Personal security: passwords, MFA and phishing

Elvin's social media account was taken over, even though his password was long and complex. The reason turned out to be simple: years ago he had used the same password on a gaming forum, the forum's database leaked, and bots tried the leaked email-and-password pairs on hundreds of sites. In this lesson we go deeper into passwords, multi-factor authentication and attacks that target human psychology.

Password strength in bits

The number of possible passwords is C = Aᴸ. Professionals express this huge number as entropy, in bits. Every extra bit doubles the attacker's work.

import math

def pool_size(pw):
    pool = 0
    if any(c.islower() for c in pw): pool += 26
    if any(c.isupper() for c in pw): pool += 26
    if any(c.isdigit() for c in pw): pool += 10
    if any(not c.isalnum() for c in pw): pool += 33
    return pool

LEAKED = {'123456', 'qwerty', 'password', 'baku2024!', 'iloveyou'}

for pw in ['qwerty', 'Baku2024!', 'nar-velosiped-bulud-7', 'P@ssw0rd2026']:
    bits = len(pw) * math.log2(pool_size(pw))
    note = 'LEAKED - never use' if pw.lower() in LEAKED else ''
    print(pw.ljust(22), f'{bits:5.1f} bits', note)

qwerty                  28.2 bits LEAKED - never use
Baku2024!               59.1 bits LEAKED - never use
nar-velosiped-bulud-7  128.3 bits
P@ssw0rd2026            78.8 bits

Nobody can remember dozens of unique passwords, which is why you need a password manager. It generates a random password for every site and keeps them all in a “vault” encrypted with one master password. A bonus: the manager autofills only on the correct domain and stays silent on a fake one — a hidden anti-phishing signal.

Multi-factor authentication

Multi-factor authentication (MFA) requires at least two proofs of different kinds: something you know (password, PIN), something you have (phone, security key) and something you are (fingerprint, face). Two passwords are not two factors — both are “something you know”. And MFA methods are not equally strong:

import hashlib, hmac, struct

def totp(secret, unix_time, step=30, digits=6):
    counter = unix_time // step
    digest = hmac.new(secret, struct.pack('>Q', counter), hashlib.sha1).digest()
    offset = digest[-1] & 0x0F
    number = int.from_bytes(digest[offset:offset + 4], 'big') & 0x7FFFFFFF
    return str(number % 10 ** digits).zfill(digits)

secret = b'12345678901234567890'   # test secret from RFC 6238
for t in [59, 60, 89, 90]:
    print('time', str(t).rjust(2), '-> code', totp(secret, t))

time 59 -> code 287082
time 60 -> code 359152
time 89 -> code 359152
time 90 -> code 969429

The secret sits inside the QR code shown when you turn MFA on. That is why you must never show that QR code to anyone, and why you should store the backup recovery codes in your password manager.

Phishing and social engineering

Social engineering hacks people rather than technology. The attacker creates urgency, frightens, poses as a boss or a bank employee, and exploits curiosity or the wish to help. The channel varies: email (phishing), SMS (smishing), phone calls (vishing), QR codes, even a friend's hijacked account.

Device and privacy hygiene

• Turn on automatic updates: most patches close weaknesses that are already publicly known.
• A screen lock and disk encryption (BitLocker on Windows, FileVault on macOS) turn a stolen laptop into a useless piece of metal.
• Review app permissions: a flashlight app does not need your contacts or location.
• Breach-notification services (for example, Have I Been Pwned) show which leaks your email appeared in — change every password that shows up there.
• Share less on social media — birthday, school, home address: they feed reconnaissance and answer “security questions”.

import math

WORDLIST = 7776
# for 3, 4, 5 and 6 words print: N words: X bits

3 words: 38.8 bits
4 words: 51.7 bits
5 words: 64.6 bits
6 words: 77.5 bits