36

I've seen some similar questions but maybe not exactly what I'm asking. Also I can't say that I've followed all the technical jargon in previous posts and am really after more of an intuitive understanding.

So let's say I'm allowed ten characters. The usual requirement is to use numbers, symbols, etc. But why is #^Afx375Zq more secure than aaaaaaaaaa? The hacker doesn't know that I've repeated a character ten times, so doesn't he still have to go through the testing of all possibilities or are things like repeated characters tested first?

Similarly, suppose I use a 21-character passphrase such as

I like Beatles' songs.

Now someone might say that that's a common type of statement but again the hacker doesn't know that I'm using a passphrase instead of

DD63@*()ZZZ125++dkeic

so why is it (I assume) less secure? Are passphrases tested first?

3
  • 21
    a 5 pin tumbler lock with all the same pin heights can be opened with a screwdriver, despite holding as many "secrets" as a random-height lock cylinder.
    – dandavis
    Dec 1, 2021 at 18:26
  • 6
    Always a good idea to start your password hacking attempts with a password database full of passwords that have been leaked before (see haveibeenpwned.com). Maybe you really did memorize some awesome Z"45nty@w# password. Maybe even no other human ever used that password; it's great, but hard to remember 100 like it, so you reuse it.. Then some site you used it on got hacked, and let your password escape in plain text: Now means your awesome password that only you ever used is just there, in a DB, waiting to be tried.. Now imagine how many humans ever used aaaaaaaaaa as a password anywhere
    – Caius Jard
    Dec 2, 2021 at 22:10
  • Relevant: superuser.com/questions/712551/… Dec 4, 2021 at 13:07

8 Answers 8

61

If you were to generate a totally random password that is 10 letters long and can contain lower and upper case letters, numbers and common symbols, then you are equally likely to come up with #^Afx375Zq as you are aaaaaaaaaa. So from that point of view you're right that the passwords are equally secure.

However, most passwords are not generated randomly. They are chosen by humans, and humans don't pick a completely random series of characters. They choose something that they will be able to remember, and clearly the second password is much easier to remember than the first.

Therefore, if you take a large enough database of user accounts, you are likely to find that far more of them have chosen your second password than your first. As an attacker I can use that knowledge, so I'll test easy to remember passwords first.

1
  • 5
    Indeed, for a password to be secure you want it to be secure even if your attacker knows the process you chose for generating the password.
    – corsiKa
    Dec 3, 2021 at 22:04
62

The strength of a password is determined by its scheme. A code like aaaaaaaaaa must be assumed to have a scheme of "ten letters" and is therefore trivially cracked compared to the scheme we must assume from #^Afx375Zq.

Attackers prioritize the simplest arrangement that meets the password scheme: start with a capital letter, end with a number and then punctuation, fill the middle with the minimum lowercase letters, starting with words as sorted by frequency. I have such a dictionary, so I could start with Anything0! through Zzzombie9~, then progress to the non-word combinations of Aaaaaaaa0! through Zzzzzzzz9~ before different variations.

Ensuring your password is more complex than the minimally permissible code gives you a slight advantage; #aaaaaaaaa should take a few minutes longer to crack as aaaaaaaaaa. #^Afx375Zq will take a good amount longer because it mixes four classes of characters and only uses three lowercase letters.

Always assume attackers know your scheme. You may get lucky and be able to hide behind some obscurity, which is certainly worthwhile, but it must not factor into your math. Don't try to be "clever"—Kaspersky's attempt at this ended in failure; they made assumptions about the attack order that ended up creating much weaker passwords.

Forcing users to add complexity to the characters in their passwords forces attackers to increase the complexity of their brute-force attacks, though it actually weakens the overall entropy. It prevents lazy and easily-guessed passwords like aaaaaaaaaa by removing them from the possible password list. There are 94⁸ possible eight-character passwords (60 quintillion, entropy = 52), yet requiring a lower, upper, number, and special reduce that to 26×26×10×32×94⁴ (16 trillion, entropy = 43).

I like Beatles' songs. is neither random nor unique. Unsurprisingly, Google has hits for it.

👉 If a Google query for your password (quoted & de-0bfuscated) might get hits, it is weak.

Passwords must actually be random (not arbitrary! not obscure! a pseudorandom number generator is okay), by characters (for passcodes) or by words (for passphrases). I like Beatles' pants. is more unique, but it's arbitrary, not random. You cannot "make up" a random phrase without assistance (ideally using a generator), only one that seems random. It's okay to generate several phrases and pick one that you can make a creative story around.

I calculated a word is worth 2.5 characters, so for equivalent entropy to a passcode with 10 random characters, log₂(94¹⁰) = 65, you'd need a passphrase with 4 random words, log₂(100000⁴) = 66. That's on the weaker side, and again: a passphrase that is a sentence is not secure.

Length isn't everything. Don't be fooled by the impressive length of a passphrase. Sure, your musical preference is 21 characters, but even if we assume it's random and not known to Google, it's four words with some punctuation thrown in: log₂(100000⁴×32²) = 76. Compare that to random lowercase letters: log₂(26²¹) = 98. Compare those to random characters: log₂(94²¹) = 137.

A summary of my password advice: The world has gotten sophisticated enough that it's impossible to remember your fully-random and unique-per-account passwords (be they codes or phrases).

  • Use authenticator apps for 2FA or passwordless access when available
  • Use a password manager to generate and save passwords
  • Lock your password manager with a strong password with 90+ bits of entropy,
    say with a generated 4char code randomly placed within a generated 4word phrase,
    entropy = log₂(100000⁴×94⁴×5) = 94, like junkie unknotted 7!cT opposite litter.
    Make a story to remember the words and keep the 4char code in your wallet if needed.
20
  • 1
    This thread has been very instructive. A followup question if I may. (I know most people would recommend a password manager but I'm trying to understand the basics here). Suppose you use an English phrase but insert a random character into it so for instance using the above example: I like ^ Beatles' songs . Does that significantly improve its security? Dec 2, 2021 at 1:11
  • 1
    @Not_Einstein Every permutation adds more complexity to it. The question then becomes "How many permutations is an attacker willing to try?" The general rule of thumb is "The more, the better". For a password you have to remember (e.g. Bitlocker PIN), try to be as random as you can, e.g. TmWouIomB4HBlMs.hzRv instead of ILike_The_Beatlez123
    – MechMK1
    Dec 2, 2021 at 1:21
  • There are 32 special characters, so log₂(100000⁴×32³) upgrades a random 3word + 2special passphrase from 76 to 81 bits of entropy, but let's not forget that phrase is not random. Let's err on the side of saying it's worth 34 (valuing the first word as "random", log₂(100000) = 16, plus each additional word as a random alphanumeric, log₂(62³) = 6×3 = 18). I like ^ Beatles' songs. is therefore still a weak 49 (or 51 if you say the ^ was added to a random location around the 4 words). You're half way there; see my password advice.
    – Adam Katz
    Dec 2, 2021 at 3:06
  • 1
    @AdamKatz I see what you mean, but the the word "complexity" has been widely used to mean the use of special characters and mixed case, without reference to length. Admin UIs, explanations of password security on login pages, and even the UIs of various password managers all use it this way. I'm not sure what a better word would be though.
    – barbecue
    Dec 2, 2021 at 16:30
  • 1
    @AdamKatz nice improvements, thanks!
    – barbecue
    Dec 3, 2021 at 22:29
24

Attackers try the most common passwords first, because they're the most likely ones that will work. So they might start with things like password or Password1 or common patterns such as 123456, 1qaz2wsx or aaaaaaaaaa

For example, there's a common technique called "password spraying", when rather than trying lots of passwords against one account, you try a few common passwords (such as Password1) against lots of different accounts. This is useful when you want to compromise any account, rather than having a specific target.

If they don't have success with common passwords, then they'll try increasingly uncommon things like longer words, using rules to mutate the words (such as adding numbers on the end or capitalising them), combining multiple words together, or even exhaustive brute-force attacks of shorter lengths.

One method of creating lists of potential passwords is to crawl websites for words and phrases (especially as more people have started using phrases). So a passphrase such as I like Beatles' song. might appear in one of these lists, because it's a phrase that might appear on the Internet somewhere. But a long random string will never appear in a wordlist (unless you post it on Stack Exchange), and 21 characters is far too long for an attacker to brute-force).

If you want to create secure passwords, the best options are either a long, random string like the one you posted (which is what most password managers do), or a series of multiple unrelated words. So rather than a sentence (like the example you gave), just pick four random words (such as the famous XKCD example of CorrectHorseBatteryStaple).

8
  • Is the XKCD scheme really better? security.stackexchange.com/questions/62832/…
    – qwr
    Dec 2, 2021 at 21:45
  • 4
    The XKCD scheme still works as well as it did because of the inherent entropy in choosing 4 terms at random from a really big list of terms. The person saying "crackers are on to this trick" seems not to understand that even with a 20,000 word list, the crackers would still need to iterate over 20,000^4 combinations - there's no shortcut to that. The XKCD method doesn't win out in terms of entropy per character but it never did and this is not what truly matters. Where it does fail is that the number of passwords a typical person has now all but requires the use of a password manager. Dec 3, 2021 at 3:52
  • 2
    @qwr I mean all the answers there say it’s still as good as it was. Why do you think the answers are wrong?
    – Tim
    Dec 3, 2021 at 10:38
  • 3
    But it's also important to remember that total entropy isn't the only attribute that matters for passwords. While you can sometimes stores them in a password manager, that's not always possible, and a huge strength of these passphrases is that you can actually remember them.
    – Gh0stFish
    Dec 3, 2021 at 11:29
  • 1
    @Confusion if people are not choosing them at random, then they are not actually doing what XKCD method prescribes. That's not a flaw in the XKCD method, at all. Dec 22, 2021 at 22:18
1

Most people, including lots of them who write password policies, don't actually understand passwords. Exhibit A: The original author of the "complexity" rules is now sorry for his mistake.

We now know that length is more important than complexity. We also know that you do not want your password to be:

a) something common, like 12345678 (yes, that's a very common password) which any of the available tools will try within the first five seconds.

b) something easily guessable like your dog's name that anyone somewhat familiar with you (or following you on Facebook) would try in a targeted low-effort attack.

Beyond that, fuck all the rules, they're silly. Most attacks on passwords don't brute-force. Most compromised passwords are leaked in one way or the other, in which case it really doesn't matter if your password is 123 or +)r%rARAT:Am))17z(rZk!,%ODbsz0

So why do you want to use some randomness in your passwords? Because of b) - humans are terrible at making something random or difficult to guess. Include at least a random part. Something like "I was born in (random three-digit number)" is a ton better as a password than whatever the complexity meters tell you.

Your phrase is pretty good - unless it is true. If it is true it falls under b) and trying out fifty statements each in a hundred different phrases and spellings is easily scripted.

Unless you're a high-profile target, stop worrying beyond that. You are much more likely to be compromised by software vulnerabilities than by someone spending the resources to brute-force even a mildly good password.

2
  • +1 for something guessable. You don't want to lock your heirs and assigns out. Especially if there is no back door and no chance of recovery. It doesn't hurt to have an envelope in a safe either.
    – mckenzm
    Dec 4, 2021 at 18:51
  • @mckenzm the solution to recovery is not to choose a weak password. It is to store your list of passwords in a trusted location or with a trusted person. If you want to go the extra step, split the list and give it to 2 or 3 trusted people (e.g. the first person gets the first characters, the second person the last characters) who are unlikely to come together for any other reason besides your funeral. Maybe your first and second wife or something. ;-)
    – Tom
    Dec 4, 2021 at 19:44
0

Before the advent of password managers, because people needed to be able to remember passwords, they had a tendency to pick simple passwords.

Simple passwords are extremely common. You know, "password", "123456", "qwerty", and so on. Don't laugh, those are actually 3 of the most common passwords in use! But there are looooong lists of common passwords, and hackers usually start with those (dictionary attacks). And yes, aaaaaaaaaa is in the top 10 000 most common passwords (along with various other lengths).

So, in order to force people to come up with something a bit different, rules like those were introduced. Are they good rules? Apparently they do help, as none of the most common passwords contain the often required combination of lower, upper, symbol and digit.

The next issue after that is that once people have found a password which fits those rules AND they can remember, they re-use it everywhere, and from there you have the issue that a leak on one site will affect your accounts on all other sites where you sued the same password. This is why the current best practice is to use password managers (but that is not something sites can enforce, this is a user-side policy), which will generate and securely store random passwords for you.

If passwords are actually generated randomly rather than chosen by humans, then the goal is to have a level of entropy matching whatever requirements you set (in bits, or number of combinations, which is the same). There are two approaches to increase this: increase the number of possible symbols, or increase their number (or both, of course). A random 10-character lower-case password has roughly the same entropy as a random 8-character lower/upper/digit/symbol password. But if it's really random, it's nearly impossible to remember anyway, so it will end up being written down.

Phrases are an alternative. Here you replace characters by words. If you pick 4 random words from a 5000-word dictionary, you have again roughly the same entropy as above, and it's probably a lot easier to remember.

However, if you are not picking random words out of a long list, but an even easier-to-remember sentence which actually makes sense, then you fall in the same traps as with the usual passwords: are you sure the sentence you chose is not so common that it will end up in dictionaries?

0

Any reasonable system will prevent a cracker from repeated attempts to brute-force a password by, for example, imposing a 'lock-out' period after a few failed attempts, or imposing a longer and longer pause after each failed attempt.

It follows that beyond a certain relatively low point, the complexity of your password is immaterial. For example, a password that is known to be of 4 digits (ie, a PIN) can be brute-forced inside three attempts in only 0.03% of attacks. Repeated attempts at such attacks should be detected by the system or its administrator, and blocked. Brute-force cracking is only feasible under that constraint if the system has already been compromised and the password encrypts are available to the cracker.

If the system administrator insists on a long and complex password, then that is an implicit admission that she/he has little faith in the security of the system and her/his ability to keep the password encrypts out of crackers' hands.

However, if you re-use on a high-value target the credentials (username, password) that you have used on a system that may be cracked, then you can expect trouble.

1
  • Interesting. Do current Windows and Mac OS systems have these preventive measures? Dec 15, 2021 at 16:33
0

I'm a fan of randomly generated passwords.

I use a password safe and randomly generated passwords. I also use my own password generator. No. I won't post it here, but you can get some good ideas from Bruce Schneier's Applied Cryptography. My passwords have any of 51 different characters, and each password has 16 characters. 51^16 = 2.1 x 10^27 possible passwords. A brute force attack would be exceptionally difficult for a classical computer. Perhaps a big quantum computer could get it. The down side of it, of course, is that my passwords are pure gibberish. Here's an example: 57x]Vb1R+}m2nh. Ugly, huh? I put them into a password safe and copy/paste them from there. So. You'd need to hack into my computer, run the password safe, guess that password, and you're in. Is this perfect? Probably not:

Smart people think they can come up with an unbreakable code, and the smarter they are, the more certain they are that they can do it. -- Charles Babbage.

Finally, most security breaches are because of social engineering by clever attackers, and laxity by the defenders. Brute force attacks on a well defended system rarely succeed.

-3

I am not a security expert, but I feel like I need to add two points.

  1. Tools that brute-force passwords will simply start at 000000 then 0000001 and aaaaaaaa is really, really easy to get in the first few seconds of that "set" of N digits. I don't know of any exact tools, but this is what I learned from ye olde tutorials on astalavista, before it became ads, and was a hacker search.

  2. The top answer, which states "aaaaa" is just as likely strikes me as mathematically inaccurate. Even-distribution algorithms have a bias to not give the same thing they just did. They're not unbiased, it's just split among all numbers instead of a specific number or set of numbers.

6
  • 1
    "Tools that brute-force passwords will simply..." -- this is simply not true.
    – schroeder
    Dec 4, 2021 at 0:46
  • 1
    Please do not respond to answers in an answer. Simply post an answer. And your assumption about the math is incorrect, your assumption about how random generators work is incorrect, and you have misunderstood the answer.
    – schroeder
    Dec 4, 2021 at 0:48
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Dec 4, 2021 at 1:42
  • @schroeder, yeah, it pretty much is, most of the time. Sequential is the most widely used. Dictionary and Rainbow Tables will provide a better yield for donkey passwords, but hard crypto slog is still permutation based - but if broken up into a few million parallel sub ranges and scaled out it starts at a pont assigned to the work unit. Not considering collisions because they will exist. We know that truncation to save space happens, and we know that not everything gets salted.
    – mckenzm
    Dec 4, 2021 at 18:56
  • 1
    There are plenty of tools freely available. Please go and download them. You will find that they do not start at 0000 or aaaa or such a thing. They start with lists of common passwords and permutations.
    – Tom
    Dec 4, 2021 at 19:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.