Have you ever signed up for a new online account and been frustrated by the password requirements? The service often insists on a longer password and the inclusion of special characters. While it may seem annoying, there's a good reason for these requests. It's all about entropy.
So what exactly is password entropy? How does it relate to a longer password? Let's take a deeper look.
What is Password Entropy?
Password entropy is essentially a measure of how unpredictable or random your password is. Think of it like a dice game. A six-sided die has six possible outcomes. The more faces a die has, the more unpredictable the outcome. Similarly, a password with more possible combinations is harder to guess.
Entropy is measured in bits, the basic unit of information in computing. Experts generally recommend an entropy of at least 64 bits. While this number is debatable, a higher entropy means more randomness and therefore more secure.
So why is randomness important? When an attacker tries to access your online account, they’re usually targeting your password. If it’s easy to guess, it’s like leaving the door open. A strong, random text acts as a sturdy lock, making it much harder for an unauthorized person to gain access.
Dictionary Attack to Crack Passwords
One of the most common methods attackers use to crack passwords is a dictionary attack. In this technique, a program systematically tries various combinations of words and phrases from a dictionary or list of common passwords. It's similar to a brute-force guessing game, but with a more targeted approach.
Imagine a hacker using a dictionary attack. They would give the program a list of common words, phrases, and even variations. The program would then try to match those combinations. If a match is found, the attacker has successfully gained access to your account.
Limitations of Predictability
Dictionary attacks are essentially a type of brute force attack that uses brute force to crack passwords. They are surprisingly effective, often cracking simple passwords in seconds. Cybersecurity companies like Hive Systems have published data showing the vulnerability of predictable text.
Because dictionary attacks rely on predictable patterns, the best defense is to add randomness to your passwords. Many people instinctively try to add symbols like “p@ssword” or “password123” to their existing passwords. But this is not random. Attackers can easily account for such predictable changes, and it may only take a fraction of a second longer to gain access.
Gizchina News of the Week
To create a truly random password, you need to eliminate human intervention. A computer-generated password created using a random number generator is much more secure. This is where password managers come into play. These tools can generate and store strong, random text for you, making it much harder for attackers to crack.
The Importance of Longer Passwords
While all four factors (length, special characters, uppercase letters, and numbers) contribute to password entropy, length plays a particularly important role. Let's dive into some math to understand why.
Imagine a password that only has lowercase letters. There are 26 letters in the alphabet. If your password is 6 characters long, there are 26^6 (or 26 to the 6th power) possible combinations. That's over 300 million possibilities.
Now, let's add a single character to the password and make it 7 characters long. The number of possible combinations increases to 26^7, or over 8 billion. As you can see, even a small increase in length significantly increases the number of possible combinations.
This is why length is so important. The longer your password, the more possibilities there are, and the exponentially harder it is for an attacker to guess.
More About Entropy
Just as we can measure password entropy, it is also possible to calculate it using a specific formula. The formula is: E = log2(RL)
- E represents entropy, which is the final result we are aiming for.
- L is the length of the password measured in characters.
- R is the range that represents the number of characters available to you.
- log2 is a mathematical function used to calculate the number of bits needed.
Let’s break down the concept of range. If you’re using a standard US keyboard layout and only use lowercase letters, your range is 26. For example, an 8-character password that only uses lowercase letters would have an entropy of 37.60 bits, which is very weak.
By adding uppercase letters, you double your range to 52. This increases the entropy to 45.60 bits, which is still not ideal. Adding the digits 0-9 increases the range to 62, and adding symbol keys increases it to 95. Even with these additions, the entropy of an 8-character password would only be 52.56 bits, falling short of the recommended 64 bits.
The most effective way to significantly improve your password entropy is to increase its length.
How Long Should Your Password Be?
Now that we understand the importance of entropy, the question is: how long should it be? The answer depends on the level of security you want. While 64 bits is a common benchmark, given the rapid advances in cracking technology, it would be wise to aim for a higher entropy, perhaps around 100 bits.
Using the entropy formula, we can calculate that a 16-character text that uses all 95 available characters will provide an entropy of 105.12 bits. A 15-character option will still provide a reasonable level of security at 98.55 bits. However, anything shorter will put you in dangerous territory.
If you are working with a smaller character set (less than 95), you will need to increase the length even further to achieve the same level of entropy.