You've been trained to think about passwords in a very specific way. I'm here to tell you why all that training is probably nonsense.
Specifically, I want to talk about these three potential passwords:
- M34tp1ez&
- 8Ks2*@nq
- unicorn notebook suggest alright
Based on common understanding, the first two are probably pretty good, and the last one is just dumb, right? Wrong. If you want a password that is strong, forget random numbers and letters. Your bank telling you that you must have at least one symbol and one number, but limiting you to only 10 characters, is just flat out dumb.
Pick a few random words, pepper them with just a bit of randomness that is easy for you to remember, and then sleep soundly knowing that your password is safe.What if I told you that a powerful
botnet could brute force the first example in about 2 hours and the second one in less than 2 minutes? What if I then told you that the third would take considerably longer? How does a hundred dectillion years sound? That's a hundred billion billion billion years - seems pretty secure.
This
comic by Randall Monroe is helpful when it comes to understanding why, but let's dig a little deeper.
These numbers assume that our theoretical cracker has no idea how your password was generated. If we suppose that the attacker (and his enormous Botnet) knows that your password is exactly 4 words, all lower case, seperated by spaces, and that the words are fairly common and 8 letters or less in length, then the strength of your password falls - for a 2000 word vocabulary (small!), all the way down to about a second. That sounds bad, right?
Let's take another look at that first password, because it isn't really random. Like Randall hints at in his comic, it's really fairly easy to guess. You've got a common word, out of our 2000 word vocabulary. Some very common substitutions make it harder to remember and type, but don't significantly increase the strength - one could expect our theoretical botnet to guess 'M34tp1ez&' in a tiny fraction of a second - thousands of times faster than the dictionary attack on 'unicorn notebook suggest alright'.
So, what are you to do, just use incomprehensible passwords like option 2? No! We can construct a password scheme that is easy to remember and less vulnerable to dictionary attacks. After all, a password of 32 random characters and symbols is worth significantly less if you have to write it on the back of your business card and stick it in your wallet. The objective here is a memorable password that is generated in a non-obvious way. If the attacker cannot figure out a dictionary attack that works, he will instead resort to brute force, and I believe we've already discussed the trillions and trillions of years involved there.
At this point it is worth mentioning that reasonably constructed password systems cannot be broken one character at a time. Despite what you've seen on Numb3rs, passwords must be guessed all at once - you have no idea if you were close or not, because what comes out the other end of a 'guess' is a very long number. If an attacker guesses 'unicorn notebook' but your password was 'Unicorn notebook', it will be no more obvious that he is 'close' than if he had guessed 'M34tp1ez&'. We can take advantage of this.
First and most obvious, you can replace your spaces with something. Any character will do, and it is perfectly ok to make it the same thing all the time, or some pattern you know. For example, unicorn!notebook@suggest#alright is still pretty easy to remember - you just use the first 3 'capital numbers' on the keyboard instead of spaces. Letters are ok too. The time to crack your password - in the worst case - just rose to 11 hours.
How else can we make life difficult? Any small change increases the chances of throwing our attacker back into the trillions and trillions scenario, while making even the easy attack harder. What if your 'rule' is that you capitalize the first letter of just one word? Easy to remember and up to 7 days. What if pick one letter out of the whole phrase - even if you use the same letter all the time - and capitalize that? 'uNicorn!notebook@suggest#alright ' clocks in at around 20,000 years.
At this point, I suggest that we have passed the point of absurdity, but if you must, try moving one vowel to the next vowel in the alphabet. Time to crack 'aNicorn!notebook@sUggest#alright', even if you know how I came up with it? 5 trillion years.
At this point it bears pointing out that these time estimates are for an attacker who has compromised the site in question and who is able to employ a network of powerful computers to attempt to break your - and only your - password at a rate of 100 trillion guesses per second. If someone is trying to simply log into your website, as is pointed out in the comic, the top rate is about 1000/second. Note that most secure websites detect and control this behavior, but let's assume that yours doesn't. In that case (which is far more common), our basic 3 example passwords weigh in like this:
- M34tp1ez& -- (worst) 3 days (best) 200,000 years
- 8Ks2*@nq -- (best and worst) 200,000 years
- unicorn notebook suggest alright -- (worst) 500 years (best) trillions and trillions
Some of the transformations I suggested start us down the path toward totally random and long passwords, and that's bad. I'll leave you with this simple trick to increase the size of your vocabulary - try adding in a proper noun (other than your firstborn's name!). Adding in some names or places can increase your effective vocabulary significantly - and increase the chances that your words are not in the attacker's dictionary, forcing them to resort to a worst case brute force attack. Something like 'unicorn Gosling suggest alright' is still just as easy to remember, but makes dictionary attacks that much harder - in my estimate, 20,000 years instead of the 500 I listed above.
If you're looking for a recommendation, on a password that is probably good enough for your bank and/or nuclear missile codes, I suggest that it need be no stronger than 'mAnning roBot piCkle winDow'. Hopefully you are imagining a robotic Peyton Manning serving up fried pickles at the fast food window while whistling his ABCs - an easy image to remember. If it's just your blog, you can probably drop the symbols and caps altogether. If you are really, really paranoid, add some symbols instead of spaces. As we discussed, 'manning robot pickle window' is still in the thousands of years range for normal attacks.
In conclusion, there really is a way to get a password that is easy enough to remember without writing down, but hard enough to crack that your data will remain safe. Pick some words, sprinkle in a little extra randomness, and call it a day. Be wary of passwords that are both hard to remember and easy to crack.
A footnote:
If the administrator of your system can see and retrieve your password for you, it is NOT a strong system - strong systems do not store your actual password. Complain or switch to a different system if possible. If your sysadmin can see your password, so can a hacker! There have been numerous high-profile breakins in the past several years of major companies like Zappos, Sony, and many others, which moves our attackers off of '1000/second' and into 'billions or trillions per second' to break your password. The only 'good news' there is that they have millions of passwords to break, assuming that the passwords are properly stored. Improperly stored passwords do not have to be broken at all no matter how cleverly you construct them.