Passwords.
They protect so much of our stuff, from our email, to our banking…
...to the bikes of our coworkers.
And yet... ...our most common passwords are still things
like qwerty or 12345678, or password, or...
Pathetic. Her birthday.
Oh, you know my birthday!
Wait, are you stealing my bike?
I’m illustrating a point.
Ugh.
There are two main problems with passwords.
And you didn’t have to steal my bike to illustrate either of them.
First.
They need to be long
Like, really long
Even if I didn’t know your birthday, I could have opened your bike lock using brute force.
No you couldn’t.
“Brute force” just means cycling through all the possibilities until you find the combination that works.
Oh right, like, nerd brute forcing.
Now your idiot lock was only four characters long, and each of those characters can be one of ten possibilities
so ten to the power of four which
means that there's just thousand options for me to cycle through.
Since when can you do maths?
Since always.
And if I can do four tries per second, then the time it takes me to cycle through all of those options will just be
Forty one minutes! Ben that's forty one minutes.
Forty one minutes, of course.
But computers that hack online passwords can try 350 billion options per second.
Which is why good passwords need to be two things: long and random.
Now, no-one’s gonna guess that.
It’s not your kid’s name - I hope…
Yaaaaaay!
Dad can I get it!?
No.
A long, random password is also virtually impossible for a computer to brute force.
a computer making 350 billion attempts a second would still take billions upon billions of
years to get close to cracking it.
How many years, precisely?
Um...uhhh
It really is a great read for young and old!
You don’t even need to be a mathematician to enjoy it!
It’s a really long time.
Alright so hackers can’t guess that password.
But I can’t remember it.
Well yes, that is a problem.
But you could remember a passphrase.
Passphrase?
Yeah remember how we said that good passwords are two things?
Long and random.
Right! So what if you took four totally random words, put them together and used them as
a passphrase?
what - like...Dapper Trombone Minotaur Accountant?
Sure, but I said totally random, that’s just describing Clive...
Hello!
Hi Clive.
Now. A long, random passphrase like this is also virtually impossible for a computer to brute force,
but it's easy for you to remember.
I guess if I only have to remember one weird passphrase ...
You’re not going to like problem two.
You should never re-use password anywhere.
I don’t do that.
Well it's pretty common.
over 80 percent of us do.
And no wonder.
On average, each person has about 27 online logins that need a password.
So when we find a strong one we can remember, we tend to just reuse it.
So?
So, say that you use a password for something big and important like your gmail account...
...you can be pretty sure that Google throws a lot of resources at cyber-security, keeping that password safe.
But if you reuse that same password at somewhere like
Clive’s Jazz and Accountancy Forums, well…
...Clive doesn’t have the same resources to throw at security.
And if somebody steals that password from Clive and it’s the same as your gmail password....
…I get it.
So you’re saying I need to remember 27 different passphrases?!
Well, it depends how secure you want to be.
But if the idea of remembering dozens of strong passphrases doesn’t appeal to you, you could always use
a password manager.
A password manager is a piece of software that's for your computer and mobile devices
and it costs between nothing and a couple of bucks a month.
Now what it does is it generates those long and complicated passwords for all of
your accounts and then stores them behind one master password.
So that way the only password you ever need to remember is the password to your password manager!
Ok you just said password a lot of times just now
Ok let's try something else.
Think of a password manager like a strict but magical governess.
(singing) For a spoonful of prudence makes the internet secure!
Hello, I'm Mary Passwords.
Yeah you are.
Mary here generates new, more secure passwords for all of your online accounts.
How long would that take to set up?
Quite a while and it's a bit of a pain in the arse.
But once she's done, she’ll put all those new passwords into her magic password bag…
which you will then lock with your own really strong password.
Probably a four word random passphrase.
Go on, think of one.
Isn’t that just Clive?
Something else!
Great! Let’s take it for a spin!
Let’s say you need to log in to your online banking...
Mary Passwords! A delight as always.
And you young man, would you like to make a withdrawal?
I’ll need to hear your password.
So you just need to give your master password to Mary Passwords.
Supercali-upper-case Y-B-9-4-G-M-K-Q!
Wonderful!
So now you have… a bunch of long, unique passwords
all stored in one place and available across all your devices.
Wait.
Didn’t you just tell me, like two minutes ago, that I shouldn’t have one password for all my accounts!?
I did hear you say that
How is this any different?!
Ok look
This isn’t reusing the same password, this is storing a
bunch of different passwords in one very secure place.
Yeah but won’t hackers try to hack my password manager?
Oh almost constantly!
Hiiiiiiyah!!
In fact, hackers have breached the security of password managers before.
There’s no evidence that passwords themselves were accessed, but in some instances the companies
companies warned their customers to change all their logins.
That’s still not ideal.
No, but you know a lot of tech writers seem to think it’s a risk worth taking in exchange for
unique, strong passwords across the board.
Alright, let’s go try a fight.
I’d like to go home now please?
Okay.
Can I please have my bike back?
Yes, and now it will be safe!
From you.
Look the point is it'll be safe.
Am I stuck with Mary Passwords now?
Don't slouch now children!
Well, look.
If you only take one thing away from all of this it should be that you need
long, random and unique passwords for all of your important logins
And if you have so few of those that you think you can remember them, then go for it
But if you do decide to get a password manager, make sure you do your research.
Sites like Wired and PCMag and Choice all offer in-depth reviews about password managers.
But make sure that those reviews are current.
Wait a second, the reviews for Mary Passwords on this are terrible!
Super-cali-fragalistic-expi-ali-SEE YA!!!!!
[sad trombone sound]
Not now, Clive.