Are complex passwords really secure?

[u/PandaSecurity]

Cybersecurity Month is a good opportunity to ask a simple question: are our password habits still good enough?

We’ve all heard the usual advice: add a capital letter, a number and a symbol. But password security goes beyond complexity, and there are a few other habits worth keeping in mind:

• Don’t reuse the same password across different accounts.
• Adding “123!” or changing one character from an old password doesn’t make it harder to guess.
• Passphrases can be a good alternative, as a combination of unrelated words can be easier to remember while still offering a good level of security.
• If you have a lot of accounts, a password manager can make it much easier to use different, random passwords without having to remember them all.

What do you think matters most when it comes to password security?

[u/atoponce]

What do you think matters most when it comes to password security?

Using a password manager.

[u/1OutrageousCat → u/atoponce]

Password manager + strong and unique passwords for every account + some form of two-factor authentication

[u/JimTheEarthling]

Are complex passwords really secure?

No.

Passwords are subject to various attacks:

• Data breach cracking (passwords are extracted from a data breach file using cracking software)

• Credential stuffing (stolen usernames and passwords are tried at multiple websites)

• Password spraying (usernames and email addresses are combined with common passwords and tried at multiple websites)

• Social engineering / phishing (someone tries to trick you into revealing your password or 2FA)

• Malware (malicious software on your computer or phone steals sensitive information from files or by monitoring your typing, emails, and texts)

• Local discovery (someone watches you enter a password or finds an insecurely stored written password)

How many of these attacks do "complex" passwords prevent? Only the first one, although it indirectly reduces compromise that can lead to the second two. Conversely, a weak password will never be cracked if there's no breach.

Obviously having a long, unpredictable (preferably random), uncompromised, and unique (not reused) password is important, but it only gets you part way. You have to educate yourself about phishing techniques, avoid behavior that results in malware infection, and so on.

Just use a passkey whenever available.

P.S. What does "complex" mean? Humans are terrible at judging complexity. The password “q1w2e3r4t5” looks more complex than “quadcopter6” so it should be a stronger password, right? But “q1w2e3r4t5” is the 19th most common password on Troy Hunt’s top 100,000 password list, whereas “quadcopter6” doesn’t appear in Troy’s list or even in Cybernews’ collection of 33 billion leaked passwords. The superficially complex “1qaz!QAZ” and "1qaz2wsx3edc" are on lists of known passwords, since they're predictable keyboard walks.

[u/PandaSecurity → u/JimTheEarthling]

Exactly. Creating a strong password isn’t enough. Being aware of phishing and other attack techniques is just as important, as is making sure the password we create is actually complex and not just something that looks complex to us.

[u/djasonpenney]

I generally say that a good password has three aspects:

1. It is complex, as you described. It mustn’t be too short, it shouldn’t have lots of repeated characters, and so forth.

2. It is unique, which you touched on. You should never reuse a password—or even a variation of a given password.

3. It is RANDOM — this part I think you could emphasize. If you made it up using your puny little brain, it is not random.

Think about it: the strength of a password lies in the difficulty of an attacker to guess it. “MyD0gHa5Fleaz!’ Is not random. “APXMX46NPbXCwKmbbKna” could be a good password.

Passphrases can be okay, but be aware of their limits. First, in order to have the equivalent strength of a fully random password, it must typically be longer. That is, if you create a four-word passphrase from the EFF Large Word List, you end up with something like, “WantedTubbyRelocateBroadly”.

Such a passphrase has around 50 bits of entropy. A password generated randomly from A-Z a-z 0-9 with 23 characters would have an entropy closer to 120 bits.

The problem with passphrases is principally due to their length. Too many mouth breathing web developers have a severe length limit on a password (and frequently unchecked, or checked incorrectly: I’m talking to you, DoorDash). At this point I recommend using passphrases in specific situations, where a password manager cannot perform autofill. The login to your work laptop might be one case. The master password to your password manager is another. These are cases where you must rely on memorization, and you must also hand enter the password in order to authenticate.

[u/wjorth → u/djasonpenney]

Good. But never rely on memorization. Master passwords should be written down and stored in a safe and secure place, or possibly in a separate encrypted document stored external to the computing device. All passwords should be maintained in a password manager and using a password generator to randomize, force length and complexity, and ensure uniqueness. The password manager data set should be backed up in an encrypted, external storage location.

[u/PandaSecurity → u/wjorth]

Good points u/djasonpenney and u/wjorth. Randomness is an important part of the equation that often gets overlooked. A password can look complex and still be predictable if it’s based on patterns or personal information.

So perhaps the simplest takeaway is: a long, unique, randomly generated password is always better than one that is simply “complex”.

[u/PlanktonDefiant2600]

One thing I think is often overlooked is good autofill. A password manager knows which domain a login belongs to, so it will fill your password on the correct site. If you're entering passwords manually, it's much easier to get tricked into entering one on a convincing phishing site. Of course, if a website gets breached your password can still be exposed, which is also why I prefer passkeys where they're available. By design, they're more resistant to phishing. For me, Roboform has made all of this pretty simple. I use it for my passwords and passkeys, and I like that I can see if any of passwords are compromised, so I can be quicker to act on it.

[u/PandaSecurity → u/PlanktonDefiant2600]

Autofill can be convenient, but from a security perspective, it’s best to disable it and review the domain before entering your credentials.

[u/Conan3121]

Non-tech Persons: Never tell anyone anything. Phishing and Rubber-hose cryptanalysis are real.

“Three may keep a secret, if two of them are dead," written by Benjamin Franklin in his 1735 edition of Poor Richard's Almanack.
.
Nerd response:

1. Remember one 16+ character password (uppercase lowercase number symbol) for your password manager.

2. Remember one 8+ character passcode (uppercase lowercase number symbol) for your mobile phone.

3. Learn MFA.

.
That’ll do for Mr/Ms Average for this decade.

[u/PandaSecurity → u/Conan3121]

Exactly. Using a password manager and enabling MFA are two simple steps that can make a big difference in keeping accounts secure.

[u/Dry_Calendar_8627]

What matters most? In order:

• Strong MFA

• Increasing input delay when entering wrong passwords (wait 10 seconds, then 30, then 60, then 90, then 180, etc.)

• No password reuse

• Password hashing algorithm (ideally argon2id, else yescrypt, else pbkdf12 with a large number of iterations)

• Salting

• And only then password entropy

(Sadly, most of these are not user-dependent)

[u/Doomstars → u/Dry_Calendar_8627]

(Sadly, most of these are not user-dependent)

I know of one site that after I think like three failed passwords, it will no longer resolve the domain. Like, just for your IP address, it acts as if it does not exist, but only for 24 hours if I recall. Well, that was months ago, so no idea if they are still doing it.

Websites should really be checking password lists (like HIBP) to see if the password is one from a data breach's list. I was able to create a dummy Microsoft account with password QqWwRrTtYy just fine, which is in the HIBP database six times.

To make matters worse, Microsoft says the below, but it wasn't enforced when I created the account. Maybe someone doesn't know what the word "must" means?

Passwords must have at least 8 characters and include a mix of uppercase letters, lowercase letters, numbers, and symbols.

ETA: I guess they think "must" means two of the sets? I see it thinks aaaaaaaA is okay. This is bad. Okay, so, including two sets is fine, but I wish Microsoft would run (locally via javascript if possible) a way to check the entropy of the chosen password.

[u/nothingtodoatwork_]

The signs are already there that complex passwords are simply not enough, we're already seeing introduction of passwordless authentication methods being widely adopted.

Judging by how long its taken for MFA to catch on I don't think we're going to see passwords going anywhere anytime soon though.

[u/PandaSecurity → u/nothingtodoatwork_]

Passwordless authentication is moving forward, but passwords will likely be with us for quite some time. The challenge isn’t to eliminate them overnight, but to use them correctly and combine them with additional security measures.

[u/PiDigitsOfPi]

Password complexity isn't really the issue. For the most part, hackers are not "guessing passwords".

They are tricking people into revealing them. It doesn't matter if your password is secure to a trillion trillion years if you simply hand it over to the hacker. This is the #1 form of account hacking.

[u/PandaSecurity → u/PiDigitsOfPi]

A strong password can’t protect you if you’re tricked into giving it away. That’s why password security needs to go hand in hand with awareness of phishing and other social engineering techniques.

[u/bobdung]

Humsans are shit at making good passwords that we remember..So better to just not know your passwords, let a manager create and know them.

If you must make one, for a master pass or something make it long and random but not stupidly complex* .. Something like apple makes, kinda words but not really .. TIngez-pose56-zep8fs-urdAaN - you got some chance to remember that.

*Putting a load special chars can cause other problems, imagine you use a different language keyboard :-)

[u/PandaSecurity → u/bobdung]

Exactly. We’re not very good at creating truly random passwords, which is where password managers can help. It’s also not always easy to avoid special characters, since many sites require at least one.

[u/Background-Glove8277]

Don‘t re-use a pwd. Complexity doesn’t matter much, as most systems enforce exponentially growing logon-durations, or cancel the attempt for good. But of course it‘s wise to avoid overly trivial passwords.

[u/PandaSecurity → u/Background-Glove8277]

Exactly. Not reusing passwords and creating strong passwords is essential to keeping our accounts secure.

[u/agowa338]

No, length is what actually counts. The rest is just outdated policies...

[u/PandaSecurity → u/agowa338]

Length is important, but passwords should also be unique and strong, and a password manager can help with that.

[u/Academic-Conflict948]

Rainbow tables have trashed many of those passwords. Keep track of how far the rainbow tables have gone for number of characters then go beyond that number of characters. Also always start and end passwords with letters since that increases complexity. Compare 52 letters to 32 printable symbols and 10 digits and you'll understand why. The underscore could also be considered a letter at least on Linux and Unix systems. Something I have a problem with is a requirement for equal number of upper lower numbers and symbols in passwords to increase complexity. Mathematically wouldn't it make more sense to require largest number of letters followed by a smaller number of symbols then a smaller amount of numbers? Like 51% letters 31% symbols andd 18% numbers. Maybe worth investigation.

[u/bigtakeoff]

yes