How reliable is a password strength checker?

I've tested the tool from Microsoft available here which tests password strength and rates them. For a password such as "i am going to have lunch tonight", the tool rates it's strength as "BEST" and for a password such as "th1\$.v4l" it rates it as "Medium".

I'm wondering how important password length really is. In this case the first password is better according the their tool but is it really better? It's based on dictionary words and has no combination of numbers and other characters besides spaces, and seems very easy to crack (not considering brute force).

Is that tool giving precedence to length instead of actual strength ?

-
I wonder if anyone has built a Markov model based brute forcer for pass phrases. – Stephen Paulger May 25 '11 at 11:07
@StephenPaulger, yes, they have. – D.W. Jun 20 '11 at 4:00
There are already available rainbow tables for NTLM and MD5 to crack any password up to 8 character long using all characters on the keyboard. The set for "lower alpha, numbers and symbols" is only 400GB large, the one for full space is about 600GB large. – Hubert Kario Aug 16 '11 at 9:51
– kba Dec 28 '11 at 21:04
@StephenPaulger, Care to elaborate on how a "markov model based brute forcer" works? – Pacerier Apr 11 '14 at 18:19

"Not considering brute force" - that's exactly what these tools measure.
Obviously they dont try social engineering, or trying to discover if it's the user's first girlfriend's dog's birthday. The attacker might know that, but these tools don't.

What they do measure is simply the difficulty for a bruteforcing tool to crack it. Not even the entropy of the password, which is an attribute of the generation method, just an estimate of how long it would take a bruteforcing tool to successfully find the correct password.
Obviously, entropy has an effect on this, but it is only total entropy that matters, not entropy-per-character. So yes, having a lot of equi-probable options for each character does add to the entropy, but length can play an even more important part in making a password uncrackable, by raising the entropy-per-character to a higher power, by character count. This makes for a much higher total entropy, which is the only thing that matters.

So, in your case - yes, the 32-character, alpha-only passphrase is much stronger than the 8-character punctuation password.

I'm gonna try and do the maths here for a bit: (please correct me when I'm wrong):

If we assume standard US-style keyboard, there are 85 possible printable characters (possibly be able to scrape a few more, but lets go with this for now): lowercase letters + upper case letters + numerals + standard punctuation + space.
This grants ~6.3 bits strength per character; at 8 chars length the password gives you ~50.4 bits strength.
Note really very strong... Even if we throw in a few more "special" characters, you're not going to upgrade that very much.

Now, for your 32 character, alpha-only passphrase...
Let's assume lowercase and uppercase letters only (even though you didnt use any), plus a space (U+32). Not even numerals...
That gives you 54 possible characters, around ~5.8 bits per character. At 32 chars long, thats over 185 bits strength. Substantially stronger. And that's even without numerals, which are usually accepted even in "simple" password schemes.

Bruce Schneier often talks about how switching to long memorable passphrases would be much more secure than short, randomized weird-looking passwords.
Now you see why.

-
What was your method of calculating bit strength per character? – Steve Mar 24 '11 at 17:50
@SteveS - I took a trivial calculation, of how many possibilities there are in the acceptable range (for each character, 85|54 possibilities), and translated that into how many bits are required to represent those possibilities. Admittedly this was a pretty rough estimation, back-of-the-napkin type calculation, not very lab-worthy (hence the approximations), but I think it's still relatively representative. – AviD Mar 24 '11 at 18:55
Excellent answer @AviD. If only more people did the math (and software vendors quit with the arbitrary "Sorry, your password must be between 8-16 characters" size limitation I would be a much happier man. – Dan McGrath Jun 2 '11 at 13:13
appendix A here goes through the same calculations. csrc.nist.gov/publications/nistpubs/800-63/SP800-63V1_0_2.pdf – user185 Jun 13 '11 at 16:16
@Graham very interesting. That doc actually has different results, mainly because I was referring to a completely random selection of characters, whereas the NIST doc smartly takes user choice into account - i.e., not random, and hence less bits of entropy per character. I think the NIST doc is more correct than my answer here - but still not sufficient, if you're going that way knowledge of the user should be taken into account too, not just language features. However, at that point it's no longer a question of entropy bits anyway... and regardless, this q was specifically about bruteforce... – AviD Jun 13 '11 at 17:00

You're worried that because the passphrase uses dictionary words, it might be easier to crack than something that must be brute-forced.

tl;dr: This is a valid theoretical worry, but right now it's not a practical concern.

"I am going to have lunch tonight" is a five word phrase using words out of the most common 5000 in the English language. Naively, guessing it is isomorphic to guessing a 5 letter password in a 5000 letter alphabet, which is 3x10^18 possibilities. That's about the same as a 10 character password using upper and lowercase, numbers, and symbols.

Of course, a smart enough cracking program could reduce this considerably. The sentence is standard English prose, which follows such strict rules that it has an information entropy rate of around 1 bit per letter. That means your phrase has 33 bits of entropy, making it only as complex as a perfectly random password of 5 printable ASCII characters.

That's not very complex.

However, to exploit that lack of complexity, you would need a specialized "English passphrase cracker" which could optimize something like markov chain modeling into kernels for GPGPU processing. To the best of my knowledge, nothing like that is even in development at this time. So unless someone with the resources to create that software wants your passphrase, you should be safe for quite a while.

-
Very important for this is also that unless the attacker knows your password is formatted like this, it's not a tool they'd use. Even with the relatively small possible number of passwords it's an awful lot to run through "just in case" - especially over a network connection. – Phoshi Mar 24 '11 at 16:29
It's important to note that if I deliberately misspell a single word, like "lunch" as "lunnch", the complexity is immensely increased. – AndSoYouCode May 28 '12 at 9:37

Entropy is a strange thing to measure.

NIST Special Publication 800-63, Electronic Authentication Guideline ncludes guides for estimating password strength:

Entropy varies greatly depending on whether a password is selected by a user or is generated randomly. Statistically, guessing the first character of a password selected by a user is tough, but guessing the second is easier and the third is easier yet. The NIST guidelines give the first character 4 bits of entropy when using the 94 characters available on standard keyboards, but only 2 bits for each of the next seven characters, and so on.

Randomly selected passwords do not display patterns, so each character carries the same level of entropy, about 6.6 bits.

This means an eight-character password selected by a user has 18 bits of entropy, while a random password the same length has about 52.7 bits.

In other words, if you can determine the first 3 characters of my password are

Awe

Then the odds of the next character being s are way, way higher than it being *.

So when we say a password character can be any character, that's not really true; most people use words that have strong patterns in them and implicitly reduce the possible set of the following characters -- thus producing a password with lower entropy (randomness).

-

I am not sure how "i am going to have lunch tonight" is dictionary vulnerable, its a seven word phrase. Where "th1\$.v4l" is a two word phrase with a character join, and character substitution something that password crackers have dealt with since forever it seems.

A few password testers use cracklib+ajax like tests with a small rule base to weed out your "this.val" password.

-
So what are you saying exactly? That the first password is more secured even if it's made up of common dictionary words with no other special characters? – iijj Mar 24 '11 at 11:13
@iijj, thats exactly correct - length is more important. – AviD Mar 24 '11 at 13:14

I suggest that anyone who uses such a site should never submit a password they actually intend to use.

-
See, where you miss the point is that you probably already intend to use the site. Adding a "Password Strength Checker" does not add to your risk. If they really are nefarious they will just not encrypt your password and take it, no need for a whole "Password Strength Checker" ruse... – Dan McGrath Jun 2 '11 at 13:20
@dan - to clarify, I'm talking about the third-party hosted code pointed to in the original post and by others. Of course, if a site I'm creating a password on provides a checker of their own (which they host, securely, etc), then there is just some more attack surface, but at the same site. – nealmcb Jun 2 '11 at 14:16

Length is almost everything when trying to defend against brute force attacks.

Even the basic password crackers allow 1337-speak style substitutions, so in your example you are effectively comparing a 7 word passphrase with a 2 word passphrase.

As long as you have long passphrases (where the exact definition of long may vary depending on your needs, but should at least be over 13 chars to make the odds of a rainbow table attack minimal) you force an attacker to try other forms of attack, such as social engineering; finding out where you wrote the passphrase; holding your cat hostage etc.

-
This is misleading. Length usually gives entropy, yes, but not always. – Pacerier Apr 11 '14 at 18:31
“Length is everything” Sweet, changing all my passwords to aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa. – Gilles Nov 7 '14 at 5:20
There you go guys - is that edit better? :-) – Rory Alsop Nov 7 '14 at 13:32

Theoretically, "password strength meters" cannot work. The tool only sees the outcome of the password generation process, while the password "strength" is really a property of the process. See this answer and then that answer for details.

The best a password strength meter application can give you is how much time it would have taken it to break your password -- in other words, it assumes that the attacker runs the exact same code and knows nothing more about you. This is not a reasonable assumption in practice: the attacker, when he attacks you, is, well, after you, specifically. Relying on a password meter for security is like praying that all attackers will be incompetent: that's a kind of "leap of faith".

-

Looking at the Javascript for that Microsoft tool it seems that it only has a limited list of dictionary words (See Lines 264 onwards in the js file), so that might explain why your passphrase is getting a higher rating than perhaps it should.

I personally would recommend this password strength tester it gives a good breakdown of the elements that make up your password and tells you how it can be improved. It rates your password "i am going to have lunch tonight" at 56% and your second password "th1\$.v4l" at 74% which seems more realistic.

However, this tool doesn't use any wordlist at all -- your passphrase is marked down just for being all lower case, while "i am going to have lunch tonight!" gets 98%. You can draw your own conclusions about how useful the %age ratings are.

In regards to the affect on length on cracking time checkout this article. Note that its from way back in 2009, though, and GPGPU-based password crackers can now manage 10^9/sec (the "class F" highest level of attack in the article) on a single gaming/workstation PC with a \$500 GPU card.

-
Seems like a great tool, thanks. Does the overall score imply that it is harder to crack ? – iijj Mar 24 '11 at 11:16
Thanks for the tool. Great discovery – Henri Mar 25 '11 at 15:38
other than the fact that it requires typing you password in to a form over http... – Yaur May 23 '11 at 3:07
@Yaur the tester does not send your password across the net at all. It assesses the strength using locally executed JavaScript. – Mark Davidson May 23 '11 at 8:06
@Yaur I disagree. Verification is fairly simple, use firebug net monitoring mode and you can watch all activity to and from the site. You could also monitor it using wireshark. – Mark Davidson May 23 '11 at 8:58

Well all password strength checker tools verifies how much effort it will take to find the password using brute force and dictionary attack.

"th1\$.v4l" is

"i am going to have lunch tonight" is

this password will take less time to crack using brute force.

-
passwordmeter.com is nice tool as for password statistics but the final strength number is not good. Consider password: "1111111111111111111111111111111111133333336666666666546546644646". The score is 0%. That's nonsense. I like the tool password-checker.online-domain-tools.com. It allows you to do a dictionary check too. – Martin Vseticka Feb 3 '13 at 12:38

Well, if you define the strength of a password as its difficulty or likelihood of being cracked, then almost counter-intuitively, the strength of a password is more a function of its length than its difficulty to remember.

"i am going to have lunch tonight"

will take more time to crack than

"th1\$.v4l"

simply because there are more characters that the attacker would need to guess correctly in order to crack the password. The longer passwords present a larger search space to exhaust, give your needle (password) a much bigger haystack to hide in.

-

If an attacker knows how a password was generated (let's say by examining the plain text passwords stolen from a few insecure sites) by a certain person, they have the knowledge necessary to lower the difficulty of brute-forcing by a lot! Because they know that you are not using all of the possible characters on your keyboard anymore, they can eliminate impossible combinations and save time.

The next time you generate a password, think about the algorithm/method you are using to generate one. Using Password Safe to generate a 21-character password out of a 72-character set (+-=_@#\$%^&<>/~\?abcdefghijkmnopqrstuvwxyzandABCDEFGHJKLMNPQRTUVWXY346789), you get approximately 1.0×1039 possible combinations or 130-bits of security.

-

I saw a comic in the newspaper recently. Or maybe it was a digital copy online of a comic, I dont recall.

It illustrated this very debate. And I will now explain to you the point it made:

Just because a password is short doesnt mean its easy to guess, as in the case with "th1\$.v4l". But just because a password is long doesn't mean its easy to guess either, as in the case with "i am going to have lunch tonight".

The fact of the matter is, no serious human hacker is going to sit there and guess your password. They might use dictionary words, but those dictionaries dont contain every possible sentence. Just words.

Nope, what hackers do (when they have exhausted a typical dictionary of WORDS), is they usually have the computer go systematically through every possible combination. Beginning to end. If they are forced down this path, the shorter the password, the worse. The longer, the better. Regardless if there are digits or symbols. Digits and symbols only matter to humans remembering and humans guessing. To a computer, they are the same thing... a sequence of 1's and 0's... and it makes no difference.

Do yourself a favor. Keep it long but simple. Short and complex might cost a hacker time, but long and simple will do the same thing. The question is, do you want a password that is easy to remember or hard to remember?

-

protected by Rory Alsop♦Feb 3 '12 at 13:43

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).