Choosing a password is no child’s play. Some uncommon combinations can also be vulnerable to breaches. Experts suggest a cautionary approach while creating and managing your passwords
People around the world behave in a
similar fashion while choosing passwords. They often pick phrases that are easy
to remember, such as names of family members and pets, or modifications of
simple words like ‘welcome’ or ‘password’.
Common sense suggests that
‘ji32k-7au4a83’ is unlikely to belong to the lexicon of universal puppy names.
However, the seemingly complex jumble can be reduced to a deceptively simple
phrase.
In the latest list of vulnerable passwords published by the data-breach website
HIBP, the alphanumeric combination ‘ji32k-7au4a83’ showed up more frequently
than expected. The mystery behind its popularity is more a tale of shared
tendencies, rather than one of deviant digital behaviour.
Character coding
David A Bader, Chair of the School of
Computational Science and Engineering at the Georgia Institute of Technology,
believes that the solution to the riddle lies in the way people from
non-English-speaking countries communicate over the internet.
“The random password that has been
found to be vulnerable by HIBP is actually the transliteration of ‘my password’
by the Zhuyin Fuhao system, used in Taiwan for converting Mandarin to Unicode,”
Bader told ETPanache. Unicode is the established encoding standard for the
digitisation of the world’s languages — from Catalan to Javanese.
Local threat
First-time internet users from the hinterlands of
India are going online in vernacular languages and their poor password habits
could jeopardise the country’s nascent digital payments sector. “With
applications like the Google Indic keyboard gaining popularity in India, the
use of scripts such as Devanagari to set passwords can present a similar
vulnerability,” said Roman V Yampolskiy, an expert on behavioural biometrics and
cybersecurity.
A Google representative told
ETPanache that keystroke data gleaned from its Indic keyboard app is stored
locally on the user’s device. He said user data is not being shared with Google
or third parties for fine-tuning its auto-correct and predictive text features.
Digital cleansing
“Since India uses both English and Hindi for
official documentation, clear advice should be given to government officials
and bureaucrats on the selection and use of passwords,” cautioned Bader. He
recommended a long random sequence of letters, numbers and special characters,
but stressed the importance of uniqueness.
Even though a food delivery app and
a music streaming service may not have anything in common, setting a common
password can expose one’s banking credentials to hackers if there is a breach
at either end.
Ripple effects
A breach at a streaming app will put more than
one’s taste in music under scrutiny. Hackers will be able to track down a
user’s physical address by checking the order log from previous transactions
made using the food delivery app.
The compromise can be furthered if a
common pool of passwords is being recycled across websites. Yampolskiy endorses
a cautionary approach coupled with diligence while maintaining a repository of
current and past passwords. “A secure password safe may also help keep your
online information safe from hackers,” he added.
Source: ET Panache
28.03.2019
