Break Bad Password Habits And Improve Your Cyber Security

Each years, NordPass put out a list of the top 200 most common passwords, along with how many uses each has had, and the time it would take them to be cracked in a brute force attack.

Despite regular warnings from security professionals, software providers and sys admins across the land, the list is packed full of the weakest passwords. We’re talking about millions of people using passwords like 123456, 000000, password and qwerty.

The Challenge

Is it any wonder that so many users’ accounts are hacked and taken over every day? Especially when many people use the same one or two passwords across all of their online logins. If one of those accounts is breached, then all of the others are immediately at risk.

But with the average person now having so many different online accounts to remember passwords for, it is understandable why people default to the same few easy to remember choices. I struggle to remember what I had for breakfast, let alone a list of random unique passwords. We humans like patterns and names, as they make things easy to remember. But unfortunately, they’re also the easiest to crack.

The strongest password choices are randomly generated, complex strings of characters. But unless you have a Guinness Record Breaking memory, you’re going  to struggle to memorise more than one or two (on top of all the pin numbers, phone numbers and other important things to remember, floating around in your brain) and if you then need to have a unique password for each account you have online, you’re going to be making very regular use of the ‘forgot password’ function.

The Solution

Without going through some intensive memory training, how then do you go about creating strong and unique passwords for each of your online accounts, and actually remember them? The good news is you can leave the remembering to a tool, and you’ll only need to remember one master password to access that tool.

First, let’s look at best practice when creating and using new passwords, as recommended by the pros:

1. No Reuse

Although it’s tempting, never use a password across multiple accounts. If one gets hacked, all the others become vulnerable. So use unique passwords for each account.

2. No patterns or personal details

With so many strings of numbers and characters to remember everyday, we’re drawn to familiar patterns and memorable dates or names. But this is not recommended. 

Using personal information like birth dates, pet names, birthplaces, family names etc, makes for easily compromised passwords, as much of this information is freely available.

As for patterns and sequences, the Nord list is the perfect example of why these are a bad idea, and so easy to crack.

3. Password format

Make sure your passwords are long! Aim for 12 characters or more where allowed, and use a combination of lower and uppercase letters, numbers and symbols. 

4. Updates

You should aim to update your passwords on a regular basis. Then even if a password is acquired through a data breach, you will have hopefully updated to a completely new password, before any attempt is made on your account.

Top Tips For Passwords & Better Online Security

So, I know, so far I’ve made your life more complicated. But fear not. Now let’s take a look at tools available to make password security a breeze, and how you can up the security for many of your online accounts.

Here are our top tips:

1. Password Generators

Creating unique, random passwords can be difficult. Our brains like memorable patterns. If you struggle with this, you make use of a random password generator.

There are many available, but here are two we know and trust:

Lastpass Password Generator

NordPass Password Generator

2. Password Managers

Now here is the real saviour. There are many great solutions available to securely encrypt and store your passwords and credentials, and which let you easily input them when required. These are usually referred to as password managers, lockers or vaults. Some are free, and some have cost associated. But it is worth researching the available choices and finding one that is right for you.

Here are a few we know of, to get you started: Lastpass, 1password, Bitwarden, Dashlane and NordPass.

3. Two Factor Authentication 

Many accounts will now allow you to set up two factor authentication. This requires you to make an additional step after entering your login details for an extra layer of security.

A commonly used one, is a unique code sent to your mobile or email, which you have to enter to gain access to your account. 

This added step makes it so much harder to breach your account, without also having access to your phone or email. You will also be notified if someone is attempting to access your account, as your will receive this two factor code. This will prompt you to go and change your login details.

There are also numerous other methods of two-factor protection, including authenticator apps and passkeys, just to name a couple.

It is gradually becoming the standard, and is frequently used for banking, paypal, email, some online stores and gaming memberships and platforms like Playstation and Steam.

If you have the option to set up two factor authentication, do it!

4. Have I been pwned 

This site allows you to enter your email addresses and will list any data breaches your email address has been included in, and what data was acquired. 

They will then also email you every time your email address is involved in any other breaches, allowing you to take action, change logins and make sure you’re not using the same credentials anywhere else.

5. Delete Old Unused Accounts

I don’t don’t know about you but I have regularly set up logins for things, and then stopped using them. Now I try to make a habit of removing these accounts. 

Your inbox can be a good place to start. All of those unwanted emails from things you signed up to forever ago. Perfect excuse to kill two birds with one stone – delete your account and unsubscribe your email address.

This can be quite a satisfying process. Spring cleaning for your digital home.‘

6. Don’t Charge Electrical Devices From Your Computer

Charging electrical devices (like phones or tablets) directly from your computer’s USB port might seem convenient, but it’s not always a good idea.

It can create security risks, especially if the device is compromised or if you’re using public or shared machines, potentially allowing malware or data access. For safety, speed, and device longevity, it’s better to use a dedicated charger.

That goes for all electrical devices! There was even a case of a rechargeable sex toy infecting a user’s computer with a virus that harvested personal data.

7. Go Easy On The Browser Extensions

Chrome and Edge for example, have enormous web stores full of useful browser extensions. However, when installing extensions you need to be selective, and only use those that are from trusted providers, and never download them from outside of official browser web stores. It is also wise to do a little Googling to make sure that they haven’t been compromised.

This recent post from covers 18 malicious browser extensions from both Chrome and Edge.

8. Don’t Complete Personality Tests Or Quizzes On Social Media

No matter how fun or harmless they seem, many of these quizzes are designed to collect personal information under the guise of entertainment. This in turn can then be used for phishing scams, or even identity theft.

Questions often mirror common security prompts like your pet’s name or the street you grew up on. Sharing too much can unintentionally give cybercriminals clues to your passwords or security questions. When in doubt, scroll past the quiz and keep your personal details private.

As for those that want you to login with your social media account or webmail account, steer well clear!

9. Don’t Click On Links In Emails, WhatsApp Messages, Or Texts

We’ve all been told numerous times that if your bank calls you, it is best to hang up and call them back on the number on your card or online banking app.

This is because there are many complex scams, where criminals pose as banks or other businesses, and encourage people to inadvertently share important information that gives them access to bank accounts and the like.

This plays out in email too, and now is becoming common on WhatsApp and of course through SMS messaging. Sometimes by soliciting personal information, but more often than not, with links.

These links can lead to phishing websites designed to steal your login details or infect your device with malware. Even messages that appear to come from trusted sources can be faked.

When in doubt, don’t click. Instead, navigate directly to the official website or contact the sender through a verified channel to confirm the legitimacy of the message.

Digital Security On A Wider Scale

Taking care of your personal online security is one thing, but it is important to remember to apply that same care to your business, and ensure that your employees are on the same page.

A hack or data breach can be catastrophic for a business. There is the potential for GDPR fines for data breaches which aren’t immediately reported, and hacks and attacks can take your site down. Losing your main revenue generator for any amount of time can be disastrous.

Website security is often forgotten about until it is too late. Don’t let your business become victim to a hack. If you’d like to find out more about how we can help protect your WordPress website, speak to our team about a Support & Maintenance plan.