Pick something meaningful and memorable to you, but not so obvious that it's easy to guess.
Make each password unique by adding a variation at the beginning or end of your passphrase.
Seriously?
Let’s talk real password strength.
For so many years we’ve been led to believe all sorts of things about strong passwords.
Some people recommend lines from songs or quotes.
Your workplace wants you to use fourteen characters, with a complexity requirement of uppercase,
numbers, and punctuation.
Your friend insists on his voodoo way of taking letters from the names of his pets
mixed with their birthdays.
You’re just trying to sign up for some online account, and end up deciding on something
quick and easy.
I’m telling you, every single one of these methods is wrong, because they ignore the
single most fundamental principle of passwords. Let's get started.
First, let’s talk about how password strength is actually measured.
In information theory, randomness of data is called entropy, which is measured in bits.
In a coin toss, there’s two possible outcomes: heads and tails.
You only need to guess twice to cover all the possible results.
To get the entropy of a coin toss, we just take log base-two of the number of possibilities,
giving us one bit.
You can reverse this by raising two to the number of bits
to get the total number of outcomes.
So if I told you that the entropy of winning the lottery is twenty eight bits, that means
you have a one in two hundred sixty eight million chance of winning
or two to the twenty-eighth power.
In modern computing, a hundred twenty eight bits is the minimum strength for encryption
algorithms like AES.
For reference, the number of atoms in the universe is estimated at two to the two hundred
seventy two power.
With all that out of the way, let me show you how this applies to passwords.
So password strength is just its length multiplied by the entropy per symbol used.
A symbol could be a character, word, or emoji.
The entropy per symbol depends on the size of the set it comes from.
For example, a set of numbers zero through nine has three point three bits per symbol.
I need thirty-nine random numbers to achieve a hundred twenty eight bits of strength.
As you increase the set sizes to have more possibilities like ASCII or Unicode, the length
requirement decreases.
If you’re great at memorizing thirty nine random numbers, then you don’t need any
other symbols.
For most people though, memorizing a phrase of words is much easier, because you can mentally
associate between them.
I personally use this method since it’s easy to remember and fast for me to type.
It was popularized by an XKCD comic many years back and referred to as Diceware, since you
had to manually roll dice to select words from a dictionary of seven thousand plus words.
Now there may be times where you don’t need a hundred twenty eight bits of strength.
In that case just simply use fewer symbols in your password. A key thing to remember is
that passwords HAVE to be randomly generated.
Human psychology is actually quite predictable, so just pulling characters or phrases out
your head drastically reduces the password strength.
Modern cracking techniques have turned to analyzing social media, classic literature,
and Wikipedia to seed their attacks, along with your traditional mangling and padding
techniques.
If you think your current password’s strong, let me show you hashes.org. It's a community that
collects and cracks leaked password hashes.
We can go to cracking, left and found lists, and then download found passwords from any year.
Then you can decompress with 7zip to see what’s been recovered.
As you can see here, there’s a ton of passwords that seem to be strong but really are not
that strong. To sum it all up, it doesn’t really matter what you use for your password,
as long as it’s got enough entropy for your security appetite.
This means randomly generated and sufficiently long.
A shared wifi password?
Eighty bits works.
Master key for your password manager?
I’d do a hundred twenty eight.
By the way, I’d love to get into password managers today, but we’ll save that for
another episode.
If you found this video helpful, give it a thumbs up and share it with your friends!
Thanks so much for tuning in, don’t forget to subscribe for more content, and if you
have any questions please let me know.
See you soon!