What Is a Dictionary Attack?

What to do: Never use the same password for two accounts. Let a password manager make and remember a different one for each.

Remember the key-cutting machine from the last page? Instead of trying every possible key shape, what if it tried the most common shapes first? For passwords, that means trying real words and common passwords before anything else.

That means even the correct horse battery staple password from the comic won’t hold up as well if the machine has those four words in its list.

Reusing Passwords Makes It Worse

Say you use the same key for your house, your car, and your PO box. Someone breaks into the post office and copies your PO box key. Now they can walk straight into your house.

This happens online all the time. Attackers break into small, unimportant-seeming websites and steal their lists of email addresses and passwords. Then they try those same email-and-password pairs on banks, email accounts, and everything else. This is called credential stuffing.

If you use the same password in more than one place, assume that every account using it is unsafe as soon as any one of those sites is hacked.

How to Protect Yourself

We need locks too complicated for the burglar’s machine. Luckily, that machine is just an ordinary computer, and we have computers too. Every account should have its own long, random password that’s used nowhere else. Nobody can remember dozens of those, so the practical way to do it is a password manager.