![\"\"](\"https:\/\/world.edu\/wp-content\/uploads\/2023\/01\/security.jpeg\")
<\/p>\n<\/p>\n
As cyberattacks increase, each of us can potentially be confronted with them.\u00a0Of course, we all have our tricks for the passwords we use on our computers and laptops: hidden under a keyboard, written on a piece of paper or taken from the birthday of the youngest.<\/p>\n
But how do you ensure that your password is truly in-cra-qua-ble?<\/p>\n
Numerous studies find that a significant proportion of passwords do not sufficiently protect users: passwords are too weak and too often reused.\u00a0For example, 51% of French people would use the\u00a0same password for professional and personal use<\/a>\u00a0\u2013 a statistic that is found\u00a0in the United States<\/a>\u00a0.<\/p>\n From a password, cybercriminals will be able to recover private information by connecting to our online accounts (messaging, social networks, etc.), in particular our bank or e-commerce accounts, but also to penetrate our computer. and encrypt its content for ransom.<\/p>\n The theft of a password can have financial consequences, but also psychological through practices such as “doxxing” (publishing information on the identity or private life of a person with the aim of harming him) or revenge porn.\u00a0In the professional context, password leaks expose the company to attacks by blackmail, to\u00a0“denial of service”<\/a>\u00a0(cyberattacks consisting in interrupting or mishandling the service provided by a third party), or even to economic espionage.<\/p>\n The two main approaches used by cybercriminals to recover passwords are social engineering and stealing credentials databases.<\/span><\/p>\n Social engineering consists for the cybercriminal in convincing his victim to reveal his password, typically by resorting to\u00a0<\/span>phishing<\/span><\/a>\u00a0\u00a0: the vast majority of attacks do not target a predefined victim and these mass attacks are intended to phish any victims.\u00a0It is only then that the cybercriminal will concentrate his forces on the phished person.<\/span><\/p>\n As for the theft of credential databases, the attack generally involves hacking a website to steal the names and passwords of users in order to log into the victim’s account, to use them on other accounts ( for example, the fraudster will test his victim’s Google IDs on Twitter) or resell them on the\u00a0<\/span>dark web<\/span><\/em>\u00a0.\u00a0The website “Have I been pwned?”\u00a0\u00bb allows everyone to check if their password has leaked on the Internet;\u00a0it currently lists nearly 12 billion accounts whose credentials have been leaked.<\/span><\/p>\n In the majority of cases, these databases of identifiers do not contain passwords, but fingerprints of passwords: the fingerprint is the result of a so-called “one-way” function which is applied to the password.\u00a0By analogy, the fingerprint is to the password what the fingerprint is to the human: two different passwords have different fingerprints and given a fingerprint, we cannot identify the human.\u00a0But given a footprint and a human, you can tell if the footprint is from that human.\u00a0In the case of passwords, we cannot therefore find the password from its hash, but we can test a password to see if it corresponds to the hash: we then say that the password is “broken”.<\/span><\/p>\n Password\u00a0<\/span>crackers<\/span><\/a>\u00a0use\u00a0<\/span>different approaches<\/span><\/a>\u00a0to test the most likely passwords: first the shortest ones, then dictionary words and their variants (e.g. “Meal”, then “Meal”, “Meal”, \u201cundermine\u201d, \u201cmeal1\u201d\u2026) and strongly structured passwords (for example starting with a capital letter, then lowercase letters, numbers and finally special characters).<\/span><\/p>\n Modern breakers may also use advanced techniques based on\u00a0<\/span>artificial intelligence<\/span><\/a>\u00a0or\u00a0<\/span>algorithms<\/span><\/a>\u00a0.<\/span><\/p>\n Finally, all possible passwords are tested if other attempts have failed: this is called an exhaustive search, which generally has little hope of being successful in a reasonable time.\u00a0In particular, attacks that consist of testing different passwords for a given user directly on a website until they succeed in logging in are impractical: they are very slow because of the web server’s response time and easily detectable.<\/span><\/p>\n To protect yourself effectively, you must use strong passwords, not use the same password for several uses and change passwords regularly.<\/span><\/p>\n For a password to be robust, it must be chosen randomly from a set of passwords having the same chance of being chosen: for example, a word present in the dictionary would be broken in a handful of seconds .\u00a0Adding a capital letter or numbers at the end provides only illusory security.<\/span><\/p>\n In order to measure the robustness of a randomly chosen password (ideal case, rarely achieved without a password manager), we count the number of tests that a hacker will have to do in the worst case to break it.\u00a0This value is generally calculated by the formula\u00a0<\/span>n\u00a0<\/span><\/em>c<\/span><\/sup>\u00a0_ where\u00a0<\/span>c<\/span><\/em>\u00a0is the length of the password and\u00a0<\/span>n<\/span><\/em>\u00a0is the size of all the elements from which to draw to compose the password.\u00a0For example, in the case of a password of length 8 (\u00a0<\/span>c<\/span><\/em>\u00a0=8), composed of lowercase letters only (\u00a0<\/span>n<\/span><\/em>\u00a0=26), the attacker will have to test 26\u00a0<\/span>8<\/span><\/sup>\u00a0passwords (i.e. 208 billion) in the worst case.\u00a0Although the figure seems astronomical, a standard computer will take less than a second to crack it using the computing power of its graphics card.<\/span><\/p>\n The National Information Systems Security Agency (ANSSI) defines the\u00a0<\/span>strength of a password by the size of the space in which it is randomly chosen<\/span><\/a>\u00a0, and distinguishes four categories.<\/span><\/p>\n A random password, constructed from an alphabet made up of letters, numbers and 8 special characters, must therefore contain at least 17 characters (for example, “b!sDzf5w,5+W2s3k”) to be considered as strong according to ANSSI, and it will be considered as very weak if it is less than or equal to 10 characters (\u201cb!sDzf5w,5\u201d).\u00a0Even very weak, the password will be difficult to memorize\u2026 especially since you have to memorize dozens of them!<\/span><\/p>\n To facilitate the memorization of passwords, an increasingly recommended technique consists in\u00a0<\/span>using “passphrases”<\/span><\/a>\u00a0, that is to say sequences of words chosen at random.\u00a0A passphrase of seven words chosen from a dictionary of 60,000 words could thus be \u201cbuttress fatally sole signified distance revegetates foraging\u201d, easier to memorize than \u201cb!sDzf5w,5+W2s3k\u201d for equivalent security.<\/span><\/p>\n But it is difficult for a human to randomly choose words from a large enough set, because we only use a few hundred words every day.\u00a0It is therefore advisable to add lowercase, uppercase and special characters in the passphrase.<\/span><\/p>\n A password manager is an application that securely stores all of the user’s passwords so they don’t need to remember them.\u00a0He only needs to remember a single password, the master password, which must be as strong as possible while remaining memorable.\u00a0The use of a password manager, for example KeyPass, is recommended by major cybersecurity players such as\u00a0<\/span>ANSSI<\/span><\/a>\u00a0, its German counterpart,\u00a0<\/span>BSI<\/span><\/a>\u00a0or the European agency\u00a0<\/span>ENISA<\/span><\/a>\u00a0, as well as by organizations such as\u00a0<\/span>Reporters Without Borders<\/span><\/a>.\u00a0Some password managers are stored in the cloud, for example Bitwarden (free and open source), 1Password (paid), DashLane (paid), or LastPass (paid, but there is a fairly advanced free version) which is the the most used manager but also the most attacked.<\/span><\/p>\n Note that managers built into browsers (which do not require installation) are not recommended for security reasons, as the\u00a0<\/span>German BSI<\/span><\/a>\u00a0points out .<\/span><\/p>\nHow does a fraudster recover passwords?<\/strong><\/h4>\n
What is a strong password?<\/span><\/h4>\n
The robustness of a password according to ANSSI<\/strong><\/h4>\n
Should I use a password manager?<\/strong><\/h4>\n