It took her less than an hour.

Fortunately, it was only an old iPad mini.

She’d never seen me log in.

She just kept guessing.

Every wrong guess made the iPad wait longer before she could try again.

So in that hour she had maybe ten guesses.

Not ten thousand. Ten.

That means my code wasn’t secure.

It was guessable.

Bank and card PINs have the same problem.

The bank locks you out after three wrong tries, so nobody is trying every combination.

They don’t need to.

Birthdays, 1234, the year you were born, the same digit four times.

A person who knows a little about you has a head start.

It doesn’t matter if you change it regularly, it’s still insecure.

With no lockout, a 4-digit code falls to anyone patient enough.

I’ve done it to two combination locks.

I used to think that a secure password had to be long, true.

It had to have a combination of letters and numbers, true.

One dictionary word is weak.

Four random words together are stronger.

An attacker is not playing Mastermind or Wordle.

No guess gives any information other than right or wrong.

They have to guess all of the password correctly, not parts of it.

I found this web page

https://www.grc.com/haystack.htm

and it changed the way I create passwords.

This is what I do today.

I use two symbols in the password.

I use upper and lower case letters.

I use a number.

The symbols and their placement are always the same.

The number is always the same.

The letters are derived from the URL of the site I’m logging into.

This is a pattern that I can remember, but if one of my passwords is compromised, potentially all of them are.

That’s why I also use 2FA where I can.

Your password does not stop a hacker getting in.

A good password stops them getting in easily in a timeframe that works for them.

2FA increases the difficulty.

Regards,
Brent.

P.S. In an incredibly awkward transition that has very little to do with passwords, but a lot to do with why this email exists.

An 8-year-old got into my iPad because she kept at it for an hour.

Reaching your goals takes the same persistence.

That can be difficult to maintain, especially in the early period when nothing much seems to be happening.

That’s when doubt sets in.

When you question if this is the right path.

When you get tempted to change tack.

But when you change the goal, you lose momentum.

Change the action if you need to.

Keep the goal.

Otherwise you start from scratch, again.

Here is one short lesson on how to set goals and distil them into one action you take every day, and keep taking.

Start here https://go.wm-tips.com/goals