Hackers get your data through weak passwords practices: Understanding why and how to improve password protection

Using authentication to secure data and accounts has grown to be a natural part of using computers. Even if several authentication methods exist, using passwords remains the most common type of authentication. People usually have a multitude of different passwords and when they create their passwords, they often use a strategy to make the password easy to remember (Pfleeger, et al., 2015; Stobert & Biddle, 2014; Ur, et al., 2015). This behavior limits the protection of users. Even if awareness of the importance of strong password increased among clients, entropy-based and complexity-based password strength is not the only aspect that should be considered (Microsoft, 2022). Password policies must understand human behavior by avoiding useless requirement like monthly change which result in reinforcing bad behaviors from users more than protecting them. The third aspect is following good password practices by avoiding, for example, password reuse across different sites. The presentation aims to explain good password practices and how organizations can increase employees’ protection with adequate structure. Anonymized data from GoSecure’s cybersecurity tests are used to evaluate the prevalence of good practices in comparison with data from other organizations’ leaks. The analysis helps reveal different types of passwords strategies and the similarity between actors. Results show that GoSecure’s clients have a better performance in terms of password creation strategies compared with passwords found in leaks. However, efforts should be put towards other aspects of password good practices as we will demonstrate that modern behavior-based password cracking techniques still achieve a high degree of success against complexity-based policies.