Passwords security

double_dutchy

Just playing devil's advocate a little here....

From media reports it seems that most banking scams involve the victim actually providing login details, e.g. with phishing emails that purport to come from banks.

Is there a danger that we focus too much on password security, rather than stopping many other scams which don't involve breaking passwords?

400ixl

Software key loggers can intercept virtual keyboards as well as physical ones. Its all software that does the work at the end of the day.

400ixl

double_dutchy said:

Is there a danger that we focus too much on password security, rather than stopping many other scams which don't involve breaking passwords?

Yes, absolutely, social engineering and other non password hacks are very important.

One of the things I advocate to businesses is that when they do their security training the also align it to out of the office environments, as many will associate with that better and get a better understanding on how to protect themselves in both environments better.

km1500

400ixl said:

Software key loggers can intercept virtual keyboards as well as physical ones. Its all software that does the work at the end of the day.

Which is why mobile phone banking apps provide protection against keyloggers as the apps use their 'own' keyboard (rather than eg the android system one) as these cannot be intercepted.

unforeseen

RobM99 said:

OK thanks, I was thinking more of special characters that don't appear on a keyboard. I'd have thought they'd be a tad more secure.   ß ◙ ì  

As they are not single code ASCII characters they could not be used.

You can use any of the characters in the printable range (codes 32-127). https://www.ascii-code.com/

RobM99

unforeseen said:

RobM99 said:

OK thanks, I was thinking more of special characters that don't appear on a keyboard. I'd have thought they'd be a tad more secure.   ß ◙ ì  

As they are not single code ASCII characters they could not be used.

You can use any of the characters in the printable range (codes 32-127). https://www.ascii-code.com/

...and that tells me exactly what I wanted to know.  Thanks you!  No apple π for me then.

Eco_Miser

km1500 said:

For a brute force dictionary attack this is equivalent to a 13 length password

my name is far fetch and i post on money saving expert website

The 19 character password elephantrhinocerous is equivalent to a length 2 password for brute force attacks ie you might just as well use the password '12'

Are you thinking that a brute force dictionary attack will try combinations of words as in the above examples?

They might, but there are thousands of words to try (with variations in capitalization and '1337' substitutions, and mis-spellings), rather than the 95 printable ASCII characters.

So for your second example there are 95*95 =9025 possible two character passwords, there are over 2000*2000 = 4 million two word passwords.

gt94sss2

I have always found it interesting that the National Cyber Security Centre recommends simply using 3 random words for your password, if not using an AI generated one plus a password manager