{"id":273963,"date":"2018-09-01T13:00:41","date_gmt":"2018-09-01T11:00:41","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=273963"},"modified":"2018-09-01T09:44:55","modified_gmt":"2018-09-01T07:44:55","slug":"how-to-create-a-password-not-even-a-supercomputer-could-break","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/273963-how-to-create-a-password-not-even-a-supercomputer-could-break.html","title":{"rendered":"How to create a password not even a supercomputer could break"},"content":{"rendered":"<p><em>By EFF Deeplinks Blog.<\/em><\/p>\n<p>Here\u2019s the not-so-secret recipe for strong passphrases: a random element like dice, a long list of words, and math.<\/p>\n<p>And as long as you have the first two, the third takes care of itself. All together, this adds up to\u00a0<a href=\"https:\/\/ssd.eff.org\/en\/module\/animated-overview-how-make-super-secure-password-using-dice\"><i>diceware<\/i><\/a>, a simple but powerful method to\u00a0<a href=\"https:\/\/ssd.eff.org\/en\/module\/creating-strong-passwords\">create a passphrase\u00a0<\/a>that even the most sophisticated computer could take at least thousands\u00a0of years to guess.<\/p>\n<p>In short, diceware involves rolling a series of dice to get a number, and then matching that number to a\u00a0corresponding word on a wordlist.\u00a0You then repeat the process a few times to create a passphrase consisting of multiple words.<\/p>\n<p>In 2016, EFF debuted a\u00a0<a href=\"https:\/\/www.eff.org\/dice\">series of wordlists<\/a>\u00a0that can be used with five six-sided dice to\u00a0<a href=\"https:\/\/www.eff.org\/deeplinks\/2016\/07\/new-wordlists-random-passphrases\">generate strong passphrases<\/a>. This year, we\u2019re upping our game. At Dragon Con 2018 in Atlanta over Labor Day weekend,\u00a0EFF will be testing new wordlists optimized for three 20-sided dice.<\/p>\n<p>Since Dragon Con is largely a fantasy and science fiction convention, we\u2019ve also created four new wordlists drawn from fan-created Wikia pages for\u00a0<a href=\"http:\/\/memory-alpha.wikia.com\/\">Star Trek<\/a>,\u00a0<a href=\"http:\/\/starwars.wikia.com\/\">Star Wars<\/a>,\u00a0<a href=\"http:\/\/gameofthrones.wikia.com\/\">Game of Thrones<\/a>, and\u00a0<a href=\"http:\/\/harrypotter.wikia.com\/\">Harry Potter<\/a>.<\/p>\n<p>If you\u2019re at Dragon Con, come visit our table on the second floor of the Hilton Atlanta. EFF and\u00a0<a href=\"https:\/\/www.accessnow.org\/\">Access Now<\/a>\u00a0are teaming up to teach people how to create passwords using giant 20-sided dice.<\/p>\n<p>Attendees will also be encouraged to write sentences or little stories using the words to help remember their passphrases. Participants who successfully create a strong passphrase will receive a gift (while supplies last).<\/p>\n<p>We\u2019re also releasing the wordlists and password worksheet online, so folks at home can play along:<\/p>\n<ul>\n<li>Game of Thrones [<a href=\"https:\/\/www.eff.org\/files\/2018\/08\/29\/gameofthrones_8k_3column.pdf\">PDF<\/a>] [<a href=\"https:\/\/www.eff.org\/files\/2018\/08\/29\/gameofthrones_8k-2018.txt\">TXT<\/a>]<\/li>\n<li>Star Trek\u00a0[<a href=\"https:\/\/www.eff.org\/files\/2018\/08\/29\/memory-alpha_8k_3column.pdf\">PDF<\/a>] [<a href=\"https:\/\/www.eff.org\/files\/2018\/08\/29\/memory-alpha_8k_2018.txt\">TXT<\/a>]<\/li>\n<li>Star Wars\u00a0[<a href=\"https:\/\/www.eff.org\/files\/2018\/08\/29\/starwars_8k_3columns.pdf\">PDF<\/a>] [<a href=\"https:\/\/www.eff.org\/files\/2018\/08\/29\/starwars_8k_2018.txt\">TXT<\/a>]<\/li>\n<li>Harry Potter\u00a0[<a href=\"https:\/\/www.eff.org\/files\/2018\/08\/29\/harrypotter_8k_3column.pdf\">PDF<\/a>] [<a href=\"https:\/\/www.eff.org\/files\/2018\/08\/29\/harrypotter_8k_3column-txt.txt\">TXT<\/a>]<\/li>\n<li>Fandom Passphrase Worksheet [<a href=\"https:\/\/www.eff.org\/files\/2018\/08\/29\/fandom_diceware_worksheet.pdf\">PDF<\/a>]<\/li>\n<\/ul>\n<p>(Note:\u00a0Any trademarks within the wordlist are the property of their respective trademark holders, who are not affiliated with the Electronic Frontier Foundation and do not sponsor or endorse these passwords.)<\/p>\n<h3 class=\"my-4\">How We Created the Wordlists<\/h3>\n<p>A diceware passphrase is just a set of rare and unusual words that is\u00a0<a href=\"https:\/\/xkcd.com\/936\/\">easy for humans to remember, but hard for computers to guess<\/a>. When we set out to create fandom-specific wordlists, we weren\u2019t sure where to gather unique but relevant words.<\/p>\n<p>Official encyclopedias for Star Trek and Star Wars only had hundreds of entries\u2014nowhere close to the thousands of possible rolls of three 20-sided dice.<\/p>\n<p>So, we began to look at the FANDOM Wikia pages for various science fiction and fantasy universes. At first, we tried using the unique page titles for sections like Memory Alpha and Wookieepedia.<\/p>\n<p>While we were easily able to gather enough words for wordlists, too many of the words were complicated, obscure names or words from fictional languages. They would have been too difficult for most fans to memorize\u2014and memorability is one of the key features of diceware technique.<\/p>\n<p>Instead, we narrowed in on some of the most popular pages for various fandoms, such as limiting ourselves to the main Star Wars films,\u00a0a selection of\u00a0Star Trek episodes from the original series and Discovery,\u00a0the Harry Potter books, and a few episodes from each season of Game of Thrones. Then, we filtered the text of each page to just its unique words.<\/p>\n<p>As a result, our wordlists are mostly regular English words with a distinct flavor of the corresponding fandom.<\/p>\n<p>Each wordlist is 4,000 unique words, repeated once to match the possible 8,000 outcomes of the three 20-sided dice.<\/p>\n<h3 class=\"my-4\">The Math<\/h3>\n<p>For this method, it\u2019s important to use carefully constructed wordlists. It\u2019s also important that the user not modify the words after they\u2019ve been chosen or re-roll for new words because they don\u2019t like the original ones that came up.<\/p>\n<p>This process relies on randomness\u2014so, the second some words on the list are prioritized over others or changed in the generation process, the mathematical analysis starts to fall apart.<\/p>\n<p>To see why, we need to understand how to analyze the security of a passphrase.<\/p>\n<p>Let\u2019s assume an attacker trying to crack our passphrase knows the method we used (in this case, a particular fandom wordlist and three 20-sided dice). We also assume the attacker is going to use the most effective attack for that particular method.<\/p>\n<p>For our method, that means trying all combinations of words in the wordlist, rather than, say, trying every individual letter combination.<\/p>\n<p>Assuming the attacker knows that our passphrase is made up of words from a particular list, then the security of a passphrase is determined by how many possibilities there are.<\/p>\n<p>In our wordlists, there are 4000 words, and we\u2019re choosing five of them, so the number of possibilities is 4000 times 4000 times 4000 times 4000 times 4000, which is about 10<sup>18<\/sup>possibilities. Around 10<sup>18<\/sup>\u00a0to 10<sup>24<\/sup>\u00a0is usually a good number to aim for, for most people. The easiest way to increase this number is by adding another word to the passphrase using the same dice-rolling method.<\/p>\n<p>How long will it take for an attacker to crack this password in practice? That number depends on how fast the computer is. Using a desktop today, computers can try about 15 million passwords per second. The world\u2019s fastest supercomputer can try about 92 trillion passwords per second.<\/p>\n<p>If you assume the attacker has a copy of the wordlist you used and a computer that can try 15 million passwords a second, it would take them over two thousand years to try every possible combination, cracking the password in just over a thousand years on average.<\/p>\n<p>The world\u2019s fastest supercomputer could crack that same password in an hour and a half on average, but not to worry: adding two more words to the password increases that time to almost three thousand years for even the fastest supercomputer.<\/p>\n<p><a href=\"https:\/\/www.eff.org\/deeplinks\/2018\/08\/dragon-con-diceware\" target=\"_blank\" rel=\"noopener\">EFF<\/a><\/p>\n<h3 class=\"my-4\">Now read:\u00a0<a href=\"https:\/\/mybroadband.co.za\/news\/cellular\/273697-gauteng-shopping-mall-mobile-data-speeds-vodacom-vs-mtn.html\" rel=\"bookmark\">Gauteng shopping mall mobile data speeds \u2013 Vodacom vs MTN<\/a><\/h3>\n","protected":false},"excerpt":{"rendered":"<p>Here\u2019s the not-so-secret recipe for strong passphrases.<\/p>\n","protected":false},"author":23,"featured_media":187163,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27],"tags":[21797,35,20179],"class_list":["post-273963","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-eff","tag-headline","tag-password"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/273963"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/23"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=273963"}],"version-history":[{"count":2,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/273963\/revisions"}],"predecessor-version":[{"id":273971,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/273963\/revisions\/273971"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/187163"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=273963"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=273963"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=273963"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}