Sign In
Create Account
Reset Password
Thread
Drew Geishecker
@drewg
A
This #password chart is making the rounds again and, as someone who's spent a career building large-scale (500M+ acct) #authentication systems, it is absolutely *wrong*.

And I don't want folks lulled into a false sense of #Security with its guidance.

Let me explain why... a 🧵
#onlinesafety
1/12
A color-coded table titled: "Time It Takes a Hacker to Brute Force Your Password in 2022." The Y axis is Number of Characters (4 to 18) and the X axis is Numbers Only, Lowercase Letters, Upper and Lowercase Letters, Numbers/Uppercase and Lowercase Letters, and Numbers/Upper and Lowercase Letters/Symbols. It purports to show the amount of time required to hack the password based on the two axes, ranging from Instantly with numbers only passwords less than 12 characters to 438 trillion years for 18-character passwords with the most combinations of characters.
06:05 PM - Mar 06, 2023 (Edited)
Avatar
0
11
Quote Spout
Echo / undo
1
Drew Geishecker
@drewg
A
In response to Drew Geishecker.
If you read the methodology by which they calculated these numbers, it’s based on several non-real-world assumptions:

1. That the system being hacked has implemented almost no protections against brute force attacks. This is almost never the case.
2/12
06:06 PM - Mar 06, 2023
1
Quote Spout
Echo / undo
0
Drew Geishecker
@drewg
A
In response to Drew Geishecker.
Every system has different levels of safeguards — making the very existence of an accurate chart like this impossible.

But if you use the same #password on multiple sites, you’re only as safe as the weakest link among them. So, don’t.
3/12
06:06 PM - Mar 06, 2023
1
Quote Spout
Echo / undo
1
Drew Geishecker
@drewg
A
In response to Drew Geishecker.
2. That the individual attempting a brute force attack is using average consumer-level computational power.

Sure, there are a lot of individual bad actors out there, but they’re not your (or companies’) primary concern and the real threat comes from far more sophisticated hacking networks.

4/12
06:07 PM - Mar 06, 2023 (Edited)
1
Quote Spout
Echo / undo
0
Drew Geishecker
@drewg
A
In response to Drew Geishecker.
3. Per the chart, it would take 438 trillion years to hack a #password with a combo of 18 numbers, upper & lowercase letters and symbols.

Complete nonsense.

5/12
06:08 PM - Mar 06, 2023
1
Quote Spout
Echo / undo
0
Drew Geishecker
@drewg
A
In response to Drew Geishecker.
If your 18-letter #password is two or three dictionary words with capitalized first letters and you swap out 5 for S’s, @ for A’s and 1 for I’s, for example, you’ve met all the rules.

But you still have a *lousy* password.

And a sophisticated hacker can compromise those quite quickly.

6/12
06:09 PM - Mar 06, 2023
1
Quote Spout
Echo / undo
0
Drew Geishecker
@drewg
A
In response to Drew Geishecker.
As directional guidance, sure, the longer the password with different cases and symbols, the better. But the chart’s numbers are all garbage, and none of this is sufficient.

Instead, here are three tips for much better protecting yourself online:

#onlinesafety #Security
7/12
06:09 PM - Mar 06, 2023
1
Quote Spout
Echo / undo
0
Drew Geishecker
@drewg
A
In response to Drew Geishecker.
1. Use a password manager. There are paid versions and free versions. Just read up and take your pick:

8/12
wired.com
IMG
5 Best Password Managers (2022): Features, Pricing, and Tips | WIRED

Keep your logins locked down with our favorite apps for PC, Mac, Android, iPhone, and web browsers.

06:10 PM - Mar 06, 2023
1
Quote Spout
Echo / undo
1
Drew Geishecker
@drewg
A
In response to Drew Geishecker.
2. Enable two-factor auth (2FA), if available.

This is per site, so it’s not supported on all, but if it is, turn it on.

Search the site’s Help or Account sections to find it.
9/12
techradar.com
IMG
Best authenticator apps of 2023 | TechRadar

We list the best two-factor authenticator apps, to make it simple and easy to improve your online security.

06:11 PM - Mar 06, 2023
1
Quote Spout
Echo / undo
1
Drew Geishecker
@drewg
A
And, as discussed with Twitter’s decision to disable SMS as a #2FA option, authenticator apps are more secure than SMS. Most are free.

Though safer, these apps make logging in a bit more tedious than using SMS. And SMS is still good protection.

So, just make an educated decision.
10/12
In response to Drew Geishecker.
06:11 PM - Mar 06, 2023
1
Quote Spout
Echo / undo
0
Drew Geishecker
@drewg
A
In response to Drew Geishecker.
3. Migrate to #FIDO (Fast Identity Online) password-less login when it rolls out.

This is a more secure authentication standard to get people off of passwords entirely, developed by Google, Apple, Microsoft and others.
11/12
forbes.com
IMG
The Benefits Of Passwordless Authentication And How To Choose The Right Method

You’re probably seeking ways to reduce the friction your customers face when they log on to your website or app. One of the biggest obstacles that you can help them overcome is the frustration of struggling with password-based login methods.

06:12 PM - Mar 06, 2023
1
Quote Spout
Echo / undo
1
Drew Geishecker
@drewg
A
In response to Drew Geishecker.
Again, FIDO needs to be implemented by each site individually, but it’s already rolling out and as soon as these big players all adopt it, you can be assured it will deploy quickly elsewhere.

Not only because it’s safer, but it’ll also be a lot less work for you.
#onlinesafety #Security

/end
06:12 PM - Mar 06, 2023 (Edited)
0
Quote Spout
Echo / undo
0

 

{{ notificationModalContent }} {{ promptModalMessage }}
Trending Splashtags
#caturday
#music
#tile
#dailypicturetheme
#catsofspoutible
Show More