How can four random words be more secure than 16 random characters?
Hi, everyone. Leo Notenboom here for
Askleo.com.
Hey, if you're not subscribed to my weekly newsletter, Confident Computing
do so right now.
Every week you'll get answers like this,
tips, tricks, and more in your inbox every week.
Com newsletter to sign up.
Here's the question.
I keep hearing about past phrases and how
using four words, like correct horse battery staple,
can be just as secure, if not more so, than 16 random characters.
How's that possible if hackers need only
get four things right in order to get into my account instead of 16?
Well, the short answer is because there are
many, many, many more words than there are characters.
Now, at first blush,
that may not seem like it's enough, but honestly, it gets better.
Got to warn you, we're going to be talking about some really, really big numbers.
So let's talk about random characters first.
When we think about it, the number varies depending on a number of things.
But for the purposes of this discussion, we'll consider the usual set, right?
Upper and lowercase alphabetics, 0 to 9, and then say 10 special characters
like exclamation points or hashtags or any of that stuff.
What that means then is that you've got 72
possible characters to choose for each of the positions in a traditional password.
What that means then is if you do the math,
the number of possible combinations of all of those 72 characters
is essentially the 72 raised to the length of that password.
For example, if you've got a one character password, there are 72 possibilities.
If you've got a two character password,
then there are 72 times 72 possible combinations.
Three character password, 72 times 72 times 72, also known as 72 to the third.
At the eight character password, which is the...
It's not even the bare minimum anymore, it's below the bare minimum.
But an eight character password,
72 to the 2 to the eighth, 72 times itself eight times, gives you,
let's see, 722,204,136,308, 736 possible
combinations.
That's the last one where we can actually
start using reasonable English, approximately 722 trillion combinations.
For 12 character passwords,
in other words, 72 to the 12th, you end up with a number that is...
Let me see here, 3, 6, 9, 12, 15, 18, 21, 23 digits long.
It's 1.9 times 10 to the 22nd.
I have to use scientific notation
for this, mostly because that's the only way we can
really think about these really, really large numbers.
The good news here is that we really don't care about the numbers themselves.
What I'm going to care about is the order of magnitude.
What I want you to pay attention to in this example is that 10 to the 22nd.
That is the order of magnitude
of the number of possible different passwords you can get
using a 12 character password where you have 72 characters to choose from.
For 16, it is 5.2 times 10 to the 29th.
In other words, a significantly larger pool of possible passwords.
And for my favorite, 20 character passwords, it's 1.4 times 10 to the 37th.
So there's one followed by 37 zeros possible different combinations of a 20
character password where you're using 72 different characters.
Like I said, we'll talk about the orders of magnitudes here to compare.
10 to the 14th is less than 10 to the 29th, which is the comparison of
the eight character password to the 16 character password.
Why do we care so much about the possible combinations?
Well, when you think about it, that's what a brute force attack is all about.
A brute force attack literally tries every possible combination.
When I started with my facetious example
of a one character password where there were 72 possibilities,
you can imagine it's very easy to just try all 72 possibilities.
Same thing for a two character password.
You've got 72 times 72.
You could probably work through the few hundred different possibilities there are.
When it gets to an eight character
password, obviously, you and I are not going to do
that manually, but that's where technology comes in.
Eight character passwords can be attempted
in seconds, less than seconds, using a computer to do the work.
When you start looking at 12 characters,
it starts to take a few months worth of computer work.
When you look at 16 characters, it takes a few million years.
And when you take a look at 20 characters, it's a number larger than even I can
imagine in terms of the amount of time that it would take for computers.
And I'm not just talking about a computer,
I'm actually talking about a network of graphics processors,
and basically the best state of the art technology we have today.
It's going to take a really,
really long time based on the length of your password.
That's why I'm saying 12 characters,
honestly, a few months, they're not going to try.
Sixteen characters is going to future proof you as the technology gets better.
What takes a few million years today?
Yeah, okay, fine.
In a few years, it's probably only going to take a few thousand years,
but that's still plenty to keep you protected from a brute force attack.
Now, let's talk about random words instead of characters.
The issue with random words is we need to assume some number of words.
We need to know how many words there are available to be used.
And honestly, there's no real agreement on that.
It depends on exactly what you want to look at.
For example, my research came up with a few interesting numbers.
It is possible that there have been
a million words ever in the English language.
The Oxford English dictionary,
traditionally referred to as the largest dictionary of the English language,
and I mean that both in terms of content, but in terms of size, physical size.
It's a multi volume dictionary, if you've ever seen it in person.
600,000 words.
There are roughly, apparently,
170,000 words that are in use, in common use today.
And then we take a look at around 30,000 words in the average person's vocabulary.
We'll run with those last two numbers, 30,000 words in the average person's
vocabulary and maybe 170,000 words that are actually in use today.
A four word passphrase, then,
means that you would have, starting with 30,000,
30,000 possibilities for the first word, 30,000 possibilities for the second,
30,000 for the third, and 30,000 for the fourth.
In other words, 30,000 times 30,000 times
30,000 times 30,000, also known as 30,000 to the fourth, the number of words.
That is roughly 8.1 times 10 to the 17th.
If we use 170,000 words instead,
a four word random phrase gives us 10 to the 20th.
If we used a five word passphrase,
well, common vocabulary would give us roughly 10 to the 22nd.
All current words would give us something like 10 to the 26th.
Now, if you focus on just the orders of magnitude we've talked about here,
the numbers really don't look that impressive.
In fact, most of them are less than our standard for random characters.
10 to the 17th, 10 to the 20th, 10 to the 22nd, 10 to the 26th.
These are the numbers that we're getting by using the various combination of words.
Whereas with random characters, we were quickly at over 10 to the 22nd
possible passwords with just a 12 character password.
And unfortunately, it's at this comparison that most people stop.
But so far,
we've been comparing apples to oranges because we're overlooking something very,
very distinctive about multi word passwords.
And it's very simple.
What we haven't considered
with multiple word passwords is the fact that passwords are case sensitive.
In fact, they are sensitive not just to the words we use,
but perhaps even the characters we might put in between the words.
So yes,
if you use a password that is all lowercase with no separators,
correct horse battery staple, for example, with nothing in between, all lowercase,
then yes, a hacker that is testing only all
lowercase, no separators, will probably crack it in some number
of times if in fact they're even looking at trying to crack word combinations.
But the reality is that's not what we do.
Even the canonical example of correct
horse battery staple is usually capitalized and has spaces in between.
As soon as you start factoring
in upper and lowercase characters into the mix of multiple word phrases,
things get really, really big, really, really fast.
But unfortunately,
here's where it is really, really hard to quantify exactly what happens.
So let's make some really gross assumptions.
Let's assume that the average length of a word is five characters.
So what that means is
for every word you might use, there are a bunch of different
combinations of capitalization, each of which is unique, each of which,
as far as passwords are concerned, are a completely different word.
So for example, let's say that A, A, A, A, A, A, five characters was a word.
All lowercase is one word.
A, A, A, A, uppercase A is another word.
A, is another word. A, A, A, uppercase A, uppercase A is another word.
There are 32 possible variations of capitalization on a five character word.
Suddenly, our word list increases by a factor of 32.
Multiplying by a factor of 32, our list of the 30,000 commonly used words
or words in an average person's vocabulary suddenly becomes well over a million
and well larger than even the OED's list of words.
If we start doing the math, a four word passphrase would then result
in 10 to the 24th different possible passwords.
Five words would be 10 to the 29th,
putting it on a par with 16 character random passwords.
And that's not even factoring in inter word spacing.
All you really need to do
to make the easy to remember, easy to type, four or five word password
pass phrase as secure or even more secure than that
completely unmemorizable random character string is this.
Choose capitalization, perhaps a capitalization scheme of your
own making instead of using initial caps, maybe use trailing caps,
use the last character of every word or something like that.
Put a character between the words.
Maybe it's a space, maybe not.
Maybe use something else of your own thinking.
And maybe, just maybe, pull a word out of the archaic word list
that you might use in all your past phrases.
That right there is going to prevent
a hacker from using common word lists or even current word lists
to successfully try and crack anything that you're doing with a past phrase.
Now, I do have to throw in a quick aside.
Honestly, the real reason that multi word pass phrases are significantly more secure
than random character passwords is because they're typically longer.
Hackers are not actually trying to do brute force attempts
against multi word pass phrases because they're just too many combinations.
But it's still a really long password,
so even a traditional brute force attempt isn't going to work.
What will work is any other way your password gets exposed.
So if you fall for a phishing attempt, if you have a key logger on your machine,
or any other way that your actual unencrypted password can get compromised,
then yes, it doesn't matter how strong or how long your password is.
If somehow they can capture it as you're typing it or over your shoulder,
or by having you type it into a phishing page, the password has been given away.
But to protect yourself from brute force
attempts, multi word passwords are absolutely more
secure and bonus, so much easier to remember.
For updates, for comments,
for links related to this topic and more, visit
Askleo.com/158497.
I'm Leo Notenboom and this is
Askleo.com. Thanks for watching.