Password Security ​

In the realm of blockchain security, protecting passwords is paramount. To ensure your data and everything it represents remain impervious to unauthorized access, let's delve into the nuances of password security.

Password Strength ​

Likely enough, you may have previously encountered recommendations on how to come up with a strong password. These may entail such advice as minimum password length, addition of special characters, etc. Such recommendations aim to increase the strength of your password that hinges on entropy, i.e. randomness of the password.

So, what defines a strong password? A strong password is a password with high entropy.

To calculate the entropy of a password, we may follow the Entropy formula:

Following the entropy formula, let us compare the following two examples:

1. A 16-character password with the character set utilizing only lowercase letters of the modern English alphabet (26 characters) yields approximately 43 sextillion ($43\ast 10^{2}1$) possible combinations.

$$Entropy=log_2(26^{16})=log_2(43,608,742,899,428,874,059,776)=75.20703...$$

2. A 16-character password with the character set expanded to 96, including uppercase letters and special symbols, inflates the number of possible combinations to a staggering 52 nonillion ($52\ast 10^{3}0$), improving entropy significantly.

$$Entropy=log_2(96^{16})=log_2(52,040,292,466,647,269,602,037,015,248,896)=105.35940... $$

As can be seen, even by only expanding the character set from 26 to 96 symbols, the number of possible combinations that a malicious party would need to bruteforce has expanded by $1.1933\ast 10^9$ times.

Additionally increasing the length of the password, will grow the number of possible combinations even further, therefore enhancing the entropy—strength—of the password.

However, instead of wrestling with complexities, we advise using a password manager program—like KeePassXC (for more details, see Adding a Password Manager Program and Configuring KeePassXC)—to generate and securely store your passwords.

Password Vulnerabilities ​

Passwords can fall victim to brute-force attacks, typically executed using powerful GPUs in conjunction with dictionaries or exhaustive iteration through all possibilities. To thwart such attempts, craft a unique password devoid of personal information like birthdays, addresses, phone numbers, or social security numbers. Avoid providing attackers with easily guessable clues.

So, how hard it is to crack a modern password? It really depends on who you ask.

With a setup like Kevin Mitnick's cluster setup housing 24 NVIDIA® GeForce RTX 4090's and 6 NVIDIA® GeForce RTX 2080's, all of them running Hashtopolis software, he used to crack passwords that supposed to take a year in mere half a month.

However, let's now compare it to a single RTX 4090, capable of processing through 300 H/s using NTLM and 200 H/s using bcrypt, as outlined in this tweet.

As an extension of our previous entropy calculations, let's now examine the following projected cracking times:

1. There are $31,540,000$ seconds in a regular non-leap year. Assuming the worst-case scenario with NTLM, at the speed of $300\ast 10^9$ H/s, it would take a single RTX 4090 approximately $4,608.83$ years to crack a 16-character password with a character set of 26 letters of the modern English alphabet.

2. If instead of NTLM we use bcrypt, therefore reducing the iteration speed to $200\ast 10^3$ H/s, while also expanding the character set to 96, including uppercase letters and special symbols, the time to crack soars to about $8,249,887,835,549,662,270.456$ years, far surpassing the age of the universe.

So, simply picking higher entropy raised the time it takes to crack a password to unfathomable numbers. Yes, the process may be sped up by using multiple GPUs, however this method pales in comparison with the XKCD approach.

It is important to note that an extensive character set isn't always necessary to reach high entropy. It can be obtained by using multi-word passwords, or lengthy sentences in particular. The classic XKCD comic illustrates this concept eloquently.