Website Tech

Tag: secure passwords

  • Making a Memorable Secure Password Phrase

    Making a Memorable Secure Password Phrase

    You need a very secure password to use as the master password for your password keeper software, and for your computer login. There may be a very few sites that you log into often that you might think can use a typed password, but avoid that.

    These few passwords have to be very easy to remember and easy for you to type. But they have to be difficult for computers to guess, in the rest of your lifetime.

    More security steps you can take, beyond good passwords: WordPress Security for People Without Technical WordPress Knowledge.

    Why do you need a Password Phrase, instead of the way you’ve been making a password for years? Because hackers know how to guess those passwords.

    See Strong Passwords for WordPress and Your Password Keeper.

    What I’m Going to Cover:

    • How to make a truly secure password phrase for your password keeper master password, and for the few passwords you type frequently. This must be hard for hackers to guess, easy for you to remember and easy for you to type;
    • How to pick a password phrase in a way you will remember it in seconds or minutes.

    You must use very strong passwords on your WordPress site (and you must have an SSL certificate, to prevent your WordPress login from being sent as plain text; many excellent hosting companies like SiteGround provide SSL certificates for free). You should use very strong passwords on every web site you use, and every password should be different.

    WordPress encrypts your passwords, and the encryption is strong enough hackers can’t break the encryption. But hackers know the way we’ve all been taught to make “secure” passwords, and that lets them automate scripts that guess your passwords.

    Making a Secure Password

    One way of making passwords that are actually secure, but you’ll never be able to remember, is use a password generator. Use the password generator in a password keeping software, and all you have to remember is the “master password” for the password keeper.

    “A password manager is just software that creates, stores and organizes all your passwords for your computers, websites, applications and networks.”

    http://thehackernews.com/2016/07/best-password-manager.html

    I give you my recommendations on how to select which password keeper you want to use, in Strong Passwords for WordPress and Your Password Keeper. I’m using LastPass, since it is easy to use, and it works on Windows, OS/X, Linux, iOS, and Android.

    The password keeper software will remember all your user names, account numbers, and passwords, plus any other information you keep as notes for that site. You can also use your password keeper for securely storing bank account numbers, credit cards, library cards, WiFi passwords, serial numbers, registration numbers, router configuration details, etc.

    The only passwords you should frequently type are the ones for your computer and for your password keeper, your phone pin, and your bank card pin. All others should be pasted from your password keeper.

    Basics of Password Security

    For each site, use the longest password the site allows, up to maybe 60 characters. Your password keeper will let you copy/paste the password, so you don’t have to ever type it. Most password keepers also have an option to simply fill in all the login information, skipping the copy/paste.

    (As long as it is a random computer-generated password, 60 characters is “lifetime strong”.)

    Never use a password on more than one site. If someone gets your password at your favorite pizza place, and orders a pizza “for carry out” on your card, you don’t want them also able to use your video streaming account or your bank, right? Many hacks on simple websites are to get 1) the password or 2) the password-making rule, for every registered user.

    Why? Because hackers know most people use the “same or similar” password on all websites.

    LastPass and many other password keepers will even warn you to change passwords if a password is used on more than one site.

    Old Rules to Make “Secure” Passwords Are Too Easy to Guess

    The rules we’ve been told by technical support people for decades, make passwords that are not secure any more. The main reason is simple: there is software that can make billions of guesses of your password per minute, and hackers using it know all the “clever” rules people come up with for making passwords.

    The rules we’ve been taught for years that should make a secure password, aren’t good enough. Those rules actually limit the possible passwords a hacker’s software would have to check. For example, the “word plus number plus punctuation” rule makes a password that is basically as easy to guess as a three-letter password; the word is in the dictionary, plus about 100 characters for all letters and punctuation, twice). Hackers know all the “substitute a number instead of a vowel” rules too, such as “3 for m or 0 for o (zero for oh)”, and that is easier for computers to check than it is for you to remember.

    Even 8 character random passwords can be guessed in under a day, if they are looking for Your password and have stolen the website’s database. While most hackers are looking for the easy targets on a website, you need a password that can’t be guessed during your lifetime!

    Making Secure Passwords You Can Remember

    Password Strength cartoon from xkcd.com/936/

    You have to remember your password keeper’s master password. Forget it and all your other passwords are encrypted in a way that can not be broken (unless of course your master password is so weak it can be guessed by password cracking software).

    The comments on the original correct horse battery staple page point out that if all four words you pick are in the 5,000 most popular English words, then you should calculate the time it takes the password software to go through 625,000,000,000,000 (5000 x 5000 x 5000 x 5000) combinations.

    There are 60 seconds * 60 minutes * 24 hours = 86,400 seconds/day. At 8 billion password guesses per second, they have your “four common words” password in about 1 day, using a “wimpy” 2012 computer.

    Obviously one way to make your password (pass phrase) more secure is use at least one word that is not in that tiny dictionary of most popular words. Engineering, scientific, medical, or any other more obscure words will do; but they have to be easy for you to remember, and remember how to spell. (Or, remember consistently how to mis-spell). Common foreign language words are also in hacker dictionaries, but less common ones are good to use; pick a language that is not common in the websites you use.

    Another way to make your password more secure is use 6-8 words. But remembering 4 random words is hard enough for most people. (Tip: get one of the associative memory courses, such as MegaMemory.) If you have a system memorized already, okay. If you have the type of memory where you know every move of every chess game Kasparov ever played, good for you, use it. But if you don’t, here’s how.

    Making a Memorable Secure Password Phrase

    I think the proper person for teaching this task is Mary Poppins:

    Julie Andrews in “A Spoonful of Sugar” from Mary Poppins 1964

    Now, pick a “mini-scene”, for example the robin or the mirror, and describe it in 6-8 words. For this mini-scene, perhaps “robin feathering fly mary whistle duet” (a robin feathering his nest flies to Mary Poppins and they whistle a duet) but don’t use that, make your own story. As long as you pick a vivid, memorable mini-scene, the “story” you make up will be completely memorable to you, but not easy for anyone to guess, even if they know what movie you love.

    • Ignore any 1-3 letter words unless important.
    • Don’t take a lyric or famous quote, as those could be in the “dictionary” of some hackers. “spoonful of sugar” is a lousy password, “spoonful of sugar to help the medicine go down” is so famous it’s not much better than “spoonful1964”
    • No punctuation between words (spaces aren’t allowed on some sites, and punctuation are harder to type); or if you must, use the same common punctuation between each word of every password; no having to remember which one you used.
    • Pick one place to put a capital letter, probably the first letter of the first word, and use that place for every password you make.
    • Pick one place to put a digit (probably the end), and one place to put a punctuation mark (probably after the digit). Use the same digit, punctuation mark and place for every password you make, so you don’t have to remember what and where you picked.
    • Only use punctuation that is accepted on almost all web sites, e.g. the top row of your keyboard, ~!@#$%^&*)_+-= so you don’t have to remember which sites use which punctuation mark.
    • If you’re not certain whether to use singular or plural (“was it penguin or penguins who bowed in the cafe?” in “It’s a Jolly Holiday with Mary”) always use singular (the simpler word). Or, move slightly ahead or back in time, so it is clear (“how many penguins gave Mary a kiss?” You do remember, don’t you, even after the years since you watched Mary Poppins? Go watch again…)
    • Any time remembering it “wrong” will be highly memorable, go with it. If you can vividly see in your imagination that in “The Matrix”, Neo did a cartwheel and grabbed a Howitzer off the floor (instead of a machine gun), excellent.
    • Any time a more complex or less common word would be memorable, use it. Know your birds? Use the actual type of robin Mary sang to, instead of “bird”.

    Some more practice making stories from mini-scenes (but soon quit practicing, pick a movie you love, change your password keeper’s master password!). This is quite a curtain call:

    Mary Poppins (1964) The Penguin Dance

    What does Neo do?

    https://youtu.be/855w0sdZjgA?t=131
    The Matrix (1999) | Lobby Shootout Scene
  • Should you Email a Password? Never! Use a Password Keeper

    Should you Email a Password? Never! Use a Password Keeper

    Never email passwords or other confidential information. Use LastPass, or another top-rated password keeper such as OnePassword, to send passwords.

    Email is not a good way to communicate passwords. Email servers get hacked, and email transmissions get intercepted. You can set up encrypted emails, but that takes some work for you and the recipient (another topic).

    With LastPass, one of the things you never have to do again is “email someone a password”.

    Better approach with LastPass is to click their icon to Share a password. When you share a password, you can specify whether the other person can ever see it or just can have LastPass fill it in for them. You can also store and share notes, account numbers, etc. via LastPass.

    A better approach for WordPress is for you to create a user. You specify what permissions they should have (for example, Editor or Author, or if they truly need it Administrator). You email them (to their email address you used when creating the user) the URL to your website/wp-admin/. When they try to log in, they click the “Forgot password” link and make their own password (using, of course, LastPass to generate it and store it).

    Want to make a good Master Password for your password manager, that is extremely difficult for hackers to guess, yet easy for you to remember and type? Read my Strong Passwords for WordPress .

  • Secure Passwords for WiFi, That You Can Type

    Secure Passwords for WiFi, That You Can Type

    Most of the time, to have a password that is secure, you use a password manager software. You have the password manager make a unique password for each and every web site or account. You have it make a password that is random, very difficult to type, and as many characters as the website will allow. The password manager will then paste the password into the login page. You never need to know what the password is, and you never type it.

    The rules we’ve all been taught for year, to make a “secure” password, result in passwords that are hard to type, hard to remember, and are easy for hackers to guess. Hackers know those simple rules, too. And hackers have lists of the top milion most-used passwords.

    You have to either use a password manager, or make a memorable 5-7 word pass-phrase, to have a secure password.

    When Would You Type A Password?

    You might have to type WiFi passwords without using your password keeper, for example on your new phone, or to connect your printer to your WiFi.

    Basically, you type a password only in those few cases where you can’t use your password manager. You can’t use your password manager to type in the WiFi password into the phone, because you can’t connect to your password manager until you have entered the WiFi password to connect to the Internet.

    You need to type in the password for your computer, before you can access your password manager.

    You also might want to connect a friend’s or house mate’s computer to your WiFi, so you can get them set up using a password keeper. You want your WiFi password easy to type, for this scenario, but not highly memorable.

    If you are setting up your Internet router or cable modem, you’ll have to type in the password. Then you can use the password manager to store all the router settings. Most password managers have places for storing notes, and keeping everything encrypted.

    What About Those Pesky Keyboards?

    The keyboards on mobile phones, and on device panels (for example, your printer), are quite difficult to use for most computer-generated passwords.

    These keyboards make typing random characters even harder, since you have to change from the uppercase keyboard to the special character keyboard to the lowercase keyboard to the numeric keyboard.

    You might find that your WiFi or your printer won’t accept a long enough password to make a password phrase from 4-5 long words. One common length is maximum of 63 characters for a WiFi password. If your hardware is wimpy about security, you might have to make a secure password using computer generated characters.

    You should change your passwords occasionally (twice a year might be a good frequency), or if you think someone shouldn’t be using your WiFi any more. If you suspect or know someone has broken into your WiFi or computer, change the password right away. You might be able, depending on your hardware, to copy/paste the old password and new password; but you might have to type it.

    How to make passwords that are fairly easy to type, yet highly secure

    If you group the characters by which keyboard they are on (uppercase, lowercase, etc), they will be easier to type, and easier to say to yourself or the other person you are giving the password to.

    Use KeePass, a free password generator with the ability to specify patterns of characters, to generate a password with groups of uppercase, lowercase, numbers, punctuation. (Most password generators do not have this feature, including LastPass.) Or you can use your current password generator to generate several short passwords, each from characters all on the same keyboard, and paste them together to make a long password.

    KeePass can use a pattern to generate the password, that is easy to type on phone keyboards. An example l{8}u{4}l{4}d{4}l{8}d{4}s would make a password with 8 lowercase letters, then 4 uppercase letters, then 4 lowercase, then 4 digits, then 8 lowercase, then 4 digits, then 1 special character.

    You make your own pattern, specifying the number of uppercase, lowercase, digits, and special characters. For most people, 4 or 5 characters at a time are easy to remember long enough to type, or 8 characters is two easy groups of 4.

    I’m now using LastPass for my passwords, but I still have KeePass on my computer for generating those passwords I know I would need to type.

    Should You Use a Special Character?

    To have KeePass generate a printable 7-bit special character, one of !”#$%&'()*+,-./:;<=>?@[\]^_`{|}~, add a lowercase ‘s’ in the pattern. To use 4 of them, use s{4} in the pattern.

    If you prefer, you can simply pick a special character you will always use. Most people would put the special character at the end; or pick some place you always put it such as after the 4th character. Always use a special character in every password, since so many web sites and WiFi routers require one. If you always use one you won’t have to remember.

    In KeePass, do not click the Advanced button and enable “Exclude look-alike characters”, since you will know whether it is O or 0, l or 1 (that’s an oh, zero, lowercase el, one) by the pattern.

    For all the KeePass pattern options, see https://keepass.info/help/base/pwgenerator.html#pattern

     

  • What to Do If A Site You Use is Pwned (Data Breach)

    What to Do If A Site You Use is Pwned (Data Breach)

    “Pwned” is the slang for when an account of yours, on some web site, got compromised in a data breach. So, hackers probably have personal information of yours.

    There are hackers trying to steal information from web sites, all the time. Some site that you’ve registered with, probably has been hacked at some time.

    You can check sites to find out what major sites are known to have had data stolen. Having checked one of those sites, and then saying “I have been pwned twice” is not likely accurate. More likely it has happened dozens of times, you just don’t know about it. On the other hand, hopefully some of the sites didn’t get anything really useful about you. (more…)

  • Strong Passwords for WordPress and Your Password Keeper

    Strong Passwords for WordPress and Your Password Keeper

    More security steps you can take, beyond good passwords: WordPress Security for People Without Technical WordPress Knowledge.

    Password Security on Your WordPress Site and the Internet

    I’m going to cover:

    • Why you must use strong passwords, and a different password for each site.
    • Choosing and using a Password Keeper to save every password you use;
    • How to store other secure information such as bank account numbers and ;
    • How easily most passwords are guessed by hacker software, since the rules people use for making passwords are thoroughly known by hackers.

    What I Don’t Cover Here

    How to make a truly secure password for your password keeper master password, and for the (very few) passwords you type frequently. This must be hard for hackers to guess, easy for you to remember and easy for you to type. For this, see my page on Making a Master Password for your Password Keeper.

    Must Have Strong Passwords for Every Website

    You must use very strong passwords on your WordPress site. You should use very strong passwords on every web site you use.

    WordPress encrypts your passwords, and the encryption is strong enough hackers can’t break the encryption. But hackers know the way we’ve all been taught to make “secure” passwords, and that lets them automate scripts that guess your passwords.

    If hackers have stolen a copy of the site database (for example, an un-encrypted backup), or have hacked access to the database, they can test literally billions of password-guesses per second, using free widely-available software.

    Hackers have gotten the username and password for every user of several large websites. If you are using one of the 100 million most common passwords, hackers just have to compare the encrypted form of the password against the encrypted entries in their password list — very easy for computers to do.

    If hackers can test passwords using the standard WordPress login form, and you haven’t restricted that, they can test thousands of passwords in a couple of hours. (To restrict login attempts, install a WordPress security plugin such as WordFence or iThemes Security. Most WordPress security plugins have the feature to restrict login attempts.)

    Making a Secure Password

    The rules we’ve been taught for years that should make a secure password, aren’t good enough. Those rules actually limit the possible passwords a hacker’s software would have to check. For example, the “word plus number plus punctuation” rule makes a password that is basically as easy to guess as a three-letter password; the word is in the dictionary, plus about 100 characters for all letters and punctuation, twice).

    Hackers know all the “substitute a number instead of a letter” rules, such as 3 for m or 0 for o (zero for oh)”, and that password is easier for computers to guess than it is for you to remember.

    One way of making passwords that is actually secure, but you’ll never be able to remember, is use a password generator. Use the password generator in a password keeping software, and all you have to remember is the “master password” for the password keeper.

    The password keeper software will remember all your user names, account numbers, and passwords, plus any other information you keep as notes for that site.

    Password Keepers

    “A password manager is just software that creates, stores and organizes all your passwords for your computers, websites, applications and networks.”

    http://thehackernews.com/2016/07/best-password-manager.html

    I’ll give you my recommendation for which password keeper to use. But first, it’s important that you understand how to select a password manager.

    Beyond storing user names and passwords, you can also use your password keeper for storing “secure notes” such as bank account numbers, credit cards, library cards, any account numbers, serial numbers, registration numbers, router configuration details, etc. Many password keepers have fields specially for these uses, which is better than only having a “notes” area.

    You can only download software that is so obviously about security, from a site that has technical strength, has industry-leading anti-virus software, has excellent reviews, has a reputation to maintain.

    Never download any software because there was a pretty advertisement about it on _____ (fill in the social media site). If you use a hacker’s program as your password keeper, guess what they’ll do…

    For password storage, you also must select a program that has 256-bit (or stronger) open source encryption. The more security experts who have had a chance to review the software for weaknesses the better. Proprietary software doesn’t get as many eyes checking for problems; companies are proud of their software, and look at how good it is, not where is it weak.

    You also need a program that you have on your computer, and your password keeper has to be able to work from your thumb drive, and/or your tablet or phone. A web based solution is okay if you synchronize to them or can easily backup the data to your computer in an encrypted format (e.g. a .zip file with a password); you can’t risk their business suddenly closing with all your passwords gone.

    Another feature to look for is a standard method for exporting your information, for example an XML or CSV text file, should you ever want to change to another program. But know this export is an insecure file; make backups of your encrypted password file not the un-encrypted export.

    This is not a complete list of good password keepers, but these work very well, and are trusted sources:

    LastPass

    The password manager I am currently using is LastPass, free for all devices (but free is either for desktop or for mobile, not both).

    LastPass is easier to use than KeePass (which I used to use), in several small but important ways. It notices when you visit a site, and offers to fill in the login form for you. (Or you can configure it, per site, to let you pick which login name to use, for example I host websites for several clients.) It notices when you log into a site that you haven’t added yet to LastPass, and offers to save the login information into LastPass. It also has fields for some common information, for example credit cards and WiFi credentials.

    The complete database is encrypted, not only the password fields. So, your user names, notes, etc. are encrypted, too. Only the encrypted data is ever sent across the Internet.

    They also have a paid version, with additional features. The most interesting paid feature is much better sharing of passwords, for example with a spouse. With the free version, you can specify single password entries to share with a specific person; you can even specify whether they can see the shared password or only use LastPass to fill it in when they log into a site.

    LastPass works on Windows, OS/X, Linux, iOS, and Android.

    There are LastPass browser extensions for Chrome and for Firefox. Definitely install these, they make using LastPass easier.

    Other Windows Password Keepers

    On Windows, I download almost all my shareware and open source software from CNET or SourceForge. For iOS and Android, use the main Apple and Google libraries.

    KeePass

    If you want a password keeper that is completely on your computer (doesn’t talk to some company’s computer for storage), look at KeePass and also get the portable version (runs off your thumb drive). (Unless you have a strong reason to use the original version, which is still being maintained, get the KeePass 2.x edition.) The main site is on SourceForge (downloads here), and the KeePass web site is excellent for learning what makes good password software, even if their software isn’t what you use. I used to use KeePass, before switching to LastPass. KeePass has versions or ports for Android, OS/X with Mono, iPhone, Linux. Some of the key features:

    • KeePass supports the Advanced Encryption Standard (AES, Rijndael) and the Twofish algorithm to encrypt its password databases. Both of these ciphers are regarded as being very secure. For example, AES became effective as a U.S. Federal government standard and is approved by the National Security Agency (NSA) for top secret information.
    • The complete database is encrypted, not only the password fields. So, your user names, notes, etc. are encrypted, too.
    • Your computer’s clipboard is cleared in a few seconds, your un-encrypted password isn’t left in memory.

    1Password is also excellent, top security, more fields for storing special information than KeePass (KeePass only has title, user name, password, URL, and notes fields). 1Password has the ability to share a group of passwords with other people, so you have access to the password (or other secure data such as account numbers); for example, as you are managing your elderly parent’s accounts you have all their vital account numbers and passwords, before they forget them.

    OS/X Password Keepers

    On OS/X: Either use 1Password or LastPass, or you can use KeePass with Mono.

    Many people simply use Keychain http://www.macworld.com/article/2013756/how-to-manage-passwords-with-keychain-access.html . But it doesn’t give you the structured fields for storing other information.

    Keychain easily synchronizes across your devices if they are connected to iCloud, but I know many people where they’ve entered passwords on one device and then been unable to login from their other devices, and of course don’t find out for long enough they don’t know which device has the correct password. Keychain doesn’t have the ability to share certain passwords, for example with family members. Keychain is great for some things (for example saving software licenses) but don’t use it as a password keeper.

    Linux Password Keepers

    On Linux Mint, I use LastPass. It also works on Kali Linux.

    There are several password keepers available via the Software Manager; check what they are designed for, several are “on your computer” only, don’t save to a central computer so you can access your passwords on your other devices.

    You might be satisfied simply using the Chrome or Firefox browser extensions of whichever password keeper you use, if Linux isn’t your primary computer.

    Exceptions to Using Password Keepers for Security

    The only passwords you would ever casually share with someone should be your WiFi password. If your WiFi hardware supports it, use the “guest” account for visitors. Read how to make secure passwords for WiFi you can type.

    The only passwords you should frequently type are the ones for your computer and for your password keeper, and your bank card pin. All others should be pasted from your password keeper.

    Your printers and other Internet-enabled (or in-house WiFi enabled) devices will also need the WiFi password typed in. Type it in once, the device remembers the settings, and you don’t type it in again until you change the password.

    Tip: find out if the device can use a Bluetooth keyboard; or organize the password into letters on the same “virtual keyboard”, e.g. numbers all together, punctuation all together, uppercase letters all together.

    Sharing Passwords

    You should use your password keeper to share passwords for bank accounts or other financial institutions, where you share the account. For most people, this would only be your spouse or parents, or a business partner. (If possible, make a separate login for each person. But if not, most good password keeper software can securely share passwords you specify with a person.)

    You should share your password keeper’s master password with the executor of your estate, or the person you have given power of attorney, the person who would need to access your accounts if you are unable to.

    If you die, and you have made someone able to access your account information, it will be much easier for them to finalize your accounts, cancel your subscriptions, turn off your repeating payments.

    For technical support, make them a temporary user name, and let the software email them a password update link. It is a bad idea to ever send a password by email or text message or phone, too easy for email to be intercepted (and hackers can program searches of email traffic for “here’s your password” type message.

    When the technical support person is done, definitely disable their access completely or change the password.

    Basics of Password Security

    For each site, use the longest password the site allows, up to maybe 60 characters. Your password keeper will let you copy/paste the password, so you don’t have to ever type it. (As long as it is a random computer-generated password, 60 characters is “lifetime strong”.)

    Never use a password on more than one site. If someone gets your password at your favorite pizza place, and orders a pizza “for carry out” on your card, you don’t want them also able to use your video streaming account, right? LastPass will even warn you to change passwords if it is used on more than one site.

    Whatever password keeper you use, keep the master password with someone trusted (for example your attorney keeping your will, or the main person who will manage your estate) in case of your death or other inability to type your password. See The 1Password Emergency Kit: Version 3.0 for how to do this.

    Old Rules to Make “Secure” Passwords Are Too Easy to Guess

    You have to remember your password keeper’s master password. Forget it and all your other passwords are encrypted in a way that can not be broken (unless of course your master password is so weak it can be guessed by password cracking software).

    But the rules we’ve been told by technical support people for decades for making passwords are not secure any more. The main reason is simple: there is software that can make billions of guesses of your password per minute, and hackers using it know all the “clever” rules people come up with for making passwords.

    Yes, if the software had to try every combination of letters, numbers, punctuation in an 8-character password (26 lower case letters, 26 upper case letters, 10 digits, about 32 punctuation marks) that’s 6,095,689,385,410,816 combinations. So your password generator can generate a password that is even 8 characters long, that would take a very long time to break, and many sites will allow 40 characters or longer (use the longest the site will take).

    But if you need to make a password that you can remember, those ways of making a “secure but memorable” password are all known, and even 8 character passwords (and often longer) can be guessed in under a day. You need a password that can’t be guessed during your lifetime!

    Don’t believe it? Maybe you will when you read this…

    https://arstechnica.com/security/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/ says “In March [2013], readers followed along as Nate Anderson, Ars deputy editor and a self-admitted newbie to password cracking, downloaded a list of more than 16,000 cryptographically hashed passcodes [encrypted with MD5 but not salted]. Within a few hours, he deciphered almost half of them. The moral of the story: if a reporter with zero training in the ancient art of password cracking can achieve such results, imagine what more seasoned attackers can do… Even the least successful cracker of our trio — who used the least amount of hardware, devoted only one hour, used a tiny word list, and conducted an interview throughout the process — was able to decipher 62 percent of the passwords. Our top cracker snagged 90 percent of them… Using a commodity computer with a single AMD Radeon 7970 graphics card, it took him 20 hours to crack 14,734 of the hashes, a 90-percent success rate. Jens Steube, the lead developer behind oclHashcat-plus, achieved impressive results as well. Steube unscrambled 13,486 hashes (82 percent) in a little more than one hour, using a slightly more powerful machine that contained two AMD Radeon 6990 graphics cards.”

    (oclHashcat-plus is the freely available password-cracking software both Anderson and all crackers in that article used.)

    https://arstechnica.com/security/2012/08/passwords-under-assault/ “A PC running a single AMD Radeon HD7970 GPU, for instance, can try on average an astounding 8.2 billion password combinations each second, depending on the algorithm used to scramble them.” [Notice the date, that’s with an “ancient” 2012 computer.]

    That 8 billion per second would be if someone stole a backup of the website’s database, for example. If they were going to try logging in to WordPress, perhaps 100-200 attempts per second would be easy, from a single computer. How many computers working together in a hacker network could attack your site at once, if you don’t have software limiting the number of attempts?

    I’ve seen over 100,000 password guesses in a night, from about 10 computers, about a day after turning off protections on a testing site with a very good password.

    The comments on the original correct horse battery staple page point out that if all four words you pick are in the 5,000 most popular English words, then you should calculate the time it takes the password software to go through 625,000,000,000,000 (5000 x 5000 x 5000 x 5000) combinations.

    There are 60 seconds * 60 minutes * 24 hours = 86,400 seconds/day. At 8 billion password guesses per second, they have your “four common words” password in about 1 day, using a “wimpy” 2012 computer.

    Making Secure Passwords You Can Remember

    Obviously one way to make your password (pass phrase) more secure is use at least one word that is not in that tiny dictionary of most popular words. Engineering, scientific, medical, or any other more obscure words will do; but they have to be easy for you to remember, and remember how to spell. (Or, remember consistently how to mis-spell). Common foreign language words are also in hacker dictionaries, but less common ones are good to use; pick a language that is not common in the websites you use.

    Another way to make your password more secure is use 6-8 words. But remembering 4 random words is hard enough for most people. (Tip: get one of the associative memory courses, such as MegaMemory.) If you have a system memorized already, okay. If you have the type of memory where you know every move of every chess game Kasparov ever played, good for you, use it. But if you don’t have a system, there is a good way to remember a short phrase.

    [adinserter block=”2″ ]

    Making a Memorable Secure Password Phrase

    You need a very secure password as the master password for your password keeper software, for your computer login, and for the very few sites that you log into often.

    See my post on how to make a good password phrase for your password keeper, it’s easier than you might think.