New algorithm shows need for better passwords

By Devang Joshi

Devang Joshi is a senior computer science major and started as the webmaster for The Johnsonian this April. He writes a technolgy blog titled “Devang’s Tech” and teaches computer science 101 labs A, B, and C. Passwords are nice things because they allow nice people (like you and me) to keep our nice things away from bad people. However, as with many computer-driven things, the password is only as good as you, the end user, make it.

It’s no surprise that most passwords people use to secure their e-mail, Facebook and even their online banking tend to be simple facts about themselves or horribly lame attempts at making a password in the first place.

A password is based in a finite world, which means if someone had the time, he or she could go through every possible combination and find your password.

Passwords, in general, tend to have rules. For example, your password needs to be between eight and 16 characters long and needs at least one number.

It’s not difficult to see how it’s possible for the computers out there to mill through the billions of possibilities (and yes a billion is a lot, but it’s still finite so you are not safe) and find the key to your personal information.

Also, as computers become faster and faster, the power the everyday “home hacker” has also increases.

Recently, researchers used pairs of graphics cards to break eight-character passwords in about two hours. Not impressed?

Well, let’s think about it.

In the English language, we have 26 letters and 10 unique numbers.

So, an eight-digit character password using 26 letters multiplied by two, which accounts for upper and lowercase, plus 10 numbers is 62 possible characters.

I am not counting all the crazy symbols you can put in your password.

Back to the math (the reason why you’re reading), with 62 possible characters and eight-character long passwords, we have 8,361,453,672 possibilities.

Let that soak in for all those who think you are safe in the world of billions of possibilities.

That’s eight billion plus possibilities researchers cracked with graphics cards.

Add to that the fact that your everyday password is not something you grabbed from a random password generator (and if it is, I apologize - you are a real trooper) and we are all kind of screwed.

Luckily, simple ways exist to keep your password safe.

Keep your password safe:

• Use a longer password with both numbers and letters.
  Security experts now say a password about 10-12 digits long is a good length. You can maximize the security by using upper and lowercase characters.
• Make your password something unique, something only you would know.
  Don’t worry if you are madly in love and your soulmate knows everything about you, you’re wrong. They don’t know everything so don’t be lazy.
• Make your password hints unique.
  Many websites allow you to recover your password by answering security questions. Making these questions difficult makes it difficult for people to crack them.
• Never give your password to anyone.
  Many people fall into this trap. If someone from Facebook e-mails you  asking for your password to perform site maintenance, don’t buy into it.  Facebook, Winthrop and Bank of America do not need your password to access your account or perform maintenance.
• Don’t save passwords on your computer, on a piece of paper or in your wallet.
  Your mind is the best place to keep your password, because it’s hard to lose your brain, right? If you’re worried about the government kidnapping you to get access to your Flicker account, well, you have bigger problems.