The Strongest Passwords and the Best Way to Create (and Remember) Them

Some of the strongest passwords you can use are the ones you don’t have to remember.  Strange as that may sound, it’s true, if you use a password manager. A password manager creates and securely stores strong, unique passwords for each of your accounts—and does all the remembering for you.  And remembering is the root of the problem when it comes to insecure passwords.  Consider how many passwords you have across all your accounts. Then consider the old passwords for accounts and online forums you no longer use, along with all the times you created a password for an online store that you only shopped at once or twice. All those passwords, it’s too much to keep track of, let alone manage. And that leads to insecure passwords. Simple passwords. Or passwords that get used again and again across several accounts.  Hackers count on that. They love it when people use simple passwords, reuse passwords, grab passwords out of the dictionary, or base their passwords on their pet names that a hacker can easily glean from a victim’s social media posts. They also love “brute force” tools that help them break into accounts by quickly feeding account logins with thousands of potential passwords in minutes.   So when you make your life easier with simple or reused passwords, you make life easier for hackers too.  That’s where a password manager comes in. It makes life easy for you to stay secure while still making it tough on hackers—particularly tough with strong, unique passwords for each of your accounts that can you update on a regular basis, which offers some of the strongest protection you have against hackers hijacking your accounts. 

The difference between a good and bad password  

First up, let’s look at password practices in general while keeping a few things in mind. Hackers will look for the quickest payday. In some cases they’ll work with a long list of accounts that they’re trying to break into. If a password on that list proves difficult to crack they’ll move on to the next in the hope that it’ll have a poor password that they can easily crack. It’s a sort of hacker economics. There’s often little incentive for them to spend extra time on a strong password when there are plenty of weak ones in the mix.  So what do poor passwords look like? Here are a few examples: 

• Obvious passwords: Password-cracking programs start by entering a list of common (and arguably lazy) passwords. These may include the simple “password” or “1234567”. Others include common keyboard paths like “qwerty.” Even longer keyboard paths like “qwertyuiop” are well known to hackers and their tools as well. 
• Repeated passwords: You may think you have such an unbreakable password that you want to use it for all your accounts. However, this means that if hackers compromise one of your accounts, all your other accounts are vulnerable. This is a favorite tactic of hackers. They’ll target less secure accounts and services and then attempt to re-use those credentials on more secure services like online bank and credit card companies.  
• Personal information passwords: Passwords that include your birthday, dog’s name, or nickname leave you open to attack. While they’re easy for you to remember, they’re also easy for a hacker to discover—such as with a quick trip to your social media profile, particularly if it is not set to private. 

On the flip side, here’s what a strong password looks like: 

• Long: Without getting into the math of it, a longer password is potentially a stronger password. When you select from the entire available keyboard of numbers, letters, and symbols, a password that is 12 characters long is far, far more difficult to crack than one with only five or even seven characters. And while no password is entirely uncrackable, taking that number up to 16 characters pushes your password into a highly secure category provided it doesn’t rely on common words or phrases. 
• Complex: To increase the security of your password, it should have a combination of uppercase letters, lowercase letters, symbols, and numbers. Hacking algorithms look for word and number patterns. By mixing the types of characters, you will break the pattern and keep your accounts safe. 
• Unique:  Every one of your accounts should have its own password. This is particularly true for sensitive accounts such as your financial institutions, social media accounts, and any work-related accounts. 
• Updated: While you may have an undeniably strong password in place, it’s no longer secure if it gets stolen, such as in a data breach. In this case, updating your passwords every several months provides extra protection. This way, if a hacker steals one of your passwords in a breach, it may be out of date by the time they try to use it because you updated it. 
• Backed by Multi-Factor Authentication (MFA): MFA offers another layer of protection by adding another factor into the login process, such as something you own like your phone. MFA has become a staple in many login processes for banks, payment apps, and even video game accounts when they send you a text or make a call to your phone with a security code that’s needed to complete the login process. So while a hacker may have your password, they’d still be locked out of your account because they don’t that security code because it’s on your phone.  

Creating strong passwords on your own 

Long, complex, unique, and updated, all described as above—how do you manage all that without creating a string of gobbledygook that you’ll never remember? You can do so with a passphrase. A phrase will give you those 12 or more characters mentioned above, and with a couple extra steps, can turn into something quite unique and complex. Here’s a three-step example: 

1. Pick a phrase that is memorable for you: It should not be a phrase you commonly use on social media accounts. If you are an avid runner, you might choose a phrase like, “Running 26.2 Rocks!” 
2. Replace letters with numbers and symbols: Remove the spaces. Then, you can put symbols and numbers in the place of some ofthe letters. Runn1ng26.2R0ck$! 
3. Include a mix of letter cases: Finally, you want both lower and uppercase letters that are not in a clear pattern. Algorithms know how to look for common capitalization patterns like camelCase or PascalCase. Runn1NG26.2R0cK$! 

Now you have a password that you can remember with a little practice, one that still challenges the tools that hackers use for cracking passwords. 

Creating strong passwords with a password manager 

When you consider the number of accounts you need to protect, creating strong, unique passwords for each of your accounts can get time consuming. Further, updating them regularly can get more time consuming still. That’s where a password manager comes in.   A password manager does the work of creating strong, unique passwords for your accounts. These will take the form of a string of random numbers, letters, and characters. They will not be memorable, but the manager does the memorizing for you. You only need to remember a single password to access the tools of your manager.  A strong password manager also stores your passwords securely. Ours protects your passwords by scrambling them with AES-256, one of the strongest encryption algorithms available. Only you can decrypt and access your information with the factors you choose. Additionally, our password manager uses MFA—you’ll be verified by at least two factors before being signed in. 

Protecting your passwords 

Whether it’s the passwords you’ve created or the master password for your password manager, consider making an offline list of them. This will protect access to your accounts if you ever forget them. Be sure to store this list in a safe, offline place—recognizing that you want to protect it from physical theft. A locking file cabinet is one option and a small fireproof safe yet more secure.  A password manager is just part of your password security solution. For example, you’ll also want to use comprehensive online protection software to prevent you from following links in phishing attacks designed to steal your account login information. The same goes for malicious links that can pop up in search. Online protection software can steer you clear of those too.  In some cases, bad actors out there will simply shop on the dark web for username and password combos that were stolen from data breaches. An identity monitoring service such as our own can alert you if your information ends up there. It can monitor the dark web for your personal info, including email, government IDs, credit card and bank account info, and more. Ours provides early alerts and guidance for the next steps to take  if your data is found on the dark web, an average of 10 months ahead of similar services.​ 

The best password manager makes your time online more secure—and simpler too. 

A password manager takes the pain out of passwords. It creates strong, unique passwords for every account you have. That includes banking, social media, credit cards, online shopping, financial services, or what have you. The entire lot of it.   And remember, remembering is the thing with passwords. Hackers hope you’ll get lazy with your passwords by creating simple ones, reusing others, or some combination of the two because that makes it easier to remember them. That’s the beauty of a password manager. It does the remembering for you, so you simply go on your way as you go online. Safely. 

The post The Strongest Passwords and the Best Way to Create (and Remember) Them appeared first on McAfee Blog.

Strong Password Ideas to Keep Your Information Safe

Password protection is one of the most common security protocols available. By creating a unique password, you are both proving your identity and keeping your personal information safer. However, when every account you have requires a separate password, it can be an overwhelming task. While you should be concerned about the safety of your data, you also want to avoid the frustration of forgetting your password and being blocked from the information you need. However, the benefits of using strong, unique passwords outweigh the occasional inconvenience.

Benefits of Strong Passwords

The main benefit of a strong password is security. Hackers work quickly when they are trying to access accounts. They want to steal as much information as they can in as short a time as possible. This makes an account with a strong password less inviting because cracking the code is much more involved.

A strong password also limits the damage that hackers can do to your personal accounts. A common strategy involves cracking the passwords of less secure sites with limited personal information. The hackers hope that they can use the password from your gym membership app to access information in your online banking account. Strong password protection prevents this situation.

Common Poor Password Practices

When someone is registering an online account, it can be tempting to blaze through the password process. In order to move quickly, there are several poor password practices that people employ.

• Simple passwords: Password-cracking programs start by entering obvious combinations. These are passwords where the user puts no thought into the code such as “password” or “1234567”.
• Repeated passwords: You may think you have such an unbreakable password that you want to use it for all of your accounts. However, this means that if hackers compromise one of your accounts, all of your other accounts are vulnerable.
• Personal information: The number combinations that you are apt to remember easily are the ones that hackers can find. You may have put your birthday or graduation year on public display in a social media account. Your dog’s name may be unusual, but if you share information about your canine friend with the world, its name is a weak password.

The Meaning of a Strong Password

A password is considered strong when it is difficult for a hacker to crack it quickly. Sophisticated algorithms can run through many password combinations in a short time. A password that is long, complex and unique will discourage attempts to break into your accounts.

• Long: The combinations that protect your accounts should be long enough that it would be difficult for a computer program to run through all the possible configurations. The four-digit pin on a bank card has 10,000 possible combinations. This might take some time for a human being to crack, but a computer program with unlimited tries could break it in a few seconds. If you were only using numbers, every character in your password would raise the possible combinations by a power of 10. To stump the algorithms, you want a password that is a minimum of 12 characters long.
• Complex: To increase the challenge of your password, it should have a combination of uppercase letters, lowercase letters, symbols and numbers. Hacking algorithms look for word and number patterns. By mixing the types of characters, you will break the pattern and keep your information safe.
• Unique: If you have been reusing your passwords, it is time for you to start the work of changing them. Every one of your accounts should have its own password. At the very least, make certain that you have not reused passwords for your financial institutions, social media accounts and any work-related accounts.

Creating a Layered Password

If you want a password that is memorable but strong, you can easily turn a phrase into a layered, complex password. In this process, it is important to note that you should not use personal information that is available online as part of your phrase.

• Pick a phrase that is memorable for you: It should not be a phrase you commonly use on social media accounts. If you are an avid runner you might choose a phrase like, “Running 26.2 Rocks!”
• Replace letters with numbers and symbols: Remove the spaces. Then, you can put symbols and numbers in the place of some of the letters. Runn1ng26.2R0ck$!
• Include a mix of letter cases: Finally, you want both lower and uppercase letters that are not in a clear pattern. Algorithms know how to look for common patterns like camelCase or PascalCase. Runn1NG26.2R0cK$!

Now, you have a password that you can remember while challenging the algorithms hackers use.

Employing a Password Manager

When you consider the number of accounts you need to protect, coming up with a properly layered password is a time-consuming task. Even if you are able to decide on a memorable phrase, there are just too many accounts that need passwords. A password manager is a helpful tool to keep you safe while you are online. It acts as a database for all of your passwords. Each time you create a new code, it stores it so that you can automatically enter it later. You only need to remember a single password to access the tools of your manager.

Most managers can also do the work of creating complex, layered passwords for your accounts. These will be a string of random numbers, letters and characters. They will not be memorable, but you are relying on the manager to do the memorizing. These machine-generated passwords are especially helpful for accounts you rarely access or that do not hold significant information.

Maintaining an Offline Password List

For critical accounts like your bank account or a work-related account, it can be helpful to keep an offline list of your passwords. Complex passwords are meant to be difficult to remember. You may recall the phrase but not all the detailed changes that make it layered. Keeping a document on a zip drive or even in a physical paper file or journal will allow you to access your information if your hardware fails or you are switching to a new system.

Keeping the Whole System Safe

Cracking passwords is just one of the strategies hackers use to steal information. In addition to using strong passwords, it is important to employ comprehensive security software. Strong passwords will help protect your online accounts. Strong overall security will keep your hardware and network safe from danger.

The post Strong Password Ideas to Keep Your Information Safe appeared first on McAfee Blog.

How to Stay One Step Ahead of Hackers

Whether using the internet for play or work, you want to spend your time online enjoying the peace of mind that comes with having a secure network. 

You don’t want to contend with someone taking your personal data — whether it’s credit card information, passwords, or bank account details — via malware or a data breach on your Android, Windows, or Apple iOS device. 

Fortunately, with some sensible precautions and simple steps, you can use your connected devices productively without worrying about cybercriminals and malicious software. This article explains how to stop hackers from getting access to your sensitive data.  

8 ways to protect your identity from hackers

You can take steps to protect your different computing and mobile devices and operating systems. These steps can be divided into technological solutions and the right awareness and information to provide a comforting measure of self-protection. 

It’s like learning karate for self-defense, giving you confidence as you negotiate the wider world (and hoping that you never have to use it). 

Use identity protection software

When it comes to identity protection software, McAfee provides a proven solution with our identity protection and privacy services. The protection includes alerts if your sensitive information is found on the dark web (up to 10 months sooner than other providers), personal data cleanup from sites gathering and selling your information, and an unlimited virtual public network (VPN) service that protects your privacy as you use public Wi-Fi networks. 

You’ll also get up to $1 million in identity theft coverage and hands-on restoration support to help you reclaim your identity.  

Use complex passwords

Simple, obvious passwords and passcodes (like your street address, your birthday, your kids’ or pets’ names, or “1234” or “abcd”) are easy for cybercriminals to crack, giving them unwanted access to your private data. 

The stronger your password, the better your protection. Some best password practices include: 

• Use a different password for all your online accounts, including your email accounts, social media platforms, and bank accounts. 
• Create a password that’s at least eight characters long, combining lowercase and uppercase letters, numbers, and symbols. 
• Don’t use consecutive keystrokes, such as “qwerty.” 
• Don’t share your passwords with anyone. 
• Avoid entering your password on unsecured public Wi-Fi, such as at an airport or in a coffee shop. 

Regularly update passwords

It’s important not to be a standing target. Just as you should use different passwords for everything, you should regularly change your passwords. You should do this a few times a year (although some cyber experts say this might not be necessary if you have a long and very complicated password). 

If you have a number of passwords that you update often, it might be worth getting a password manager like McAfee True Key to keep track of them. Not only will you not be faced with remembering all your different passwords or writing them down (also a no-no), but it can also help you create and store unique passwords.  

The software uses the strongest encryption algorithms available to protect your passwords, scrambling them so no one else can access them. It’ll also suggest new passwords and automatically log you into your online accounts with just one master password. 

Use multi-factor authentication

Another important line of defense is multi-factor authentication (sometimes known as two-factor authentication). This system uses a password and a second piece of verification — often an SMS message sent to your Android device or iPhone — to authenticate your identity. 

This provides hard-to-beat protection even if a hacker has your password. Besides receiving SMS codes, there are also code-generating apps and physical security keys. 

Learn to spot potential scams

Thinking before you click on an email or text is a very important defense against phishing scams. Your bank won’t send you an email or text notifying you that there’s been suspicious activity on your account.  

Does getting a large refund from your phone company sound too good to be true? It is. Similarly, the Internal Revenue Service (IRS) won’t text to tell you that you owe them money, and princes aren’t going to give you a fortune out of the blue. 

Internet users beware: If you’re not absolutely certain that the text message you received is from a legitimate and trusted source, delete it. You can always contact the business or person directly to confirm that the message is legit. 

Keep device software up to date

Any operating system or app you use is open to malicious cyberattacks. This is why you should keep all your software up to date with the latest versions. Software developers are continually fixing holes in their products and offering cybersecurity patches to make them as safe and hacker-proof as possible. 

Make sure your software, firmware, and security settings are up to date on your home’s Wi-Fi router, as well. You can often change your settings to allow for automatic updates. 

Be cautious when using public Wi-Fi

Sure, who doesn’t like to go to a cafe, library, or hotel lobby to use the free Wi-Fi? But security is often weak in these public networks. If you open your online banking account or access personal information, you may unwittingly be giving a personal invitation to eavesdropping cybercriminals.  

This is where the bank-grade level of protection of McAfee Secure VPN comes in, which automatically turns on when you need it and keeps you safe on public Wi-Fi networks. 

Use encryption

Even if your device does get hacked, you can protect vital information on your Windows or macOS system with an encryption program like BitLocker or FileVault. You can protect any hard drive you use, including portable ones and USB keys. 

It’s also a good idea to only shop at encrypted websites marked with the prefix “HTTPS” in their URLs. 

Discover how McAfee keeps you secure online

One of the best ways to surf the web in comfort while keeping hackers at bay is with the comprehensive solutions provided by McAfee Total Protection. 

Your protection includes proactive measures (meaning we’ll guide you to the best choices for prevention), early detection, and expert identity theft support.  

This means you’ll get identity monitoring, up to $1 million in identity theft coverage, lost wallet protection, premium antivirus software, a secure VPN, and personal data removal. In particular, our Personal Data Cleanup service will help find and remove your personal information from data broker websites and people search sites.  

With McAfee, you don’t have to be afraid of hackers. Let us deal with them.  

The post How to Stay One Step Ahead of Hackers appeared first on McAfee Blog.