Hackers love when you reuse passwords—here’s why it’s so dangerous
Finding and remembering endless passwords is the bane of my existence, and the fact that you’re reading this on the Internet probably won’t please you either.
This is why so many of us fall into the trap of using the same password on multiple sites, but it’s probably the most dangerous thing you can do when it comes to online security.
Password Reuse Is the Shortcut Hackers Love
If you only know your password, what does it matter if you use the same one on multiple services? In a perfect world, you might be right, but hackers have different ways to extract your password from the websites they hack.
A common method is to “brute force” the encrypted password until they find a password that matches it and unlocks your account. However, if they have your email address and password for a service, it’s easy to just try the same combination on other popular services.
Since many people reuse their passwords, this saves a hacker a lot of hassle!
Even “low risk” accounts can be the weak link
You may not care about some of your accounts being hacked. Maybe it’s an old forum that’s gone, or a service you never actually used and just created an account for.
However, these small player accounts can actually be the most dangerous place possible to reuse passwords. These sites may not have good security, making them much easier to hack. Getting your password from an insecure site can allow a hacker to access your bank account or other crucial services where they otherwise would have had no chance of hacking the security.
Your email account is the master key to everything else
The most important account to give a strong and completely unique password is your primary email address. This is the address you use to sign up for other services. If someone gains access to this account, it will allow them to reset passwords across the board and, of course, lock you out of everything.
In addition to a unique password for your primary email address, you need to enable two-factor authentication and set up a backup recovery method, such as the email address of a trusted friend or family member, or a backup code. Depending on what your service offers.
Of all your online services, you should defend your primary email account as if your life depended on it, because it pretty much does these days. The only copy of my master email password is printed on a piece of paper hidden somewhere in one of my safes. But maybe I’m more paranoid than most.
7/10
- Supported Desktop Browsers
-
Chrome, Firefox, Safari, Edge, Opera, Brave
- Price
-
From $3.33/month for the Personal plan
Keeper Security is a reliable password manager that offers a monthly subscription (as opposed to an annual subscription, like Bitwarden), as well as a completely free basic account that forgoes premium features.
Reusing Passwords Makes Every Breach Personal
Big hacks target entire companies or large organizations, but if you reuse your passwords, you’re connecting that data breach to every other online resource you’ve affected. This is why it is crucial to isolate your different accounts. Yes, it’s a real pain to come up with passwords, remember them, and recover them, but at the very least, your bank, primary mail, and other key accounts that you can’t afford to lose access to should be completely unique.
It is also important to know that we are only notified of data breaches that are detected or disclosed. It’s entirely possible that your credentials were already exposed years ago in a data breach that no one knew about. This is one of the reasons why many modern online services put an expiration date on your passwords and require you to change them.
Then of course we tend to just mix up our existing password or change a small part of it because we can’t be bothered to imagine something unique when we are blinded by an expired password. This is again why some services will tell you that your new password is too similar to your old one.
You see, even if you remix your password or change parts of it, hackers who know one of your old passwords can use it as part of a “dictionary attack”, where the assumption is that the target password is similar to a known password, and therefore a password cracker can complete all the permutations in a matter of seconds, because there are only a limited number of combinations.
The Simple Solution: Let a Password Manager Do the Work
The simple solution here is to simply use a specialized password manager. We maintain a list of the best password managers and there are even good free password managers if you don’t want to spend money right away.
A password manager will securely store your passwords, generate new ones if necessary, and automate updating and saving all your passwords so you don’t have to remember them.
8/10
- Supported Desktop Browsers
-
Chrome, Edge, Safari, Firefox, Opera, DuckDuckGo, Vivaldi, Brave, Tor
- Price
-
From $10/year
- Free trial
-
Free account available
