3

I use a password manager for most of my passwords and they all have roughly 150+ bits of entropy so I feel pretty good about those. :)

But my master password is something I have to remember and whether I use a password or a passphrase, its entropy is much much lower, so that I can realistically remember it. Still, it's in the 65+ bits range and rough calculations on hash cracking with moderately powerful systems would take a dozen years to crack.

So my question is: as long as I change my password more often than it would take to crack my password, can I feel safe with a weaker password?

If I choose passwords that can only reasonably be cracked in 5 years, but I change my password every year, I should be fine, right?

  • 1
    If a password with 65 bits of entropy can be cracked in 12 years it's definitely not being stored correctly. I calculate about 50 billion guesses / second to have a 50% chance of guessing in 12 years. PBKDF2 with a decent number of rounds should limit you to hundreds or maybe thousands of guesses per second, increase that by a couple orders of magnitude if you think someone has the hash and is using a large cluster to crack it. – AndrolGenhald Sep 27 '17 at 21:44
  • I used bee-man.us/computer/password_strength.html to do the crack calculation. It was based on 65.7 bits of entropy and 60 billion guesses / second, so basically what you got. It is a 5 year old site, but I don't see how that would matter. So you're saying as long as they (LastPass) are using the right encryption, it should take much longer, right? – William Kelley Sep 27 '17 at 22:13
  • 1
    It looks like they're using PBKDF2-HMAC-SHA256 with 5000 rounds by default (they actually let you adjust the rounds, so that's a plus). I haven't gotten around to using hashcat myself but it looks like some people were getting around 10k guesses per second on a top of the line GPU a couple years ago, so even with Moore's law an attacker would have to have thousands if not millions of gpus, and at that point they're probably going to be building an ASIC. – AndrolGenhald Sep 28 '17 at 2:56
  • It's probably a moot point anyway though, I'm fine using my primary password for a few years, but after 5 years I'm more concerned that someone might have had the opportunity to look over my shoulder, use some sort of keylogger, etc. – AndrolGenhald Sep 28 '17 at 2:58
  • 5
    @WilliamKelley I ask because if someone gets your LastPass blob now and starts cracking it now, and they succeed 5 years from now but you haven't changed any of those other passwords, the attacker would have all your passwords. In other words, I think your "change master password every year" strategy requires that you change all your stored passwords every year, too. – drewbenn Sep 28 '17 at 6:01
3

I believe you are trying to ask if you can get effective security from a bad password as long as you rotate it frequently enough. The answer is no, because password rotation does not help security before a compromise; it can only help after the fact, after a password has been compromised.

Changing your password won't make a difference against a brute force attack on a live authentication system.

Think about an attacker that can brute force all the passwords over a 5 year span. Let's say he tests all passwords beginning with A-E in year 1, F-J in year 2, K-O in year 3, P-T in year 4, and U-Z in year 5. If your first year's password begins with K, he won't get it. But if you rotate passwords and next year you choose one beginning with F, he'll guess it that year. In other words, if the attacker's guessing pattern is virtually certain to guess your password in five years, each year his chances of guessing it are 1/5, no matter what you've set it to.

Rotating passwords helps if there's a chance your password has been compromised in some way without your notice. For example, you might want to rotate it if you used it an airport, coffee shop, or other suspiciously public place; if you find a virus or other malware; if you ever mistyped your password into a username field; or if you just have a bad feeling that it might have been stolen. Otherwise, it's a fairly ineffective security practice.

  • 1
    In this scenario, if you change the password yearly the probability of the password being brute forced in one year is just the same as if you never change it, ok. But the probability of it being brute forced in two years is the half. and the probability in 5 years is 1 if you do not change it! Probabilty computation is often misleading... – Serge Ballesta Sep 28 '17 at 7:28
  • @SergeBallesta, agreed, which is why password rotation is utterly useless unless there has been an actual compromise. What he's trying to ask is if he can use a bad password as long as he rotates it more frequently, and the answer is "no!" I'll paraphrase this in the answer above. – John Deters Sep 28 '17 at 16:22
  • "password rotation is utterly useless unless there has been an actual compromise" - That's not at all what I got from @SergeBallesta's comment, it sounded to me like he was trying to say something along the lines of this: if an attacker can enumerate the entire keyspace in 5 years, with no changes they'll have a 100% chance of cracking the password; on the other hand if the password is changed every year, they'll have a 1-(1-1/5)^5=67% chance of cracking the current password at some point in those 5 years (assuming they're always working on the latest password). – AndrolGenhald Sep 28 '17 at 16:37
2

Your analysis sounds correct to me. Even with a bad hash that would allow billions of guesses per second, cracking a 65 bit password would have enormous electricity and time costs.

After a few years of using the same password I'd be much more worried about someone having captured it (or part of it) some other way, such as looking over your shoulder, an inventive keylogger, or any other such means.

tl;dr: With 65 bits of entropy in your password cracking the hash is no longer your weak point.

Edit: As has been pointed out in comments, when you change your master password you should change all the other passwords as well since an attacker could crack the old master password and use it to decrypt the old password database.

1

First, your password manager is a (soft) 2-factor authentication. You need a file you have and some password you know. This makes it already much more secure than a plain password.

When you now assume somebody got you password file, there is the (weaker) password left. And now you get a paradox: Assuming somebody can copy your password file without you noticing but does not get your password, changing your password actually weakens the security.

The reason is, that the attacker has a collection of your password files (e.g. 10 versions with different master passwords). When he's now brute-forcing your password, he just tests each password on all files and the chance to get it right is 10 times bigger than brute-forcing a single file.

Note that the same is true for most disk encryptions, which do not re-encrypt everything when you change your password. An attacker who is able to copy the header (i.e. LUKS) can brute-force the master key in the header even when you changed the passphrase.

The result is, that changing a password when you suspect somebody may get an encrypted file does not help, if there is any chance that he already got the file. If you suspect he got the password but not the file, change it. As regular changes are making things worse, choose a good password and keep it. You may also consider physical security for your password database like putting it on a usb stick, if you can make sure you will not lose it.

Regarding the question, if a good salt and hash stretching would not prevent the problem: When you change your password and the attacker starts brute-forcing both, you have two options:

  • The new password is weaker: The attacker will find the new password faster than the old one and the overall security is weakened.
  • The new password is stronger: The security does not change, as the attacker will find the password of the first file just as if you never changed your password.

This means, you cannot make the security stronger. Either it keeps the same or it will even become weaker.

Hashing the password more often makes the brute-forcing slower, but only by a constant factor (number of files available). Compared to an exponential factor when adding more characters when choosing one good passphrase, this is not the bottleneck when cracking a passphrase.

I assumed here, that you only change the master password. If you change all stored passwords when you changed your master password, this does not apply.

Conclusion: Choose one good long password at the beginning and keep it. And make sure nobody gets access to your password database.

  • If the password is properly salted it makes no difference. – AndrolGenhald Sep 29 '17 at 13:42
  • That's not true. You cannot create a rainbow table, but I can hash every guess twice and test it against both files. The security can get only worse when changing a password, but never better. I add a explanation. – allo Sep 29 '17 at 14:32
  • If you're hashing the same password attempt twice to try it against different hashes how is that any faster than hashing two password attempts to try against one hash? – AndrolGenhald Sep 29 '17 at 14:33
  • Two is a small constant factor. The important factor is, if one of your passwords either is much weaker than the others. And then the change cannot help. So the best advice is: Choose one strong password and keep it. – allo Sep 29 '17 at 14:40
  • 1
    It sounds like the point you're trying to make is that if you change the master password you should change the other passwords as well, otherwise an attacker could use the old master password to decrypt them. If you do that, the old password is fairly useless. – AndrolGenhald Sep 29 '17 at 14:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.