The Usability of Passwords


How to hack a password
  3. Brute force attack: Very simple to do. A hacker simply attempts to sign-in using different passwords one at the time. If you password is "sun", he will attempt to sign-in using "aaa, aab, aac, aad ... sul, sum, sun (MATCH)". The only thing that stops a brute force attack is higher complexity and longer passwords (which is why IT people want you to use just that).
  4. Common word attacks: A simple form of brute-force attacks, where the hacker attempt to sign-in using a list of common words. Instead of trying different combination of letters, the hacker tries different words e.g. "sum, summer, summit, sump, sun (MATCH)".
  5. Dictionary attacks: Same concept as common word attacks - the only difference is that the hacker now uses the full dictionary of words (there are about 500,000 words in the English language).

When is a password secure?

This means it takes the following time to hack a simple password like "sun":
  • Brute-force: 3 minutes
  • Common Word: 3 minutes
  • Dictionary: 1 hour 20 minutes
Note: "sun" has 17,576 possible character combinations. 3 letters using the lowercase alphabet = 263
  • 10 minutes - still far too risky
  • 1 hour - still not good enough
  • 1 month - this is something that only a dedicated attacker would do.
  • 1 year - now we are moving from practical risk to theoretical risk. If you are NASA or CIA then it is unacceptable. For the rest of us, well - you do not have that kind of enemies, nor is your company data that interesting.
  • 10 years - Now we are talking purely theoretical.
  • A lifetime: 100 years - this is really the limit for most people. Who cares about their password being hacked after they have died? Still it is nice to know that you use a password that is "secure for life"
But let's take a full swing at this. Let's look at "100 year - secure for life". It has good ring to it and it makes us feel safe. There is still the chance that the hacker gets lucky. That he accidently finds the right password after only 15 years instead of 100. It happens.
Let's step that up too and go for the full high-end security level. I want a password that takes1,000 years to crack- let's call this "secure forever". That ought to be good enough, right?

Making usable and secure passwords

Now that we have covered the basics, let's look at some real examples, and see just how usable we can make a password, while still being "secure forever".
Note: The examples below are based on 100 password request per second. The result is the approach that is the most effective way to hack that specific password - either being by the use of brute-force, common words or dictionary attacks.
First let's look at the common 6 character password - using different methods:

Does that mean that the IT-departments and security companies is right? Nope, it just means that a 6 character password isn't going to work. None can remember a password like "J4fS<2", which evidently mean that it will be written on a post-it note.
Like these:

It takes:
  • 1,163,859 years using a brute-force method
  • 2,537 years using a common word attack
  • 39,637,240 years using a dictionary attack
If you want to be insanely secure; simply choose uncommon words as your password - like:

A usable and secure password is then not a complex one. It is one that you can remember - a simple password using 3+ words.
It is not just about passwords

  2. Add a penalty period if a person has typed a wrong password more than - say - 10 times - of something like 1 hour. Again, this seriously disrupts the hacking script from working effectively.
A hacker can hack the password "alpine fun" in only 2 months if he is able to attack your server 100 times per second. But, with the penalty period and the 5 second delay, the same password can suddenly sustain an attack for 1,889 years.

Remember this the next time you are making web applications or discussing password policies.Passwords can be made both highly secure and user-friendly.

2011 Updated information available at

Nothing Else to Do...


UPDATES 8794393769864248210

Post a Comment

Please leave a comment


Follow Us


Hot in week