Hi, this is Gary with MacMost.com. This is
Part II of my course The Practical Guide to Mac Security. This course is brought to you
free thanks to my Patreon supporters. To find out more go to MacMost.com/patreon.
So I'm going to start this course by talking about Passwords.
Passwords are perhaps the most fundamental part of your Mac computer device and internet security.
Without strong passwords all other security measures don't mean much since with a weak
password it's easy for someone else or an organization to break into one of your accounts.
So to understand why you need strong passwords it's important to understand
how an account is broken into. The main method that is used is simply Brute Force.
This means trying over and over again to break into an account. Any internet account has
three parts to it. The first part is simply the Service itself. So this could be a shopping site,
it could be your bank's website, it could be a site like Facebook. Now for your individual
account you've got an ID. This is almost always your email address. Email addresses are unique.
That's why they make good IDs. IDs have to be unique. Your name probably isn't unique. There's
probably somebody else with your name. Coming up with your own ID it's going to be hard to come up
with an ID that's unique. But email addresses are unique. You've got your email address and nobody
in the world has that same email address. So they make really good IDs and also they're good
because they are hard to forget. So you can't forget your ID because it's your email address.
The third part, of course, is the Password. With these three things the target site,
your email address, the ID for your account, and the Password, if somebody has those three things
they can get into your account. So the target is always going to be a
property of some value. The bank is always a common example but social media accounts,
email accounts, the account setup on your computer, your iCloud account,
these are all good examples. Shopping sites like eBay and Amazon are all good examples. There is
some value to having access to somebody else's account on these targets. You email address,
the second part, is easily available. If you've ever gotten a single piece of junk email that
means your email address is out there and everybody has gotten some junk email. So if
you don't think you have look in your junk folder and if you still don't find it there it's probably
because your internet service provider has filtered it out before they come to you.
Lists of email addresses are out there. Your email address is public information just like the street
address for your house. Anybody walking by your house can see that. So the only real security is
your Password. If you have a weak password brute force can be use. A combination of the target
site with your email address which can come off a list of everybody's email address, and a password
that you use that is weak can be tried and, if successful, they've broken into your account.
Now what are the chances that they are going to guess your password. Well, pretty remote except
that they can try again and again and again. Using brute force they can try millions of times, trying
all sorts of weak passwords to try to get in. They can do this because they're not just using
one computer. They are usually using networks of computers. Sometimes computers that have malware
on them that have been turned into servants of the malicious people that want to break into accounts.
So you have all these computers all around the world trying a service, and email address,
and password over and over again and trying to get a certain number of accounts that they can hack in
a given time period. So try, try, and try again is how brute force works to break into your account.
Another way that they can break in is with the Data Breech. So a data breech
is when you have those same three things, the target site, email address, and password, but the
email address and password come from a list. This list is from when there is a data breech.
So sometimes you hear about a big company, maybe a retailer or online service, they have a data
breech. They say somebody got to all our data. This could include email addresses and passwords.
Now when you hear about this you are told to change your password at that site or service.
Sometimes you get an email directly from them telling you to do that. You may think,
okay I've changed my email address for that service so I should be safe. But a lot of people
reuse passwords. So if you've used that same email address and password on another site they
can break into that other site. So in other words Site A you're using the same password as Site B.
Site A has a security breech so your password for Site A is out there but you've changed your
password for Site A but you forget that on Site B you're using the same email address and password.
They are going to try that email address and password combination at that site. It's a lot
easier given a data breech list like this for them to get in. Not all data breeches are reported. A
lot of them are not. So a site that you signed up for that you didn't even think was important,
maybe you don't even use it anymore, that site got a data breech. You never even heard about it
and that password you are using in another site that is important, now that site is broken into.
They will try, try, and try again to use this data breech information to get
into different accounts. They are usually pretty successful.
A third way to do it doesn't involve weak or strong passwords because any password
is vulnerable. It's Social Hacking. You've got the same three things that are needed but in
this case they are going to use you and con you out of your email address and password.
This doesn't need any kind of brute force. They can do it in one try. We'll talk about that later
on in the course and how to avoid that. So even strong passwords will have their limit.
Now in order to get a strong password you need to understand what a weak password is. So what is a
weak password? Well, first it's any dictionary word. Any word that's in a dictionary. Now keep
in mind even though there are only about 80,000 words in English which seems like a really low
number if you think about it. 80,000 words, 80,000 passwords, take no time at all for a computer to
run through them and try all those words as passwords. But, in fact, most of those are
technical terms and things like that that we don't normally use. Everybody uses about 10,000 words so
it's really easy to go through those words and try them as passwords, even combinations. So
things like this for passwords, they may be great because you can easily type them and can easily
remember them. But they will easily be broken. You account will be broken into if you use something
like this. Even combinations of words like let me in or my pass. Things like that where there's
more than one dictionary word in there easily broken when they try to break into accounts.
Also variations. You may think you're being being clever by using a
zero instead of an O or a 5 instead of an S or even an exclamation point instead of a
one or an i. These can easily be broken too because they know all these tricks and they're
going to try the word dragon with an O and dragon with a zero and all other variations you could
possibly dream of. It's not hard for them to add these to the list and try these variations.
Also names and places. So you might want to have your password be the name of a loved one.
But there are fewer names than even regular dictionary words. Even if you throw in a place
names and team names and variations of things like that. These are also things that are tried.
Just imagine a huge list of potential passwords. Millions and millions of passwords that other
people have tried that are combinations of words and things. These are all going to be tried with
your email address to break into your accounts. Also dates. People try to use dates but in fact
there aren't that many dates. 365 days a year and most dates that we try to use
are either without the year or maybe within the past 50, 60, 70 years like birthdays and
anniversaries and such and there's only so many formats. It really isn't hard to try all of these
different dates. No matter how clever you think you're being trying to use a different date format
they're going to be things that are easily broken. Combining words with dates as well.
Anything easy to type also is on this list like 1,2,3,4,5,6,
qwerty, just repeating the same character over and over again. Or things that are on the same row on
the keyboard. These are all things that they are going to try to break into your accounts.
So the last piece here that makes a weak password, even if a password looks strong,
it's weak if it's not unique. So what's not unique. Any password you've used before.
You should only use a password at one site once and that's it.
Once you've changed that password never use it again. Never use it at a second site.
A password anybody else has used before. So this, of course, you wouldn't know but
if you're going to be using a random password then chances are it never has been used before.
Any words or phrases from TV, movies, book, anything like that. Just weird things that
you've heard being used as passwords in combinations or anything that's not unique.
Think of if it exists somewhere else in some form. If it's been written, spoken, in anyway then it's
not unique. Then it is something that will be tried as a password to break into your account.
So knowing what a weak password is can help you learn what a strong password is. It's basically
anything that's not a weak password. So follow some simple rules to have a strong password.
The first rule is it must be random. It cannot be something that comes out of your head that
you've seen somewhere or somehow picked from some source. It's got to be random. The only
way to have a random password is to have the computer generate random characters for you.
It's got to be long. Six characters is not enough. Even eight is questionable.
It should be long. You shouldn't have to worry about memorizing it or typing it because, as
we're going to learn in this course, you're going to use a Password Manager, like the one built into
Safari, to actually generate the password. It's going to remember it for you and it is going to
enter it for you. You don't need to ever enter it in. So, coming up with a password that's 12 or 16
characters long and it's random and impossible to memorize, that's fine. That's a strong
password and that is what you should be using. Also unique. Never use the same password twice.
Never use it at two different sites. Never repeat using that same password.
Then as a bonus, in addition to that also use as many different characters as you can. Of course
use letters. But up and lower case. Numbers and many symbols are accepted for passwords like
dashes and such. The more different characters you use the stronger the password will be.
So how do you get a strong password? I've already mentioned this. There's really
only one way to do it right and that's have a random, password generated by your computer.
We're going to learn in this course how to use Safari to have a random password generated.
But there are also many third party password managers like OnePassword and LastPass that
will generate random passwords for you, remember them, and enter them in for you automatically.
Anything less, anything that you come up with or that you can easily memorize
because it's short enough or typed like that is not going to be a strong password
and is going to make your computer, your devices, your online accounts vulnerable to attack.