UserNumeroUno | P@SSW0RD | 52743b4d6f93a6827d887f428ea84f43UserNumberOne | P@SSW0RD | c9230eef666f58dedddeeaa18b395606Just to clarify.
UserNumeroUno's salt would be "Uuno" and UserNumberOne's salt would be "Uone" var HASH = md5(salt + password);
Try it out for yourself with different passwords and you can see how interesting effects can be done with salts to secure passwords further. The problem is, salts don't protect you against weak passwords to begin with.
No matter how good a hashing algorithm is, it merely protects the password from getting stolen and used immediately. It increases the amount of time it takes for the hacker to reveal the true password and gives the administrators time to discover that there was a breach and notify their customers in time to change their passwords. Simply put, hashing is a delay tactic. As I mentioned, password protection, encryption, and cracking is all about time.
The more time it takes a hacker to uncover the password, the more likely he is to give up on it, and the more time a security researcher has to figure out what went wrong to fix the problem. In reality, both of these users are using a terrible password which could be cracked in a day at most, probably a few hours if the attacker knows what to expect, or even seconds with a good old dictionary attack.
Let's explore the mathematical implications of a good, strong password so that you can understand... *play the fanfare*
If you didn't guess by now, you should know that password cracking, and just computing in general, is very math-heavy. In fact, it's so math heavy, that if you don't properly throttle back your computer when breaking passwords, you can literally bake the silicone inside of it to a paste. That being said, password cracking is a very intense process and a huge game of numbers. There are reasons why your annoying network admins keep telling you to use long, complex passwords. Be honest with yourself, do you use the same password in more than one location? If so, you're doing yourself a disservice and exposing yourself to potential threats. So, mathematically speaking, a password is weak because it's not only predictable, but also finite in that it only would take someone so many guesses before arriving at the correct one. This is why length and complexity affect the strength of a password so strongly because it increases your chances of creating a unique and unknown password. This is something that can also be reproduced with a very simple mathematical formula:S = C^L (That's c raised to the power of L), where C = the password complexity or number of unique characters, and L is the length of the password, and S is the overall password strength. This is why it's insisted on by experts in the industry (who know what they're talking about) that you should always prioritize Length over Complexity.
Complexity is affected by the unique characters in a password. The number of unique characters in a password *multiplies* its strength. Note I say "multiplies." Complexity is dependent upon your key-space. For the sake of this example, assume that we're not "guessing" passwords and simply using brute-force to crack the password. When you create a password like "p4ssw0rd" you are using only two keyspaces - lowercase and numerical. This is the alpha-numeric keyspace standard which accounts for no less than 50% of the passwords in use today. Alpha-numeric is a very weak keyspace and here's why: there are 26 letters in the English alphabet, and 10 unique numbers (0-9). That's a total of 36 letters of entropy. Compare that to the 96, standard UTF-8 unique characters on a keyboard, including alpha-lowercase and alpha-uppercase, the space bar and all the unique symbols. Since most password crackers will try lowercase alpha-numeric first (because it's the fastest and most common), your chances of getting your password cracked is a lot higher, compared to someone who includes at least one symbol, uppercase letter, and a space in their password, which are not so common. So, a with the password "p4ssw0rd", you have 8 characters, but only 26+10 potential unique characters for complexity. That's a total of (36^8) = 2,821,109,907,456 (~2.8 trillion) possible passwords. But here's the thing. That is only POTENTIAL strength. Because this only assumes that the attacker is using brute force based on the knowledge that you are using alphanumeric case without knowing any of the letters or numbers in the password. If he knows that you have at least one "s
" in your password, that eliminates two unique characters, bringing you down to only 34 potential characters. That takes you down to 1.7 trillion possible passwords
! That cuts your password count down by almost half! Why such a big difference? Because of the exponential function of length, which brings me to the next topic.
I'm going to give you two passwords:
i love my super secure password
Which do you think is stronger? If you guessed the latter, you would be right. The reason is because the second password is longer and mathematically superior to the first.
Let's do the formula again: For the first password, we assume it uses full keyspace. That gives it a complexity value of 96 characters. Nice! But it only has 9 characters in length compared to the second. That leaves us with 96^9.
Now, for the second password. It only uses lowercase letters and spaces, so we only have 27 unique characters. (We are assuming the attacker will include spaces in his alphanumeric keyspace.) However, the password is extraordinarily long at 31 characters. That leaves us with 27^31.
If you passed 6th grade math, you should already guess that the second password will force the attacker to go through more password attempts compared to the first.
How many passwords?
First password: ~ 6.9 quintillion attempts. (or 69 followed by 16 zeros)
Second password: ~ 235 trindecillion attempts (or 235 followed by 42 zeros) WOW! That's a huge
difference! Imagine if you just replaced the first letter of each word with a capital letter. That would almost double our complexity! However, this password is only mathematically superior. Against a hybrid dictionary attack, it would significantly weaken it, but that's a discussion for another tutorial.
Building a Strong Password
It's not difficult to construct a significantly strong password that is up to the task of defeating your typical brute-force attack. Most password crackers will give up if they do not get a result within a few days, maybe two weeks at most if they are patient. Your goal is to create a password that is long, complex, and easy to remember. A password isn't much good to you if you, yourself cannot remember it. That's actually really easy to do. Take my example from the above scenario, and apply it to a password that you want to make secure. Using random words that do not usually go together, you can make a very strong password.2Yams+1Shower=???2 Roads Diverged.3lementary, dear Watson! All of these passwords I gave you as examples are over 12 characters long, easy to remember, and aren't something you would ordinarily guess. Even with a hybrid dictionary attack, an attacker would be hard-pressed to get the correct combination of words, symbols, and numbers replacing the correct characters, and that assumes they had at least some
idea of what your password was, which is unlikely if you maintain a good personal security policy. Mind you, not every site you use will let you use extraordinarily long passwords or symbols, so you'll have to learn to substitute characters and shorten them appropriately. It is most important to recognize that just because it's difficult for YOU to remember a password, does not automatically mean that it will be difficult to guess, especially not for a computer. I always like to quote the XKCD web comic which illustrates my point effectively.
A special thanks is owed to Randall Monroe, the author of XKCD and his math-y/science-y humor, which I greatly appreciate.
The subtle science of password cracking and the brutal math of cryptography is not as difficult to understand as some would have you believe. In fact, many programmers aren't great mathematicians. They simply know how to manipulate a computer into doing all the thinking for them, since our brain-meats are so woefully unequipped for the task of calculating higher mathematics at a rate of millions of iterations per second.
We will discuss the actual process of password cracking, how it is done, what tools can be applied to it, and the effort required to crack weak versus strong passwords.