Password Length vs Complexity: Why Longer Always Wins

Every site that you log into wants a capital letter, a

number, and a special character.

But guess what?

None of that matters as much as how long your password is.

Dr. Mike Saylor joins Prasanna and me to explain why.

Mike is the co-author on Learning Ransomware Response and Recovery,

and he's got receipts, including 20 terabytes of pre-computed password

hashes that you can just go buy, uh, which is the reason that nobody even

bothers cracking passwords anymore.

They just look 'em up.

There's a hard limit to how far these guys have gotten, and, uh,

get past that limit and your risk goes way down, for now at least.

We also get into why some LastPass customers lost everything and others

didn't, whether passphrases actually work, and if forcing people to rotate their

passwords does anything but annoy them.

If this is your first time watching or listening to me, I'm

W. Curtis Preston, AKA Mr. Backup.

I've been obsessing about backup, recovery, and now cyber

recovery for over 30 years.

If that's your bag, I'm your guy.

You're not gonna find anyone that cares about this topic more than me.

Ever since 1993 when I had to tell my boss that there were no backups of

the database that we had just lost.

Now I've written five O'Reilly books, a blog, and this podcast.

Here we turn unappreciated admins into cyber recovery heroes.

This is the Backup Wrap-Up

Welcome to the Backup Wrap Up.

I'm your host, W. Curtis Preston, and I have with me once again the flowing

mane of hair from Prasanna Malaiyandi.

How's it going, Prasanna?

I'm good, Curtis.

I know.

I was like, "Who is he talking about?"

Yeah, I think we know who we're not talking about.

Just saying.

You doing all right over there?

could also say his beard is, know

Yeah, I'm just, I'm just, I'm trying to become Mike is what I'm doing

here with the… It's just creeping further and further back on everything.

But anyway, speaking of Mike, thanks for joining us again, Mike

Sure.

Thanks for having me.

once again Dr. Mike Saylor, and he is my co-author on the book that

is over my right sh- left shoulder.

if you're watching us on YouTube, it is Learning Ransomware Response and

Recovery, which, came out in, March.

And, selling like hotcakes, at your local bookstore.

I doubt it's at your local bookstore, but you can order it at your

favorite internet-based bookstore, wherever that happens to be.

and, I will say if you order it directly from O'Reilly, you and I

make a little bit more money, but I don't know if anybody cares about that

Is, is the audio version available?

The audio version is available on, on Amazon.

if

ask me about that recently

Yeah.

Yeah.

it is really weird to hear your book read to you by someone else.

I just, I have actually listened to the audio version, and it was just odd, right?

but yeah, it is available, and for those of you that like to listen

to audiobooks, it's a page-turner.

What do you call that with, in an audiobook version?

Anyway, we're working through the book and going through a couple of

different topics, and today we're talking about password managers.

And we can talk about something that's come up a lot here, our least favorite

password manager, that would be LastPass, and why is that, Prasanna?

Why have they come up more than once on the pod?

Boy, because they were and all of the password vaults that people were using

were stolen, and then they sort of covered it up and said, "No, don't worry about

it. It's okay. They didn't really get the password vault." And then it was found

out they got the password vault, and then it was found out, yes, these password

vaults could be cracked, and supposedly people with a bunch of cryptocurrency

have had their wallets drained.

Whether or not they're necessarily related, it's hard to say definitively,

but it looks like there is a pattern

I think at least one blogger says that he believes he has proof that

the, the, that it, that what was happening is directly related to the,

y- you know what I'm trying to say.

Dang it.

Oh, and, oh, one

yeah

add to that is, what ended up happening was LastPass was backing up the vaults,

and they had a custom script in order to be able to do that, and they had

hard-coded the password the script in order to be able to do the backups

No bueno.

The reason why that's relevant to the topic at hand is the people who had their

passwords actually fully compromised were the ones that had passwords that

were short enough to guess, right?

and so because when you have a password manager that isn't a complete

piece of crap, it's not storing the passwords in plain text, right?

It's storing the passwords encrypted with some salt, right?

So the only way to guess a password is to encrypt it similarly and then

compare the encrypted result, right?

And the people who had their passwords ultimately stolen via this hack is

because their passwords were two things.

They were short enough, and also they were encrypted with

an older version of the product.

And so it was, I think the salt was smaller or something like that, right?

and so those two things together.

So really when we put all that together, we have the phrase that comes up a lot,

Mike, which is length over complexity.

when we think about all of the things that we've done to make passwords more

secure, one of the things anybody who's logged in any- anything in the last,

I don't know, 20 years has been told, "Nope, that password's not secure enough.

You need to add a, a capital letter." And then it's oh, you need to add a, a,

you know a number. And then it's like, "Oh, you need to add a special character.

No, not that special character." and, by the way, there's actually a comedian

that I saw do this bit where he, Y- what, you know the one I'm talking

about, right? Where he just one by one adds… Yeah, and so the people, they're

like, hey, we're gonna change the S to a dollar sign. They'll never guess

that." so that's complexity, right?

The, making the password more and more complex.

And I use a password manager, and one of the things that it

does is it automatically creates a super complex password.

But what do we mean when we say length over complexity?

it's a math problem.

so the longer your password is, the longer the math problem is.

So if you've got a eight-character password, even with complexity, you're

st- it's still eight characters.

still the same eight-character math problem.

that's a math problem if your is to do math, like I'm gonna

try and crack this password.

Nobody does that anymore, and they haven't for a long time.

If you're a legit password-cracking bad person, you're gonna go buy tools, and

you mentioned this already, if I've got an eight-character encrypted password,

I just need to go encrypt stuff until the encryption, the, the encrypted

password looks the same as this one.

Right

So that's a ha- they call that a hash.

So the encrypted password results in a hash value, and that's

the result of a math problem.

I just need to go encrypt a bunch of stuff until I come up with the same math answer

you went through to encrypt your password.

there's a project, and it's been going on for years, called Rainbow Tables,

and you can go to their website and buy six terabytes of math answers.

Oh, where they've already encrypted, encrypted a bunch of passwords?

still do this.

they've done this 24 hours a day, seven days a week, across

every platform that's out there.

It's a nonprofit organization.

that was my air quotes.

and you can buy the entire database of encrypted hashes with the,

respective clear text password.

And so now you're not doing math, you're just comparing all the hashes

that you wanna look up, and that's really what it is, and you're looking

it up in this Rainbow Table database.

I think the, the version we purchased, man, eight or years ago was, it was

up to six terabytes of text files.

A

that's a lot of text files!

And and just to give you an example of how much data that is, just

doing the lookup took three days.

That's how much data there was.

But yeah, if I can get your encrypted eight-character password, your

hash, I'm just gonna go look it up.

That's why passwords are irrelevant today, and that's why it doesn't mean,

it doesn't make sense to force users to change passwords every 30, 90, 100, and

whatever days, unless you're a regulated industry that's a checkbox you gotta do.

Because if a bad guy can get the hash, they can get the password

Like, question for you on the hash, because I know sometimes when hashing

you can pass in a salt, right?

Or something, a variable, if you will, in order to ensure that what

comes out isn't always the same.

In the case of the passwords that are being generated and the

hashes here, is that not the case?

It is, and that's why I meant, so the, the rainbow tables, they're,

creating these across all of the available systems in their project.

So Linux, all the different flavors of Linux with Salt, Linux without

Hmm.

Windows, every version of Windows with LTM, LAN, hashing, on, with it

turned off, Cisco VPN, Office 360.

they're, everything that they can get their hands on to do these, math problems,

they're doing it, and they're creating a catalog, and they're selling it

Wonder, I wonder how many different types of systems they're doing that for

I will ask while we are talking

The, that, that's actually both fascinating and terrifying

all, all at the same time.

so i- if there's just a database then of all of the available passwords and hashes,

z- from those passwords, why then do we care about, com- length of a password?

'Cause it's still a math problem.

so eight characters is obviously an easier math problem than 15 characters.

but it also, lends itself to Difficulty.

And so when someone sits down at your desk and tries to guess your

password, they're gonna look around at all your notes and all that stuff,

and they're gonna, my dog is hal.

the longer that password is, the longer it's gonna take them to figure it out.

And the more times they try to figure it out, hopefully you've got your

system configured to that user account after so many failed login attempts

Is it the case that given that this project has been running for 15 years,

and given the fact that they have to, support, for lack of a better word, so

many different systems, that they have to do this, this password, for every

different system that they support, can we assume that they haven't gotten very

far in terms of length of passwords?

doing some research on the Rainbow Tables project, they, their hashing,

activities include LM, NTLM, so LanMan, NT La- NT LanMan, MD5, SHA-1,

and only-- they're currently only up to password length of 10 characters.

And having done all of that, the database is currently at just over 20

20 terabytes of text file

they've yet to, to really expand, let's see, common hashes, MD5,

SHA-1, SHA-256, and SHA-512

Hey

is where they're at.

Like one of the things

AES

what does that mean, by the way?

For the, for those that don't know what you're talking about, what, when

we talk about SHA-1, SHA-256, SHA-5, what, what are you talking about there?

So the MD5 is the fifth version of a, of an encryption or hashing algorithm.

so fingerprinting a file.

and the same thing with SHA.

SHA-1 is the first version of SHA, and I can't remember what SHA stands for.

but they're, they've been around forever, probably 40 years at

Ever.

Yeah.

and then SHA-256 and SHA-512 are the size, so 256-bit, 5- 512-bit, the size of

that encryption value or that hash value

And so that, that, that's gonna… The, so when we say SHA-512,

doesn't it mean that it's a f- is the, the hash is 512 bytes long?

Is that what that means?

That's correct.

Yeah.

similar like AES 256, AES 512, it's the, the, the bits in the encryption value.

And

But I'm

when you, look at how long do I need… How long would it

take to, to crack a SHA-512?

It's like 300 years if you do the math.

don't have to do the math anymore.

You just have to compare… You just have to capture the hash then go compare it

to somebody else that's already done the math or done the exercise the same hash.

One, and by the way, those are all just current day problems.

the quick evolution of quantum computing, even more complicated

encryption and hash values that I can capture today, I don't have to wait

300 years to break that, that math.

I just have to wait another five or 10 until quantum computing's available

for me to throw that at it and have it you know, decrypt it in real time.

This is why people don't like you, Mike

there's a whole lot of bad guys that are just, capturing encryption

now s- and knowing that they'll be able to decrypt it in the next

couple years in a fairly near term

Yeah.

See

quantum safe algorithms now, right?

In order to be able to handle the upcoming that yes, everything

you're doing now can be cracked

Right.

But having said that, at least the current technology that's available, right?

There is a table that we used in the book that, basically gives a, a certain

number of years that it would take to crack a password of a certain length.

And so I believe the current recommended size is at least 16 characters.

Does that sound about right, Mike?

I would say so.

and a- along those lines, the longer the password gets, the

more ridiculous the word gets, like supercalifragilistic, right?

That might be a word, one-word password, but y- really gotta evolve, migrate

away from passwords into passphrases.

passphrases starts touching on the next evolution of MFA, that's cognitive MFA.

It's like only you would know that part.

only you have experienced that thing, so only you would know, what the

missing piece is or what the answer to this question is or… it's very

similar to, I wanna do my credit report, and so my credit, the reporting

agencies know everything about you.

And so it's not just your name, Social Security number, your date of birth.

They're like, how much is your car payment?

How much, when, what's the address you lived at when you were 20 years old?"

Right

So those are cognitive things, or for the most part.

if I did enough reconnaissance on you, I could probably figure those things out.

It wasn't breached or leaked

Yeah.

it's more personal than just the data that might be part a profile or

what I find super frustrating is when I get one of those cognitive

tests and I don't pass it.

For me, that's very frustrating.

They're like, "Which of the following, which of the following addresses

is associated with you at some point?" And I'm like, I don't know.

I think… I don't think it's any of them, but…"

And then they're like, "Sorry, we could not, authenticate you."

And that is a sneaky question.

Sometimes they give you a list and the right answer is none of these.

yeah.

so I, I, that, by the way, I… Go ahead

So Mike, it's interesting you talked about sort of moving

from passwords to passphrases.

Do you know if there's been re- Because I know s- sometimes it's hard to remember

passwords, Which is why people in the past tended to use the same password

over and over and over everywhere, right?

Or some variation.

passphrases, do you know if been research done to figure out, like,

are people able to remember these a lot easier than the passwords that

you used to have for individual sites?

Don't know that.

But I think the approach would be similar.

so with your passwords, you're not supposed to use the same

password for different things.

So you've gotta come up with a way of remembering what

password goes with what thing.

very similar with your passphrase.

passphrase should help you relate the phrase to whatever

it is you're logging into.

if you're logging into work, your passphrase could be, "I really

wish I didn't work here," or, "I'd rather be fishing," right?

so y- 'cause that's something you feel or comes to mind when you go to log in.

versus your bank, I love rolling in cash." something like that. my

account's not negative again." But, something that's related to what it is

you're logging into is very helpful, and that's the, it's individualized.

So whatever it is that you've had to do to remember the password for this

thing, yeah, I think you would carry that forward to developing a passphrase

for that, along those same lines

The, I, I guess may- maybe because it was a pretty long time ago that I migrated

to everything being in a password manager, and so I don't even, I don't

even go down that… I never went down that path of thinking about passphrases.

But I think if I would, if I did that, I would use it for

a handful of accounts, right?

Where, 'cause I, I can't… There's no way that my brain could remember the

passphrases for as many as o- as many online accounts as I have, so that's

why I've got to have a password manager.

But I can see potentially using that, like you said, for logging

into work, for logging into, a s- a smaller set of critical things.

Is that, does that seem appropriate?

and I'll add to that, we've talked about this Rainbow Tables project.

When they're taking dictionary words and combinations of dictionary

words, dirty cat, big dog, right?

So they're doing that in an effort to create these encrypted

hashes for your lookups.

what becomes exponentially harder and will dura- you know, draw out

the duration of their project so much longer are these passphrases.

Curtis's password might be, "The big dog, eats steak." Prasanna's could

be, "The big dog eats steaks," plural.

those two passphrases are completely different and when you

encrypt them and hash them, even though there was only one letter.

then what if the big dog eats steaks, back to that, that comedian where,

I'm gonna replace E's with threes, and I'm gonna capitalize the first

letter of each word, things along…

So that, that completely changes the hash value, and that, that is so much

further down the line of the Rainbow Table project, math problems than

just the simple word combinations.

And many words there are in the American dictionary, guess, there,

there's probably a math formula for figuring out how many passphrases

that you can make in, 16 characters.

Exponentially harder than the 10 character password combinations

Yeah.

So when we talk about work, is it, does it make sense to, for work

passwords, where we're using passwords and not pass keys, does it make sense

to mandate a password length then?

Yes

and,

I think 16 characters is appropriate

Yeah.

By the way, speaking of things that annoy me, you know what annoys me?

Is sites that go, "I'm sorry, your password is too long," or, "I'm sorry,

but your password is, has a special character that we don't like." Those two

things really annoy me, 'cause I've gone to 20 characters wherever I can, right?

and and they're like, "I'm sorry, that's too big

My favorite is thinking I'm using the right password, for it only to not

work, and then I forgot my password.

So you change your password to the one you thought you were using, and it says you

can't change it to the current password.

I just tried that

Yeah, I've seen that.

or the, the, "I'm sorry, you can't change it to that 'cause that was

a previous password." some of them have they track the last three

passwords and, and you can't change it

too.

I know it's frustrating to some people, important because that previous

password may be the one that was compromised in some breach some time ago.

So you're safe today because you're using a new password, but if

Right

to use an older password, it could have been one that was compromised.

So

And that's why they do it.

good policy

yeah, I, yeah, I'm not saying that was one ano- that annoys me, but

it's annoying when it happens when you're trying to do something, right?

And I'll add this too.

I mentioned that 16 characters I think is appropriate, but it does depend on

all the other stuff that you m- you're h- hopefully doing or could do mitigate

the risk of an il- an illegitimate login or someone stealing your credentials.

There are so many other settings and tools and layers that you could

hopefully put in place or are in place that could mitigate the risk of a

shorter password or even a compromised

Prasanna, one of the things that we talk a lot about is password managers,

and when we're talking about using this for work, there's thing we,

there's a, there's enterprise-wide or commercial level password managers.

y- you have any thoughts on that?

yeah, no, I think enterprises should be using a password manager because

otherwise people are gonna be y- storing passwords in their web browser or using

the same passwords across multiple systems, all the rest of those things

which you don't want as an enterprise, especially if you have, like, admin

level accounts or things like that.

And so I think going with an enterprise solution or a single sign-on solution,

I know Microsoft has one with, I think it's now Entra, And, or you can look at

Okta or any of these other companies in order to be able to provide this sort

of mechanism so you don't necessarily need to remember all the passwords,

which I know that SSO is slightly different than a password manager, but

I think it sort of solves the same issue

Yeah, SSO is very different, right?

But you can connect a number of applications, especially SaaS

applications, to your SSO and, it would, I would argue that a strong sing- s-

a strong s- single sign-on system is probably, there's no probably, is more

secure than 150 different passwords that I am forced to store in a password manager.

If we can have a single, to go back to the previous episode, MFA protected, phishing

resistant, MFA protected single password that I need to use for work, that is

then going to have policies enforced on it, that to me is much more secure than

any password manager, and that way you can say, "Just use this one password."

Having said that, I'm still not a fan when we talk about like Entra

ID, I'm still not a fan when we start talking about backup systems.

I'm not a fan of having, them stored in the same whatever you have,

either SSO or, password manager that you have for the company.

I don't like that because if it's ultimately compromised,

then, that's a, a problem.

Mike, you talked a, a little bit about this and one, final thought about,

passwords is that, this idea of forcing people to, automatically rotate.

I know there's some situations where that might be a good idea, but in general, my,

my opinion has been in general enforce a really long password and, a- and then not,

and then don't force people to rotate it.

Any, any thoughts on that?

Yeah, this kind of goes back to my comment on, it depends.

It depends on what else you're doing, and it depends on why you

need to enforce a, a password change, whatever the frequency is.

If it's six months or one year, why?

Why are we doing that?

regulatory compliance requires it.

know, CMMC or the, cybersecurity maturity model for organizations

that do business with the US government, have to have that setting.

They have to do it.

so why?

Why do we have to do it?

If you don't have to do it, why is it there?

it there because we're lazy, and I need somebody to tell

me when to change a password?

Are we lazy on the IT side, where we're not reviewing system access enough,

and I'm gonna rely on that password expiring to save my butt from having

not disabled that user when they left two months ago, So there's that.

it's why.

if you can, absolutely enforce longer passwords, and if you've got other

good controls in place like MFA, login and session restrictions, session

timeouts, all these other good things, risky sign-ins, geographic limitations,

concurrent logins, not being able to log in locally for, privileged accounts.

there's so much you could do, and if you're doing good stuff, then absolutely

you can rely on passwords a little longer

The, the, the one thing I wanted to ask is, does your position

change on password expiration if they're using a password manager?

as a … Like, if for instance, the main password to access a password manager

expired, but the individual passwords for the individual services rotated, as an end

user, it's no different if I have to reset that password other than sort of having to

go and go through the reset flow, right?

But I don't need to remember anything other than my master password, right?

So does it really make a difference?

Depends.

It's, I'm gonna get a shirt that just says, "It depends," or wear a hat.

One of the two.

it depends.

So how religious are you at protecting your password

manager and that one password?

if, I'm able to get on your machine while you're doing your password

manager, and I can see all that stuff, then it doesn't make any difference.

If it's on a USB drive and you let your grandkids y- chew on that like a

pacifier, it's probably not a good idea.

j- it just, it truly depends, and it, and on a personal note, you've gotta, assess

your own risk, and on, from a company perspective, it comes down to the weakest

link, and the weakest link are people.

And if you're relying on just that one pass- It's, and it's no

different than single sign-on.

Single sign-on is great from a usability and sometimes from a security perspective,

but I've been on so many incident responses where the, the user credentials

were compromised, legitimate-looking login to the environment that gave

that bad guy access to everything.

And so very similarly, it's just the one key that unlocks

everything, and, I don't know.

It depends

That's sort of like the opposite of what you would want in cybersecurity

with isolation and sort of fault domains and everything else.

Yep.

That's one of the reasons I'm glad the smart grid initiative fell

apart, where all the people's, everybody's power meters and all that

Mm-hmm.

are all gonna be talking and all this, just

Simplicity is the friend of the bad guys.

You want complexity.

The more complex something is, the less… more effort it's gonna take,

and, bad guys are lazy for the most part.

Yeah, it's that eternal war between complexity and usability, right?

or security and usability, right?

That you, again, my personal opinion for what it's worth is to simplify

it as much as possible for the user, but add that security, right?

If you make it too complex, if you make it too much of a pain in

the butt, if they're able to go around it, they will go around it.

and Mike, you talked about, in our pre-call, you talked about,

an environment where you said that you would enforce something on

laptops and then what happened?

Yeah, I was hired by an organization to become their chief security

officer because of a security event.

event was, two field employees working out in the field, stopped at dinner somewhere.

bad guys broke into their car, stole two laptops.

The laptops had a combined three hundred years of client data on them.

So they hired me to figure out what happened and how do we

prevent this from happening again.

One of the solutions was new laptops, 'cause the older ones couldn't…

weren't capable of these new controls.

New laptops, encrypt the hard drives, integrate the encryption password and

the BIOS and the Windows into a So you, you log in with your credentials, you

have to scan your fingerprint, and that's the multi-factor, something you know,

something you have, or something you are.

and then so we deployed that, fifty laptops out to the field.

Forty-nine people complained and completely resisted, "We

will not use this laptop."

One other thing I do wanna add, as far as the description of the controls,

the laptops had cameras, on the lid, and the camera would actively

look for the presence of a person.

So it's not, taking pictures of you.

It just wants to know there's a person in front of the computer so

that when I get up and move away, it automatically locks the screen.

So just more security controls.

But forty-nine of fifty people said, "It violates my privacy. I'm old, I don't

have good fingerprints, so that's a, an accessibility violation." All this stuff.

And so for all of the months of work we put into implementing security,

politics defeated it all in a week.

And we had to shut it off and let 'em do things the way they used to do it.

But that was a business decision.

It went Very well

going back to something we talked about on the last episode, the idea being that

perhaps this is something, these things like enforcing really long passwords,

enforcing MFA, and other th- these things like you talked about with the

laptops, that perhaps if you can start with the, the privileged accounts, right?

It's a smaller number and it's, it's a group of people that theoretically

would be, what do you call it?

Would be more amenable to this type of control.

All right.

thanks again, Prasanna, for your, your wisdom as well

I'm gonna figure out how long of a passphrase I can start creating.

Thanks, Mike

You're welcome.

Mine's 24

Nice.

All right.

And once again, thank you to the listeners.

You're why we do this.

And, buy my book.

All right.

Have a good day

The Backup Wrap Up is written, recorded, and produced by me, W. Curtis Preston.

If you need backup or DR consulting, content generation, or expert witness

work, check out backupcentral.com.

You can also find links for my O'Reilly books on the same website.

Remember, this is an independent podcast, and any opinions that

you hear are those of the speaker and not necessarily an employer.

Thanks for listening