"Your Password Sucks" by Bryan T

We all have a basic understanding of why passwords are important. If I asked you to email all of your passwords to me, you wouldn’t do it. You understand that your online identity has value and that you wouldn’t want to give it up to a stranger.

However, keeping your password a secret is only half of the story. Having a strong password also matters, but unfortunately, this is a topic many people don’t understand. Perhaps even more dangerously, there are many people who falsely believe that their passwords are secure.

Personally, I’ve gone through many password changes as my understanding of cybersecurity has evolved. I’ve gone from using a two character password to using my name as a password to using a basic “word + number” password to a secure 40+ character password. I’m lucky that I haven’t experienced any devastating losses before switching to using a more secure password. (Although sometimes, I receive the rare email that some stranger in China logged into an account that still uses my old password!)

Know Thy Enemy

Before you start designing passwords, it’s important to understand who you’re fighting against.

Your most valuable asset is, ironically, the fact that you aren’t valuable. You are one of billions of internet users and there is no reason why an attacker would want to dedicate all of their resources into potentially ruining your life. However, don’t trick yourself into thinking you aren’t a target. If an opportunity opens up, expect to have several hundreds of computers trying to break into your account.

“If an opportunity opens up?”

I’m going to focus on an attacker’s ideal scenario—when a service you use has been compromised and customer details have been leaked. An attacker can try to guess your password even if the service isn’t compromised, but they’ll generally be limited to 1000 guesses per second. In the case of a data breach, the risks are far more interesting.

Once your account details have been released in a data breach, the danger you’re in depends on the security practices used by the compromised service. If the service stores your passwords in plaintext (i.e. character-for-character the exact same way you registered it), you’re screwed regardless of how strong your password is.

Fortunately, most services store a hash of your password, preventing attackers from obtaining your password immediately. In this scenario, the time you have to protect any vulnerable accounts depends on how much time it takes an attacker to guess your password.

a side note on hashing Storing a hash of a password is more secure than storing a password in plaintext because a hash cannot be reversed. If you imagine your password as a recipe, its hash would be a cooked meal. It’s easy to verify whether two meals come from the same recipe (they’ll taste the same!), but hard to derive the recipe from the meal (without guessing, of course).

How quickly can an attacker guess your password from a stolen hash? Your average gaming computer can generate over 20,000 megahashes per second. For Americans, that’s 20,000,000,000 hashes (guesses) per second!

And that’s with your average gaming computer. Dedicated computers can achieve speeds over 8 times that, generating over 160 gigahashes (that’s 160,000,000,000 hashes, Americans) per second.

It’s important to note that most attackers make random guesses. Humans are lazy and tend to create passwords that match a set of patterns. A common strategy for cracking passwords is to take a giant list of leaked passwords and apply millions of common transformations (e.g. converting o’s into 0’s, s’s into $’s, changing capitalization) on them.

Even if you have a long password, if it resembles a common password pattern, it may be cracked more quickly than a shorter password composed of completely random characters.

Design a Strong Password

Password strength indicators lie to you. Many websites will claim that a password is “strong” just because it contains a few special characters. In reality, the strength of a password is not determined by what characters it contains, but by how difficult it is to guess the order of those characters.

We need to design a password that meets the following criteria:

●      It should be long enough that random guessing is infeasible.

●      It should be unique enough that it cannot be guessed with a strategy.

●      It should be memorable enough to be recalled without much effort.

A good procedure for creating passwords is the “xkcd method” (aka passphrase method):

The logic behind the “xkcd method” is that choosing four random words takes more information to represent in a computer, meaning it’s less likely to be guessed randomly. Because the passphrase is composed of words that have significance to the creator, it’s also easy to remember.

This method is sometimes criticized for being easy to crack if the attacker has a strategy. Indeed, if an attacker knows that they should only guess permutations of English words, they could reduce the search space (and thus the time it would take to guess your password) significantly. Because of this flaw, I recommend you also use a word that isn’t likely to be in a dictionary.

The final procedure looks like this:

1. Pick three random words. Try to use a random number generator to pick the word if you can; humans are a terrible source of randomness.
2. Pick a word that is unlikely to be found anywhere else. This can be a made up word, an inside joke, or even an uncommon misspelling of a word.
3. Connect the words together using spaces.
4. Memorize your passphrase! Creating a short narrative for your passphrase may help you remember it.

Stop Recycling Passwords

Now you have a strong passphrase, but you can’t just use it everywhere.

First, some websites will not accept your new passphrase. Some services will complain about your password being too long or not having enough special characters.

Second, reusing passwords poses a security risk. Any service you give your password to may store your password insecurely or use your password for nefarious purposes. If one of your accounts is compromised, any accounts using that password are also in danger.

Manually creating per-service passwords that are secure, unique, and memorable is not a trivial task. The solution is to use a password manager such as Master Password or LastPass. A password manager allows you to create strong passwords for every service you use while only requiring you to remember your master password.

Not only does this solve the issue of password reuse, but it also allows you to create passwords that satisfy the password requirements of services that don’t accept passphrases.

Shame Bad Websites

If you see a website that has a maximum length limit on passwords or prohibits certain characters, yell at them aggressively and threaten to stop using their services (try testing their PR team by doing it in public, like on Twitter). These are signs that a website stores passwords insecurely. Websites that hash passwords properly should not have these restrictions. (Sadly, a couple of offenders are Turnitin and College Board!)

If you see a website that requires you to include any number of special characters, feel free to politely tell them that those requirements are no longer recommended.

The National Institute of Standards and Technology (NIST) recently (just this year!) changed their security guidelines, advising companies to remove password complexity requirements. Research suggests that these requirements actually lead users to create worse passwords. Part of the reason why many passwords fit common patterns is because users tend to replace letters with similar-looking symbols and numbers in order to satisfy unnecessarily strict password requirements. Although these passwords contain more obscure characters, since many of these substitutions are predictable, they don’t make the password any more secure.

Last Words

If you only take away one thing from this post, it should be the idea that password design is a science, not an art. While security experts may disagree about what the “optimal” password creation procedure is, most would agree on one thing: Most people don’t know how to make passwords.

The passphrase creation method detailed here is certainly not the only way to achieve a high level of security. You’re free to use whatever method you see fit; I only ask that you understand the risks and make an informed decision.

The strategies mentioned here aren’t a definitive guide to cybersecurity either. If you want to ensure that your online identity is completely secure, I encourage you to do your own research. If you want a good jumping-off point, I recommend looking into multi-factor authentication (especially the emerging standard, U2F).

And if you do end up becoming a security nerd, try not to get tunnel vision. Don’t forget to watch out for your offline identity too!

Credit to xkcd for having so many relevant comics!