Password Length Alone Won't Save You, Warns Maharashtra Cyber Official
Maharashtra Cyber's Yashasvi Yadav says complex passwords and avoiding public Wi-Fi are key defences as cybercrime grows exponentially.
Cybercrime has become the leading organised criminal enterprise, outpacing even drug trafficking, a senior Maharashtra Cyber Department official has warned, while urging the public to treat online safety with the same seriousness as personal hygiene.
Speaking at an event in Mumbai, Additional Director General of Police Yashasvi Yadav said cybercrime is expanding at an exponential rate and described it as the "numero uno crime syndicate". Drug trafficking, he added, does not compare to the scale of the problem. His central message was the importance of what he called cyber hygiene.
Length is not enough
Yadav stressed that password security is a critical line of defence, but cautioned that a long password is not automatically a safe one. He recounted the case of a friend who lost roughly Rs 5 crore in a cryptocurrency fraud despite believing his password was secure.
The password in question was a famously long dictionary word. Yadav said such a password could be broken in about one second through a brute-force attack, because cracking software can run through dictionary entries almost instantly regardless of how many letters they contain.
By contrast, he said, a short five-character password that mixes symbols, lowercase and uppercase letters, and punctuation could take the same software around 60 years to crack. The deciding factor, he underlined, is not length but complexity and robustness.
Public Wi-Fi flagged as a major risk
The official also singled out public Wi-Fi as one of the most dangerous tools people routinely use. Connecting to an untrusted network, he warned, can expose far more than browsing activity — it can open the door to bank accounts and the contents of a mobile phone.
He said users should be cautious about who operates a network. Trusted institutional Wi-Fi may be acceptable, but in crowded public places such as railway stations, criminals often set up rogue networks designed to look like the official service.
Once a victim connects, the attackers can harvest photos, passwords and contact lists, Yadav said. That stolen data then becomes raw material for crimes including digital arrest scams, investment fraud and sexual extortion.
The remarks underline a growing concern among law enforcement agencies that everyday digital habits, rather than sophisticated hacking, remain the weakest link in personal cybersecurity.