthdays, creating common passwords like 1234, using brand names, pop-culture references, or sports to create a password.” —Elias Manolopoulos, founder of Aeon Ads
You’ll want to change your settings immediately if you use any of these weak passwords.
Not including enough numbers and special characters
“Try to inject as many symbols and numbers and a variety of characters that make your password fairly unique for an unknown entity to guess, but relatively easy for you to remember. Substituting symbols for alphabets is also a good idea as long as the choice of word is fairly complex, so [email protected]! instead of kresteva798! could work, but decades-old [email protected]$$w0rd! would not.” —Ax Sharma, cybersecurity researcher and engineer
Learn to spot the signs your phone has been hacked.
Using the same password for multiple sites
“Using the same password to log in to every account is a critical mistake that many people make. Even with just one set of log-in credentials, hackers can log into other sites using the same email and password. They, often correctly, assume that users will have the same password across platforms.” —Alex Heid, Chief R&D Officer at Security Scorecard
Here are 20 cybersecurity secrets hackers don’t want you to know.
Never changing your passwords
“There are some users who recommend changing your password every year, which is reasonable to consider if it isn’t too much of a burden. However, this can be tedious and unnecessary for power users with hundreds of online accounts that already have strong, unique passwords, so in this case, we just recommend changing new passwords as vulnerabilities to affected services are brought to light.” —Colt Agar, Managing Editor at TheTechReviewer.com
Find out the latest online scams (and how to avoid them).
Creating a password that’s too short
“It is advisable to choose passwords of a significant length, preferably greater than 15 [characters]. This makes passwords resistant to both online brute-forcing as well as offline hash cracking.” —Sudeep Singh, cybersecurity expert and author of the research paper Breaking the Crypt
Here are more secrets to steal from people who never get hacked.
Ignoring data-breach news
“Data from breaches gets distributed to the bad guys. The data from the LinkedIn breach is out there for anyone to use. If your password gets exposed in one breach, then every account where you reused it is at risk. It is not a question of if your data will get exposed—it is just a matter of when. Unique passwords for each account limits your exposure. Assume you used the same password for 20 sites and one of them gets breached; you now need to change the password on 20 sites instead of one.” —Tom Evans from Ashton Technology Solutions
Here’s how one man fell for an email scam (and you could too).
Opting for impossible-to-memorize passwords
“There are some online password generator services or offline random password generators that generate a long string of random characters which are not possible to memorize. While these passwords look very secure, they are not easy to use due to the difficulty in memorizing them. People who use such long randomized passwords tend to save the passwords on a piece of paper or a note on their phone or computer. This makes the passwords vulnerable to discovery by someone else.” —Singh
Be on the lookout for these common Facebook Marketplace scams.
Storing passwords in places that aren’t secure
“There are a number of very secure password-storage services out there. Google has a built-in password manager to its online account that can be used with Chrome and other Google apps. Apple, of course, has its keychain that can store password and account information. And there are third-party providers of password-management services. Unless you fancy carrying around a notebook of passwords at all times—I do not suggest this!—you need to look into one of these solutions.” —Jason David, CEO of Software Portal
Make sure you never store this on your smartphone.
Slightly modifying your password
“Everyone does it. You get the pop-up on your screen, ‘Cannot use the same password,’ so what do you do? Add a number at the end of it and we think we’ve hacked the system. Well, research shows that modifying passwords slightly is extremely common and also very predictable.” —Jay Lee, uAcademy
Make sure you never do this when accessing public Wi-Fi.
Using malicious password generators
Here’s how to clear cookies from your phone (and why you should).
Choosing passwords you can’t remember
“I find that the most effective passwords meet a couple of criteria. First, they are complex in length and structure, use no or few words, and can be easily remembered. Phrases from lyrics and rhymes work for me. Take Jack and Jill as an example. There are many different passwords a user could create simply from a nursery rhyme that has nothing to do with your family, pets, dates, or locations and can be easy to remember. J&JwUth3H1ll or J4ckAJ1llwUptH1!! These are strong passwords yet memorable.” —Terry Ray, Senior Vice President at Imperva
Not using a reputable password manager
“How can you keep track of all of these passwords? Not on sticky notes or on files you save to your computer called passwords! We recommend simple-to-use password managers such as LastPass or similar to securely manage your passwords and secret ‘codes.'” —Greg Keller, Chief Strategy Officer at JumpCloud
Next, find out why you need to stop commenting on those viral Facebook memes.