Online Safety: Password Security in the Age of Data Breaches

Here are our key findings and recommendations for password security in 2024.

The Password Basics:

Password Reuse is Rampant and Dangerous: The research emphasizes the widespread problem of password reuse, making users vulnerable to credential stuffing attacks. This tactic allows cybercriminals to gain access to multiple accounts by leveraging compromised login credentials from a single source. The analysis of 721 million exposed credentials found that:

According to Consumer Reports: 72% of individuals with multiple exposed passwords reused them across different accounts in 2022, a significant increase from 64% in 2021.

“If that one password you use over and over again is exposed in a data breach, it’s easy for cybercriminals to use a kind of attack called credential stuffing…and gain access to your social media, banking information, and more.”

Strong and Unique Passwords are Essential: The document stresses the importance of creating strong, unique passwords for each online account. This means avoiding common passwords, personal information, and default passwords provided by manufacturers.

A 7-Step Guide to Creating and Using Safe, Secure Passwords

In today’s digital world, securing your online accounts is more important than ever. Strong passwords are the first line of defense against hackers and cybercriminals who seek to access your sensitive information. Here’s how you can create and manage safe, secure passwords:

1. What Makes a Password Secure?

A strong password has the following characteristics:

• Length: Aim for at least 12-16 characters. The longer the password, the harder it is to crack.
• Complexity: Include a mix of uppercase and lowercase letters, numbers, and special characters (such as @, #, $, &).
• Unpredictability: Avoid using obvious information such as your name, birthday, or common words like “password123”.
• Passphrases: A random combination of words or a phrase that is easy to remember but hard to guess (e.g., “PurpleBanana$Waterfall22”).

2. Creating Strong Passwords

Use Passphrases

Instead of a random assortment of letters, consider using a series of unrelated words. For example, “Turtle$Mountain*SkyBlue77”. This approach makes it easier to remember while still difficult for hackers to guess.

Incorporate Special Characters

Adding special characters makes it harder to crack passwords through brute-force attacks. For example, a password like “MyHouse!2024” is much stronger than just “MyHouse2024”.

Avoid Common Passwords

Steer clear of common passwords like “123456,” “password,” or any password that uses easy-to-find personal information like your pet’s name or your favorite sports team.

3. Managing Passwords Safely

Use a Password Manager

A password manager can help you generate and store complex passwords securely. Popular password managers like LastPass, Dashlane, and Bitwarden can store your passwords in an encrypted vault, which only you can access.

Never Reuse Passwords

Each of your online accounts should have a unique password. This way, if one account is compromised, it doesn’t put all your other accounts at risk.

Update Passwords Regularly

Set reminders to update your passwords periodically (every 6-12 months). This practice reduces the risk of someone gaining long-term access to your accounts without your knowledge.

4. Avoiding Password Pitfalls

Avoid Using Sequential Numbers

Passwords like “abc123” or “qwerty” are highly predictable and should be avoided.

Don’t Use Personal Information

Avoid using easily accessible information such as your address, phone number, or anything visible on social media profiles.

Don’t Write Passwords Down (Except in a Secured Password Logbook)

While it may be tempting, avoid writing your passwords down where they can be found, especially in unsecured locations. You can use a secured password logbook that is kept under lock and key to provide a failsafe backup of your passwords – also a password logbook can give trusted family members access to your accounts in an emergency. SCARS Institute offers a special-purpose password logbook at the SCARS Institute Bookshop (shop.AgainstScams.org)

5. Additional Security Measures

Enable Two-Factor Authentication (2FA)

Where available, enable two-factor authentication for an added layer of security. This requires you to enter a secondary code sent to your phone or email, ensuring that even if someone has your password, they can’t access your account.

Check for Password Breaches

Regularly check if your passwords have been compromised in known data breaches by using services like Have I Been Pwned. If your password appears in a breach, change it immediately.

Use Biometric Security

If possible, enable biometric security (e.g., fingerprint or facial recognition) for accessing your devices and accounts.

6. Password Managers: Enhancing Security with Tools Like Bitwarden

Password managers are powerful tools designed to help you create, store, and manage complex passwords securely. By using a password manager, you can generate strong, unique passwords for each of your accounts without needing to remember them all. One of the most trusted and secure password managers is Bitwarden, which is used by organizations like SCARS (Society of Citizens Against Relationship Scams) for securing sensitive information.

Why Use a Password Manager?

Enhanced Security: Password managers generate complex, random passwords that are hard to crack. Since you don’t need to remember these passwords, you can create stronger ones.

Convenience: They save and autofill your passwords, so you don’t have to type or memorize them.

Encrypted Storage: Password managers store your passwords in an encrypted vault, which only you can access with a master password.

Sync Across Devices: Password managers like Bitwarden allow you to access your passwords from any device securely, whether you’re on your phone, computer, or tablet.

Bitwarden: A Trusted Password Manager

Bitwarden is an open-source password manager known for its robust security features and transparency. Here’s why it’s a popular choice:

Open Source: As an open-source tool, Bitwarden allows its code to be reviewed by security experts, ensuring that vulnerabilities are identified and patched quickly.

Strong Encryption: Bitwarden uses end-to-end encryption, meaning your passwords are encrypted before they leave your device, and only you can decrypt them.

Cross-Platform Availability: Bitwarden works on multiple platforms, including Windows, macOS, Linux, iOS, and Android, and integrates with all major browsers.

Two-Factor Authentication (2FA): Bitwarden supports 2FA, adding an extra layer of security beyond just a password.

Free and Premium Versions: Bitwarden offers a free version with essential features, while the premium version offers advanced options like security reports and encrypted file storage.

How to Get Started with Bitwarden

Create a Master Password: When setting up Bitwarden, create a strong master password that only you know. This is the key to accessing all your saved passwords.

Store Passwords Securely: Once your account is set up, you can store passwords for all your online accounts in Bitwarden’s encrypted vault.

Generate Strong Passwords: Use Bitwarden’s built-in password generator to create strong, random passwords for each account.

Sync Across Devices: Install Bitwarden on all your devices, so you always have access to your passwords securely.

By using a password manager like Bitwarden, you can ensure that your online accounts are protected by strong, unique passwords without the hassle of remembering them all. This tool simplifies the process of maintaining good password hygiene and significantly enhances your overall digital security.

7. What To Do If Your Password Is Compromised

1. Change the Password: Immediately update the password for any compromised accounts.
2. Enable 2FA: If you haven’t already, enable two-factor authentication on all sensitive accounts.
3. Monitor Accounts: Check your account activity for suspicious behavior.
4. Notify Affected Parties: If your password compromise impacts others (e.g., shared accounts or services), notify them promptly.

Conclusion

Creating and using strong, unique passwords is critical for protecting your online identity and sensitive data. By following these guidelines and utilizing tools like password managers and two-factor authentication, you can significantly reduce the risk of a security breach. Remember, your digital security is only as strong as your weakest password—stay vigilant and proactive!

More Information

• Password Safety Check – How Safe is Your Password?
• BitWarden Password Manager (used by SCARS Institute)
• Have I Been Pwned? Check for your passwords in Data Breaches
• Consumer Reports
• Recommended Anti-Virus/Malware:
  • Malwarebytes (used by SCARS Institue)
  • BitDefender