We’ve discussed how using passphrases as passwords can boost your security, but if you’ve chosen a phrase used in every-day speech, you’re not doing yourself—or your data—any favors. According to a new Cambridge study, a common phrase, like, say, “outofthepark,” is only marginally more secure than a dictionary word, and anyone looking to crack your password already knows to try common phrases along with common words. If you prefer passphrases, here’s how to make them more secure.
Full size
Why Common Passphrases Aren’t As Secure As You Think
The reason that many password systems won’t allow you to choose dictionary words as you passwords—or at least require you to add numbers, capitals, or special characters to those words—is because the first thing a hacker will do to try and guess a password is try every word in the dictionary to see if they can get in. Even swapping out “i” for “1″ or “e” for “3″ often isn’t enough—the fact that those tricks have been around for as long as they have means that those common substitutions are easily added to your dictionary list and included with the brute force attack. The goal of encouraging passphrases instead is to create credentials that are entirely nonsensical to a password cracking utility, but memorable to the human who needs to access a given system every day. Photo by Francis Storr.
The trouble though is that so many people, when they embrace passphrases, use common phrases from books, popular movies, memorable quotes, sports teams, or other proper nouns that are easily guessed. A group of researchers from Cambridge University recently published a study (PDF link) where they found that using a dictionary of these common phrases allowed them to crack open about 8,000 passphrases in Amazon’s old PayPhrase system. They conclude that passphrases as a password system ultimately provide less then 30 bits of security, which they note is too weak to withstand most online attacks. Ars Technica explains what this means in plain terms:
The “30 bits of security” means the chances of a single guess cracking a four-word passphrase would be one in 2^30. What’s more, the two-word phrases cracked in the study provided just 2^20.8 (or 20,656/0.0113) bits of security. Another way of expressing the same finding is that a dictionary of slightly less than 21,000 phrases is enough to guess the login credentials that slightly more than 1 percent of people in the real world will use.
Admittedly, 1 percent of phrases is a very small number, but it’s still cause for concern, and drives home the point: any security system, even if it’s well built and sufficiently complex, can easily fall prey to user-introduced patterns. In the end, the user—and their password—is almost always the weakest link.
Read the Full Story at LifeHacker.
