A New (and Simple) Strategy for Secure, Essentially Unbreakable Passwords

Last Updated May 6, 2011 1:46 PM EDT

Barely a day passes without news of some new e-mail server, bank, or online service getting hacked (we're looking at you, Sony). That's one reason we frequently remind you about the need for data security, including strong passwords. My personal favorite way to concoct strong passwords is with a personal cypher that lets you convert a phrase into utter gibberish. But security expert Thomas Baekdal contends there's a better way: a simple multi-word phrase is far harder to crack than a short string of letters, numbers, and symbols.

Essentially, Baekdal shows that while a single word is useless as a password because it is easily cracked using common hacking methods, stringing together a few words using a separator like a space, dash, or similar character can catapult a phrase like "this is fun" into secure territory, as you can see in this chart:

In fact, Baekdal goes on to say that by using 3 words in a password, it can take over a million years to crack using brute-force or almost 40 million years using a dictionary attack. That makes this approach 10 times more secure than using a gibberish string like J45sx>2.

If you have control over the log-in procedure at your server, Baekdal further suggests adding a time delay between sign-in attempts and a penalty period if the wrong password is entered several times in a row. These two practices can essentially convert even a 2-word password, which is crackable in just a few months, into something that sustain continuous attack for almost 2,000 years.

Of course, all of these time estimates will continue to drop as computers get faster and computing power gets cheaper, so it pays to periodically review how you secure your corporate and personal data. But for now, it looks like this more straightforward password strategy could make a lot of sense. [via Lifehacker]

More on BNET:


Market Data

Watch CBSN Live

Watch CBS News anytime, anywhere with the new 24/7 digital news network. Stream CBSN live or on demand for FREE on your TV, computer, tablet, or smartphone.

Watch Now

Market News

Stock Watchlist

New Android App

For your Android phone and tablet, download the FREE redesigned app, featuring CBSN, live 24/7 news.

The all new
CBS News App for Android® for iPad® for iPhone®
Fully redesigned. Featuring CBSN, 24/7 live news. Get the App