# Do longer, more complex passwords actually increase the incidence of breaches? **URL:** \ **Category:** Factual Questions\ **Created:** [January 31, 2015, 4:53pm UTC](https://boards.straightdope.com/t/do-longer-more-complex-passwords-actually-increase-the-incidence-of-breaches/711439 "2015-01-31T16:53:09Z")\ **Posts on this page:** 10\ **Page:** 3
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [February 2, 2015, 2:47pm UTC](https://boards.straightdope.com/t/do-longer-more-complex-passwords-actually-increase-the-incidence-of-breaches/711439/41 "2015-02-02T14:47:52Z")
> [@](#): > > Quoth **lazybratsche** : > > 1. Set up two-factor authentication for really critical accounts - e.g. if you log into your email or bank account from an unknown computer, you’ll need to provide something like a code texted to your phone. One caveat: Don’t do this if your phone is not set up to be able to receive texts. Yes, I know, that sounds too obvious to mention, but it happened to my uncle this past weekend. > [@](#): > > 1. For the master password on your password manager and any others you wish to remember, use a string of random words as a passphrase. This is far easier for our chattering monkey brains to memorize than 16 random characters. Again, a caveat: Use _random_ words. A sentence is not random words. Even a nonsense sentence is not random words. Try flipping open a dictionary to a random page, then close your eyes and poke at the page, and pick whichever word you’re touching (and not the nicer-sounding word right next to it, because that’s also not random), and repeat about five times. Actually, that’s _still_ not as random as it should be, because you’re more likely to flip to a page in the middle of the dictionary. > [@](#): > > Quoth **Habeed** : > > What would be cheaper for a large IT endeavor - paying several people to perpetually reset passwords, etc, or buying dedicated hardware to store the hashes on that can’t be cracked. The former, by a very large margin. The only practical way to make something that can’t be cracked is to prevent it from communicating with the outside world at all, and that’s useless for a password server. ---
**Author:** ![Scruff](https://avatars.discourse-cdn.com/v4/letter/s/6f9a4e/32.png) [@Scruff](https://boards.straightdope.com/u/Scruff)\ **Post date:** [February 2, 2015, 3:10pm UTC](https://boards.straightdope.com/t/do-longer-more-complex-passwords-actually-increase-the-incidence-of-breaches/711439/42 "2015-02-02T15:10:00Z")
> [@Nava](#): > > Also, what happens if you use several computers and you aren’t allowed to install stuff in some of them? …edited… Should I keep my password manager in a USB drive? I keep a password manager on my phone, synced (for backup purposes) to my computer at home. I have my various work accounts in there, as well as my various personal ones. So I need to - have my phone with me - remember the phone unlock password - remember the password manager password It works quite well, though it is a bit tedious typing some of the more arcane passwords by hand. ---
**Author:** ![lazybratsche](https://avatars.discourse-cdn.com/v4/letter/l/ba8739/32.png) [@lazybratsche](https://boards.straightdope.com/u/lazybratsche)\ **Post date:** [February 2, 2015, 3:36pm UTC](https://boards.straightdope.com/t/do-longer-more-complex-passwords-actually-increase-the-incidence-of-breaches/711439/43 "2015-02-02T15:36:19Z")
> [@Mangetout](#): > > Seems like the increasing use of password managers could itself be a security problem; how does the end user know that the basket into which they have placed all of their eggs is actually safe and secure? Sure, with the open source offerings, it’s possible for individuals to check and verify the integrity of the thing, but has anyone reading this actually done that? I imagine it’s a rarity. > > And we are encouraged to put all our eggs in the basket - not only the passwords, but all of the other related security credentials. I use Keepass which is the only common open source password manager. You’re right that I have to implicitly trust it since I don’t have the knowledge or ability to review the code myself. Still, given the number of developers who (1) use it themselves (2) make the many plugins, extensions, and ports, and (3) the tin-foil hat brigade who has been using KeePass for 10 years, I feel reasonably confident that it doesn’t have any blatant security risks. At least, none of the ExportPw([evil.mountain.fortress1.ru](http://evil.mountain.fortress1.ru)) variety. However, even if KeePass is compromised, not all of my eggs are in that basket. For my most critical accounts (email, banking, dropbox, etc) I have two factor authentication set up. To log in from a computer or IP address that’s not familiar to Google or whoever else, I need to enter a code sent by text to my phone. If my passwords are compromised, I am still secure as long as I have my phone in my possession. > [@Nava](#): > > Also, what happens if you use several computers and you aren’t allowed to install stuff in some of them? (My current client stops certain programs, others directly didn’t give us any kind of admin privileges). Should I keep my password manager in a USB drive? Doesn’t seem particularly safe, somehow. Online only? OK, soooo… I have to log in to a webpage before I can log in to my work computer… is anybody else seeing a contradiction in terms there? I’ve got my password database stored on Dropbox, synced to all of my computers and my phone. I can open it on my phone and, if necessary, use it to manually enter passwords. I’ve got a strong, memorized password for Dropbox, and there is strong encryption on the KeePass database. I am as confident as anyone can be that there is negligible risk of someone obtaining my password database and success brute-forcing its encryption. ETA: I see most of my points were already made! That’s what I get for leaving to shovel the snow halfway through posting. ---
**Author:** ![lazybratsche](https://avatars.discourse-cdn.com/v4/letter/l/ba8739/32.png) [@lazybratsche](https://boards.straightdope.com/u/lazybratsche)\ **Post date:** [February 2, 2015, 3:46pm UTC](https://boards.straightdope.com/t/do-longer-more-complex-passwords-actually-increase-the-incidence-of-breaches/711439/44 "2015-02-02T15:46:08Z")
> [@Chronos](#): > > One caveat: Don’t do this if your phone is not set up to be able to receive texts. Yes, I know, that sounds too obvious to mention, but it happened to my uncle this past weekend. Also, set up those backup codes, especially if you’re going to leave the country and are planning on using wifi and email to keep in touch with everyone. :smack: > [@](#): > > Again, a caveat: Use _random_ words. A sentence is not random words. Even a nonsense sentence is not random words. Try flipping open a dictionary to a random page, then close your eyes and poke at the page, and pick whichever word you’re touching (and not the nicer-sounding word right next to it, because that’s also not random), and repeat about five times. Actually, that’s _still_ not as random as it should be, because you’re more likely to flip to a page in the middle of the dictionary. I suspect that if someone, say, obtained every document that I have written and spent a lot of effort analyzing my personal dictionary and grammar structures, they would have a better chance of brute forcing some of my passphrases. Even though I picked random words, I did it until I had a string that was vaguely meaningful and memorable to me. But that kind of attack would require physical access to my computer, and if that is possible there are all sorts of ways that I could be completely screwed. At some point in the paranoia spiral, you have to trust that your wife, house guests, and coworkers aren’t putting a keylogger on every device you own. And if the NSA is after me personally, I’m sure they can figure out a way to get my [del]precious bodily fluids[/del] personal data. ---
**Author:** ![Emerald\_Hawk](https://avatars.discourse-cdn.com/v4/letter/e/e495f1/32.png) [@Emerald\_Hawk](https://boards.straightdope.com/u/Emerald_Hawk)\ **Post date:** [February 2, 2015, 4:25pm UTC](https://boards.straightdope.com/t/do-longer-more-complex-passwords-actually-increase-the-incidence-of-breaches/711439/45 "2015-02-02T16:25:46Z")
> [@Napier](#): > > How does guessing work, in the sense of workflow between the miscreant and the secure server? Seems like it would have to include a secure server letting unknown outsiders rapidly try thousands or millions (or billions or trillions) of passwords that are nowhere near correct, without setting off any alarms. Apple didn’t exactly admit it, but I think they had a bug in one of their Apple ID authentication systems (Find my iPhone API) that allowed attackers to try thousands of passwords without setting off alarms. I believe this is how many of the hacked iCloud accounts were compromised. See [Apple blocks tool that brute-forces iCloud passwords | PCWorld](http://www.pcworld.com/article/2866872/apple-blocks-tool-that-bruteforces-icloud-passwords.html) , and if you can read python, [GitHub - hackappcom/ibrute: AppleID bruteforce p0c](https://github.com/hackappcom/ibrute). But yes, normally accounts should be locked, IP’s banned, and requests throttled after several wrong guesses. Not everyone does this right though, especially smaller companies. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [February 2, 2015, 4:26pm UTC](https://boards.straightdope.com/t/do-longer-more-complex-passwords-actually-increase-the-incidence-of-breaches/711439/46 "2015-02-02T16:26:48Z")
If someone’s put a keylogger on your computer, then you’re screwed no matter how good your password is. There’s no sense in worrying about something that you can’t do anything about. But there’s a lot of room for someone to get ahold of your KeyPass database without being able to install a keylogger. So, yes, it really is a very good and prudent idea to make your KeyPass password as secure as possible. ---
**Author:** ![Voyager](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/voyager/32/133_2.png) [@Voyager](https://boards.straightdope.com/u/Voyager)\ **Post date:** [February 2, 2015, 8:50pm UTC](https://boards.straightdope.com/t/do-longer-more-complex-passwords-actually-increase-the-incidence-of-breaches/711439/47 "2015-02-02T20:50:55Z")
> [@lazybratsche](#): > > Even that password isn’t very good, since dictionary searches include common substitutions. There are even more sophisticated techniques that do a good job of predicting all of the tricks that humans think are so clever. > > [ArsTechnica had a good article](http://arstechnica.com/security/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/) a few years back about how easily passwords can be identified from a list 16,000 of hashes (which is how passwords are stored on the server you log in to). In a nutshell, three different experts were able to get most of the passwords in less than a day, using pretty ordinary computers. > > Since the whole article is rather long, here are a few quotes: > > Personally, I’ve given up on remembering lots of not-very-good passwords. I use Keepass2 as my password manager, with one strong passphrase that I have to remember. Every password for accounts that I care to keep secure is completely random and as long as each website will allow. If someone is targeting you, you have a greater chance of getting screwed. But for the most part when people steal the hash list they are going to hash the most common passwords and see what matches. If the hackers get 10,000 hits on “password” they aren’t going to bother with your reasonably strong one. If I were a celebrity or something I’d choose a real strong one - and my real passwords are a lot stronger than that example, which was a spinoff from Terr’s story. When I was at Bell Labs the performance review packet for managers came with a note from Brian Kernighan warning everyone that your stuff isn’t as secure as you think it is. Though he was talking about hacked C compilers. ---
**Author:** ![Voyager](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/voyager/32/133_2.png) [@Voyager](https://boards.straightdope.com/u/Voyager)\ **Post date:** [February 2, 2015, 9:09pm UTC](https://boards.straightdope.com/t/do-longer-more-complex-passwords-actually-increase-the-incidence-of-breaches/711439/48 "2015-02-02T21:09:05Z")
> [@lazybratsche](#): > > With a list of usernames and password hashes, the hacker has all the time they want to try to guess each password with their own computers. The ArsTechnica article I mentioned above describes this process. Since hashes can’t easily be reversed, the hacker has to essentially guess by brute force, computing the hash for many many candidate passwords and seeing if any match. Again using the linked example, the hackers tried (1) all 1-6 character passwords, (2) dictionary words including common substitutions (i.e. “3” for “E”), (3) dictionary words plus a handful of random characters, and (4) more sophisticated guessing methods which learn and use common combinations of characters (i.e. “q” followed by a “u”, or a “1” followed by “9”). **This approach plausibly could have identified P(ett4R0se**. > > At the end of this process, the hacker now knows the actual password for a large majority of accounts, along with the username and email. They can use those to log into the hacked website, or try to use them to log into associated accounts. The crucial factor here is what is the incremental benefit to the hacker of getting into an account with a reasonably strong password? If the account is owned by a star with dirty pictures, pretty high. If it is just a credit card number, pretty low, since these are sold in bulk. If hashing the standard list of bad passwords plus the dictionary with perhaps some simple substitutions will give you 60% of the passwords, you’re probably going to stop. There is also an incentive for speed, since if the break-in is detected the cards might go on a watch list which will reduce their value. (And increase the risk to those using them, but the hacker probably won’t care about that.) Picking two unrelated words (and pretty rose isn’t good) makes the password a lot more secure. And easier to remember. ---
**Author:** ![Terr](https://avatars.discourse-cdn.com/v4/letter/t/839c29/32.png) [@Terr](https://boards.straightdope.com/u/Terr)\ **Post date:** [February 2, 2015, 9:16pm UTC](https://boards.straightdope.com/t/do-longer-more-complex-passwords-actually-increase-the-incidence-of-breaches/711439/49 "2015-02-02T21:16:53Z")
> [@Voyager](#): > > The crucial factor here is what is the incremental benefit to the hacker of getting into an account with a reasonably strong password? If the account is owned by a star with dirty pictures, pretty high. If it is just a credit card number, pretty low, since these are sold in bulk. > > If hashing the standard list of bad passwords plus the dictionary with perhaps some simple substitutions will give you 60% of the passwords, you’re probably going to stop. There is also an incentive for speed, since if the break-in is detected the cards might go on a watch list which will reduce their value. (And increase the risk to those using them, but the hacker probably won’t care about that.) > Picking two unrelated words (and pretty rose isn’t good) makes the password a lot more secure. And easier to remember. Yes, I wonder how long it would take the hash-churning software to get to PurpleJumpingElephant34 ---
**Author:** ![Dr.Strangelove](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dr.strangelove/32/6613_2.png) [@Dr.Strangelove](https://boards.straightdope.com/u/Dr.Strangelove)\ **Post date:** [February 3, 2015, 2:03am UTC](https://boards.straightdope.com/t/do-longer-more-complex-passwords-actually-increase-the-incidence-of-breaches/711439/50 "2015-02-03T02:03:30Z")
> [@Chronos](#): > > It really needs to be something like “I rolled dice for it”, because even if the cracker tries rolling dice, it’s not going to roll the same numbers you did. Yeah. The XKCD approach is really about having a _provable_ amount of entropy in the result. Rolling dice absolutely guarantees this (when done correctly). Any kind of cleverness with substitutions does not make the same guarantee. An O\<=\>0 substitution contains _less_ than a bit of entropy, at least if you haven’t done it with a coin flip. In fact, you can’t really guarantee that substitutions have any finite amount of entropy at all. What do people do if they try “password” at a site and get the response “password must contain at least one capital and one number”? Guaranteed that almost all of them will be “Password1”. I’ve done it myself (with a slightly better base password, mind you)! They didn’t get several additional bits of entropy as one might naively expect; they got 0.1 bits or less. So yeah, the only way to get guaranteed entropy is via a truly random process. I rolled a die 25 times to get my last long passphrase. [Previous page](https://boards.straightdope.com/t/do-longer-more-complex-passwords-actually-increase-the-incidence-of-breaches/711439.md?page=2)