How Long Should a Password Be?

[00:00:00]How long should a password be?

[00:00:07]Hi everyone, Leo Notenboom here for askleo.com.

[00:00:10]For a long time, the common thinking was the best, most practical password consisted of random combinations of upper and lowercase letters, numbers, and a special character or two.

[00:00:21]If so composed, the password length needed to be only 8 characters.

[00:00:26]Randomness remains important, but as it turns out, size matters more, much more.

[00:00:35]And 8 characters isn't enough these days.

[00:00:38]It's not even close.

[00:00:41]The short answer is that passwords should be longer.

[00:00:46]Longer is always better.

[00:00:49]Here's what I mean by that.

[00:00:51]Traditional 8-character passwords, They're getting compromised easily these days, and I'll talk about that more in a minute.

[00:00:57]16 characters at a minimum.

[00:01:00]Now, ideally more. I use 20.

[00:01:04]A multi-word passphrase makes longer passwords easier to remember, of course.

[00:01:09]And if you use a password vault, you can make all of these really good security decisions easy.

[00:01:19]When you hear about lots of accounts being stolen by a hacker from a service provider, you're naturally concerned that the hacker might now have access to your account username and password.

[00:01:30]If the service stored your actual passwords, well, that could be the case.

[00:01:35]If the service is storing your actual password, be clear, they don't understand security or they have made some horrifically bad decisions.

[00:01:45]In fact, most services store an encrypted, technically a hashed form of your password.

[00:01:52]For example, if my password were password, and of course, that's a really bad password, then the service might store something like what you see here on the screen, this really long stored hash.

[00:02:05]That's a hash value that corresponds to the password.

[00:02:09]Hackers do not get a list of usernames and passwords.

[00:02:12]They get a list of usernames and password hashes.

[00:02:16]And what's great about password hashes is that you can calculate a hash from a password, but you cannot calculate the password from the hash.

[00:02:25]As a result, one would think that if a password is hashed, it's pretty unhackable, right?

[00:02:31]Sadly, not so much.

[00:02:34]The most common type of password attack is simply a high-speed guessing game.

[00:02:38]This doesn't work on a login page.

[00:02:40]They're slow and they deny further access after too many failed attempts.

[00:02:44]But it works wonderfully if the hacker has the entire stolen database of usernames and passwords sitting on their computer.

[00:02:52]Those attacks start with exhaustive lists of possible passwords.

[00:02:56]Common simple passwords, common combinations of words, common obfuscations of words.

[00:03:04]For example, instead of password, maybe mixed case password or password with 4 and 0 instead of A and O. You get the idea.

[00:03:13]Lists of all variations people think will hide their passwords.

[00:03:18]Lists of all previously discovered passwords.

[00:03:22]This might actually be the most successful because people so routinely reuse passwords across multiple sites.

[00:03:30]They calculate the hash of each guess,, and if it matches what was found in the database of account information they stole, they know they've got a match.

[00:03:38]They have figured out the password for that account.

[00:03:41]It's easy for hackers to make an amazing number of guesses, millions and millions of guesses in short amount of time.

[00:03:48]That's why you're not using a short password or common obfuscations, right?

[00:03:53]That's why a password created from totally random combinations of characters is best.

[00:03:59]It forces the hackers to move on to a true brute force attack of every possible combination in order to gain access.

[00:04:08]Now, computers are fast.

[00:04:10]In fact, the computer on your desk is so fast, its ability to do operations is measured in terms of billions of operations per second.

[00:04:18]Creating a password hash is not a simple operation on purpose.

[00:04:22]However, it is still something that could be done very quickly on most computers.

[00:04:27]Spread the work over many machines, perhaps a botnet, and the amount of processing power that can be thrown at password cracking is amazing.

[00:04:36]The net impact is that it is now feasible to calculate the encrypted hash values for all possible 8-character passwords comprised of upper and lowercase alphabetic characters, digits, and special characters.

[00:04:50]72 possible characters.

[00:04:52]26 uppercase, 26 lowercase, 10 digits, and say 10 different special characters in each of the right position equals 72 to the 8th, or over 722 trillion combinations.

[00:05:06]Now, that may seem like a lot until you realize that an offline attack, which is easily performed once you've stolen a database of usernames and encrypted passwords, could be completed in a few hours.

[00:05:17]This assumes technology that can guess something like 10 billion passwords per second, which is very, very possible.

[00:05:24]Doesn't matter what it is.

[00:05:26]If your password is 8 characters long, the hackers already have it, even if it was well hashed by the service they stole it from.

[00:05:34]Now, as we've seen, 8-character passwords give you over 722 trillion combinations, which can be guessed in an offline brute force attack in hours.

[00:05:45]16 characters gives you over 521 octillion The offline brute force guessing time in this case would be measured in centuries.

[00:05:56]20 characters?

[00:05:57]Well, that's 14 undecillion.

[00:06:01]I had to look up that number.

[00:06:03]That's why 20 is better than 16, and both are better than 8, or even my previous recommendation of 12.

[00:06:10]Every time I update this video, those numbers keep getting bigger.

[00:06:15]Now, what about special characters?

[00:06:18]I usually leave out special characters from my password unless the system I'm using that password on requires them.

[00:06:25]Here's the deal.

[00:06:26]Instead of 72 raised to the power of the password length, it's 62, upper and lowercase plus digits.

[00:06:35]So we run those numbers.

[00:06:37]A 16-character password has 47 octillion combinations.

[00:06:42]A 20-character password has 704 dekillion combinations.

[00:06:48]So to begin with, those numbers all by themselves, they're fine.

[00:06:53]However, adding even a single non-special character gets you more additional combinations than it would had you used special characters.

[00:07:05]A 16-character random password with special characters is 72 to the 16th.

[00:07:11]A 17-character random password with no special characters is 62 to the 17th.

[00:07:17]If you compare the numbers, which you'll actually see printed out in the companion article for this video, 62 to the 17th is 5 times larger than 72 to the 16th.

[00:07:33]Yep, using special characters makes your password better.

[00:07:37]But significantly better yet is just to add one more character or two or six.

[00:07:45]Long passwords are good, but passphrases are better.

[00:07:49]What's the difference?

[00:07:50]Well, in general, a password is a random string of characters.

[00:07:54]A passphrase is a longer string of words.

[00:07:58]Passphrases are easier to remember, so it's easier to make long ones.

[00:08:02]As we saw, Password length is the single easiest way to increase the security of passwords.

[00:08:08]You may have a nice, secure, 20-character random password that's difficult to remember.

[00:08:14]In fact, the only way to use this is with a password manager that remembers it for you.

[00:08:20]On the other hand, a passphrase like its fleece was white as you know nothing, Jon Snow, at 50 characters is wonderfully long, secure, and most of all, memorable.

[00:08:32]Much like the now canonical example of correct horse battery staple, 29 characters, you might even have a difficult time forgetting it.

[00:08:41]The biggest problem with passphrases, many services that use passwords don't allow spaces or such lengthy passwords.

[00:08:49]What about quantum computing?

[00:08:51]Of late, quantum computing has entered the discussion for sure.

[00:08:55]The concern is that its capabilities are supposed to be such that, well, No password is safe.

[00:09:00]That's not quite true.

[00:09:02]Two things keep me from worrying about it.

[00:09:05]First, while we've certainly heard the hype and the promise of quantum computing, it's still a long way off.

[00:09:12]Hackers aren't getting access to it anytime soon.

[00:09:15]And while corporations and nation-states will probably have initial access, you'd have to be targeted for them to even care about your passwords or the accounts you have.

[00:09:24]We're talking many years before any of this becomes commonplace.

[00:09:29]And even so, second, we're already seeing the development and deployment of quantum-resistant encryption algorithms.

[00:09:38]While there's certainly no way to tell what's being used to hash your password, a form of encryption after all, it's likely that some passwords are already being stored in a quantum-resistant form.

[00:09:50]As I said, it's just not something I worry about today.

[00:09:55]Shouldn't services fix this and do better?

[00:09:58]Of course they should, and many do.

[00:10:01]But passwords shouldn't be kept in plain text anywhere by the services at all, and yet some still do.

[00:10:08]There are techniques that make brute force attacks significantly harder, yet many services use techniques that are easier than the examples I've shared above.

[00:10:18]Some services do a great job of keeping your information secure.

[00:10:22]Some services don't.

[00:10:24]The problem?

[00:10:26]You can't be certain which is which.

[00:10:29]To be safe, you have to act like they're all at risk.

[00:10:34]So the bottom line for staying safe is pretty simple.

[00:10:37]Don't trust that the services you use handle passwords properly.

[00:10:42]Well, many, even most of them probably do, it's become painfully clear that many do not, and you won't know which kind you're dealing with until it's too late.

[00:10:53]Use longer passwords, 16 characters at a minimum and 20 if possible.

[00:10:58]Use even longer passphrases when they're supported or where the information is particularly sensitive.

[00:11:05]Always use a different password for each site login that you have.

[00:11:10]That way, even if a password is compromised on one service, it won't give the hackers access to everything else.

[00:11:19]Even the best 8-character password should no longer be considered secure.

[00:11:23]12 is barely good enough for now, and you should be moving on to 16 or even more for the long run.

[00:11:31]For updates, for comments, and for links to related topics, visit askleo.com/4844.

[00:11:40]I'm Leo Notenboom, and this is askleo.com Thanks for watching.