{"id":8525,"date":"2018-08-21T12:00:51","date_gmt":"2018-08-21T19:00:51","guid":{"rendered":"https:\/\/www.privateinternetaccess.com\/blog\/?p=8525"},"modified":"2024-01-23T23:15:37","modified_gmt":"2024-01-24T07:15:37","slug":"how-to-improve-your-security-with-better-passwords","status":"publish","type":"post","link":"https:\/\/www.privateinternetaccess.com\/blog\/how-to-improve-your-security-with-better-passwords\/","title":{"rendered":"How to improve your security with better passwords"},"content":{"rendered":"

Passwords are one of the easiest (and first) ways to fail. We\u2019re always told to have secure password but not told how to make one or why. It might shock you to know the two most common passwords are \u2018123456\u2019 and \u2018password\u2019. This is because most people forget to change from the default password supplied with their new device.<\/p>\n

Password security can always<\/strong> be broken. Always<\/strong>. It simply depends how long and how much effort it would take. For example, most people\u2019s router username and password is still admin\/password. That would take about 4 seconds to enter and next to no effort.<\/p>\n

A lot of websites opt for the recommended NIST system<\/a> of requiring 8 characters with at least one uppercase, at least one lowercase, at least one number and at least one special character. Using this system, it would mean a password would look something like \u2018Pas$w0rd\u2019. This is still not secure. As stated earlier, passwords will always be broken. They are often broken through either guessing (social engineering), malware (keylogging) or brute force.<\/p>\n

There are 6.63 quadrillion different possible 8 character passwords and at the Passwords^12 convention in 2012, Jeremi Gosney demonstrated a machine<\/a> that broke all 6.63 quadrillion passwords in 5.5 hours. That equates to 350 billion password guesses per second. And this was in 2012<\/em>\u2026<\/p>\n

Password strength is called password entropy and entropy is based on the character set used (uppercase, lowercase, numbers and symbols) as well as length. Password entropy predicts how hard a password is to crack using guesses, brute force methods, dictionary attacks or other methods.<\/p>\n

If a password uses numbers (0-9), uppercase (A-Z), lowercase (a-z) and special characters (!\u201d\u00a3 etc), there are 95 possible choices for a one character password. If the password is two characters long there are 9025 possible choices and for three characters there are 857375 possible choices (and so on with the equation being expressed as 95^n\u00a0<\/em><\/strong>(with n being the number of characters in the password)).<\/p>\n

As a species, humans make terrible choices for passwords. Even if a person chooses a \u2018random\u2019 password, we have bias towards certain letters and numbers. This is called letter frequency and can easily be seen in the game Scrabble. There are more letter E (12) then Q (1). Nobody wants to get the Q or the Z. In addition humans are notoriously bad at remembering random strings of letters and numbers, so we either write it down (which is a very bad idea for a password) or we make it easy to remember.<\/p>\n