Last week we unmasked Spotting spooky phishing spells and phantom emails to help you keep fake messages out of your inbox. As part of the October cybersecurity awareness month, this week we're addressing your passwords.
In previous blog posts, we've emphasized keeping your accounts secure with strong passwords. But as technology evolves in 2026, so do the tricks hackers use to break into accounts.
Why AI makes password security critical
Back in the day, attackers manually guessed passwords or relied on trial and error. Cybercriminals now use AI password cracking tools. The AI algorithms analyze massive breach databases, personal social media data, and predictable patterns (like swapping @ for a or adding 2026! at the end). AI tools can predict and crack weak, short, or pattern-based passwords in seconds.
According to security.org, more than two in three Americans reuse passwords across multiple accounts. Because many people reuse passwords, attackers will use stolen login credentials and test them across hundreds of other services. If you reuse the same password for work and personal accounts, one breach can compromise your entire digital world. Tips to ghoul-proof your passwords
Use 16+ character passphrases
Length is your single best defense against password cracking. Instead of a short, code like P@ssw0rd!, combine 3 to 4 random, unrelated words into a long passphrase (e.g., CursedFloatingPieScream or RavenReadingInDungeon). They are easy for humans to remember, but much harder for AI systems to crack.
Never reuse passwords
One account, one passphrase - no exceptions. If one company suffers a breach, your other logins are protected.
Skip obvious shortcuts and patterns
Swapping letters for symbols, keyboard sequences, pet names, birthdays and personal details are all easy targets of AI cracking tools.
Use multi-factor authentication (MFA)
Multi-Factor Authentication provides a crucial line of security. Even if an AI cracking tool guesses your passphrase, MFA blocks unauthorized access.Managing Your Credentials
I realize that remembering long, unique passphrases for every single login sounds terrifying! For official best practices on managing credentials safely at the University, check out the UMN guide for choosing strong passwords and keeping them safe.
What about Passkeys? You may have noticed more personal accounts offering Passkeys. Passkeys are a passwordless tech that lets you log in using your device's fingerprint, face scan, or screen lock. Whenever a personal app or website offers passkeys, turn them on! For official University accounts, we’ll continue relying on strong passphrases paired with Duo MFA.
Protecting your accounts doesn't have to be scary. By switching to long, unique passphrases and using MFA, you can keep the digital ghosts out of your data all year long!
Article by Karen Matthes, Extension Learning Technologies, klm@umn.edu
Comments
Post a Comment