Introduction
A lot of ordinary computer users understand what a password is. It protects their sensitive data and it's all they need to get access to a majority of accounts. It's also that all-important word that will allow them to access their significant other's Facebook profile while they're away to make sure they haven't been cheating and the PIN or pattern for their phone that betrays them access to their partner's deepest, darkest secrets.
Not surprisingly, many people will resort to anything to gain access to someone's personal data, when properly motivated. All manner of excuses crop up as to why they are exonerated from any crime or guilt for doing so.
"I know he's cheating" or "I'm only doing it for a prank. I'm not hurting anybody."Honestly, these are the cheapest, weakest excuses for invading someone's privacy. First, if you need to resort to betraying someone's privacy to determine whether you should trust them or not, you already have your answer. If you can't trust your significant other to be faithful and they can't trust you to keep your nose out of their business, why are you with that person in the first place?Ok, now that that little slap in the head is over with...let's get on with the real meat of this article.
How Passwords Work
There's actually a science to password security that only recently became widely adopted and understood by people that use them almost daily. You might be surprised, but the majority of passwords are a mere six to eight characters long and only use a single word in all lowercase. These are considered extremely weak passwords for a lot of reasons, but we'll get to that later.
The biggest problem with passwords is storage. Your passwords are perfect measures of security as long as they remain 100% secret, but unfortunately, that's almost impossible. The password becomes 100% useless once it gets exposed or an unauthorized person sees it. So, how do companies, websites, and credential managers store passwords so that nobody, not even themselves, can see them? They use encryption.
Encryption is an old stand-by method used since ancient times to confuse someone who would attempt to intercept and read messages that were not intended for them. Traditionally, there's a cipher and a key, a mathematical formula that scrambles or conceals the message, and a key which reveals or unscrambles it. One without the other makes the message useless. If you don't know the cipher or how it works, the key doesn't work, and if you don't know the key, you cannot unlock the cipher. This is basic encryption.
With modern encryption, we use complicated mathematical formulas (algorithms) that make it almost impossible for a human, without the aid of a computer, to unlock a cipher. It simply takes too long. The goal of encryption is to make data so difficult to decipher that it becomes irrelevant or worthless to the interceptor. Therefore, time is the greatest factor when discussing encryption. The longer the data stays encrypted, the more secure it is.
With passwords, a special type of encryption is used that results in what's called a "one-way hash." This is a special type of algorithm that has no key. Essentially, it only encrypts, but it does not decrypt. It cannot be undone. This protects the original password from being found, and also makes it more secure by adding additional characters to it.
So, when a user wants to access their account, they use their password. The server will take this password and run it through its hash algorithm to produce a one-way hash. Then, it will compare the user's password to the stored hash (which was created when the user made their account). If the hash matches, then the user is permitted access. Ideally, no two hashes can ever match. Changing just one character produces a wildly different hash that cannot be, in any way, related to another.
If a hacker wants to access that account, he would have to steal the hash and then use brute-force techniques to try every possible password combination and use the correct hash algorithm (and there are many) until he found the original password, which produces the same, unique hash.
It is infinitely more secure than storing the passwords in plaintext, meaning without encryption. However, this still isn't secure enough! The reason is that people are predictable and often use the same, weak passwords all the time. In fact, hackers and security researchers alike have compiled lists of BILLIONS of passwords that are most commonly and even not-so-commonly used by people. It's simply due to the fact that there are so many people in the world, odds are, your password, no matter how unique you think it is, matches someone else's somewhere in the world. That can be a problem!
But, there is another way to further secure these passwords to make it a lot harder to predict and compile lists of passwords and the easiest way to do that is with hashing. You can further secure these password hashes by adding salts to them. A salt is a tiny addition to a password hash that gets attached to the password when the account is created. It gets thrown into the equation and scrambles the password into a totally different hash that makes it even more unique.
Hash salts are usually based on a user's account name or a piece of their private information when they create the account, which a hacker wouldn't know very easily. Often, the salt secret is usually kept even more closely guarded by the site admins than the user password database (storage location).
For example, say we have the following example of a password database: I have two users with the same password...really WEAK passwords. If a hacker figures out one of their passwords, then they will have both, because they would match. The user's passwords are P@SSW0RD, which, when run through the MD5 algorithm, produces the following hash:
b46f685f85e0af830d82ddbbe795eff3
By adding a unique salt, I can do something about that. I created a quick Javascript program that takes the user's name, and pulls the first and last three letters from their username and makes them into a salt. Then, the program takes the salt, plus the user's password, and runs them through the MD5 algorithm and produces the hash that will be their password. Take a look at the results below.Username | Password | HASH
UserNumeroUno | P@SSW0RD | 52743b4d6f93a6827d887f428ea84f43UserNumberOne | P@SSW0RD | c9230eef666f58dedddeeaa18b395606Just to clarify.
UserNumeroUno's salt would be "Uuno" and UserNumberOne's salt would be "Uone" var HASH = md5(salt + password);
Try it out for yourself with different passwords and you can see how interesting effects can be done with salts to secure passwords further. The problem is, salts don't protect you against weak passwords to begin with.
No matter how good a hashing algorithm is, it merely protects the password from getting stolen and used immediately. It increases the amount of time it takes for the hacker to reveal the true password and gives the administrators time to discover that there was a breach and notify their customers in time to change their passwords. Simply put, hashing is a delay tactic. As I mentioned, password protection, encryption, and cracking is all about time.
The more time it takes a hacker to uncover the password, the more likely he is to give up on it, and the more time a security researcher has to figure out what went wrong to fix the problem. In reality, both of these users are using a terrible password which could be cracked in a day at most, probably a few hours if the attacker knows what to expect, or even seconds with a good old dictionary attack.
Let's explore the mathematical implications of a good, strong password so that you can understand... *play the fanfare*
The Math!
If you didn't guess by now, you should know that password cracking, and just computing in general, is very math-heavy. In fact, it's so math heavy, that if you don't properly throttle back your computer when breaking passwords, you can literally bake the silicone inside of it to a paste. That being said, password cracking is a very intense process and a huge game of numbers. There are reasons why your annoying network admins keep telling you to use long, complex passwords. Be honest with yourself, do you use the same password in more than one location? If so, you're doing yourself a disservice and exposing yourself to potential threats. So, mathematically speaking, a password is weak because it's not only predictable, but also finite in that it only would take someone so many guesses before arriving at the correct one. This is why length and complexity affect the strength of a password so strongly because it increases your chances of creating a unique and unknown password. This is something that can also be reproduced with a very simple mathematical formula:S = C^L (That's c raised to the power of L), where C = the password complexity or number of unique characters, and L is the length of the password, and S is the overall password strength. This is why it's insisted on by experts in the industry (who know what they're talking about) that you should always prioritize Length over Complexity.
Complexity
Complexity is affected by the unique characters in a password. The number of unique characters in a password *multiplies* its strength. Note I say "multiplies." Complexity is dependent upon your key-space. For the sake of this example, assume that we're not "guessing" passwords and simply using brute-force to crack the password. When you create a password like "p4ssw0rd" you are using only two keyspaces - lowercase and numerical. This is the alpha-numeric keyspace standard which accounts for no less than 50% of the passwords in use today. Alpha-numeric is a very weak keyspace and here's why: there are 26 letters in the English alphabet, and 10 unique numbers (0-9). That's a total of 36 letters of entropy. Compare that to the 96, standard UTF-8 unique characters on a keyboard, including alpha-lowercase and alpha-uppercase, the space bar and all the unique symbols. Since most password crackers will try lowercase alpha-numeric first (because it's the fastest and most common), your chances of getting your password cracked is a lot higher, compared to someone who includes at least one symbol, uppercase letter, and a space in their password, which are not so common. So, a with the password "p4ssw0rd", you have 8 characters, but only 26+10 potential unique characters for complexity. That's a total of (36^8) = 2,821,109,907,456 (~2.8 trillion) possible passwords. But here's the thing. That is only POTENTIAL strength. Because this only assumes that the attacker is using brute force based on the knowledge that you are using alphanumeric case without knowing any of the letters or numbers in the password. If he knows that you have at least one "s" in your password, that eliminates two unique characters, bringing you down to only 34 potential characters. That takes you down to 1.7 trillion possible passwords! That cuts your password count down by almost half! Why such a big difference? Because of the exponential function of length, which brings me to the next topic.
Length
I'm going to give you two passwords:
P@$$w3rd!
i love my super secure password
Which do you think is stronger? If you guessed the latter, you would be right. The reason is because the second password is longer and mathematically superior to the first.
Let's do the formula again: For the first password, we assume it uses full keyspace. That gives it a complexity value of 96 characters. Nice! But it only has 9 characters in length compared to the second. That leaves us with 96^9.
Now, for the second password. It only uses lowercase letters and spaces, so we only have 27 unique characters. (We are assuming the attacker will include spaces in his alphanumeric keyspace.) However, the password is extraordinarily long at 31 characters. That leaves us with 27^31.
If you passed 6th grade math, you should already guess that the second password will force the attacker to go through more password attempts compared to the first.
How many passwords?
First password: ~ 6.9 quintillion attempts. (or 69 followed by 16 zeros)
Second password: ~ 235 trindecillion attempts (or 235 followed by 42 zeros) WOW! That's a huge difference! Imagine if you just replaced the first letter of each word with a capital letter. That would almost double our complexity! However, this password is only mathematically superior. Against a hybrid dictionary attack, it would significantly weaken it, but that's a discussion for another tutorial.
Building a Strong Password
It's not difficult to construct a significantly strong password that is up to the task of defeating your typical brute-force attack. Most password crackers will give up if they do not get a result within a few days, maybe two weeks at most if they are patient. Your goal is to create a password that is long, complex, and easy to remember. A password isn't much good to you if you, yourself cannot remember it. That's actually really easy to do. Take my example from the above scenario, and apply it to a password that you want to make secure. Using random words that do not usually go together, you can make a very strong password.2Yams+1Shower=???2 Roads Diverged.3lementary, dear Watson! All of these passwords I gave you as examples are over 12 characters long, easy to remember, and aren't something you would ordinarily guess. Even with a hybrid dictionary attack, an attacker would be hard-pressed to get the correct combination of words, symbols, and numbers replacing the correct characters, and that assumes they had at least some idea of what your password was, which is unlikely if you maintain a good personal security policy. Mind you, not every site you use will let you use extraordinarily long passwords or symbols, so you'll have to learn to substitute characters and shorten them appropriately. It is most important to recognize that just because it's difficult for YOU to remember a password, does not automatically mean that it will be difficult to guess, especially not for a computer. I always like to quote the XKCD web comic which illustrates my point effectively.
A special thanks is owed to Randall Monroe, the author of XKCD and his math-y/science-y humor, which I greatly appreciate.
________________________________________________________________________________
Conclusion
The subtle science of password cracking and the brutal math of cryptography is not as difficult to understand as some would have you believe. In fact, many programmers aren't great mathematicians. They simply know how to manipulate a computer into doing all the thinking for them, since our brain-meats are so woefully unequipped for the task of calculating higher mathematics at a rate of millions of iterations per second.
We will discuss the actual process of password cracking, how it is done, what tools can be applied to it, and the effort required to crack weak versus strong passwords.
(This posting originated from "The DepthSec Archive as written by "True Demon" March 23, 2016)
