We all assume hackers won’t crack our own passwords, even if they’re simple ones with only a few characters.
But just how easy is it for someone to break into an online login?
According to new research, anything with six characters, regardless of whether numbers and symbol are included, can be cracked instantly.
The same goes for anything that is seven or eight characters but made up of just numbers or lower case letters.
But the news doesn’t get much better for any eight character combination.
In fact, they can all be guessed in about 39 minutes according to US cybersecurity company Hive Systems, which is based in Richmond, Virginia.
On the flip side the way to guarantee that your password won’t be cracked for some 438 trillion years is to use 18 characters made up of numbers, upper and lower case letters and symbols.
A more manageable 11 character password featuring the same alternative features would be cracked in around 34 years, the research suggests.
Hive Systems made the colour-coded table for 2022, showing how safe users’ passwords really are.
The company said its data was ‘based on how long it would take a consumer-budget hacker to crack your password hash using a desktop computer with a top-tier graphics card’.
‘If you use the same password on multiple sites, you’re in for a bad time,’ Hive Systems wrote in a blog post.
The firm also discussed hashing, a technique which protects stolen passwords, and how hackers get around the one-way algorithm.
In the context of passwords, a ‘hash’ is a scrambled version of text that is reproducible if you know what hash software was used.
For example, if the word ‘password’ is hashed using MD5 software the output would be 5f4dcc3b5aa765d61d8327deb882cf99.
Passwords you use on websites are stored in servers as hashes instead of in plain text like ‘password’ so that if someone views them, in theory, they won’t know the actual password.
In the given example for ‘password’, the hacker would only see 5f4dcc3b5aa765d61d8327deb882cf99.
It is impossible to reverse this hash to produce the word ‘password’, but what hackers do is make a list of all the combinations of characters on your keyboard so they can then begin hashing them.
By finding matches between this list and the hashes from the stolen passwords, hackers can figure out a user’s true password, which in turn allows them access to your logins for various websites.
‘We reviewed password data breaches from 2007 to present, reported through HaveIBeenPwned, to see what attackers have actually been trying to crack and whether that changed over time,’ Hive Systems said.
‘Generally speaking, website logins that people probably care less about, like forums and restaurants, used and continue to use MD5 and SHA-1.
‘That is a pretty big deal assuming people reuse the same passwords on more concerning sites like banking, government, private messaging, email, and social media.’
In light of the new research, experts have urged the public to use more complicated passwords with unique letter and number combinations, along with two-factor authentication (2FA).
2FA requires users to provide an additional piece of information, such as a pin code sent via text message, as well as a password.
Last month London-based card machine provider Dojo analysed data on 100,000 breached passwords from the UK government‘s National Cyber Security Centre (NCSC).
It found ‘123456’, ‘qwerty’ and ‘password’ – all easily remembered but notoriously bad choices – were among the most frequently hacked passwords.
Overall, pet names or terms of endearment – including ‘love’, ‘baby’ and ‘angel’ – were found to be the most commonly hacked passwords, ahead of animals, colours and swear words.
This term refers to the strain of having to think up and remember multiple passwords, as more and more our every day lives are digitized and we’re required to open online accounts to access basic services.
‘Attackers exploit these well-known coping strategies, leaving individuals vulnerable,’ he added.
Dan DeMichele, vice president for Product Management at password manager provider LastPass, called strong passwords ‘the first and most essential line of defence against a cyber-attack’.
‘A strong password is at least 16 characters long and includes a mix of capital and lowercase letters as well as numbers and symbols,’ he said.
‘Cyber attackers love it when their intended victims are uninformed and unaware about cybersecurity — it makes their task easier.
‘It’s therefore imperative you keep up to date on security best practices.’
