Your six strongest practical password techniques ranked.
Hi, everyone. Leo Notenboom here for Askleo.com,
where we've been dealing with passwords and password protection and strong
passwords and complex passwords and all that kind of stuff since 2003.
So it's funny.
As I was preparing for this article,
I realized that I remember a password from, I'll say, 1976.
That's when I first started computing, when I was first introduced
to a mainframe. Actually that is where I learned to compute for the first time.
And that's where I fell in love with computing.
And, you know, the rest, as they say, is history.
The password, "iforgot".
Lower case.
Now, that's a horrible password,
don't use that password, I'll use it in a variation a little bit,
but don't use that password because it's like I said, Horrid,
the reason it was acceptable at the time is that it was public.
The terminal that we were using to get some status information,
if I remember correctly, required a username and password.
I don't remember the username,
but the password was literally on a sticky note on the side of the terminal
for everybody to see because they had to type it in.
If there was an option to not have
a password, that would have been sufficient.
There was zero security.
You want something better than that!
You want something a lot better than that.
So what I want to do is go through six different approaches or six approaches
to passwords from what I consider to be the strongest to the weakest.
And and yet still have them be pragmatic, practical solutions that you can actually
use in some cases that you should actually use.
Now, there are a couple of criteria.
I want to make sure that the passwords we generate, the passwords we use
are sufficiently, I'll call it, resistant to brute force
"Try every password" attack. depending on the password you choose
many are in fact vulnerable to
programs that simply literally try every possible password.
We don't want to be vulnerable that way.
The passwords must also have what I will
call an extremely high probability of being, unguessable.
There are a couple of approaches to doing that.
And of course, the passwords must be
extremely unlikely to have ever been used before.
That's a hard one to get our brains around, because it seems like almost
anything we could come up with might have been used before.
There's no absolutes, there never are,
but we want the probability to be extremely high
that every password that we use will be the first time and the only time
that that password will ever have been used.
And that's kind of icing on the cake.
It'd be nice in some cases if we could memorize the passwords.
As we'll see, that's not going to work for all of them.
But there are some techniques that might
allow us to remember some of our more important passwords that are used at times
where perhaps the only thing we can do is remember them.
And I also want to be clear that I'm ruling out some of the more esoteric
approaches, there are a gazillion ways to generate passwords.
Don't get me wrong, many of them are good,
but some of them are so extremely esoteric as to be, well, impractical.
And one of the things I want to focus on is, of course, pragmatism.
I want them to be things that we can actually do.
Now, I'm going to assume that we're not using two factor authentication.
We should be using a two factor authentication.
Don't get me wrong, I heartily recommend two factor authentication.
But the best way to evaluate
passwords or password approaches is to consider them on their own to not
have any other kind of safety net,
if you will, that might be coloring our decision if we pick a password,
that it is as secure as possible without Two-Factor authentication,
then we only make life more secure by adding two factor authentication.
One of the concerns I have about
Two-Factor, to the extent that there's a concern at all, is that it might tempt
some people to use less than secure passwords.
Not a good idea, but I'm only going to focus here on passwords.
I'm also going to assume you will never, ever, ever use the same password twice.
You will never use it for two different services, you will never use it
for a service and a PC, you will never reuse passwords.
It is clear from a lot of evidence that reusing passwords is one of the most
dangerous things you can do when it comes to your security.
So don't do that.
And I'm also going to assume you're using
a password vault of some sort. Not only do vaults make some of these
password generation techniques easy, they make them possible.
They make the result possible because you
and I, we're not going to remember, for example, this very first most secure
approach. We'll never remember that we're going to need help.
And that help comes in the form of a password vault.
Use one, please.
It enables better security.
So with that, what's our number one
strongest password approach in a short, long, random characters?
For example, as you can see on the screen,
there is a 20 character password with completely random letters and numbers
and special characters that is extremely, extremely secure.
For example, when it comes to brute force,
the amount of time that it would take to crack this strong of a password
generally doesn't even show up on comparison charts.
It is almost literally off the charts.
It is not something that's going to take a reasonable amount of time.
The last chart that I looked at topped out at a password of this form.
Long random characters topped out at 14.
So you had 14 characters that were completely random
that would take nine hundred and sixty eight centuries to crack using a large
distributed system that it's not like there would be one or two computers
working in a corner for that length of time.
This is for a large distributed system
pragmatically that ain't going to get cracked.
My choice of 20 is both future proofing because of course
in 10 years computers are going to be more powerful.
They're not going to be that much more powerful, but.
I just like 20, I do it in part because I can.
Number two, will surprise people long, multiple random words.
We all remember that correct horse battery
staple from the CD comic, that's a great pass phrase,
nobody should ever use it because it is in so many people's memory already.
But it's a great example of how easily
memorable something long and strong could be.
So here's another example again on the screen, although this one I could
read out to you because it is just five words "drying karen ruth afoot sauce"
There's no rhyme or reason between how
those words fit together, other than, yeah, there's five words that happened
to fit together, you could build some kind of a memory palace or story that would
allow you to remember those five words in sequence.
It's an example of a twenty nine character
password created out of five random choices.
It's actually one of those things that would take 14 years to crack
on that distributed system that seems actually pretty darn secure.
And it's a great solution for passwords that you must remember.
I use a slightly less secure variation, but it's great for those passwords
that are things that you are likely to have to type in.
They are passwords that you might have
to use when your password vault is not available to paste things in for you.
Now, my slightly less secure variation,
I'll call this option number 2A is a long, multi word mangled phrase.
We all have memorable phrases.
We all know of things that that just flow.
The one that I've used in my example here,
"Obi-Wan you’re my only soap" is a mangle of a phrase common in pop culture.
Anybody that's watched the first Star Wars movie knows its Obi Wan Kenobi.
You're my only hope.
But what I've done is I've dropped a word
and I've exchanged one word with a sound alike.
It's a great way to have something that is both memorable and long and strong.
I use this technique, as I said,
for passwords that I actually need to remember.
I have a specific phrase in mind and I've
got a couple of algorithms, I'll call them, that allow me to modify them.
So I'm never using the same password twice.
Number three, medium length words with padding.
This one also surprises people, the passwords you'll see on the screen,
breakfast pancakes surrounded by some characters, seems, it feels insecure.
It feels less than secure.
And yet it is a nice, long password that is long enough to never
be brute force and extremely obtuse enough.
I'll call it obtuse, convoluted enough that nobody's going to guess it right.
Nobody's going to guess necessarily
the two words that you happen to choose and nobody's going to guess the pattern or
sequence or how you've padded it out at either end.
The padding string is totally up to you
and is part of what I believe makes this a very secure option.
You can choose the same padding string everywhere.
The only thing you need to change,
of course, is the words you would use inside.
That makes for a nice, long, strong, secure password.
Number four on my list, medium length, random characters.
So it's the number one technique, only shorter.
We've seen that 14 characters is where
a lot of the calculators and tables of password strength happen to top out.
So I'm going to say something less than that.
The example on your screen is only 10 characters in length.
It is a good password that would take something like nine years to crack, but.
It's not going to be guessable, it's not going to be trackable,
and it's something that leaves you quite, quite secure.
The variation that I tend to recommend
these days is 12, because once again, you've future proofed
yourself to a sufficiently safe degree by going a little bit longer.
But these are the length of passwords
that I wouldn't necessarily go any shorter than now.
Number five is shorter with padding here,
I've combined something that is both short and perhaps simple and memorable.
Once again, with padding of your own choice.
The pattern can be consistent.
It can be algorithmic, it can be whatever makes sense.
That is easy for you to remember. And in this case,
the example password that I've used, I forgot is also itself easy to remember.
The hardest part about this one is
probably choosing something that's different for every account.
I would use something this short only
in cases where I either needed to remember a short password and a short password.
A length of limitation was in place that didn't allow me to go any bigger.
So this is another one of those things that length matters more than complexity.
This password doesn't look very complex, and yet it is sufficiently random
and unique and long enough to be fairly secure.
Number six, shorter random characters.
We have still encountered systems
that won't let you have passwords longer than eight characters.
That's bad.
Any eight character password can be guessed.
A single computer can literally calculate
every eight character password in a pretty reasonable amount of time.
So.
The best we can do if we're faced with an eight character limitation is
to use the strongest algorithm we know of and it in eight characters,
the strongest algorithm we know of is completely random characters.
In other words, it's option number one, slice down to eight characters.
It's the best you can do if you're faced with that eight character limitation.
This is the best you can do.
And I wouldn't recommend any variation other than this.
And in fact, depending on the service you're using, if it really is something
secure after complaining, I'd seriously consider using a different
service because clearly they don't get security and the state of security today.
All of this can sound intimidating.
These really long passwords, even the five word passwords
that supposedly would be easy to remember aren't going to be easy to remember
for everybody, at least not without compromising their randomness.
So I continue to beat the drum about using a password vault.
A password vault makes it possible,
in fact, easy to use the most secure password selection algorithm every time.
And it also makes it trivial
to ensure that you're using a different, extremely secure password on every site.
Those two things by themselves are more than enough reason that you should be
using a password vault along with all of these really secure
passwords to maintain your account and online security.
And of course, now that we've talked about passwords,
consider adding two factor authentication as well.
That way you'll be even more secure.
For links, related articles, for updates,
for comments and more, visit askleo.com/32876.
I'm Leo Notenboom.
This is Askleo.com.Thanks for watching.