Nine Ways Your Account Can Be Compromised Even with a Superstrong Password
Hi everyone. I’m Leo Notenboom for askleo.com. Let's dive right into today's question. “I
sometimes play a game online to pass the time. It's a simulation type of game but I like it.
One day I logged into my account and realized that someone had changed the password and taken
all my stuff. How is it possible they've hacked my account? My password has plenty
of characters. It's almost impossible to guess because it sounds like random gibberish
to everyone except myself, and there are plenty of numbers and secret characters in it.
Is it true that they used a hacking device or program of some sort to hack my account?”
Now to be clear I can't say what happened to your account specifically. I really don't have
any idea. But I can tell you that having a strong password, which is something we harp
on all the time don't get me wrong, it's only a start. There's much more to your security
than having a long strong password. Here are some of the ways your account could be compromised,
even with that long strong password. The first thing that comes to mind: a key logger. Malware
installed on your machine that's recording your keystrokes. It will dutifully record every one
of those characters in your long strong password and pass it on to whoever installed the keylogger.
I also want you to understand that some of the techniques that I keep hearing about supposedly
bypassing keyloggers don't, or rather they don't bypass all key loggers. Remember once malware is
on your machine it could be logging everything. It could be capturing everything. And that means all
of the things that you might use to quote unquote bypass a key logger. It can record all that too.
The takeaway here of course is don't let malware on your machine. Once malware is on your machine
all bets are off and getting your keystrokes is not that hard. Another option? You could have used
a public computer. Now using a public computer in and of itself probably isn't that big a deal,
but you need to understand two things. One it could have malware. All bets could be off.
However even if it doesn't it's possible to install malicious hardware on machines
that you don't control. That malicious hardware could be something, for example,
between the keyboard and the computer and it could once again be logging all of your keystrokes
without any software being installed on the machine. Option number three? You've been phished.
Somewhere, somehow you fell for a phishing attack. You got an email
that convinced you you needed to sign in with your account. Except it was a fake. They took
you to a fake website where you tried to login with your account and you typed in your password
to a malware author, who then collected it and can run off and log into your account. Another? This
is less common these days, but it's still possible you've got really poor security question answers.
By that I mean you have questions that are used for account recovery
that anybody could find the answer to. They may know your date of birth. They may know
your mother's maiden name. It may be that you've posted some of the answers to your favorite pet
on your social media that anybody could find out. Make sure those questions, if they are still being
used, have answers that are clearly not obvious to anybody. Also not as common these days maybe you
logged in on an open wi-fI connection. Open wi-fI can be sniffed and if the game you're playing
isn't using encryption in its communication path your password could have flown by in plain text.
Again that's not something that should be happening. Often and honestly I would really
question the security of the game at that point, but it is a possibility. Another possibility?
You walked away while you were logged in. At that point again, depending on the security that
is implemented by the game, somebody could have walked up to your machine and changed
your password without you knowing about it. In that same vein another possibility is that you
just left your computer accessible. You weren't necessarily logged in but there were shortcuts
of some sort that allowed someone else to log into the game as you without you being around.
At which point they could change your password. You told a friend. I have a string of questions
from people who basically shared a password with a friend or a relative or someone who they trusted.
After which, at some point, that trust was compromised and that friend misused the ability
to log in with that password. It's possible that that so-called trusted friend wasn't
as trustworthy as you thought and went in and changed your password. Finally, the last thing
that comes to mind is someone watched. I don't know how difficult it is to type your password,
but even some long complicated passwords that look to you and I like a gobbledygook
sometimes end up being fairly easy to type sequences on a keyboard. If someone is watching
as you type in your password they could see what that sequence is. They could memorize it. They
could quickly write it down and they could come back later then and log in as you and change your
password. Now there are, of course, probably other ways that your password could get compromised as
well. If the service is doing security poorly maybe they're storing your real password and
they actually had a breach of some sort. That's not in your control. These are the things that
are in your control, that are worth reviewing if any time your account gets compromised
and you don't understand why. Especially if you've used a good strong password. I hope that
was helpful. Hope that gives you some ideas. For updates, for comments, for related links and more
visit askleo.com/4492. I’m Leo Notenboom. This is askleo.com. Thanks for watching.