Password strength 4459886 224492145 2008-07-09T02:24:35Z NimblyPimbly 7316319 /* Guidelines for strong passwords */ '''Password strength''' is a measurement of the effectiveness of a [[password]] as an [[authentication]] credential. The strength of a [[password]] is a function of length, complexity, and randomness.<ref name=CERT>{{cite web | url = http://www.us-cert.gov/cas/tips/ST04-002.html | title = Cyber Security Tip ST04-002 | work = Choosing and Protecting Passwords | format = [[HTML]] | publisher = US CERT | accessmonthday = April 10 | accessyear = 2008}}</ref> Although passwords serve an essential role in [[computer security]], they must also be reasonable and functional for the end user. Passwords that are too strong will almost certainly be written on paper, which some consider a security risk.<ref name=Gartner>{{cite web | url = http://www.indevis.de/dokumente/gartner_passwords_breakpoint.pdf | title = Passwords are Near the Breaking Point | format = [[PDF]] | publisher = Gartner | Author = A. Allan | accessmonthday = April 10 | accessyear = 2008}}</ref> In contrast, others argue that forcing users to only remember passwords necessitates weak passwords, and thus poses a much greater security risk. After all, most people are good at securing their wallets or purses, which is a "great place" to store a written password. <ref name=Schneier-writedown>{{cite web | url = http://www.schneier.com/blog/archives/2005/06/write_down_your.html | title = Schneier on Security | work = Write Down Your Password | format = [[html]] | Author = Bruce Schneier | accessmonthday = April 10 | accessyear = 2008}}</ref> Using strong passwords lowers overall [[risk]] of a security breach, but strong passwords do not replace the need for other effective [[security controls]]. Risks are posed by several means of breaching computer security which are unrelated to password strength. Such means include: [[Vulnerability (computing)|software vulnerabilities]], [[phishing]], [[keystroke logging]], [[Social engineering (security)|social engineering]], [[dumpster diving]], etc. ==Determining password strength== There are two basic approaches. One is to evaluate passwords along lines suggested by criteria from any of several sources, including standards organizations. The other is to assure that any password chosen not be in categories likely to prove insecure (eg, one's own or children's name, phone number, birthday, ...). Both approaches are discussed below, from more than one perspective in several cases. === Bit Strength === A common criteria for analyzing password strength is to calculate its "bit strength", which is also used in calculating the strength of [[encryption]] keys, though the two are not identical cases.<ref name=NIST /><ref name=Gartner /> Bit strength is the total number of possible permutations in a password. For example, a password with eight-bit strength has 256 different possibilities (ie, 2^8). Passwords are usually composed of [[ASCII]] characters; the printable ASCII character set includes lower case and uppercase letters, in addition to digits and symbols (punctuation included). Although characters on most computer keyboards produce eight bit characters in most modern computer systems, characters used in passwords rarely use eight bits. The reason is that not all 8-bit ASCII versions are identical, while all have the same characters in the first 128 (ie, 7-bits) positions. This produces 6.5 bits of 'strength' at a maximum.<ref name=Gartner /> ==== Calculating Bit Strength ==== Bit strength can be calculated by taking the total number of possibilities for each character in a proposed password, and multiplying by the total password length. The number of variations per character is contingent upon: * [[Password policy]], which may require a certain composition for a password (eg, maximum length), or exclude certain characters. The space character is often prohibited as are some kinds of punctuation; the prohibitions are largely due to system conventions and differ from system to system. * [[Information entropy]], of the password. This is often taken, incorrectly in some respects, to be its 'randomness'. For example, ignoring entropy, a password policy requiring that passwords contain lowercase letters, uppercase letters, numbers and symbols results in 95 variations per character (for ASCII character passwords), which equals 6.5 bits and will impose a certain cost on attackers using a brute force attack. If the password is eight characters long, the bits-per-character is multiplied by the overall length (6.5 x 8) to produce the total bit-strength (52 bits). Increasing the password size will increase an attacker's work factor (a term coined by Shannon), which is generally desirable. ==== Entropy and Bit Strength ==== Whereas a password policy usually sets a theoretical limit for the number of variations per character, the information entropy considerations are required to determine the effective number of variations per character. [[NIST]] uses the following scheme to estimate password entropy (ie, randomness)<ref name=NIST>{{cite web | url = http://csrc.nist.gov/publications/nistpubs/800-63/SP800-63V1_0_2.pdf | title = Electronic Authentication Guideline | format = [[PDF]] | publisher = NIST | accessmonthday = March 27 | accessyear = 2008}}</ref>: * the entropy of the first character is four bits; * the entropy of the next seven characters are two bits per character * the ninth through the twentieth character has 1.5 bits of entropy per character; * characters 21 and above have one bit of entropy per character; This suggests that, in the absence of a password policy, an eight-character password has an 18-bit strength. Yet, even with a password policy requiring at least one number, one symbol, and mixed case, an eight-character password only achieves an estimated 30-bit strength.<ref name=NIST /> ==== Bit Strength Threshold ==== Some basic benchmarks have been established for password bit-strength to protect against certain types of [[password cracking]]. In 1999, [[EFF DES cracker|an Electronic Frontier Foundation project]] broke 56-bit [[DES]] encryption in less than a day using specially designed hardware.<ref name=EFF-deep-crack>{{cite web | url = http://w2.eff.org/Privacy/Crypto/Crypto_misc/DESCracker/HTML/19980716_eff_descracker_pressrel.html | title = EFF DES CRACKER MACHINE BRINGS HONESTY TO CRYPTO DEBATE | format = [[HTML]] | publisher = EFF | accessmonthday = March 27 | accessyear = 2008}}</ref> In 2002, ''distributed.net'' cracked a 64-bit key in 4 years, 9 months, and 23 days.<ref name=distributed>{{cite web | url = http://stats.distributed.net/projects.php?project_id=5 | title = 64-bit key project status | format = [[HTML]] | publisher = Distributed.net | accessmonthday = March 27 | accessyear = 2008}}</ref> Currently, ''distributed.net'' estimates that cracking a 72-bit key using current hardware will take about 403'784.9 [[days]] or 1'105.5 [[years]].<ref name=distributed-72>{{cite web | url = http://stats.distributed.net/projects.php?project_id=8 | title = 72-bit key project status | format = [[HTML]] | publisher = Distributed.net | accessmonthday = March 31 | accessyear = 2008}}</ref> No currently expected increase in [[digital computer|computer]] power will be sufficient to break 128-bit or 256-bit encryption using random keys via a brute-force attack. Due to currently known limitations in physics, there is no expectation that any [[digital computer]] (or combination) on [[Earth]] will be capable of breaking 128-bit or 256-bit encryption via brute-force.<ref name=schneier-cyptogram>{{cite web | url = http://www.schneier.com/crypto-gram-9902.html | title = Snakeoil: Warning Sign #5: Ridiculous key lengths | format = [[HTML]] | author = Bruce Schneier | accessmonthday = March 27 | accessyear = 2008}}</ref>{{Fact|date=June 2008}}<!---Needs additional independant souce---> Whether or not [[quantum computers]] will be able to do so in practice is still unknown, though theoretical analysis suggests such possibilities. As a result, there can be no exact answer for the password strength required to resist brute force attack in practice. Clearly 56-bits is too low, whereas some may find 64-bits acceptable in the current hardware environment. NIST recommends 80-bits for the most secure passwords, which can nearly be achieved with a 95-character character set (e.g., original ASCII) with a 12-character random password (12 x 6.5 bits = 78).<ref name=NIST /> === Randomness versus Entropy === [[Randomness]] and [[Shannon entropy|entropy]] are often confused, and this difference is important in choosing passwords. A random sequence is one without a pattern, or alternatively without a generating algorithm. For instance, the number [[pi]] (3.1415926...) has no discernible pattern, passes statistical tests for randomness, and yet is useless for encryption keys or passwords as it has low entropy. Any particular segment of that sequence is entirely predictable by calculation or lookup of the digits of pi. Entropy in this context requires unpredictability (by an attacker) and pi has none, at least for an enterprising attacker. <ref name=perfect /> People are notoriously remiss at achieving entropy. Some stage magicians exploit this, in a minor way, for amusement, by divining random choices (of numbers, say) by audience members. In one analysis of over 3 million eight-character passwords, the letter "e" was used over 1.5 million times, while the letter "f" was only used 250,000 times. True entropy would have had each character being used about 200,000 times. The most common number used is "1", whereas the most common letters are a, e, o, and r.<ref name=perfect /> ==== Entropy Sources ==== Several current methods for generating entropy may improve password strength: * a [[PRNG|pseudo-random number generator]] (PRNG) is an algorithm, often implemented as a software program, which attempts to implement a [[random number generator]]. The quality of these routines has been quite variable, and they are widely thought unsuitable for use in any security context, such as when choosing passwords.<ref name=rfc4086>{{cite web | url = http://tools.ietf.org/html/rfc4086#section-6.1 | title = Randomness Requirements for Security | work = PRNG: Some Bad ideas | format = [[HTML]] | author = Eastlake, D.; Schiller, J.; Crocker, S. | accessmonthday = April 7 | accessyear = 2008}}</ref> Computer language library routines are often limited in period run length (to perhaps 2^32 or 2^64 values before the sequence repeats), and these are wholly inadequate for security use. [[RANDU]] is an infamous, very widely used, and very long-lived, incompetent random number routine for IBM mainframe environments. Some operating system calls (eg, [[/dev/random]] (though not /dev/urandom) both from the [[Linux]] kernel) are rather better. Many others, however, do not pass muster; for example, Windows 2000 and XP has had a flawed PRNG.<ref name=xp-prngbug>{{cite web | url = http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9048438 | title = Microsoft confirms that XP contains random number generator bug | format = [[HTML]] | author = Gregg Keizer | accessmonthday = April 7 | accessyear = 2008}}</ref> * a [[CSPRNG|cryptographically secure pseudo-random number generator]] is a PRNG which is intended to produce a number series suitable for cryptographic use, that is, for circumstances in which security is central. These are often dependent on hardware sources of entropy, such as a [[hardware random number generator]] (audio background noise, hard drive fluctuations, the [[Intel]] or [[VIA]] CPU randomness circuits, etc). [[Yarrow algorithm|Yarrow]] and [[Fortuna (PRNG)|Fortuna]] are software algorithms for managing the output of such entropy sources for cryptographic or security use. * Internet sites which use some of the above techniques: [http://www.random.org Random.org] (source is atmospheric noise); [http://fourmilab.ch/hotbits/ Hot Bits] (source is radioactive decay of Krypton-85). * Manual methods of entropy generation are highly unlikely to be adequate (eg, pick a character, pick another character, ...), unless bound to a mechanical system or set of rules (eg, fair dice or the I Ching). Yet, statistical methods for ensuring entropy are quite sound in the negative sense of detecting patterns (and too high entropy sequences); although they have historically failed to distinguish between sequences having adequate entropy and those with merely random appearance. It has been a tricky figure/ground point throughout the history of probability and random number generation. In that light, consider that there are 10 numbers (10.5% of the printable ASCII characters set), 26 uppercase (27.3%), 26 lowercase (27.3%), and 33 symbols (34.7%). If a sequence has this distribution, chances are that it is more random than another without this distribution, and so will be a better choice as a password. Thus, a 12-character password with four symbols, three lowercase, three uppercase, one number, in addition to a final character (most likely alphanumeric), would appear to be at least not a bad choice. But, even if one's name has such a distribution, it's still an exceptionally bad choice as a password, since it is so easily guessed. ===Character Selection & Length=== One of the components in determining password bit-strength is the set of permitted characters. The printable characters which can be produced on a typical U.S. English keyboard include 26 letters (all either upper or lower case), 10 numbers, and 33 symbols (i.e., punctuation, grouping, space, etc.). Because several ASCII characters vary between national implementations (at least four, and sometimes seven), there are about 88 printable characters which can be used nearly everywhere.{{Dubious|date=April 2008}},<!-- with regret, this is not dubious at all. The situation of assorted 7-bit ASCII character sets is long and sordid, quite indeterminate, and basically a dog's breakfast. The advent of Unicode / UCS has at least 'settled' what the lowest 128 characters are, though this is not exactly what most of the prior character sets had. --> Systems vary in which characters are allowed in passwords: often some printable characters are excluded. Some systems do not permit case differences (i.e., the upper-case "E" is considered equivalent to the lower-case "e"), others prohibit some of the remaining symbols. The space character is a rarely permitted character in passwords.{{Dubious|date=April 2008}} In a system password policy, these are alphabetic (upper and lower case), numeric, and 'special' characters. In the past few decades, systems have slowly permitted more characters in passwords, but limitations are still common. The reason this matters is that brute force and pattern matching password crackers must exert more effort ([[Claude Shannon|Shannon]] used the termed 'work factor') to find a password if there are more choices at each position. For instance, if the allowed characters are only upper case alphabetic, an eight-character password will have 26^8 possible values (about 38 bits worth). With 88 allowed characters, the same password will have 88^8 possible values (about 52 bits), a very much larger number requiring (on average) a significantly more work (perhaps prohibitive) of a successful brute force or pattern-matching attack. In addition, users commonly fail to choose passwords with high entropy (i.e., randomly) and thus make password cracking easier. For example, hacking results obtained from a MySpace phishing scheme in 2006 revealed 34,000 passwords, of which only 8.3 percent used mixed case, numbers, and symbols.<ref name=myspace-passwords>{{cite web | url = http://www.wired.com/politics/security/commentary/securitymatters/2006/12/72300?currentPage=2 | title = MySpace Passwords aren't so Dumb | author = Bruce Schneier | format = [[HTML]] | publisher = Wired Magazine | accessmonthday = April 11 | accessyear = 2008}}</ref> == Guidelines for strong passwords == Common guidelines for choosing good passwords are designed to make passwords less easily discovered by intelligent guessing:<ref>Microsoft Corporation, [http://www.microsoft.com/protect/yourself/password/create.mspx Strong passwords: How to create and use them]</ref><ref name="schneier07">Bruce Schneier, [http://www.schneier.com/blog/archives/2007/01/choosing_secure.html Choosing Secure Passwords]</ref><ref>Google, Inc., [https://www.google.com/accounts/PasswordHelp How safe is your password?]</ref><ref name="Bidwell000">{{cite book | first = Teri | last = Bidwell | title = | publisher = Syngress Publishing | year = 2002 | id = 1931836515 }}</ref> * Include numbers, symbols, upper and lowercase letters in passwords * Password length should be around 12 to 14 characters * Avoid passwords based on repetition, dictionary words, letter or number sequences, usernames, or biographical information like names or dates. === Examples of weak passwords === {{seealso|Password cracking}} As with any security measure, some are weaker than others. For example, the difference in weakness between a dictionary word and a word with obfuscation (ie, some letters in the password are substituted by numbers) may require a password cracking device to work a few seconds longer. The examples below illustrate various ways that weak passwords are constructed, all of which are based on very simple patterns which result in extremely low randomness: <ref name=perfect>{{cite book | last = Burnett | first = Mark | editor = Kleiman, Dave | title = Perfect Passwords | publisher = Syngress Publishing | date = 2006 | location = Rockland, MA | pages = 181 | isbn = 1-59749-041-5 }}</ref> * Default passwords (as supplied by the vendor): ''password'', ''default'', ''admin'', ''guest'', etc * Dictionary words: ''chameleon'', ''Red Sox'', ''sandbags'', etc * Wordlist with numbers: ''password1'', ''deer2000'', ''john1234'', etc * Wordlist with simple obfuscation: ''p@ssw0rd'', ''l33th4x0r'', ''g0ldf1sh'', etc * Wordlist doubled: ''crabcrab'', ''stopstop'', ''treetree'', etc * Sequences: ''qwerty'', ''12345678'', ''euidhtns'', etc * Identifiers: ''jsmith123'', ''1/1/1970'', ''555-1234'', etc There are many other ways a password can be weak;<ref>Bidwell, p. 87</ref> the core principle is that a password should include real entropy (usually taken to be randomness) and ''not'' be trivially derived from a "clever" pattern, nor should passwords be mixed with information identifying the user: that is the purpose of the user name! === Examples that follow guidelines === The passwords below are examples that follow guidelines for a strong password. Since these passwords have been publicly published, they should '''never''' be used verbatim. *''4pRte!ai@3'' — mixes uppercase, lowercase, numbers, and punctuation *''Tp4tci2s4U2g!'' — built from a phrase that a user can memorize: "'''T'''he '''p'''assword for ('''4''') '''t'''his '''c'''omputer '''i'''s too ('''2''') '''s'''trong for you to ('''4U2''') '''g'''uess'''!'''" — mixes types of character as well *''BBslwys90!'' — loosely based on a phrase that a user can memorize: "'''B'''ig '''B'''rother i'''s''' a'''lw'''a'''ys''' right ([[right angle]] = '''90'''°)'''!'''" — mixes types of character as well. *''tDI"60Hs7Q'' — characters selected from two stanzas by different methods from a page randomly selected using a 10-sided die. *''l52@36291QBs('' - unique serial number of a dollar bill with added random elements. ==Password Policy== {{mainarticle|Password policy}} A password policy is a set of designed parameters, often controversial, that ensure: * Implementation of strong passwords * Reasonable passwords for the user population For example, password expirations are a topic often covered by password policies. Password expirations serve two purposes:<ref name=LOPSA>{{cite web | url = http://lopsa.org/node/295 | title = In Defense of Password Expiration | format = [[HTML]] | publisher = League of Professional Systems Administrators | accessmonthday = April 14 | accessyear = 2008}}</ref> * Cracking: Considering that the time to crack a password may be 100 days, expirations that occur every 90 days ensure insufficient time to crack the password. * Compromise: In the event a password is compromised, changing it will cut off access to the attacker. Some argue, however, that password expirations have become obsolete, since:<ref name=CERIAS>{{cite web | url = http://www.cerias.purdue.edu/weblogs/spaf/general/post-30/ | title = Security Myths and Passwords | format = [[HTML]] | publisher = The Center for Education and Research in Information Assurance and Security | author = Eugene Spafford | accessmonthday = April 14 | accessyear = 2008}}</ref> * Simplicity: Asking users to frequently change passwords encourages simple, non-resilient passwords. * Cracking: In general, passwords can either be cracked in a matter seconds/minutes/days, or in a matter of decades. 30/60/90 day password changes do not make sense in that context: either change daily or never. === Handling strong passwords === Among the hardest passwords to crack are long, random strings of characters. However, these passwords are also the hardest to remember. The imposition of a requirement of strong passwords may encourage users to write them down, store them in PDAs or cellphones, or share them with others as a safeguard against memory failure. All of these increase risk of disclosure. The following measures can increase acceptance of strong password use, if carefully used: * A training program. Also, update training for those found to disclose passwords. * Reward users of strong passwords by reducing the rate, or eliminating all together, the need for password changes (password expiration). * Compensate for disclosed passwords by building a vigilant account closure process for departing users and/or a process to show each user a last login notification banner. * Automate a password reset system as a safety net. This will also reduce Helpdesk call volume concerning password resets. However, easily guessable password reset keys bypass the advantages of a strong password system. === Memory Techniques === Password policies sometimes include memory techniques for remembering passwords: *Mnemonic passwords: Some users develop [[mnemonic]] phrases that generate seemingly random passwords: for instance, the first letter of each word. Another way to make "random" passwords more memorable is to use random words (see [[diceware]]) or syllables instead of randomly chosen letters. *Patterned passwords: Any pattern in a password makes guessing (automated or not) easier. As of [[October 2005]], employees of [[Departments of the United Kingdom Government|the UK Government]] are advised to use passwords of the following form: consonant, vowel, consonant, consonant, vowel, consonant, number, number (for example ''pinray45''). This pattern is called an Environ password{{Fact|date=August 2007}} and is case-insensitive. This pattern of alternating vowel and consonant characters causes the password to be pronounceable and thus more memorable. Unfortunately, such patterns severely reduce the password's [[information entropy]], making [[brute force attack|bruteforce]] password cracking considerably more efficient. === Protecting Passwords === Computer users are generally advised "never write down a password anywhere, no matter what" and "never use a specific password for more than one account." These maxims, while sound in theory, ignore the reality that an ordinary computer user may have dozens of password-protected accounts. The multitude of accounts often ends up with users having the same password everywhere. A user's attempt to comply will often result in many forgotten passwords, even for important accounts. When inconsistent password complexity requirements prevent consistent use of complex passwords, overly simplified passwords are created to satisfy user frustration as well as aid in the ease of password memorization. If passwords are written down, they should never be kept in obvious places such as address books, [[Rolodex]] files, under drawers or keyboards or behind pictures. Perhaps the worst, but all too common, method is a note near the computer. Better locations are a [[safe deposit box]] or a locked file approved for information of comparable sensitivity to that protected by the password. Software is available for popular hand-held computers that can store passwords for numerous accounts in encrypted form. Another approach is to use a single password for low security accounts and select separate, strong passwords for a smaller number of high-value applications such as [[online banking]]. Manual or offline forms of this approach are also in use. For example, a phone directory may be used to keep a map between computer accounts and password hints. At a 2005 security conference, an expert from [[Microsoft]] was quoted as saying: "I claim that password policy should say you should write down your password. I have 68 different passwords. If I am not allowed to write any of them down, guess what I am going to do? I am going to use the same password on every one of them."<ref>[http://news.com.com/Microsoft+security+guru+Jot+down+your+passwords/2100-7355_3-5716590.html?tag=nefd.pop Microsoft security guru: Jot down your passwords], ''News.com.com'' Retrieved on 2007-05-07 </ref> Security expert Bruce Schneier agreed: "I recommend that people write their passwords down on a small piece of paper, and keep it with their other valuable small pieces of paper: in their wallet." <ref name=Schneier-writedown /> == Time needed for password searches == {{mainarticle|Password cracking}} One way to judge the strength of a password is to measure the time and computing power required for cracking. The time to crack a password is compared to bit strength, which is a function of entropy, length, and complexity. Most methods of password cracking require the computer to generate large numbers of passwords to check. Brute force cracking, where a computer tries ''every'' possible key or password, is the lowest common denominator of password cracking. More common methods of password cracking, such as dictionary attacks, pattern checking, word list substitution, etc, will invariably be attempted before brute force. The ability to crack passwords is a function of: * Number of keys (passwords) per second a computer is able to generate * Number of computers working on the cracking effort Individual desktop computers can generate anywhere between one million to ten million keys per second depending on age and power. For example, many of the individual computers used in the first 3DES cracking effort by distributed.net in 1997 were generating only around one million keys per second. Yet, when ordinary desktop computers are combined in a cracking effort, as is often done with [[botnets]], the capabilities of password cracking are considerably extended. In 2002, Distributed.net completed a crack on a 64-bit [[RC5]] key in four years, in an effort which included over 300,000 different computers at various times, which generated an average of over 12 billion keys per second.<ref name=distributed /> What do these key rates mean? <!---Does WikiPedia ask the reader questions? NO!---> Consider the average 18-bit strength password (seven lowercase and one number): 2<sup>18</sup> = 262,144 permutations. Because a single desktop computer can check at the very least one million passwords per second, this is obviously problematic. An eight-character password that is user-selected with numbers, mixed case, and symbols, only reaches an estimated 30-bit strength, according to NIST. 2<sup>30</sup> is a meager one billion permutations. For a 1997 desktop, it would take an average of 16 minutes to crack. <ref name=NIST /> Despite their capabilities, regular home desktop CPUs are particularly inefficient at cracking passwords in relation to purpose-built password crackers. Although it has long been common knowledge for government bodies such as the [[NSA]], EFF conclusively proved in 1998 that a dedicated password cracker with [[FPGAs]], as opposed to CPUs, is a vastly superior cracking device. Their single machine, Deep Crack, generated 18 billion keys per second.<ref name=EFF-deep-crack /> ==References== {{reflist|2}} ==External links== * [http://psynch.com/docs/choosing-good-passwords.html Choosing Good Passwords — A User Guide]. * [http://psynch.com/docs/password-policy-guidelines.html Password Policy Guidelines]. * [http://www.modernlifeisrubbish.co.uk/top-10-most-common-passwords.asp Examples of common (and hence weak) passwords] * [http://download.lawr.ucdavis.edu/pub/it/CambridgePWStudy.pdf The Memorability and Security of Passwords — Some Empirical Results (Study done by Cambridge University Computer Laboratory)] * Bruce Schneier (December 14, 2006). [http://www.schneier.com/essay-144.html MySpace Passwords Aren't So Dumb]. * [https://www.isc2.org/cgi-bin/content.cgi?page=738 Rainbow tables] * [http://www.csoonline.com/read/120105/ht_passwords.html How to Write Better Passwords] * [http://tools.ietf.org/html/rfc4086 RFC 4086: Randomness Requirements for Security] * [http://www.searchlores.org/commonpass1.htm Frequently used passwords to avoid] <!-- I removed a recently added generator and took a look at the two remaining. Neither inspires confidence and both involve passing around passwords over the Net. Furthermore the software which handles user's passwords is not available for inspection .The security implications here are not good. ===Password generators=== * [http://supergenpass.com/ SuperGenPass hashes users' "master password" with domain to create a unique password per domain] * [http://www.chooseapassword.com Choose A Password password generator] --> [[Category:Cryptography]] [[Category:Authentication methods]] [[ms:Kekuatan kata laluan]] [[sk:Sila hesla]] [[vi:Độ mạnh của mật khẩu]] [[zh-yue:密碼強度]] [[zh:密码强度]]