…is not that databases with password hashes get hacked, or that the encryption / hashing algorithms are weak, or that GPU based attacks are getting so strong, but that users will always be the weakest link.

Users.

Because they will always:

• Choose weak passwords like:
  • 123456
  • password
  • <Same as your username>
  • <Your dog's name>
  • etc.
• Write it down on stick-it notes and stick it to their monitors
• Use one password for all authentication portals
• Never change passwords
• Choose too simplistic passwords like:
  • P@ssword
  • 1234!
  • etc.
• Think they will never be the victim
• Think it is not too bad if people get their passwords.

There is a lot of misinformation out on the web. This article suggests that "throwing in symbols" will not help you create a more complex password, yet they then jump from the 9 character alphanumeric password that can be cracked in 48 days to a 7 character password with symbols that will only take 7 days - but they shortened the password! Also neglected to be mentioned is that this brute force cracking ONLY works under the following conditions:

• The password is stored as some kind of one way hash and this hash value has been compromised
• The hashing algorithm is MD5 or NTLM, as those typically can be calculated at a rate of about 20000 - 40000 million hashes per second on a fast GPU, whereas other hashing algorithms such as SHA-1, SHA-256 only achieves 3000 - 7000 million hashes per second, slowing down the feasibility of cracking by a factor of up to 13 times. There is a big difference between spending 10 days to crack a password and 130 days.
• The attacker has a vested interest in your data. This is a double sided sword though. Web sites like LinkedIn, Facebook etc. are high profile targets not because of any one person's account, but because of the vast amount of accounts that can be breached. Facebook has 800 million+ accounts. It makes it economical to attack, whereas it is not economical for someone to try and hack your 100 user application if there is not a good return on investment for the attacker.

The first point is very important, as most systems have some kind of user interface that gathers the user's credentials, and trying to brute force attack this is not going to work unless the password is trivial. The time to recover a non dictionary password, even if it is only 7 characters long, by trying to brute force a well designed authentication portal is tremendous. With network lag it is hard to get more than say 1000 attempts per second. Assuming the system does not kick you out, that is 400 million times slower than a brute force attack on raw hashes, rendering the attack invalid when good passwords are in use, even if they are only 7 characters long.

So lets assume your password hash has been compromised somewhere. Lets assume the attackers has some large farm of GPU's to crack the passwords. A lot of assumptions but not unreasonable. Especially since many people use one password across devices, so if their LinkedIn password is cracked like what happened recently, that means a would be attacker can potentially target users and hack into their bank accounts, network accounts etc.

All you need to do is to look at this graph. With current technology, a password that adheres to the following:

• At least 9 characters or longer
• Combination of lowercase, uppercase, digits and symbols
• Not an obvious password, but well chosen.
  • Bad passwords
    • Password1!
    • Qwerty12345.
    • ILoveJanet!
    • JD1961-04-24
    • etc.
  • Good passwords
    • Bal_s can, fly 10
    • photo M_ - blue
    • etc.
• Do NOT write your password down. If you have to, use a password manager like 1Password to store all your passwords.
• Do NOT share passwords on multiple sites. Group them in tiers.
  • Tier 1 Password - used for banking website, etc. - most secure
  • Tier 2 Password - use for less important but still sensitive portals such as Facebook, email etc.
  • Tier 3 Password - use for non sensitive web sites
  • Tier 4 password - use for sites where you do not care if the password is compromised. This password can be shared.
• Change your passwords from time to time.

If you adhere to that, you will be relatively safe. Computer security is a moving, dynamic system and as long as you keep current with technological advances, you will be OK. A 9 character password might not be good enough in 5 year's time. So do not expect it to stay secure forever. Change it, adapt. In 5 years or whenever 9 digit passwords can be cracked easily, use 10 or 11 character passwords. But there is no need to overreact and start using 15 character passwords. A 15 character password is just as impossible to brute force than a 12 character password today.