In recent years there have been a number of spectacularly huge hacks. As examples:

  • The 2013-14 hack of Yahoo involving 3 billion accounts
  • The 2016 hack of Adult Friend Finder involving 400+ million accounts.
  • The 2014 hack of eBay involving 140+ million accounts.

In the last few months a repository of 1.4 billion plain text passwords was found on the net.

I have two questions:

  • What could most easily be changed that could have made these hacks much harder?
  • What could most easily be changed that would make credential stealing less worthwhile? For example, if we all stopped using usernames and passwords to log into systems?
  • @schroeder Updated the question. Thanks so much for helping me clarify this. – felipa Mar 12 '18 at 15:10
  • The service providers could have not stored the passwords in plain text or reversible encryption and instead relied on a one-way hash. – myron-semack Mar 13 '18 at 3:44

What is your actual question? "Is there a single change that could have made these hacks much harder?" seems like you are asking what could have been done to make it harder for the hacker to acquire the passwords (e.g: How do I properly secure my system?) but your example makes it look more like you want to know how you as a user can minimize the threat of stolen/leaked passwords.

In case you want to know how to make it harder on the hacker the answer is simple: No there is no magic trick that will make it harder for any hacker to compromise your system. It's an array of things you have to do.

What you as a user can do to minimize the threat of stolen passwords is also quite easy:

  • Use 2FA wherever possible
  • Use a password manager (KeepassX comes to mind)

If you do NOT want to use a password manager (for whatever reason) here are two things to consider when choosing a password:

Never use the same password twice!

You are probably not a person of special interest so the most probable way for you to get your password stolen is by these huge password leaks. By re-using your password across multiple platforms attackers can clearly map your username to your password and simply use that.

Increase the haystack

We have been told to create passwords which are hard for humans to remember but easy for machines to brute-force. Do not make your password a random string of letters, numbers and special characters, simply increase the size of the password, chose your favourite book quote or something similiar. 923_ixa13ff$/)" is an arguably worse password than "I like to take long hikes during spring, it's very relaxing"

  • I did mean "what could have been done to make it harder for the hacker to acquire the passwords" – felipa Mar 12 '18 at 15:03
  • Then no, there is no "magic trick" to make it much harder for the hacker to break into your system. It's multiple things you need to do like salting the passwords, properly securing your routers, switches, clients, properly training your staff to identify phishing attempts etc. and even then there are 0-days and less than 0 days that you'll never catch. – Slzy Mar 12 '18 at 15:06
  • OK thanks. On the other side of the question, if there are no passwords (say some biometric system) then I suppose these hacks just disappear? – felipa Mar 12 '18 at 15:07
  • 1
    Pretty sure that will not be the case. Those biometric systems will still need to be coded somehow, you could abuse/exploit weakness in said code. As long as you have humans write code there will be ways to exploit it. There is no 100% bug/abuse free code out there. Some biometric scanners are even worse than a password - F.ex. the samsung biometric scanner for their phone could/can(?) be "hacked" by printing out a picture of the persons face or simply holding it up to your screen while you're on their facebook page. – Slzy Mar 12 '18 at 15:11
  • Those are good points. I was just wondering what the theft of 1 billion biometric credentials would allow a hacker to do. – felipa Mar 12 '18 at 15:13

Since people are lazy and don't really believe someone are interested in their stuff somehow I guess following things could prevent the password cracking:

I believe that could make password hacking even more tough.
Use random set of characters and a maximum length that your account or system will accept,
Use all of the Allowable Character types.

there so few systems out there that actually have device authenticator.
Use authenticator device to log into sensitive services.(or security tokens) are devices that use complex algorithms to generate one-time passwords.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.