LockInCS

Topic 1.2 · Unit 1: Introduction to Security · 15 minute session

1.2 Suspicious Website Logins

In an online password attack, adversaries try to log in using common passwords, common patterns or stolen passwords. Signs include many failed attempts in a short time, logins at unusual times and logins from unknown devices. Long, random, unique passwords and multifactor authentication (MFA) make authentication stronger.

Big idea Weak authentication is an open door. Long, random, unique passwords plus multifactor authentication (MFA) close it.

Course and exam description (CED) codes covered: 1.2.A.11.2.A.21.2.B.11.2.B.21.2.C.11.2.C.21.2.C.3

Last reviewed against the CED:

By the end of this session you can

  • 1.2.A Identify common signs of a password attack.
  • 1.2.B Explain how adversaries take advantage of weak authentication.
  • 1.2.C Explain how to make authentication stronger.

Already know this? Jump to the checkpoint.

1. Signs of a password attack (1.2.A)

In an online password attack, the adversary tries to log in to a device or service using common passwords, common password patterns or passwords stolen in earlier breaches 1.2.A.1.

Login records give it away. Watch for these signs 1.2.A.2:

  • Many failed attempts in a short time. A person mistypes once or twice. A tool fails dozens of times a minute.
  • Logins at unusual times, such as 3 a.m. for a student account.
  • Logins from unknown devices the user has never signed in from.
A table of seven login attempts. Rows 1, 2 and 7 come from the student's home address in the evening or on the weekend and succeed. Rows 3 to 6 come from an unknown address at 3:12 a.m. on Thursday, fail three times within seconds, then succeed.
Anatomy of a login log: rows 3 to 6 show all three signs, and row 6 is where the adversary got in.

2. How weak passwords get cracked (1.2.B)

People are predictable. Common patterns include 1.2.B.1:

  • one or two words, then a two-digit number (often a year), then a special character at the end
  • names of family members or pets
  • personally significant dates

Adversaries use this. They collect personal details about the target, such as birthdays, anniversaries and pet names, build a dictionary of likely passwords from them, and let an automated tool submit the guesses 1.2.B.2. A public social media profile can hand them most of the list.

Guessing dictionary built from one public profile
# found online: dog "Mocha", born 2008, team "Falcons"
Mocha2008!
mocha08!
Falcons2008!
MochaFalcons08?   # still guessable: both words are public

3. Making authentication stronger (1.2.C)

  • Long, random, unique. Every account gets its own password. A password manager can generate and store them, or you can use a long, unique passphrase 1.2.C.1.
  • No personal words or numbers. Skip names, dates and anything meaningful to you 1.2.C.2.
  • Turn on multifactor authentication (MFA). MFA asks for extra proof of identity, such as a one-time code, on top of the password 1.2.C.3.

Prevent: a passphrase made of several random unrelated words is long and easy to remember. A password manager means you only have to remember one.

Lock it in: memory hooks

One picture per idea. If you remember the hook, you can rebuild the details.

  • Strong passwordsLong, random, unique: three words to remember, one password per account.
  • Signs of an attackToo many, too late, too strange: many failures, unusual times, unknown devices.
  • MFAA password is something you know. MFA adds a second proof, so a thief needs two keys, not one.

Common misconceptions

  • "Adding a year and an exclamation mark makes a password strong."

    Not quite. Word plus two-digit number plus symbol is one of the most common patterns, so it is one of the first things guessing tools try.

  • "Adversaries guess passwords by hand."

    Not quite. They build a dictionary of likely passwords, often from your personal information, and feed it to an automated tool that submits guesses.

  • "MFA is pointless if my password is strong."

    Not quite. Passwords get stolen in data breaches no matter how strong they are. MFA asks for extra proof, such as a one-time code, so a stolen password alone is not enough.

Simulation · [1.2.A.1, 1.2.A.2]

Log hunt: spot the online password attack

This is the sign-in log for one student account. Tap every line that is a sign of an online password attack, then check.

Account activity · jleeswipe sideways for more
DAYTIMEDEVICERESULT

  1. Fine. The student’s usual school device, during school hours.

  2. Fine. A known device at an ordinary time.

  3. Red flag. A login attempt at an unusual time from an unknown device: two signs at once.

  4. Red flag. One second later, another failure. Many failed attempts in a short time point to an automated tool guessing passwords.

  5. Red flag. The pattern continues: one guess per second from the same unknown device.

  6. Red flag. The guessing worked. The adversary is in, which is why multifactor authentication (MFA) matters: a correct password alone would not be enough.

  7. Fine. One failure on the usual device in the afternoon looks like a normal typo.

Exam traps

  • First find the normal pattern in a log, then name the rows that break it.
  • A long password reused on many sites is still unsafe: one leak unlocks every account.

By the numbers

Say each list out loud, then tap to check.

3 guesses, 3 signs Say them, then tap
  • common passwords
  • common patterns
  • stolen passwords
  • many failed attempts in a short time
  • unusual times
  • unknown devices
3 weak patterns Say them, then tap
  • words + two-digit number + special character
  • family or pet names
  • significant dates
3 stronger habits Say them, then tap
  • long
  • random
  • unique (password manager or passphrase)
  • no personal names
  • dates or numbers

In 30 seconds

  1. Online password attacks use common passwords, common patterns or stolen passwords.
  2. Signs: many failed logins in a short time, logins at unusual times, logins from unknown devices.
  3. Weak patterns: words plus a two-digit year plus a symbol, family or pet names, meaningful dates. Adversaries turn personal details into a guessing dictionary for an automated tool.
  4. Defense: long, random, unique passwords or passphrases, a password manager, no personal words or dates, and MFA whenever available.

Cover this list, say the points out loud, then take the checkpoint without scrolling back up.

Checkpoint · 6 questions

Checkpoint: Suspicious Website Logins

Pick an answer to mark it. Every answer is explained, and you can try any question again. Your saved score counts first tries only, and stays in this browser.

  1. 1 Which log entry pattern is the strongest sign of an online password attack? 1.2.A.2
    Show answer

    Answer: D. Many failed attempts in a short time from an unknown device matches the signs of an online password attack.

  2. 2 In an online password attack, adversaries try to log in using which of the following? 1.2.A.1
    Show answer

    Answer: D. Online password attacks use common passwords, common password patterns or stolen passwords.

  3. 3 Which password follows the most common weak pattern? 1.2.B.1
    Show answer

    Answer: A. A word, then a two-digit number (often a year), then a special character at the end is one of the most common patterns, so guessing tools try it early.

  4. 4 An adversary reads a target's public profile and finds their dog's name and birth year. How are these most likely used? 1.2.B.2
    Show answer

    Answer: C. Adversaries build dictionaries of possible passwords from personal information and submit them with an automated tool.

  5. 5 Which is the strongest choice for a new account? 1.2.C.1, 1.2.C.2
    Show answer

    Answer: C. Passwords should be long, random and unique, and avoid personally meaningful words or numbers. A password manager can generate and store them.

  6. 6 A student's password was leaked in a data breach, but the adversary still cannot log in. Which control most likely stopped them? 1.2.C.3
    Show answer

    Answer: D. Multifactor authentication (MFA) requires extra proof, such as a one-time code, in addition to the password, so a stolen password alone is not enough.

Key terms: flip the cards

Read the term, say the definition out loud, then flip to check. Struggling a little to remember is what makes it stick.

  • Online password attacktap to flip

    An attack where an adversary tries to log in to a device or service using common passwords, common patterns or stolen passwords.

    Example and CED codes
  • Multifactor authentication (MFA)tap to flip

    A login that requires extra proof of identity, such as a one-time code, in addition to a password.

    Example and CED codes
  • Password managertap to flip

    A tool that generates and stores long, random, unique passwords so each account can have its own.

    Example and CED codes
  • Passphrasetap to flip

    A long password made of several words, easier to remember than random characters and hard to guess when the words are unrelated.

    Example and CED codes
  • One-time password (OTP)tap to flip

    A code that works for a single login or a short time, often sent by text or an authenticator app as a second factor.

    Example and CED codes

Questions students ask

What are the signs of an online password attack?

Many failed login attempts over a short time, login attempts at unusual times, and login attempts from unknown devices.

Why is Buddy2009! a weak password?

It follows the common pattern of a word, a two-digit year and a special character at the end, and it uses a pet's name, which an adversary can find and add to a guessing dictionary.

What does a password manager do?

It generates and stores strong passwords, so each account can have a long, random, unique password without you memorizing them all.

↑ Top

Enlarged view of the selected figure