1.2 - Suspicious Website Logins

Password Attacks and Authentication Security

Online Password Attacks

An online password attack happens when someone tries to break into an account by systematically trying different password combinations against a live login system. Unlike offline attacks, which work on stolen password databases, these attacks interact directly with the actual login service.

They rely on predictable human behavior in how people create passwords, plus automated tools that can test thousands of possible passwords fast.

The guesses usually come from three places: common passwords (like 123456 or password), common password patterns (like a word plus a year plus a symbol, covered below), or stolen passwords leaked in earlier data breaches. Stolen passwords work because a lot of people reuse the same password on several sites.

Recognizing Signs of Password Attacks

Rapid failed login attempts: lots of failed logins in a short window points to automated password guessing.

Example: an account gets 47 failed login attempts in 3 minutes, each one a different password. That pattern suggests an automated tool running through a password list. Real users usually fail once or twice from a typo, then stop and reset their password. Dozens of rapid attempts is a red flag.

Login attempts at unusual times: access attempts outside someone's normal pattern are worth flagging.

Example: an employee who works 9 to 5 Eastern and always logs in from the US suddenly has login attempts at 3 AM. Even if it succeeds, that's worth investigating, since attackers often work from different time zones or during hours when they're less likely to get caught.

Login attempts from unknown devices: authentication from a device never associated with the account is suspicious.

Example: someone who only ever logs into email from an iPhone and MacBook suddenly has login attempts from an Android device in a different country. The device fingerprint (browser, OS, screen resolution) doesn't match anything they've used before, which suggests stolen credentials.

Signs of suspicious activity like these are often called indicators of compromise (IoCs). The easiest place to spot them is a login log, which records every attempt to sign in to an account. Compare each entry to the account owner's normal pattern.

Example: here's part of the login log for one account. This user normally signs in from work around 8:50 AM on a Windows laptop.


Date   Time      User     Source IP       Device            Result
Mar 3  08:52:10  mlopez   203.0.113.8     Windows / Chrome  SUCCESS
Mar 4  08:47:33  mlopez   203.0.113.8     Windows / Chrome  SUCCESS
Mar 5  02:14:01  mlopez   198.51.100.77   Linux / Firefox   FAILED
Mar 5  02:14:03  mlopez   198.51.100.77   Linux / Firefox   FAILED
Mar 5  02:14:05  mlopez   198.51.100.77   Linux / Firefox   FAILED
Mar 5  02:14:07  mlopez   198.51.100.77   Linux / Firefox   FAILED
Mar 5  02:14:09  mlopez   198.51.100.77   Linux / Firefox   SUCCESS
Mar 5  08:55:41  mlopez   203.0.113.8     Windows / Chrome  SUCCESS

The five entries at 02:14 on March 5 show all three signs at once: four failed attempts exactly two seconds apart (a steady rhythm that points to an automated tool), a time far from this user's normal 8:50 AM sign-ins, and an IP address and device that never show up anywhere else. The last of those attempts says SUCCESS, so the adversary got in. The fix is to change the password right away and turn on MFA.

How Adversaries Exploit Weak Passwords

Pattern 1: Base word + number + special character

Structure: one or two words, then a two-digit number (often a year), then a special character at the end. Examples: Summer24!, Password23#, GoBears25!

People use this because it hits the complexity requirements while staying memorable, but attackers know this pattern and prioritize it in their attacks.

Pattern 2: Personal names with simple modifications

Structure: pet name plus birth year, or child's name plus anniversary. Examples: Bella2015, Maxwell08!, Charlie2020

Names are easy to remember, and adding a date makes it feel unique, but social media and public records reveal pet names, kids' names, and important dates pretty easily.

Pattern 3: Dates with personal significance

Birthdays, anniversaries, graduation years embedded directly. Examples: May151990, 06172018!, Tigers2019

These dates are memorable and meaningful, but birthdates show up on social media, wedding dates get shared publicly, and graduation years are right there on LinkedIn.

Dictionary Attacks with Personal Intelligence

Attackers build custom password dictionaries by gathering intel through:

Social media digging: scanning Facebook, Instagram, LinkedIn, Twitter for family names, pet photos, hobbies, and dates

Public records: property records, marriage licenses, business registrations

Data breaches: looking at previously leaked passwords tied to the target's email

Physical observation: bumper stickers, desk photos, overheard conversations

Attack process:

Research turns up a dog named Bailey, a daughter named Emma, and a 2010 graduation

Automated tools generate variations like Bailey2010!, Emma2010#, BaileyEmma10, bailey2010!, BAILEY2010!, Emma&Bailey10

Scripts try each one against the target's accounts

Eventually one hits and grants access

Example: an attacker finds a target's LinkedIn showing they graduated in 2012 and live in Denver. Instagram shows a dog named Rocky and posts about the Broncos. They build a dictionary with Rocky2012!, Broncos2012#, RockyBroncos12, Denver2012!. Within minutes, Rocky2012! gets them in.

Strengthening Authentication

Increase length

Longer passwords make attacks exponentially harder.

Weak: Dog2024! (8 characters). Stronger: PurpleTrainCactusMidnightRiver (30 characters).

Every extra character multiplies the total combinations an attacker has to try. Even if both use only lowercase letters, a 16-character password takes over 200 billion times more guesses than an 8-character one. Aim for at least 16 characters, 20+ is even better.

Eliminate personal significance

Cut out anything that shows up on social media, public records, or casual conversation. Avoid family, friend, or pet names, birthdates, anniversaries, graduation years, favorite teams or bands, addresses, phone numbers, company names. Instead, go for random combinations with zero connection to your actual life.

Weak: Jasper2019! (dog's name plus adoption year). Strong: 7$mKp2@qLnX9vRt4 (totally random).

Maximize complexity

Spread different character types throughout the whole password instead of clustering them.

Poor: Password123!, letters up front, numbers at the end, symbol tacked on, easy to predict.

Better: 9mT$2pLx@7nK#5qR, uppercase and lowercase mixed in, numbers scattered around, symbols spread out, no obvious pattern.

Use lowercase, uppercase, numbers, and special characters, and mix them throughout the entire password rather than just checking a box with one of each.

Make it unique

Use a different password for every account. When one website gets breached, adversaries try the leaked passwords on other sites, so a reused password lets one breach unlock many accounts. A unique password keeps the damage to one account.

Use a password manager or a passphrase

Long, random, unique passwords are hard to remember, so there are two good options:

Password manager: an app that generates strong random passwords and stores them for you. You only have to remember one strong master password (and you should protect it with MFA).

Passphrase: a long password made of several random, unrelated words strung together, like PurpleTrainCactusMidnightRiver above. It's long enough to be strong but much easier to remember than random characters. Pick the words at random, not a sentence about your life.

Implement Multifactor Authentication (MFA)

MFA means proving your identity with more than one method. Even if your password is compromised, an attacker still can't get in without the extra factor.

The three types of factors:

Something you know: password, PIN, security questions

Something you have: phone app code, physical security key, smart card

Something you are: fingerprint, face, iris scan

Common MFA setups:

TOTP (time based one time passwords): apps like Google Authenticator or Authy generate six digit codes that refresh every 30 seconds

SMS codes: a text delivers a temporary code

Push notifications: an app asks you to approve or deny a login attempt

Hardware security keys: physical devices like YubiKey that you plug in or tap

Biometrics: fingerprint or face scan

Why it matters: if an attacker guesses or steals your password, they still don't have your phone, key, or fingerprint, so they're stuck.

Example: an attacker guesses your password Beach2023! through a dictionary attack. When they try to log in, the system asks for a six digit code from your authenticator app. Without your actual device, they're locked out, and you get an alert about the suspicious attempt.

Turn on MFA everywhere you can, especially email, banking, social media, and work accounts. Authenticator apps or hardware keys are better than SMS, since SMS can get intercepted through SIM swapping.

Back Next