12 password mistakes that hackers hope you’ll make

Password hacking is in the news with alarming regularity. Recently, thousands of Disney+ customers lost their accounts in a mass hack attack within days of the new streaming service’s launch. As reported by The Market Realist, those hacked accounts were then sold on the dark web. While large-scale attacks like this can make consumers feel helpless, there are steps we can all take to protect our passwords and our data. Some of them are common sense (don’t use the same password for every site!), and some aren’t quite as obvious. Read on to learn the most common password mistakes that hackers hope you’ll make. And while brushing up on your cybersecurity knowledge, make sure you know what happens when you ignore those security warnings on your computer.

“Common mistakes people make with passwords make them easily hackable. Those mistakes include using easy passwords like birthdays, creating common passwords like 1234, using brand names, pop-culture references, or sports to create a password.” —Elias Manolopoulos, founder of Aeon Ads.

Here’s what you’ll need to do if your data has been hacked.

“Try to inject as many symbols and numbers and a variety of characters that make your password fairly unique for an unknown entity to guess but relatively easy for you to remember. Substituting symbols for alphabets is also a good idea as long as the choice of word is fairly complex, so kr3st3v@798! instead of kresteva798! could work, but decades-old p@$$w0rd! would not.” —Ax Sharma, cybersecurity researcher and engineer.

Here are 7 alarming things hackers can do when they have your email address.

“Using the same password to log in to every account is a critical mistake that many people make. Even with just one set of log-in credentials, hackers can log into other sites using the same email and password. They, often correctly, assume that users will have the same password across platforms.” —Alex Heid, Chief R&D Officer at Security Scorecard.

These are 17 things cyber crooks don’t want you to know.

“There are some users who recommend changing your password every year, which is reasonable to consider if it isn’t too much of a burden. However, this can be tedious and unnecessary for power users with hundreds of online accounts that already have strong, unique passwords, so in this case, we just recommend changing new passwords as vulnerabilities to affected services are brought to light.” —Colt Agar, Managing Editor at TheTechReviewer.com.

Here are another 11 ways thieves steal your identity.

“It is advisable to choose passwords of a significant length, preferably greater than 15. This makes passwords resistant to both online brute-forcing as well as offline hash cracking.” —Sudeep Singh, cybersecurity expert and author of the research paper “Breaking the Crypt”

“Data from breaches gets distributed to the bad guys. The data from the LinkedIn breach is out there for anyone to use. If your password gets exposed in one breach, then every account where you reused it is at risk. It is not a question of if your data will get exposed—it is just a matter of when. Unique passwords for each account limits your exposure. Assume you used the same password for 20 sites and one of them gets breached; you now need to change the password on 20 sites instead of one.” —Tom Evans from Ashton Technology Solutions. Be aware of these other clear signs you’re about to be hacked.

“There are some online password generator services or offline random password generators that generate a long string of random characters which are not possible to memorise. While these passwords look very secure, they are not easy to use due to the difficulty in memorising them. People who use such long randomised passwords tend to save the passwords on a piece of paper or a note on their phone or computer. This makes the passwords vulnerable to discovery by someone else.” —Singh. Plus, your password recovery questions are insanely easy to hack—and you might be to blame.

“There are a number of very secure password-storage services out there. Google has a built-in password manager to its online account that can be used with Chrome and other Google apps. Apple, of course, has its keychain that can store password and account information. And there are third-party providers of password-management services. Unless you fancy carrying around a notebook of passwords at all times—I do not suggest this!—you need to look into one of these solutions.” —Jason David, CEO of Software Portal

“Everyone does it. You get the pop-up on your screen, ‘Cannot use the same password,’ so what do you do? Add a number at the end of it and we think we’ve hacked the system. Well, research shows that modifying passwords slightly is extremely common and also very predictable.” — Jay Lee, uAcademy.