Passwords and Why They're Weak

A password is the oldest way to prove who you are online: a secret that only you are supposed to know. You type it in, the system checks it, and if it matches, the system trusts that you really are you.

The whole idea rests on one fragile assumption — that the secret stays secret. In practice it rarely does. Understanding why passwords are weak explains almost every account takeover Olivia could ever suffer.

Picture a house key. Now picture that Olivia made a copy of that one key and handed an identical copy to every shop she visits. The day any single shop is robbed, a working copy of her key is loose in the world — and it opens her front door. That is the trouble with passwords, and the rest of this page is really just that one picture in detail.

What a Password Really Is

A password is a shared secret. Olivia knows it, and the system she is logging into keeps a way to check it. As long as no one else learns it, only Olivia can prove she is Olivia.

That word shared is the catch. The secret is not held by Olivia alone — the system holds a check for it too, and Olivia has to type it out every time she logs in. Each place the secret travels, and each place it is stored, is one more place it could escape from.

So a password's security does not come from being clever. It comes entirely from staying unknown to everyone except its owner. The moment a second person learns it, it stops protecting anything.

Guessing and Brute Force

The most obvious attack on a secret is to guess it. Attackers do not sit and type guesses by hand, though. They run automated tools that test enormous lists of likely passwords — common words, names, birthdays, and the passwords people pick most often — at a speed no human could match.

Testing every possible combination until one works is called brute force. A short or common password falls almost instantly to this, because there are so few possibilities to try. A long, unusual one takes far longer, because the tool has vastly more guesses to grind through.

This is the one weakness that a stronger password actually fixes. Length and unpredictability buy real protection here — against guessing. The trouble is that guessing is not the attack that hurts most people.

Reuse and Leaks — the Real Killer

Companies get breached. Sooner or later a website Olivia uses suffers a break-in, and the attacker walks away with its stored passwords. This is a leak — a secret escaping not because it was guessed, but because the place keeping it was robbed.

On its own, one leaked password opens one account. The damage explodes because of reuse — using the same password on more than one site. When Olivia uses the same secret on a small shop and on her email, a breach at the shop hands the attacker a working key to her email too.

And attackers know to try. After a leak, they take the stolen passwords and feed them into the login pages of email providers, banks, and other shops, automatically, to see where else the same secret works. Every account Olivia reused now opens with one stolen copy. This is the most common road to a real account takeover.

Why "Just Pick a Strong Password" Isn't Enough

A strong password sounds like it should settle the matter. A strong password genuinely helps against guessing. But look at what it does not help against.

A strong password can't stop a site from being breached, and it can't un-leak a password once it's out — so a leaked password should be treated as burned, however complex it was. The real damage comes from reuse: if Olivia used that same password elsewhere, every one of those accounts is now exposed too. And there is a second way to lose it: a phishing page, a fake login screen built to look real, simply captures whatever Olivia types. A strong password typed into a fake page is handed straight to the attacker.

So strength is one defense against one attack, not a cure. A password can be long, unique, and unguessable, and still be leaked or captured. That gap is exactly why the next topic asks for more than one kind of proof.