{"id":1296,"date":"2024-12-14T13:09:10","date_gmt":"2024-12-14T12:09:10","guid":{"rendered":"https:\/\/mindynamic.com\/en\/?p=1296"},"modified":"2025-05-02T12:09:48","modified_gmt":"2025-05-02T10:09:48","slug":"secure-passwords-in-the-age-of-ai-what-really-matters","status":"publish","type":"post","link":"https:\/\/mindynamic.com\/en\/2024\/12\/14\/secure-passwords-in-the-age-of-ai-what-really-matters\/","title":{"rendered":"Secure Passwords in the age of AI: What Really Matters"},"content":{"rendered":"\n

For decades, we\u2019ve been taught to create passwords using a combination of numbers, uppercase and lowercase letters, and special characters. But is this really the best approach? Are there perhaps other ways to generate secure passwords and how does AI help attackers to crack passwords? In this post, we will explore these questions.<\/p>\n\n\n\n

Although current efforts increasingly aim to minimize the use of passwords \u2013 for example, through passkeys \u2013 passwords will remain with us for the foreseeable future. They are especially essential in the realm of system access and accounts, where authentication via a password or secret remains the most common method.<\/p>\n\n\n\n

Password Entropy<\/h3>\n\n\n\n

A secure password is defined by a level of complexity that makes it economically impractical for attackers to crack. The complexity of a password can be increased in two ways \u2013 either through a larger character set or by increasing the password length.<\/p>\n\n\n\n

To calculate password complexity, the concept of password entropy is used. This is measured in bits and indicates the actual strength of a password.<\/p>\n\n\n\n

Before diving deeper into this, let’s first take a look at how long it takes to crack passwords with different character sets and lengths. The table below is published annually by Hive Systems:<\/p>\n\n\n\n

\n
\"Brute<\/a><\/figure>\n<\/div>\n\n\n\n

It is based on a so-called brute-force attack, meaning that all possible combinations are systematically tested. More about the different types of attacks will be covered in the next chapter.<\/p>\n\n\n\n

So, what do these numbers from the table mean? Does this mean that it always takes exactly that long to crack a password with the corresponding complexity?<\/p>\n\n\n\n

No, the values in the table represent a worst-case scenario. This means that all possible combinations must be tested to find the correct one.<\/p>\n\n\n\n

For example: A password with 8 uppercase and lowercase letters could take 8 months to crack in the worst case. However, it’s also possible that the password could be found much earlier. The more complex a password is, the less likely it is that it will be randomly cracked quickly. This is why it’s important to allow some flexibility in complexity.<\/p>\n\n\n\n

One thing to consider: <\/strong>the tested passwords where hashed with bcrypt, one of the gold standards in password hashing. This hashing algorithm is slow on purpose. If the tested passwords would have been hashed with a fast algorithm like SHA, the search could be faster by a factor of a million!<\/p>\n\n\n\n

What can we learn from the table?<\/h3>\n\n\n\n

The table shows that a secure password can be created with relatively few characters when a complex character set is used\u2014comprising uppercase and lowercase letters, numbers, and special characters.<\/p>\n\n\n\n

More importantly, we also see that it is possible to create secure passwords with a smaller character set.<\/p>\n\n\n\n

For example, a password made solely of random numbers, when 18 characters long, can be considered secure.<\/p>\n\n\n\n

Why is that?<\/h3>\n\n\n\n

This is where password entropy comes into play.<\/p>\n\n\n\n

Let\u2019s take a password with 10 characters and a character set consisting of uppercase and lowercase letters, numbers, and symbols (a total of 32 characters). This password has an entropy of approximately 66 bits, or about 1.8 \u00d7 10\u00b9\u2079 possibilities (18,446,744,073,709,551,616).<\/p>\n\n\n\n

Now, comparing this with an 18-character password made only of numbers, we get an entropy of 60 bits\u2014just 6 bits less.<\/p>\n\n\n\n

So, we conclude: The entropy of a password is what matters most, not necessarily the use of different character types or symbols.<\/p>\n\n\n\n

Principles for Secure Passwords<\/h3>\n\n\n\n

Before we dive into what really matters when creating secure passwords, let’s first take a look at some basic best practices:<\/p>\n\n\n\n