Building Better Teams

Articles and Posts

Blog

 

“password”

Administrators of new wifi access points have a hard task: find a password that guests can remember, and hackers won’t.

You’ll want to prevent hackers from accessing your system. Who’s going to hack your system? How will they hack in? Unfortunately, long gone are the days of hackers sitting in dark rooms wearing face-coverings guessing your favourite things one-by-one (but movies love to paint this portrait).

When hackers want to “crack your wifi password” they download a simple, easy to get, and free script. It runs for a few minutes (or hours), watches the the network signals going through the air, and attempts trillions upon trillions of combinations per minute. It attempts every word in every language (yes, even if you write 漢字). It attempts every combination of letter-substitution (for example, replacing “e” with a “3” in your password). It attempts adding letters, removing letters, adding numbers, removing numbers, clever little word games like “ten dot 2”, adding special characters, and… well, you get the idea. They try everything. They even have mathematical models that predict how humans tend to pick passwords.

The hackers who are after your wifi password never once think about you, who you are, or what your passwords might be. They download a file and hit “run”, then go get a cup of coffee. By the time they’re back, they have access.

Why do they have access? Because instead of picking a word that is hard for software (not people) to guess, the passwords tend to be some slight modification of a “Company Motto“, and turned into “C0MpanY M077o!“. Sure, a human might not guess it, but the above mentioned script doesn’t work like a human.

Worse, the password is easy for scripts to crack, but truly horrible for humans to remember. It will be entirely insecure, but also not usable by the people who want to use it.

There are two simple outcomes:

  • If you don’t need a password, your password should just be “password”. These “p45sword” variations don’t help.

  • Use a secure password generator, and use something it gives you. They were designed in ways that scripts need a billion years to crack the password.

Here are some password generators. Some of them are free, some of them will try to sell your their products. I don’t take commission from any of them, and I obviously don’t guarantee their quality (for legal liability reasons).

Brian Graham