More and more of us are stuck choosing passwords that only Mordac could love.

Mordac is the “preventer of information services” who appears in my favorite Dilbert cartoon about password management. A “Mordac password” contains a collection of different types of characters: both upper and lower case, plus digits, plus punctuation, plus anything else they can think of. Mordac doesn’t care if the password is impossible to remember as long as you never, ever write it down.

I believe there are three types of passwords:

1. Simple passwords
2. Basic strong passwords
3. Secret keys

Keep in mind that passwords can’t provide really strong security for one simple reason: if an attacker intercepts your password, then it doesn’t matter how cleverly it’s constructed – the attacker now owns your identity.

Here’s an interesting report on password rules: https://gizmodo.com/the-guy-who-invented-those-annoying-password-rules-now-1797643987

However, given that we’re all stuck using passwords, let’s consider the different kinds:

Simple passwords

This is what the password mechanism was designed for in the first place. You pick a word you’ll remember and you use it as your password. It should not be a word that people are likely to guess. You simply need to pick a word or other identifier from among hundreds or thousands of possibilities, memorize it, and keep it secret.

Use simple passwords when there’s nothing very important at stake. For example, I tend to use the same simple password when I sign up for “free” subscriptions to things. The web site owners want to use my sign-up as a way to track my behavior and it doesn’t hurt me personally if someone else uses the account.

Basic strong passwords

These are passwords that might resist an automated attack. There are two types of automated attacks. The first kind, an interactive attack, requires the attacker to send dozens, hundreds, or thousands of queries to a server, trying different passwords until a match is found. Some servers automatically check for this and block such attacks, but poor design has forced many systems to tolerate such attacks without blocking them.

A basic strong password presents the attacker with millions, or preferably billions, of possibilities. Such passwords are both memorable and very hard to guess. The easiest way to create a basic strong password is as follows:

1. Pick three words. They can be short or long, but they should not form a phrase. If you like long, obscure words, you might get by with picking two words instead of three.

2. Scramble the order so they don’t form a recognizable phrase.

3. Punctuate them with digits, punctuation marks, or special characters, as allowed by the server that will be checking this password. Some sites allow any character you can type, while others limit your choices.

Voila. If you did this correctly, there should be about a 1 in a billion chance of someone guessing or otherwise cracking your password.

Here’s an example. I pick up a bilingual dictionary and open it to two different places, yielding the words above, sigh, and dam. I pick a digit and a punctuation character, and stick them between the words. This yields the password:

above3sigh.dam

This is the sort of password I use for on-line banking and for other applications involving valuable information.

Very strong passwords

The second type of automated attack, an off-line attack, requires that the attacker has stolen the password file for the server under attack. Password files generally store the passwords in ahashed format, that is, the passwords aren’t directly readable. An off-line attack guesses possible passwords, applies the hash function to them, and then checks for a match. It’s practical for a modern attacker to test millions, even billions, of passwords in this way.

This is the type of password you want to use for incredibly valuable things. Ideally, you should use a random password generator to produce such passwords. Don’t even think that you can memorize such a jumble of characters: write it down on a piece of paper. If you use it a lot, it will eventually form a pattern in your mind and you’ll remember it.

Password Generators

Unfortunately, I have no immediate recommendations for random password generators.

I recommend that you do not use Internet web sites to generate random passwords: while such sites may provide more randomness than you may get with a poor on-machine implementation, there’s nothing to prevent the password from being intercepted after it’s been generated, or even retained by the hosting web site.

If I remember correctly, Adam Shostack had once published a Javascript for random password generation. I’d trust him to do it right. However, his web page doesn’t note this as something he’s done, and perhaps I remember this incorrectly. If done correctly, Javascript is a promising way to generate passwords. The Javascript would run on your own browser, so the password doesn’t need to traverse the Internet. The host site provides the program (the Javascript) but doesn’t actually run it, so it doesn’t see the password.

I’ve looked at one or two Javascripts on the net that generate passwords, and unfortunately they don’t meet randomness requirements.

This article by Rick Smith is licensed under a Creative Commons Attribution 3.0 United States License.