Tag: passwords

Creating ideal passwords: Part 2, Creating good-enough passwords

June 21, 2021 By Pete Schult

Last week I looked at some of the characteristics of good passwords and used a list from Mike Chu to summarize them:

  1. A good password is longer than 15 characters
  2. No part of it exists in a dictionary of any language
  3. No part of it exists in any common or breached password lists
  4. It contains uppercase letters, lowercase letters, numbers, and special characters/symbols

Is that list the One True Path?

I should mention now that there is not uniform agreement that strictly following the above list is the best practice. Many computer security experts argue that weakening requirement #2 allows people to use nonsense phrases which might be more secure overall1 than traditional “secure” passwords.

You might skeptically remind me that last week I said that if a word is in a dictionary, then it’s on a “small”2 list and, thus, easy to crack. That is true, but this method doesn’t stop with 1 word. The key is to string 5 or even 6, 7, or 8 common but randomly chosen words together to make the password.3

For example

carrie scarf argue literal hot

If you like (or if the site’s requirements mandate it), you can then tweak the string in line with criterion #4 above by upper-casing some letters and throwing in digits and punctuation. Then you memorize the “phrase”.

This often-shared strip from the webcomic xkcd illustrates the method and some of the theory behind it:

"To anyone who understands information theory and security and is in an infuriating argument with someone who does not (possibly involving mixed case), I sincerely apologize."
[Click image to enlarge]

The phrase really should be randomly generated

In the illustration, each common word in the 4-word string is taken to have 11 bits of entropy which corresponds to selecting each word randomly from a list of about 2,000 words. If you don’t use a truly random method of selecting the words though, you can’t simply add up 11 bits per word to get the total entropy.

The point of that last paragraph was that if you think up a list of 5 words, chances are that there will be some sort of connection among them:

  • Maybe they’ll form a sort-of grammatical phrase
  • Or they might have related meanings
  • They could easily be related to some of your publically known interests
  • …

That connection reduces randomness. To avoid that, you’ll want a tool of some sort for generating random words from a list. Here are some examples (you can find others by Googling “xkcd password generator”):

Whether or not you can trust any of these tools is, as always, a question since even if the designer is trustworthy, websites can be hacked and software can be made malicious without appearing so. Thus, this method may not be quite ready for prime time, as they say, but I present it as one to consider.

Indeed, if you think of passwords as combinations for combination locks, then the problem of needing a unique password for each site we use is like that of memorizing a large number of combinations.

Next time I’ll look at software that can (metaphorically) convert that list of combinations into a keychain so that the load on your memory is much less while your security is still high.

Notes

1 For instance, one way hackers can get someone’s passwords is by surfing around Pinterest, Instagram, and other picture sharing sites looking for photos that include a victim’s computer with some of their passwords stuck to it on PostIt Notes. If you can memorize your passwords, that security hole is now plugged.

2 Small relative to what a computer can crunch through in a short time.

3 When you consider that most traditional passwords that are memorizable will probably have exactly 1 upper-case letter, 1 digit, and 1 special symbol, then a string of 5 words from a list of 10,000 or so words becomes competitive with or possibly superior to a 15-character not-quite word.

Image credits:

Locked Desktop Computer Cartoon by Free Clip Art
License: CC BY-SA 4.0

xkcd, “Password Strength” by Randall Munroe
License: CC BY-NC 2.5

Creating ideal passwords: Part 1, Basics

June 14, 2021 By Pete Schult

The Ideal Computer Password

The Ideal Computer Password is a string of characters that

  1. Is completely random and
  2. You use for only 1 account, but
  3. You can remember easily and exactly (including where you used upper-case and lower-case letters) and
  4. No one else in the world would ever guess, even if they know you and various details about your life.

Having thus established that Ideal Computer Passwords are even rarer than unicorns, let’s move on to some tricks for strong passwords that will work well enough.

And though my framing of the ideals in absolute terms was completely tongue-in-cheek, I’m going to be keeping these ideals in mind as useful guides for password creation.

Why websites torment you with “You need to use a @&$%! character”

Today I’ll discuss the nitty-gritty of secure passwords: password length, the character set to use, and strings not to use.

NordPass and a partner company that does data breach research evaluated a database of passwords to develop a list of the “Top 200 most common passwords of the year 2020.” I suggest looking at it (it’s actually less NSFW than you might expect) because not all the entries are lazy attempts to set passwords with minimal thought.

To be fair to the people setting passwords on online accounts, we aren’t told what proportion of these passwords were from throw away “accounts” that you’re forced to set up to read an article for free (for example), so it’s worth keeping the salt handy if asked to panic about the “fact” that the CEO of your bank “might” use 123456 (2020’s #1 entry) for their password to the bank’s computer system.

At the same time, as you get down towards #200 on the list, you start to notice entries that might not be obviously bad choices for a password. I mean, even someone new to computers could immediately see that 123456 would be crackable, but what’s clearly wrong with azerty or ginger?

Mike Chu has an article “Password Best Practices: The SIMPLE Way to Get It Right” where he gives a list of some traits of secure passwords:

  1. Longer than 15 characters
  2. No part of it exists in a dictionary of any language
  3. No part of it exists in any common or breached password lists
  4. Contains uppercase letters, lowercase letters, numbers, and special characters/symbols

Since individual letters have entries in many (most?) dictionaries, I think we have to interpret no part to mean ‘no “word”‘ where I’m being deliberately vague about what I mean by word.

The idea behind the list is to get off-road, as it were, so that hackers can’t reduce the universe of possible password strings to the universe of strings in commonly available lists. And now we can see what might be some problems with ginger, for example:

  1. It has only 6 characters (6 ≤ 15)
  2. Ginger is a word likely to be in most dictionaries of English
  3. While the violation of trait #3 might not have been predicted (hence the nonobviousness of ginger‘s insecure status), we now know that it is on at least 1 list of breached passwords
  4. It uses only lowercase letters for its characters

Since we’ve now seen what not to do for creating passwords, next time I’ll get into some techniques that can help with creating them.