Choosing A Master Password

All you need to know about generating a master password

“One password to rule them all”

By Colin McCrae

It has become standard advice for online users to have strong, unique passwords for all their online accounts. Not without reason: a data breach at one company with a poorly protected user database leads to attackers having huge lists of email addresses and associated passwords some of which will work on other companies’ websites.

With many users now having signed up to over one hundred accounts requiring password login, following this advice would necessitate memorizing an impossible number of different passwords.

A potential solution to this problem is to have one master password, which is then varied in a specific way based on the name of the online service. A simple example of this would be to replace some letters of the master password with the first two and last two letters from the services’ name. The downside of such a system is that it would only take two of these passwords to be revealed from data breaches for an attacker to work out the system. Thereafter, the attacker would know all the users’ passwords across all their accounts. For some of the simpler substitution methods, a single data breach may be enough.

There really is no substitute for using strong passwords, unique to every online account.

It is wholly impractical to expect users to memorize over one hundred passwords. These passwords need to be stored somewhere, and preferably backed up. Two potential choices are: (1) store them as an encrypted file, or (2) use one of many password managers (such as LastPass, 1Password, Dashlane, KeePassX, etc.). Whatever your choice, you will need a ‘master’ password — a password giving you access to all your other passwords. This master password will need to be memorized, and will itself need to be very secure, as behind it lies access to all your online accounts.

Master Password Choice

Choosing a master password should be taken seriously. If compromised, your entire online identity could be blown wide open — everything from email to banking, social media, and arguably worst of all: cryptocurrency accounts.

So how do you choose a master password? It needs to have three qualities: (1) strong (so it can’t easily be broken), (2) memorable (so you don’t forget it), and (3) relatively quick to enter on a keyboard and touchscreen.

Password Strength

Provided you keep your master password secret, an attacker will need to attempt a brute-force attack against your password — in other words making repeated guesses of your password. Depending on the type of authentication each site uses, and whether their user account data has been breached, it can be possible for billions of password guesses to be made every second. Moreover, attackers have access to vast databases of known passwords (from historic data breaches) and dictionary words, which when coupled with common letter substitutions and known common password patterns can help them guess likely more passwords first.

The strength of a password is defined by how many guesses an attacker would need to make on average to correctly guess it. The name of the game is to make your password as hard to guess as possible. This is achieved by maximizing three parameters: length, complexity, and randomness. The randomness of a password can be quantified by the term ‘entropy’.

What is Password Entropy?

In its simplest definition, password entropy is a measure of how unpredictable (or random) a password is. It is traditionally expressed in ‘bits’, where a bit is a binary digit representing two possible states (on or off, true or false, 1 or 0). For example, password with 10-bit entropy would be one that is equally likely to be one of any 1,024 possibilities (1,024 = 2¹⁰ = 2x2x2x2x2x2x2x2x2x2).

You can determine the entropy of any randomly generated password from its length and the character set used. For example, if you were to randomly choose an 8-character password using only the 26 lowercase letters, the total number of possible passwords is 26⁸ (slightly more than 208 billion). This translates to just over 37-bit entropy (found by calculating the base two logarithm of 26⁸). A password such as this is too weak to use as a master password. Depending how the password is stored, it could be susceptible to being cracked by brute force.

Note that a password must be chosen completely randomly from all the possible options, otherwise its entropy is reduced. Using the 8-character lowercase letter password ‘password’ would not count as 37-bit entropy, since not only is that one of the most commonly used passwords used but it’s also a dictionary word. Attackers will check all common passwords and dictionary words first and hence would crack this password after far fewer than 208 billion attempts.

It is very hard to assess the entropy of user-chosen (non-random) passwords. This is because humans choose passwords that tend to follow predictable patterns: using whole words and names, predictably substituting certain letters for numbers and symbols, etc. The best way to maximize the entropy of a new password is for the password to be selected as randomly as possible.

It’s worth pointing out that for every 1-bit increase in password entropy, it would take an attacker on average twice as long to crack the password (as there are twice as many possible passwords). In this way, a 50-bit password is twice as hard to crack as a 49-bit one, and 1,024 times as hard to crack as a 40-bit password.

Maximizing Password Strength

It’s clear that longer random passwords are harder to crack than short passwords, as are passwords which are composed of a larger number of possible characters (the character set). What’s not so obvious is that lengthening passwords is much more effective in strengthening them, compared with expanding the character set.

Let’s take the earlier example of our 37-bit password (8 characters long, randomly composed of lowercase letters only). Doubling the character set to include uppercase letters would increase our password strength to 45-bit. However, simply adding two more characters (making the password 10 characters long rather than 8) is more effective, yielding a password strength of 47-bit. It is also arguably faster to type 10 lowercase letters than 8 mixed case letters (especially on a touchscreen) — likely easier to remember it also.

Doubling the length of the password to 16 characters has an astounding effect, taking the strength to over 75-bit. In mathematical terms, the length of the password is exponentially more important than size of the character-set used.

When choosing how strong a password to create, it’s a compromise between ensuring enough entropy that a brute force attack will take an impractical length of time, and ensuring the password isn’t too hard to remember or type out.

1Password recommend at least 40 bits of entropy and consider 75 bits of entropy to be a ‘full green bar’ in their ranking system. William McLaughlin, a Security Analyst at Independent Security Evaluators recommends a minimum of 80 bits of entropy to protect against offline attacks, as a compromise between usability and security.

Strong Password Examples

Below are examples of passwords that meet at least 80 bits of entropy.

• Using uppercase and lowercase letters plus numbers (case sensitive alphanumeric) needs 14 characters:

uDQwfng7Suv4yJ

• Lowercase letters and numbers only (alphanumeric), you would need 16 characters:

41mkbvrclnr8uqqz

• Lowercase letters only, it would be 18 characters long:

ugaeivczglgyydsauo

These passwords are all about as short as possible (given their character sets), whilst still having at least 80-bit entropy. However, they are not necessarily easy to remember. If this is what you are thinking, then a passphrase may work better for you.

Passphrases

There are a number of ways of generating passphrases randomly. One of the early examples was Arnold Reinhold’s Diceware list from 1995. It uses rounds of five dice rolls to select words at random from a list of 7,776 words.

Recently, the Diceware word list has been improved upon by the Electronic Frontier Foundation (EFF) based a word recognition research carried out at Ghent University’s Center for Reading Research. It is a list of well recognized and concrete words, with insulting and difficult to remember words removed.

The EFF recommend a six-word passphrase generated using this list of words, which would give 77 bits of entropy. However, to be consistent with our previous examples which met or exceeded 80 bits, we will use seven words (which actually gives 90-bit entropy). Your passphrase would then look something like this:

shifty neutron exact aqua velvet sizzle equinox

There are pros and cons to using a passphrase. On the one hand, many people find them easier to remember compared to a string of characters (despite being longer). The downside is that passphrases can take longer to type, particularly on a touch screen.

How to Choose a Password Randomly

Computers are not able to generate passwords completely randomly, which is why these random number generators are referred to as ‘pseudo-random’. The deterministic nature of computation makes it impossible to say that any number generated is completely ‘random’. For this reason, it may not be wise to have your master password generated by a password manager, or indeed on a computer at all.

This is another reason why the Diceware / EFF word list for generating passphrases from dice rolls will create for you a very good random master password with reliable entropy.

Non-Master Passwords

Your master password will become the master ‘key’ to your complete password vault — where login details to all your individual services and websites are kept. It is also important these passwords to be chosen as randomly as possible. Most password managers will offer an option to generate unique pseudo-random passwords based on your chosen character set and length. This is certainly good enough to use for each individual online account. For these passwords, you do not need to worry about how easy they are to enter or remember: in theory you should never need to manually enter them, nor remember them.

Setting your password manager to generate 16-character passwords using lower and uppercase letters, numbers and symbols for all your passwords should be sufficient. Assuming 8 symbols are included in this character set, these passwords will have an entropy of 98-bit. Bear in mind they do not need to be remembered.

Final Thoughts

This post simply covers considerations when generating a master password, a small but important part of the much greater subject of online security. You can create an incredibly strong master password, say 256-bit entropy, and still have your online accounts comprised in a countless number of ways other than a brute force attack. Ensuring a strong master password is one step in many steps required to secure your online security, and in no way replaces the need for other forms of security.

A few other relevant recommendations include:

• Keep your master password secret, not just from casual observers, but also from sophisticated viruses, compromised websites, key loggers, etc.
• Refuse to complete ‘memorable information’ requests (such as mother’s maiden name, name of first pet, etc.), or where mandated treat them as additional strong unique passwords (never enter them ‘honestly’).
• Use Two-Factor Authentication (2FA) wherever available, and certainly for important accounts like email and cryptocurrency related websites. 2FA where a code is sent via SMS to your phone number is not a secure form of 2FA, as your phone number can easily be ‘stolen’ from you.

If you found this article interesting, please hold down the clap button below. Follow me on Medium to see more content like this.

I am currently working on EdgeFund, an open-source platform which offers a decentralized shared bankroll on the Blockchain. To learn more about EdgeFund, please visit our website. Join our Telegram group to chat to the team and follow us on Twitter!