Big Gain or Little Gain? — TechKnowSurge

About this interactive

The What Makes a Good Password lesson rates each password habit by how much it really helps. Big gains. Length: each extra character multiplies the number of guesses, so going from eight characters to sixteen is a huge jump. A password used nowhere else: one site's breach then gives attackers nothing for credential stuffing elsewhere. A second factor: a stolen or guessed password is no longer enough on its own. Several unrelated words instead of one dictionary word. Changing a password when a site reports a breach, and keeping passwords out of plain text files and plain email. Little or no gain. Complexity added the way most people add it: a capital first letter and a ! at the end, an @ for an a, a zero for an o, a misspelling, the site's name added to one base password, the number bumped at each forced change, an old password reused, a keyboard run like qwerty. Guessing tools try exactly these swaps and patterns first, and variations on one password fall to credential stuffing once the base is known. A quick test for each card: would an attacker's usual tools or a stolen password list still get in?

What you'll learn

Judge which changes make a password-protected account much safer (more length, a password used nowhere else, a second factor) and which add little (predictable complexity, substitutions, variations)
Explain why predictable changes add little: guessing tools and credential stuffing try the same swaps, patterns and reused passwords people use

Aligned to

CompTIA Security+

4.6 Given a scenario, implement and maintain identity and access management.

2.4 Given a scenario, analyze indicators of malicious activity.

NIST 800-53

IA-5 Authenticator Management

Key terms

Multi-Factor Authentication: An authentication method that requires users to provide two or more verification factors to gain access.
Credential Stuffing: An automated attack in which stolen username and password pairs from one breached service are systematically tested against other services to gain unauthorized access. It exploits users who reuse passwords across multiple accounts.
Dictionary Attack: A type of brute force attack that uses a predefined list of common words and phrases to guess passwords.
Password Reuse: The poor security practice of using the same password across multiple accounts, increasing exposure if one account is compromised.
Passphrase: A sequence of words or a sentence used as a password, combining length and memorability to create a strong authentication credential.

Topics

Passwords Authentication Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →