C'YaPass: Forget All Your Passwords

Never Memorize A Password Again
Never Type A Password Again
Never Make Up A Password Again

One Billion Yahoo! Accounts Hacked: What Does It Mean?

The New York Times headline shouts, Yahoo Says 1 Billion User Accounts Were Hacked^, but what does that mean?

First of all this hack dates back to September, 2013, so there's no way to unscramble these eggs.  If the data in your Yahoo! account has been compromised I suppose you have to protect yourself from every angle now.  If you had documents that reveal more about your identity in there then the hackers may know a lot about you.

Yahoo! says that the following items were exposed:

  1. account telephone numbers
  2. encrypted passwords
  3. birth dates associated with account
  4. plaintext security questions 
Let's talk a bit about number two from that list, encrypted passwords.

Encrypted Passwords : MD5 Hash

The encrypted passwords as Yahoo! calls them are actually MD5 hashes of the account's password.  It is similar (but much older and proven in the past to be insecure) to SHA-256 hash.  Modern computing power makes it possible to hack many of these passwords in a short time through brute-force attacks.  I've written about brute-force attacks here and you can read more about it at: ( http://cyapass.com/post/how-hackers-crack-passwords-part-1 ) 

Making the Brute-Force Attack Impossible

However, even with the older MD5 hash technology being implemented, if your account password was not based upon natural language words (words you'd find in a dictionary) then your account will probably be safe. If your password for your Yahoo! account was one generated by C'YaPass for example (64 characters long and based upon random letters and numbers) it is close to impossible for hackers to crack it even with the older MD5 technology so you'd probably be safe.  

Don't Need To Be Faster Than the Tiger

The important thing is that you'd be more safe.  Your passwords just need to be stronger than all the other people's then you're safe.  You don't have to be faster than the tiger.  Just faster than the people you're running with.  :)

Yahoo! Does Something Smart, But Is It Too Late?

Of course, now Yahoo! finally reacts and does something useful.   They created Yahoo! Account Key (see more at: https://help.yahoo.com/kb/SLN25781.html^)

What Does Yahoo! Account Key Do?

This method allows you to sign on without using a password.  You simply set up a phone number that Yahoo! will send a notification to each time you attempt to sign on.  When you attempt to sign on to your Yahoo! account the message will popup on your phone and only if you acknowledge it will you be logged in on the other device.
You can watch the video that shows it in action:


Fewer Is Better

The fewer passwords you have, the better.  That's a great way to create a secure sign in and it means less passwords for you to memorize.  However, this only works with Yahoo! accounts at this point.  Maybe this is the way the industry will go, but for now you can't use this technology anywhere else.  And, since a lot of users will migrate away from Yahoo! it may be far too little, too late.

Until Passwords Are Dead, Make Them Stronger

Until passwords are completely destroyed, you must make them stronger.  You really should make them so strong that you cannot even memorize them.  How can you do that?  Just let C'YaPass generate them for you.
Get the app or try it in your browser.

Try It In Your Browser

Here's where you can get the iPhone/iPad, Android and Windows versions.
iOS / iPhone / iPad

The iOS (iPhone / iPad) version is available for the first time today (12.08.2016) in the App Store at:

https://itunes.apple.com/us/app/cyapass/id1183137527?mt=8^

Android

You can also get the Android version in the Google Play store at:

https://play.google.com/store/apps/details?id=us.raddev.cyapass^

Windows 

You can get the Windows version here at this site (just click the Get C'YaPass menu or follow this link: http://cyapass.com/page/get-c-yapass^

Nothing Can Make You Completely Safe, But You Can Be Safer

There are no guarantees for safety.  As soon as someone offers you a guarantee, someone else sees it as a security challenge to crack.   Fortunately there are ways to become more safe.  

Safe Enough Through Strength

However, if you use the correct tool, you will be so safe that it is too bothersome for nefarious characters to try to crack your security.  They'll move on to easier prey.

Convenience and Strength

A proper security tool should offer you convenience and strength.  We all know that if a tool is too difficult to use, people are going to ignore it, even if it makes them safe.  

That's a big reason that C'YaPass is focused on making your life easier.  That's why the big three ideas of C'YaPass are so important:

Big Three of C'YaPass

  1. Never type a password again
  2. Never memorize a password again
  3. Never make up a password again

In the End, It's Just A Password Generator

But, C'YaPass is no panacea, no cure-all.  It will :
  1. Make far stronger passwords than you could ever create
  2. Make it easier to sign in to your secure sites no matter what device you are using.

Even When Using C'YaPass, Think Strong

The strong you make your site/keys in C'YaPass, the better.
Here's how you can make stronger site/keys:
  • Make them longer
  • Put special chars in them
  • Use uppercase
Why would you do all of that?  in the extreme case where some hacker comes along and attempts to generate passwords based off of the billions of graphic patterns and unlimited site/key inputs it will make it more difficult for the hacker to get even close to your site/key.  Without your exact site key they'll never be able to get your final hash password.  

Here's An Extreme Example

Suppose you make your site/key something like any of the following:
  • yahoo
  • gmail
  • microsoft
Those may be common site/keys which could mean the nefarious actor would be half way towards a final hash.  Well, it's probably not even half way with all the graphic patterns she'd have to try also, but stronger is better.

You might create yours which look like the last two in the following image:


Of course, you can make the pattern you draw far more complex than my example also.

Why Would I Tell You This?

I reveal everything about C'YaPass so you can be the most secure possible.

Main Goal of My Work With C'YaPass

My goal is to get everyone to use C'YaPass, but a more important goal of mine is to :
Make Everyone More Secure
and 
Make Hacking of People's Data More Difficult As A Deterrent

It we all simply become more conscious of security through many people considering passwords and we obtain stronger security, then I consider that a success.

Arbitrary Password Requirements Got Users Going In All Directions

We've all experienced it. You go to a web site and try to sign up and create a password and it has yet another set of arbitrary rules for creating your password.  

Those requirements are often created by developers who make arbitrary decisions that are not based upon current research.  

MIT Technology Review magazine has exposed research which shows that longer passwords are stronger.

MIT Technology Review Magazine

MIT's Technology Review magazine reported back in October 2015 that research shows that longer passwords is what makes them stronger.  The article goes on to explain that many web sites get password requirements wrong and require special characters and uppercase in a false belief that those elements make passwords stronger.  You can read the original article at : https://www.technologyreview.com/s/542576/youve-been-misled-about-what-makes-a-good-password/

Making Passwords Stronger

Making passwords stronger means making them longer.  But everyone knows that human memory has limits.  A great length for a password might be 64 characters. However, there are few people who are going to memorize a 64 character password for even one site. That's what C'YaPass is for.  It generates long passwords (which are not based upon words) and will manage them for you.

Arbitrary Password Requirements

Even a federal student loan payment site (nelnet.com) that I've had to use recently enforces these false requirements.  Here's what the requirements look like:


The alarming thing in these requirements is that a password is constrained to a maximum of fifteen characters.  That's not good.

That's a very short password and makes it quite a bit easier for hackers to generate password possibilities.

Arbitrary Requirements Confuse Users

These requirements confuse users into believing this is how you create a strong password.  But, as the MIT article mentioned, the hackers have changed their methods and using those extra symbols doesn't do much to increase the strength of a password.

Great Sites Understand That Password Length Is What Matters

Here are some example sites and companies that accept the C'YaPass default 64 character password:

  • Microsoft
  • Google
  • LinkedIn.com
  • Yahoo! mail - They changed this right after they were hacked.  Previously they only allowed passwords up to 32 characters.

What About Apple?

My AppleId will only accept up to 32 characters and it forces an uppercase.

Password Strength Testers

We've all seen those Password Strength testers which supposedly determine how strong your password is, but they are of dubious value.  That's because they simply check for things like the arbitrary requirements I showed you earlier in this article. 

When I enter a 64 character hash value generated by C'YaPass, that is not based upon words into those things, they generally say the password is of medium strength.  That's something that really needs to change.

Check Your Password Strength

Here's a utility that was created by the creators of DashLane, a popular password management system that stores your passwords in an encrypted file or out on the web on the Dashlane site.  

https://howsecureismypassword.net/

That link will open in a new window and then you can check your password strength and how long it will take hackers to guess your password on average.  

Test Easy Passwords

You don't have to type your real password, but just type in something like a word.  For example I used the word super and it resulted in the following:


I then changed my test password to "supergood" and got the following result:


Finally, I changed my password test to one generated by C'YaPass :

8d9b0b2639a9bdf96c1066ad2fa488f33b1188fc0ab7c600df83cfe2851e9017

I obtained the following result:


Yes, sesvigintillion is a real number.That's a long, long time.  See https://en.wikipedia.org/wiki/Names_of_large_numbers for more about sesvigintillion.

Make Your Passwords Stronger

Whether you decide to use Dashlane or C'YaPass is up to you, but definitely start using something to make your passwords stronger and your accounts more secure.

C'YaPass Availability

You can get C'YaPass for Windows here at this site for free: http://cyapass.com/page/get-c-yapass

You can get the Android version in the Google Play store for free: https://play.google.com/store/apps/details?id=us.raddev.cyapass

IOS Coming Very Soon

The iOS / iPhone/ iPad version is coming soon (by end of year 2016).

How Hackers Crack Passwords (part 1)

All Memorized Passwords Are Inherently Weak

If you can memorize your password, it is because it is most likely based upon a mnemonic (memory device).

If your password is based upon a memory device, it is most likely based upon a natural language (English, Spanish, etc.) word. Humans tend to memorize based upon words since it is how we communicate.

Word-based Passwords Are Inherently Weak

However, if your password is based upon a word it is weak.

But, why is that true?  To understand the reason that word-based passwords are weak, we must take a look at the methods that hackers use to crack passwords.

One Way Hackers Crack Passwords

Brute Force Attack

Here are the steps that the hacker uses to do that:

  1. Obtain the site's database of passwords
  2. Generate passwords from a natural language dictionary of words
  3. Compare each generated word against the stolen database of passwords until successful

It's a little more difficult than this because most sites do not store their passwords in clear text but instead they also hash those passwords.

What's A Hash?

You can think of a hash as a one-way encryption technique.

That means the computer algorithm takes an input and will turn that exact input into one and only one output.

A simple diagram of this might look like the following:


In our example above, we use the ClearText (unencrypted) input of the letter a.

I've made the Hash Algorithm (in this case we are using SHA256 - Secure Hashing Algorithm) a black box in the diagram because we do not need to know the implementation details of how it works.

Every time we input the value a into the SHA256 algorithm we are guaranteed the output shown on the right.  

That value becomes a unique identifier for the value a.

One-Way Encryption : Hash

We can think of this as a one-way encryption.  But why do we call it a one-way encryption? That's because it is unfeasible that anyone can reverse the process to turn the hash value (ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb) back into the ClearText (the letter a in our case).

No Known Way To Reverse the Hash Value

Let me say that again. There is no known way to take the hash value and calculate what the original ClearText input was.
That's the power of a secure hashing algorithm.

For Every Input, There Is A Unique Output

Along with that, the hashing algorithm also guarantees that two different inputs will never produce the same hash output.
Even if the value is only changed by 1 bit of data (1/8th of a an ASCII character as it is stored on a computer).

That means if you hash the two long ClearText values shown below which differ by only one character the output hash will not be similar at all:
ClearTextHash
thisIsAReallyLongMessageForTestingTheHash9ef787ac41ec34065c69fecd7413a17ea5765ef1dc58f38d2e51d78917c5d371
thisIsAReallyLongMessageForTestingTheHash24a12d57aa0803a16ee84a82ec102686e9130918168327ad4ddee6ba66716a0ad

Most Sites Hash Your ClearText Password

This is how most modern sites now store your password.  They create a hash from the ClearText password that you've given them.  They then store that hash in their database along with your userId so they know which on it is associated with.
This guarantees that no one can every reverse the hash and discover your password.

Weak and Common Passwords

If you've been following along you may have thought about how you could go about attempting to break this.
Since a specific ClearText message produces only one SHA256 hash, you could create hundreds of passwords, hash them and then compare those hashes to what is in the site's database of passwords.
But this only works for weak and common passwords.

Dictionary Attack

That's exactly what the hackers do.  They generate hashes from every word in the natural language dictionary.

Let's look at an example table of how the hacker might do this (but of course you'll have to imagine that I have every word from the English dictionary available to me as the hackers do).

ClearTextHash
aardvark cf9c1cb89584bf8c4176a37c2c954a8dc56077d3ba65ee44011e62ab7c63ce2d
aphorism9238993bf1898c1a0de5f4f04c1a23000e848097b532a543dced7687444ea758
batteryf3d1701e1d575e1294786989517866986bc97343e07af63e201f46ba0be5806a
chinchilla2180cc6f060cdfb71a458b60f404f56d682abaf7efd3df81a957684ab3803f18
despise9272459bf48061da35d110383b95e5c3287320e40093a07e16227a719efede0c
earth7b74b418a352d67108173c20c1b16b4b726bad8606be65711ff924dbf9a40670
flavorb5d2f4515ba34f2f83f3a84e6958769f2b89b5ceca3fdfe1b4303eead3507daa
grind3026fac023c67598797c8c7da4ac6cf653f832b2c9de761d3922fb85ea086b1c
password10b14d501a594442a01c6859541bcb3e8164d183d32937b851835442f69d5c94e

Common Passwords

This is also why using a password that is commonly known to hackers, like password1, is so dangerous.  

Modern Computing Power
Modern computing power means that hackers can generate hashes for millions of possible passwords and compare each one of those hashes to their stolen password databases in very little time. 

Generating Passwords, Computing Hashes

Of course, with modern computing power, hackers are able to take multiple words from the dictionary, smash them together, and then compute  a hash from those longer passwords too, since they are still based upon natural language words.  They can do millions of these in a short period of time.

Replacing Vowels With Numbers

Since the hackers know the scheme a lot of people use wh3r3 th3y r3p1ac3 c3rta1n l3tt3rs with numbers, the hackers generate millions of passwords that mimic that too.  Once they mimic these patterns and generate the hashes they are bound to hit upon at least a few weak passwords out of the 500 million (according to Yahoo! that was the recent number) they've stolen.

Salting the Hash

There is another element of security that is generally applied to this also called salting the hash that would further scramble the hash, but I won't go into that here.

What Does This Mean?

This exposes the fact that passwords based upon natural language words are much weaker since the attacker can use all the words in the dictionary to generate passwords, hash them and check them. 

Main Point

 However, if you password were not based upon a word, it would be far less likely to be hacked.
This leads us to the fact that you really should create your passwords from some random list of characters and numbers.
For example, no hacker could guess your password is: 
bdb7085c1cd90f6cc1f44856131a56535c0e493188dc6919b0ef8e3b7cffaf8d
The hacker is not even going to try that, because it would take her too long to even mess with creating an algorithm that checks an almost infinite list of hashes.  There isn't enough computing power in the world to make this effective.
That is why your passwords should themselves be based upon a cryptographically strong hash.
That's what CYaPass does for you.

How Could You Remember Your Password?

It is unlikely that you could remember that hash above.  Of course there are people who can do it  But that would be more of a pain than just using the passwords you already use.
That's why you should use C'Ya Pass and forget all your passwords.

C'Ya Pass Generates Cryptographically Strong Hashes For You

All you have to do is 
  1. supply a site/key (to help you remember what the password is used for)
  2. Draw a pattern
C'Ya Pass will generate a password for you that is a SHA256 Hash.  That long password will be your actual password which will then (most likely) be hashed again by the target site you are logging into.  

Then, if the site you are logging into ever gets hacked it is unfeasible the hacker would be able to generate your original long hash password and be able to hack you.
That's how C'Ya Pass makes your passwords stronger and makes it so you never have to memorize a password again.