Nowadays, most people use password managers (hopefully). However, there are still some passwords that you need to memorize, like master password (for a password manager), phone lock, wifi password, etc.
Security wise, can passphrase reach the strength of a good password without getting so long that it defeats the purpose of even using it?
can passphrase reach the strength of a good password
Relevant xkcd: https://xkcd.com/936/
I’d love to hear from someone well versed in security if this is legit or significant weaknesses exist, but the math seems to check out as far as I can tell.
For what a civilian target would worry about, using sufficiently long passwords is your best defense. Complexity is barely important.
111111111111111111111111111.1111 is an excellent password.
Everyone should Ctrl+f their password here. But also wait the 10 minutes it’ll take to load the whole thing.
If your pw is on this list, change it immediately.
If it’s less than 8 chars? Change immediately. If it’s less than 10 chars? Change… Now.
If it’s less than 14 chars, consider just making your password longer.
This advice will save more people in its simplicity than saying more.
Want a smidge more?
If you’re paranoid, take a password that you think is decent, then insert it here, then use the output as your password.
Most times, pws aren’t stored in plain text, they’re stored using that algorithm. So, if your password is ‘password’, hackers night easily be able to see that your passwords encrypted value is exactly what that link will output if you put in ‘password’. If your password is on that huge list from the beginning of the post, they can easily decrypt the encrypted password, because these passwords’s hashes are known.
So, use the hash itself as a password.
Hell, throw a comma at the beginning to throw it off.
using sufficiently long passwords is your best defense
No, using 2FA is your best defense, along with wise recovery questions. It matters nothing if you know someone’s password, but can’t get the 2FA code.
That’s basically a Diceware passphrase. And, it’s kinda ok. The amount of entropy is pretty significant (close to what the comic lists, if the Wikipedia article has it right). And it’s really easy to add more entropy. I often recommend passphrases to my users (I work in Cybersecurity) and use them myself. Take a sentence, with spaces, capitals and punctuation. Now throw in a few numbers for fun and stop worrying about brute force attacks, until some idiot decides unsalted MD5 is perfectly fine for storing passwords. Most such passphrases will blow right past the 4 words in that comic and are very easy to remember. Even better, make that the passphrase for your password vault (oh look a plug for KeePass). Then have the rest of your passwords all be unique, 20 character jumbles of letters, numbers, and special characters.
Also, enable Two-Factor Authentication (2FA) wherever possible. Even if it’s just a One Time Password (OTP) sent via SMS (which is a shit way to do 2FA), that’s better than no 2FA.
Dictionary attacks have been around for a long time, but It’s still quite strong especially if you throw in a number.
A fully random 8 character password has about 10^14 brute force combinations (assuming upper and lower case + the normal special characters). 4 words choosen at random from the top 3000 words (which is a very small vocabulary really) is 10^13 dictionary attack combinations, add a single number or account for variations in word style (I.e maybe don’t always use camel case) and you’ve matched the difficulty. If you use 5 words it’s 10^17 combinations.
(This is basicly copy pasted from a comment I made earlier)
If your services are storing passwords properly with a salt, dictionary attacks (including rainbow tables) are just as time-consuming to perform, since the salt renders each password hash unique; even for the same passwords.
So the same principle still stands; the longer your password, the longer to guess - as long as the encryption-at-rest is done correctly.
i also dont really get it. the bitwarden pw tester says it will take 14 years to crack “its.a.beautiful.day”, write beautiful with 2 t`s and it will take “centuries”? 🧐
but yes i still use them. but always with numbers and random characters in between and words from multiple languages or fantasy words.
That would be because the pattern on the first password are correctly spelled words and the way passwords are cracked offline (when there’s a leak of data being sold somewhere) is that they use dictionary attacks.
This means that a big file containing all known words, and can also include known used passwords from past leaks, is used to try a lot of combinations. A combination of good words that appear 1:1 in these word lists will score way lower in terms of difficulty for a computer to crack. A simple script can add spaces and periods (like your example) between words and they WOULD get your password. By adding only one random character that doesn’t fit a pattern (just like your second ‘t’), you basically force the cracker to try all possible combinations of all characters for the length of your password, which is WAY more difficult.
TLDR: There are more combinations of aaaaaaa, aaaaaab, aaaaaac then there are of matching words together for the same length of password (one.one, one.two, one.three)
most people use password managers
You don’t know many boomers, do you?
According to security.org survey data, in 2021, 22% of Americans said they used a password manager, but in 2023, the percentage increased to 34% with a further 10% of users saying they use a security passkey or other physical password device.
So in the most generous interpretation of that, just over half of people are not doing anything secure.
Yes, I use passphrases for stuff like my password manager, my computer login, and my disk encryption. For my login (which I type a lot) it’s four words; for occasional stuff like disk encryption it’s six. I’m sold on the argument that a passphrase is way easier to memorize compared to a comparably-secure random password.
The number of possible passphrases is the number of words in the dictionary you use to generate passphrases raised to the power of the number of words in your passphrase (assuming a small chance of reusing the same word in a passphrase). I use this command to generate a random phrase using my stock OS word list:
grep -v '[^a-z]' $WORDLIST | shuf --random-source=/dev/urandom | head -n5 | paste -sd ' '
grep -v '[^a-z]' $WORDLIST filters out words with apostrophes or other weirdness. On my system the filtered list is 77,866 words.
For four words, 77,866 ^ 4 ≈ 3.7 × 10^19 possible passphrases.
Compare that to randomly-generated passwords. I’ll assume that random lowercase & uppercase letters, numbers, and symbols add up to 46 characters. The number of combinations is 46^n where n is the length of the password. A four-word passphrase is the same order of magnitude as secure as a 12-character password, which has about 9 × 10^19 possible combinations.
I’m sure that if you make up your own passphrases instead of randomly generating them then the security is much lower.
Very similar heuristic here, insofar as when to use passphrases and how long.
LUKS and Bitlocker volumes get 8 words, computer logins usually get 4 words (potentially more depending on frequency/criticality of system).
Smartcards and mobile devices do have numeric pins due to frequency of use and relative difficulty in copying those for offline attacks.
Websites that are filled in w/ password manager get passwords get the random symbol-laden strings that ‘meet requirements’
correct horse battery staple?
I do use a password manager, and a lot of my passwords are automatically generated piles of random ASCII.
There are of course passwords I have to key manually a lot; especially the master key of my password database. I often use pass phrases for these. The ones I have to commit to memory, or even need to key manually reading with my eyes from my database, or in the case of my Wi-Fi passwords tell to other people, I make these fairly human readable/typeable. Trying to key lFqvC3]gI~l8p2V6TvTY&p in is a pain in the ass even in a font that renders that uppercase I and lowercase L as different glyphs. Something like corrEct_horse battery staPle, well I worked in an underscore and two capitals in something I can still touch type pretty effectively. Don’t use correct horse battery staple as a password; it’s burned.
