Ordinarily, a platform will require its new users to create a strong password with a combination of upper-lower case, symbols, numbers, and so on. Each website will have different policies on their passwords. Frequently, this will create problems, such as forgetting the password because of its complexity. So, do strong passwords do anything to secure an account, or is it just a placebo?
Every time a new user is trying to sign up on a new social media platform or a website, that application will ask the user to create a strong password with a combination of uppercase and lowercase, unique symbols, and so on. Nowadays, with the abounding new and existing application, it will become a burden to remember all the unique passwords for each social media.
Although the presence of password-remembering features built-in browsers or third-party applications that offer the same feature, some users might feel reluctant to do so. The threat of data leakage will always be there, and storing important passwords might not be the best idea to do in the midst of data leakage nowadays.
Creating a password with:
- Unique symbols, upper-lowercase, and number combination
- Something that only a user can remember and not a word in a dictionary
- Long passwords
- Often change passwords
- Not the same passwords that a user use in all of their social media-
-is always suggested as the important step to ensure the safety of a user’s account, but does it actually do anything?
Florencio, Herley, and Coskun in a paper titled Do Strong Web Passwords Accomplish Anything? argued that unique passwords are the only tool that a bank has against bulk guessing attacks, but they also stated that cryptographical password, like “g4nt3n9” is easy to guess if the attacker knows the individual well. The authors would later also express that there is no difference between strong and weak passwords, as both of them offer no better protection against password stealing attacks and bulk guessing attacks.
But what is a bulk guessing attack?
A bulk guessing attack or commonly known as brute force attack is a method where the attacker will attempt to guess the correct password by trying out all the possible combinations, such as letters, symbols, numbers, and so on until it becomes correct. As crazy as it sounds, this type of attack is carried out by a tool, not manually done by the attacker since there are too many possible combinations.
There are a few ways to prevent a bulk guessing attack for a customer:
- Locking out an account after many failed attempts
- Logging out an account that is connected to a different browser or device to prevent further attempts.
As for a company or the social media provider, applying CAPTCHA can be a preventive action against a bulk guessing attack. It is important to note when creating a CAPTCHA that it does not matter how hard the question is, but how hard it is for a computer to answer the question.
TL;DR
Undoubtedly, all websites and social media always suggest their users create strong passwords. Though when it comes to brute force attacks, sophisticated passwords would not really do anything, it still matters to create strong passwords. If an individual tried to get into your account, a sophisticated-encrypted password will surely protect your account.
Read our other works:
• Small Business Should Pay More Attention to Cybersecurity
• Are We Experiencing Cybersecurity Expert Shortage?
• Which One Do You Need, VPN or DNS?
References:
- https://support.microsoft.com/en-us/windows/create-and-use-strong-passwords-c5cebb49-8c53-4f5e-2bc4-fe357ca048eb
- Florêncio, D., Herley, C., & Coskun, B. (2007). Do strong web passwords accomplish anything?. HotSec, 7(6), 159.
- https://owasp.org/www-community/controls/Blocking_Brute_Force_Attacks
