My Smelly Friend, Kevin

All through high school, our crowd had a running joke about our friend, Kevin.

Smart, funny, sociable, even-tempered and well-liked.

Kevin was always well-dressed . . . “put together” we used to say. It’s not like he massively overdressed, or (ugh!) wore a bow-tie. He was always just *slightly* overdressed, but in a good way. Years of taking classes together, we never once saw him slouching around like so many of the rest of us.

The running joke? Our friend Kevin . . . smelled.

We could walk into a classroom, get a whiff of his high-quality cologne, and laugh that we must have just missed him because we could smell him. Or rather his awesome, signature fragrance. We’re not talking about some nasty Axe body spray — oh heck no. Kevy bought the *good* stuff.

For some people, their reputation precedes them. For Kevin, his cologne left a distinctive trail everywhere he went.

The only way Kevin could be stealthy was to *not* wear cologne.

So how can we be *stealthy* online? We’ve put our whole lives online now, and need to do what we can to protect ourselves.

One thing we can do is use a Modern Password on every online account.

A Modern Password is *different for every site.* It's composed of 14 or more characters: upper-case, lower-case, numbers and special characters. No dictionary words and nothing that is specific to you, the website or the industry the website is associated with. No sports team names, no family or pet names, no birthdays or anniversaries — basically nothing specific about you or your interests.

If the bad guys find and analyze one of your passwords, they shouldn't find anything that relates to you. Absolutely nothing personal — not a hint of you, not even the slightest whiff of you.

Like a deserted ghost town in an old spaghetti western . . . the bad guys should find nothing but tumbleweeds blowing in the wind.

All the bad guys should see is a random string of letters, numbers and special characters. Using a high-quality password manager makes this *extremely* easy.

Don’t let your digital cologne betray you.

Be stealthy!

#InfoSec
#SmellyKevin
#PasswordManagers

Hello Fellow Mastolorians!

All Passwords Are Definitely NOT Created Equal.

In 2018 1Password (a highly-successful password manager company with a market value of $6.8 billion) ran a contest called “How strong should your Master Password be?” The company gave out prizes to the first security researchers who successfully hacked various types of passwords in a carefully constructed contest. They followed that with some additional research of their own.

Important considerations are:
​ "How long does it take to crack my password?" is definitely *not* the right question.
​ "How much does it *cost* to crack my password?" is the right question.
​ The results of their contest apply specifically to the ways 1Password generates, secures and stores passwords.
​ You shouldn’t assume passwords used on other websites are protected the same way.

Below is 1Password’s chart which lists the *least costly* to crack to the *most costly* to crack password types which are created by a password generator, not a human.

​ Three Random Words is the least secure, or least costly to crack, with an estimated cost to the hacker of $4,200. This style of password is frequently recommended by the British National Cyber Security Centre (NCSC), a public-facing entity attached to GCHQ, the British version of the NSA.

​ “Smart Passwords” composed of 19 randomly-chosen upper-case letters, lower-case letters, numbers and special characters were the most secure, or most costly to crack. Password researchers call these "4-class passwords" since they're composed of 4 classes or types of characters.

You can think of these kinds of ultra-strong passwords as *modern* passwords, because their growing popularity is a modern dynamic related to the increasing use of Password Managers, which create millions of them every day.

These types of passwords are best suited for use when you don't need to memorize the password, and you don't need to frequently type it on a cellphone. These outrageously strong, modern passwords can be written down and securely stored, or typed just once then stored in your Password Manager.

And in May of 2022, Microsoft Authenticator added a new Password Generator which allows its 75 million users to create strong, unique passwords with different combinations of letters, numbers, and special characters.

Google's Chrome is by far the most popular browser, with at least 7 out of 10 people worldwide using it to access the internet. Chrome's built-in Password Manager automatically produces only one type of password — randomly-generated modern passwords composed of upper-case letters, lower-case letters, numbers, and (frequently) special characters. If a special character isn't auto-generated, the user is free to manually add a special character if the website requries it.

Note: The dollar amounts in the chart above take into consideration the techniques and strategies 1Password uses to generate, process and store a master password. We can't assume other websites would store our passwords as securely. Nor would these dollar amounts apply to passwords we humans create on our own, off the top of our heads. Those passwords would be far weaker and much less costly for a hacker to crack.

https://blog.1password.com/cracking-challenge-update/

#Passwords
#1Password
#PasswordManagers
#ComplexPasswords
#SpecialCharactersInPasswords