By Chris Morris | CNBC
Passwords are the first line of defense in protecting access to our finances, credit information and identities. But we, as a collective nation, do a pretty lousy job of guarding that line.
Among baby boomers, 58 percent still don't use secure passwords, according to the 2016 Norton "Cybersecurity Insights Report." And digitally native millennials are even more vulnerable.
Passwords aren't foolproof, of course. Any determined hacker can get past them, just as a burglar can get past a locked door. But despite repeated warnings from experts, many people are still doing the digital equivalent of leaving a key in the lock of their front door.
Protecting yourself isn't hard, but it does require a little effort. Here are eight ways to beef up your online security.
1
Don't pick a weak password.
As astonishing as it seems, people continue to use "123456" and "password" for their passwords, even though those have consistently been ranked the weakest, most easily guessable passwords for years. When you're asked to create or update a password for a site, avoid simple patterns that are easily guessed. SplashData and TeamsID suggest you select something that's 12 characters or longer, using letters, numbers and other symbols.
2
Use multifactor authentication.
An increasing number of online services that revolve around sensitive information (such as Gmail, online bank accounts and Slack, a group communication system favored by many companies) offer the option for an additional step between entering your password and accessing your account. (Typically, a code is sent to the phone number you have on record.) It takes a bit longer to gain entrée to the site, but it's a notable deterrent for someone trying to compromise your account.
3
If biometrics is an option, take it.
Smartphones, tablets and laptops are increasingly letting you log on with a fingerprint instead of a password. That's not only more secure, it also prevents you from forgetting your password. HSBC is one company embracing the movement, launching voice recognition and touch security services for up to 15 million U.K. customers who access their accounts through their mobile devices.
"The launch of voice and touch ID makes it even quicker and easier for customers to access their bank account, using the most secure form of password technology — the body," Francesca McDonagh, head of retail banking and wealth management for HSBC UK told the BBC.
4
Different accounts need different passwords.
While it's certainly easier to use the same password on multiple sites, remember that doing so can increase your vulnerability. Not only can hackers use that password to access other important accounts of yours, you're also opening yourself up to scrutiny from a larger number of people trying to crack many different sites. If you regularly visit a large number of sites and worry you'll forget which password to use, this next tip will come in handy.
5
Consider a password manager.
Password managers keep track of the various usernames and passwords you use on various sites, not only boosting safety but saving you time by automatically filling in the username/password fields. They'll also synchronize your passwords across different devices, meaning you won't be stumped if you log onto a site from your smartphone but registered on your laptop. There are several options to choose from, including offerings from Norton, Dashline, LastPass and LogMeOnce.
6
Don't share your password.
This seems like common sense, but a staggering number of people still freely give their passwords to others. Globally, says Norton, 31 percent of millennials are likely to share theirs. And one-third of the people who say they've shared their password in the U.S. have shared the password to their bank account. Don't be one of those people.
7
Don't fall for phishing.
Approach your email with skepticism. Delete notes — especially those with attachments — from people you don't know. And never click on attachments that seem suspicious, even if you do know the sender. Should you get a note from your bank or preferred airline, look real closely at the actual email address of the sender and make sure it matches the institution's URL. And rather than clicking on embedded links, copy and paste them into a browser window, which will let you better see where you're headed.
8
Always update software.
It seems we're notified almost daily about some program or another that requires an update. After a while, it's seemingly easier to put it off. But by doing so, you're putting yourself at risk.
"When that update notice comes up, people are ignoring it," says Hemu Nigam, founder of SSP Blue, an Internet security consultant business and former vice president of Internet enforcement at the Motion Picture Association of America. "Almost every single time, there's going to be a security update in that feature update, so you need to do it."
Passwords are the first line of defense in protecting access to our finances, credit information and identities. But we, as a collective nation, do a pretty lousy job of guarding that line.
Among baby boomers, 58 percent still don't use secure passwords, according to the 2016 Norton "Cybersecurity Insights Report." And digitally native millennials are even more vulnerable.
Passwords aren't foolproof, of course. Any determined hacker can get past them, just as a burglar can get past a locked door. But despite repeated warnings from experts, many people are still doing the digital equivalent of leaving a key in the lock of their front door.
Protecting yourself isn't hard, but it does require a little effort. Here are eight ways to beef up your online security.
1
Don't pick a weak password.
As astonishing as it seems, people continue to use "123456" and "password" for their passwords, even though those have consistently been ranked the weakest, most easily guessable passwords for years. When you're asked to create or update a password for a site, avoid simple patterns that are easily guessed. SplashData and TeamsID suggest you select something that's 12 characters or longer, using letters, numbers and other symbols.
2
Use multifactor authentication.
An increasing number of online services that revolve around sensitive information (such as Gmail, online bank accounts and Slack, a group communication system favored by many companies) offer the option for an additional step between entering your password and accessing your account. (Typically, a code is sent to the phone number you have on record.) It takes a bit longer to gain entrée to the site, but it's a notable deterrent for someone trying to compromise your account.
3
If biometrics is an option, take it.
Smartphones, tablets and laptops are increasingly letting you log on with a fingerprint instead of a password. That's not only more secure, it also prevents you from forgetting your password. HSBC is one company embracing the movement, launching voice recognition and touch security services for up to 15 million U.K. customers who access their accounts through their mobile devices.
"The launch of voice and touch ID makes it even quicker and easier for customers to access their bank account, using the most secure form of password technology — the body," Francesca McDonagh, head of retail banking and wealth management for HSBC UK told the BBC.
4
Different accounts need different passwords.
While it's certainly easier to use the same password on multiple sites, remember that doing so can increase your vulnerability. Not only can hackers use that password to access other important accounts of yours, you're also opening yourself up to scrutiny from a larger number of people trying to crack many different sites. If you regularly visit a large number of sites and worry you'll forget which password to use, this next tip will come in handy.
5
Consider a password manager.
Password managers keep track of the various usernames and passwords you use on various sites, not only boosting safety but saving you time by automatically filling in the username/password fields. They'll also synchronize your passwords across different devices, meaning you won't be stumped if you log onto a site from your smartphone but registered on your laptop. There are several options to choose from, including offerings from Norton, Dashline, LastPass and LogMeOnce.
6
Don't share your password.
This seems like common sense, but a staggering number of people still freely give their passwords to others. Globally, says Norton, 31 percent of millennials are likely to share theirs. And one-third of the people who say they've shared their password in the U.S. have shared the password to their bank account. Don't be one of those people.
7
Don't fall for phishing.
Approach your email with skepticism. Delete notes — especially those with attachments — from people you don't know. And never click on attachments that seem suspicious, even if you do know the sender. Should you get a note from your bank or preferred airline, look real closely at the actual email address of the sender and make sure it matches the institution's URL. And rather than clicking on embedded links, copy and paste them into a browser window, which will let you better see where you're headed.
8
Always update software.
It seems we're notified almost daily about some program or another that requires an update. After a while, it's seemingly easier to put it off. But by doing so, you're putting yourself at risk.
"When that update notice comes up, people are ignoring it," says Hemu Nigam, founder of SSP Blue, an Internet security consultant business and former vice president of Internet enforcement at the Motion Picture Association of America. "Almost every single time, there's going to be a security update in that feature update, so you need to do it."
 |
| A customer tries out the Apple Touch ID, fingerprint scanner, on the iPhone 5S. |
 |
| Cyber-attacks are on the rise with security breaches like Ashley Madison, Vtech and Anthem dominating the last year. A secure password goes a long way in warding off such cyber-attacks. Two key elements make for a perfect password—it should be easy to remember and hard to crack. With some basic tricks and know-how of what hackers prowl, you can create a secure password for your online accounts. Click on to read some important tips for setting a safe password. |
 |
| A typical password consists of a root (generally a pronounceable word) and an appendage (a suffix or prefix). Therefore, break the norm. Do not choose a password that is a simple transformation of a word. For example, adding a number sequence at the end of a proper noun is a common practice. Avoid this. |
 |
| Experts advise using “passphrases" wherever possible. For example, "Ihave50books@home," or abbreviating a sentence like "I have two kids:Jack and Jill" as "Ih2k:JaJ." Passwords created using such cues are easier to remember and harder to crack by a malicious person or malware as they won't be in any hacker's dictionary. |
 |
| Choosing a password based on personal data like your name, pet’s name, phone number, address, anniversary, date of birth or car plate’s number is a strict no-no. Such information can be easily discovered by anyone planning to hack your account. |
 |
| Do not form a password that is fewer than six characters or one that exactly matches a word in a dictionary—read forward, reversed or pluralized, with some or all of the letters capitalized. A hacking program (often called "cracker") can try the full set in under one minute. |
 |
| Do you know that an 8-digit alphanumeric will generate 645 trillion combinations as against 100 million for a number-only password? |
 |
| It is best that you memorize important passwords and not write them down anywhere. But if you must, we suggest the following—Don’t write down the entire password, rather just a hint which would help you reconstruct the password whenever you look at it. Also, keep it in a secure place like wallet, so that you can immediately notice if it is missing. |
 |
| These days, password management software is available to securely store your passwords and apply them when you log on to various sites. They also help you generate strong passwords. According to Top 10 Review, RoboForm Everywhere is 2015’s top-rated software program which sells for less than $10. |
 |
| Never reuse important passwords (like for online banking) on other websites. "Not all websites protect their passwords properly, or your password may be captured by malware. Use unique passwords with a password management software to keep track of them," says Dr Angela Sasse, University College London's head of information security research. |
 |
| Randy Abrams, director of technical education at WeLiveSecurity, suggests a smarter way of encrypting password-reset questions—do not provide correct answers. For example, your mother’s maiden name is Tarzan. Or, that the name of the first school you attended was LegoPrimary. |
 |
| Don’t make a password so complicated that it becomes cumbersome to remember or type. A password with too many special characters would make it harder to type on touchscreen phones or gadgets, since one has to toggle between keyboards. |
 |
| Don't update your password regularly, because that compels you to reuse the old passwords with minor or no modification. Many companies force their users to change password frequently—some every 30 days—to prevent exploitation of any leaked password. According to experts, such a step levies more harm than improve security. However, it is okay to recycle password for sites that don't store personal info, such as Internet radio stations. For important sites, change the password once or twice a year. |
 |
| Many websites now offer two-factor authentication. In addition to typing in the password, a one-time numeric code is generated, which is sent to on mobile. This offers a substantial improvement in account security. So go for this option whenever and wherever it is available. |
