It is not a good idea to use username and a static password as the authentication method for logins, since it dramatically increases the risk of unauthorized access to services and information. Stefan Sundh, user authentication specialist at identity and security company Nexus Group, gives you the 13 reasons why passwords are not secure.
- Users often reuse the same password for different services.
“This means that if the password for one service gets into the wrong hands, unauthorized people can not only get access to that particular service but also to a range of other services,” says Sundh. - Many people do not change default passwords immediately, which means that it is easy for unauthorized people to gain access.
“Default passwords are often publicly available in manuals, and they are often also pretty easy to guess. In addition, it is not at all uncommon that they are publicized in hacker forums,” says Sundh. - Passwords are often shared amongst users.
“This means that organizations cannot be sure of who actually has access to services and information,” says Sundh. - Users tend to keep the same password for a long time.
“If an unauthorized person gets their hands on the password, they can keep using it for unauthorized access for an equally long time,” says Sundh. - Password-cracking tools are getting really good at guessing passwords.
“The technological advances within this area go really fast – it is just a matter of time before passwords that are considered strong today will be rendered breakable,” says Sundh. - People often use too weak passwords.
“This can even make it possible for people to guess the password without the aid of brute force tools,” says Sundh. - Passwords are easily stolen through social engineering.
“There are an endless range of methods, for example, convincing emails or spoofed websites where people are asked to share their username and password. And a surprisingly large percentage of people actually do share their login information when asked to,” says Sundh. - Passwords are sometimes sent over unsecure networks, which makes them easy to steal.
“You know that Wi-Fi on your favorite café? It is most probably an unsecure network,” says Sundh. - Organizations’ password databases get hacked much more often than most people care to realize.
“In many cases, the hacker attack never gets noticed by anyone, or it takes a long time for anyone to notice. This means that the hackers meanwhile can use the passwords as much as they like to access all kinds of sensitive information,” says Sundh. - Users often write down passwords, for example on sticky notes.
“This of course makes the passwords very easy to steal,” says Sundh. - Passwords can be stolen by malware equipped with key logger components.
“Someone wanting your password can get hold of this kind of software very easily,” says Sundh. - If a password gets into the wrong hands, unauthorized people can access the service and its information without anyone noticing.
“The user has no clue that someone else is accessing the service using their password. And maybe even worse: the organization providing the service does not know, which means that external people can steal company sensitive information unnoticed,” says Sundh. - Organizations often fail to remove user accounts and their passwords when employees quit their jobs, which gives them access to information they should no longer have access to.
“This is so common – it is just crazy, there is no other way to put it,” says Sundh.