Do random words make better passwords?
Hi Everyone.
Leo Notenboom here for askleo.com.
If you're not getting my weekly Confident
Computing newsletter in your inbox every week, be sure and visit
askleo.com/newsletter and sign up today.
Each week you'll get new answers, opinions, recommendations, and more.
That's askleo.com/newsletter.
to sign up.
I ran across an article in a UK security publication that talks about using three
random words as being a better approach to traditional passwords.
Now by traditional passwords.
I mean, whatever it is you're currently using all the way to the extreme of
the long, strong, completely random character style passwords.
When we talk about what makes a good
password, there are a couple of things that really need to factor in one of them,
of course, is how difficult is it to brute force a password?
In other words, how difficult is it to just whack away
at every every possible password for a given scheme and break your way in?
That's where, of course, length matters most.
Let's take a look at a couple of different approaches to passwords and
what the numbers really are, how many different possibilities there
might be when we talk about random characters, the most traditional type
of random password most people talk about what we're talking about is having a fixed
length string of 12, 16 or, in my case, I default to 20 characters long
where each character has no relationship to the characters before or after it.
Each character is one of a to Z,
upper and lower case, zero to nine digits, and then, of course, probably about ten.
I'll just call them special characters.
When you do that, you end up with each character having 72 possibilities.
At one extreme, a one character password would have 72 possibilities.
A two character password would have 5184 different possibilities.
As you can imagine, that's pretty easy to test.
You could try all 5184 pretty quickly.
That's where length starts to come in.
When we look at a eight character password, all of a sudden we're talking
722,000,000,000,000 different possibility abilities.
That seems like a lot, but with current technology that's
actually within the realm of a fast computer or a network of fast computers
to literally just try every combination, every possible combination.
That's one of the reasons we talk about length being so incredibly important.
Twelve or 16 characters takes us two numbers that are so incredibly large.
The number of possibilities are so incredibly large that it becomes
unfeasible for computers, even a network of computers to be able
to brute force or try every possible combination.
How does that compare, though, with using random words?
Well, while we've been able to look at 72
as the number of possible characters in each position,
when we talk about random words, we're talking about the English language.
In my example, how many words are there that one might
choose from now, the Oxford English Dictionary tells us
that there are 1700 different words in the English language?
No, and I don't use all 170,000 words.
In fact, if we were to just dream up a random password of three words,
there's a very good possibility we would be selecting from a collection
of vocabulary significantly smaller than that.
They actually suggest that the average
person knows somewhere between 15 and 20,000 words in a common vocabulary.
I'm going to use 10,000 as our number.
10,000 words is a pretty reasonable number number to think of.
When we're just pulling words out
of the air, we're not going to pull them out of the fringes of our vocabulary.
We're going to be using the more common words that we use day to day.
So with 10,000 as that number,
all of a sudden, the combinations get interesting.
A one word password.
Ten possibilities.
A two word password has 100 million possibilities. When we get to three words.
Well, all of a sudden, we're at 1 trillion.
Now we're starting to get close to.
But as it turns out,
not the same as that eight character, completely random password.
Remember, that was over 700 trillion or
three word password has only 1 trillion combinations.
That's not looking too good when we get up to longer combinations of words,
of course, four words, five words and six words.
Then all of a sudden we are talking some very, very large numbers.
That makes the brute force approach well, significantly less practical.
But even so, our six word password has
fewer possible combinations than our 16 character random password.
Doesn't that mean that random words are worse?
Well, not really, because there's more to passwords than
brute force, and there's more to random words than just the words.
We're actually comparing apples and oranges.
Here, when we use random words as
a password, we actually are using more than the random words.
We have the option of putting something
in between them changing their capitalization and so forth.
Most of the time, when we use random words as passwords, we're adding a space between
the words, maybe capitalizing things and so forth.
So that already increases the number of possible word in nations.
Well, the word combinations haven't
changed, but the things that a hacker might actually have to test in order
to try all those word combinations has increased dramatically because now they
have to include, well, do I try them with or without the space?
Do I try them capitalized or not?
Do I try them without a space and capitalized?
Do I try them with some other separator in between?
As you can see, it's way more complex than you might imagine.
And it does mean that the combinatorics of three possible words under represent
the number of actual passwords that a hacker would have to try
because of all these other issues, spacing, capitalizations and so forth.
But even if the number of combinations
that a hacker would have to try, brute force is less than the equivalent or
a reasonable choice in the random character password.
I'm going to say that random words are still better.
First, we have to realize
that the majority of hacks, the majority of password exposures are not
done by brute force, as many people remind me every time I talk about brute forcing,
how can they do that if they immediately lock you out of logging in?
If you get your wrong password three times in a row?
Of course, that's not how brute force password hacking is done.
It's actually done on captured databases
of password information and then done offline as fast as they like.
That happens.
It's just not very often.
Yes, there are lots of breaches,
but a lot of breaches include the hashed password information in such a way
that the hackers actually don't know how to brute force those passwords.
They don't know what the algorithm to be used should be.
So brute forcing isn't really as important a characteristic of password qualities.
You might think what is more important are
things like our ability to actually use them.
I'll even go one step further our willingness to actually use them.
Now, as much as I might want everybody to always use a password vault,
which makes using, in my case, 20 character, completely random passwords.
Easy, trivial, not something you ever have to think about.
Not everybody remains convinced that password vaults are the way to go.
They need something that's easier to remember.
A three random word password is a great alternative for people that need something
with more pneumonic value than random characters.
As we've all seen, correct horse battery staple.
That famous now four word password,
that you should never use, by the way, is something we all remember.
I didn't have to look it up.
We saw it, we laughed at it, we understood it, and we remembered it.
That same kind of technique,
even with only three words, can make for an incredibly valuable
approach to choosing your own passwords in a way that makes sense to you.
Now, granted, you should be using a password vault
security experts up and down recommend that password vaults are one thing you
could do to significantly increase your security.
But even so, you're going to have passwords,
including the one for the vault itself, that you're going to need to remember.
Multiple random words, maybe with your own unique choices.
Separator are a great way to go to keep things both long and complex in the sense
that these are random combinations of words.
And by the way, I did mention length.
We now advise you to use twelve characters or more.
It's difficult to pick a three word
password that isn't already much longer than that.
So random words are something to consider.
I'm not saying that you should immediately
convert to using three or four or more random words.
This is up to you.
What I want you to do are choose
techniques that make sense to you that have value to you.
Of course, I want you to use a password vault.
But even if you don't having this random word approach, be validated as a very
valid approach to choosing a password is another tool in your Arsenal.
Now, the article on which this video is based is that as Leo come the 738,
there you'll find the not only the usual updates, related links, comments and more.
But I've expanded on some of the math
behind some of the combinatorics I talked on earlier in this video.
I actually go through the very long
numbers that you get when you take 20 random characters or three or four or six
random words and allow you to compare those apples to apples.
That article also has a link to the article
by the National Cybersecurity Center at the UK that actually spurred this
little thought exercise and links to random password generators that will do
well, whatever you like, be at random characters or random words.
Again, that's askleo.com/137138.
I'm Leo Notenboom.
This is askleo.com.