YOU might wonder what the point of choosing a safe password is. After all, whether your password is 12345 or k3^&gHi]0%"N£l@2!Bc9, a would-be hacker still has to go through all the possible permutations to find it, right?
Well, no. Hackers don't work at random; they use "cracking dictionaries" of the likeliest passwords. These dictionaries include real words, common password combinations, and perhaps databases of real passwords that have been leaked or stolen.
So if your password was among the 6.5m passwords apparently stolen from LinkedIn, then even if (as appears to be the case) they are not linked to email addresses or usernames, it could end up in such a database, making it more likely for a hacker to try it out in future. This is why you should change your LinkedIn password now, and also why you should use different passwords for every online account.
A common rule of thumb is that a password should be at least eight characters long and contain numeric and special characters as well as both upper- and lower-case letters. But even here, there are pitfalls. It's tempting to make such a password out of a common word: turning "motivation" into m0t1vAt!oN, for instance. But as a recent paper by Joseph Bonneau of Cambridge University describes, dedicated password-cracking software uses "mangling rules" to try out such mutant variants as well.
Mr Bonneau's paper, based on a study of nearly 70m passwords obtained (with consent and properly anonymised) from Yahoo!, looked at the likelihood of guessing a user's password based on the 1,000 commonest entries in a cracking dictionary specific to the user's language. The results, posted over on our statistics blog (and in the chart above), shows that for English-language users, this method will crack 8% of passwords. But as the chart shows, the rate varies from language to language. The Chinese, it seems, are the most security-savvy, while Indonesians are the least.
However, another interesting finding was that using the "wrong" cracking dictionary doesn't always have as much of an effect as one might think. Using the 1,000 commonest entries in a Greek cracking dictionary to target Greek users achieved a 13.4% success rate. Using the Chinese dictionary on those same users yielded 9.3%. That is proably because there are quite a few common passwords (such as famous names and easy strings of numbers) that are used universally.
So what's a really safe way to make up a password you can actually remember? One method is to create a passphrase, a set of words that are easy to remember in themselves but add up to a very long and hard-to-crack string of characters (here is a method for creating a truly random passphrase using a set of dice). However, a good passphrase can take a long time to type. Personally, I invent nonsense passwords that are hybrids of words from several different languages—easy for me to remember, but guaranteed not to be found in any dictionary—and then "mangle" them for good measure.
Source: The Economist
