How to steal someone else's password

[Объединенное Детективное Бюро]

So many people use the same passwords. And not only the same combination, but also one that can definitely be considered easily selectable. Internet expert, director of iFusion Labs and blogger John Pozadzides described which passwords can be used and which are not, and how to crack a weak password. Attention: this is NOT a guide on “How to steal a password”, but an adapted translation of the “Rformer” of a Lifehacker article with an attempt to explain how vulnerable your current password can be. According to Alldayplus.ru, the top 20 passwords of the Runet look like this: 12345; 123456; 11111; 55555; 77777; qwerty; 111111; 00000; 666666; 123456789; 54,321; 123321; 1234567; 123,123; gfhjkm; 7777777; qwert; 22,222; 555555; 123. In terms of statistics, the top 10 passwords are used by 20% of the network population. But don’t worry: if the hacker didn’t get your password now, it means that he just needs a little more time ... Hackers, and I'm not talking about their ethnicity, have developed a wide range of different tools to steal your personal data. The main obstacle to these scammers is still the password that you yourself have chosen: ironically, the best information protection people have is the one they take least seriously. The easiest way to get someone else's password is to use the brute force method (brut-force, "brute force"), when the password is selected virtually manually using a special program. So, how do you understand if you are at risk? Pretty simple. Follow my logical chain: - You use the same password several times in different places. - Some sites important to me, such as the Internet bank or your workplace connected via VPN, have a decent level of security, so I won’t touch them. - However, sites like the Hallmark postcard service, your favorite online forum, the online store where you are buying, are unlikely to be properly protected. So I will try to do something with them. - Thus, my next step is utilities like Brutus, wwwhack, THC Hydra, which will be applied to any of these services with the instructions to pick up 10 thousand (well, or 100 thousand - it doesn’t matter) user and password combinations as fast as it generally perhaps. - As soon as I get a pair of login and password, I can try it on other sites. - Uh, stop. How do I know how you use the bank, and which login do you use most often? In secret - all this is recorded in cookies (cookies), which are stored in the browser in unencrypted form and with excellent, “speaking” names. How fast can this whole scheme be implemented? Well, it depends on three things: the length and complexity of your password, the power of the hacker computer and the speed of its Internet connection. As a rule, hackers have a rather powerful machine and fast Internet, so let's try to estimate the approximate time of password guessing depending on its length, complexity and taking into account all possible common combinations. Also pay special attention to case letters and special characters. Adding only one letter or the symbol “*” to the greeting that the eight-character password will be selected not for 2.4 days, but for more than two centuries. Please note that this is only an approximate calculation time on an average computer, and this table assumes that any word from the dictionary is used. If Google had connected its computers to work, it would have ended 1,000 times faster. Now I can sit for hours and try to break you down to make you completely unhappy - and 95% of these methods use primarily your weak password. So what prevents you from protecting yourself better and calmer at night? Believe me, I understand that more than different complex passwords are more difficult to remember. But try, at least for a start, to create a password that, although it will be easy for you to remember, it will never occur to others. And here are some more tips on this subject: 1. Replace some of the characters with similar ones. For example, “o” can be replaced with “0” or “@”. For example, koza will look like k03a. 2. Capitalize part of the letters in the password, as Vkontakte students do: for example, M0dIfIeD. 3. Think of the name of someone close to you. But do not use this name on its own - better add a dictionary word to the name, and this will be the easiest defense against brute force. 4. Favorite place, car brand, vacation experience, favorite restaurant are also suitable. 5. You really need to use different combinations of login and password everywhere. Remember, from a technical point of view, you can break into anywhere if you know that you use standard passwords. This feature will not work if you use different passwords everywhere. 6. Since it is difficult to remember which passwords and where you use, I recommend saving them in special crypto-programs, for example, Roboform for Windows. It stores all your passwords in encrypted form, and you only need to know one master password to access them all. Roboform also automatically fills out forms on web pages and can even be installed on a PDA, mobile phone or flash drive. (Lifehackers readers love to use the open-source KeePass program, which serves the same purpose and is cross-platform.) Mac and iPhone users can use the 1Password utility. 7. Thinking of a new password? Try the Microsoft Password Checker utility and see how good it is. And here is a video that shows how Roboform is used. Another aspect that I would like to touch upon is the importance you attach to passwords. Those that you think of as insignificant can actually mean a lot. For example, the password from the mailbox - many people think that this is nonsense, because there is nothing particularly important there. And the fact that e-mail is associated with your account in the Internet bank - for example? If I break into your mailbox, I can access your bank account - saying that I forgot my password and ask you to send it. Do you still think it doesn’t matter? Many people think that they are protected by their router or firewall if they store all their passwords at home. And of course, they never change passwords from their devices by default! Therefore, anyone can drive up to the house, sit down with a laptop on the landing and violate the security of the wireless network, and then do brute force until they get complete control over your network. Every day we come across people who over-inflate a particular problem, making an elephant out of a fly. But believe me - this is not the case. There are still fifty different options that are disadvantageous for you that can compromise you with a weak password. I don’t even want to mention them. I also understand that most people just don't care about all this - naturally, until they are taught a good lesson. But do me a favor, and yourself too - spend a little time and strengthen the protection of your passwords! So that I know that my words were not in vain. Selected comments on the original Barts article: “Because I read a lot, I use passwords that have roots in forgotten or Eastern European languages, and it’s easier to remember them if these words have any meaning for me. I can add an asterisk or underscore to them, but I’m sure that my passwords cannot be guessed. For example, the number of my diploma or the number of the prisoner that my grandfather had in a concentration camp. For example, I started with the Aramaic version of my name: “Bartholomew” - in the original, this name sounded like “Bar Tolmai”, son of Ptolemy (mathematician or astronomer). The Tolmai bar can be represented as B4r T01m4i, 84r-T01m4i or B4r_ + 01m41 (but this is already for maniacs). And voila - the 10-digit password is ready. If I need to make an even more secure password, I can add the number 5669, these are the last digits from the number of the old car of my parents in Poland, when this country was still part of the Soviet occupation zone (and by the way, these are not real numbers). And for less significant sites, for example, gaming or just computer forums, I use from time to time simpler passwords, for example, Sekigahara1600 - simply because it is convenient for me to remember the date and time of this historical battle. ps Don’t be silly, I DO NOT use any of these passwords in reality "kityglitr:" I am perfectly protected, all my passwords are unique and change monthly ... dudes, this is driving me crazy. There is nothing to be done, however, you need to worry less about it. ” minealone6: "¿ʚ ʚ ʚ ʚ ʚ ɔ ɔ ʇʎ ʇ ʇ ʇɔ ʇɔ ʇɔ ʇɔ ʇɔ ʇɔ и q q w D D D D" DharmaLab: "You can, for example, double each letter, even if you use weak qer, q. You can double the word, even with capitalization of letters: “passwordPASSWORD. You can also draw virtual forms on the keyboard: say, a 2x2 square. And also with capitalization - 12qw! @Qw ". ultraaman: “And no one can pick up my password! Because I use the brand of my favorite toy car when I was not told how old. I have a good choice, right? ” ragincajunnyc: “In addition to the above, I would like to note that unique logins are not allowed everywhere. There are a bunch of services that use an e-mail address like netflix@domain.com , newegg@domain.com [/ email as a login ] etc. In this case, it becomes much easier to select passwords, especially if you have a computer with a powerful processor. ” heckler95: “But I like to use the first letters of sentences, phrases, or lyrics of songs, including punctuation and numbers, to the proper extent. For example, a password based on a UPS slogan (“What can brown do for you?”) Would look like this: UPSWcbdfy. No vocabulary words. Registers, special characters, numbers. But the main thing is not to forget all this later. ” John Steele: “The article is very interesting ... from a theoretical point of view. But what about practice? Okay, let's assume that I'm using a password with five characters in different case. Suppose I have a Hallmark account. And fast internet. Well, does Hallmark really not notice if you send thousands of requests from one IP within 10 hours? Many systems do not allow more than four attempts in two minutes. ” Jsmorley: “I personally use only 4 passwords. One of them is on sites that are not particularly important for me, they are approximately 80% of the total. One I use ONLY for my bank account. I use one on Google, including my public Gmail account. And one password - for a private Gmail mailbox. They are all strong to the extent necessary. And with this approach, I have never had a problem with a stolen password; they may not be “for centuries”, but “for years” - exactly ”. Toothball: “And I use serial numbers from my gadgets. For example, my MP3 player has a 12-digit serial. Simple and effective - if I forget the password, I’ll just turn the player over and look at its underside. ” The link is not valid

 

[Бедеров Игорь Сергеевич]

A good way is described - to divide the sites into categories and highlight separate passwords for them. :!: