Password strength is a measurement of the effectiveness of a password in resisting guessing and brute-force attacks. Specifically, it estimates how many trials an attacker who does not have direct access to the password would need, on average, to correctly guess it. The strength of a password is a function of length, complexity, and randomness.

Using strong passwords lowers overall risk of a security breach, but strong passwords do not replace the need for other effective security controls. The effectiveness of a password of a given strength is strongly determined by the design and implementation of the authentication system software, particularly how frequently password guesses can be tested by an attacker and how securely information on user passwords is stored and transmitted. Risks are also posed by several means of breaching computer security which are unrelated to password strength.

Such means include: wiretapping, phishing, keystroke logging, social engineering, dumpster diving, side-channel attacks, software vulnerabilities etc. There are two primary ways passwords are created, automatically (using randomizing equipment) or by a human. The strength of randomly chosen passwords can be calculated with precision.

More commonly, passwords are generated by asking a human to choose a password, typically guided by a set of rules or suggestions; an example is at account creation time for computer systems. In this case, only estimates of strength are possible, since humans tend to follow patterns in such tasks. In addition, lists of commonly chosen passwords are widely available for use in password guessing programs.

All passwords on such lists are considered weak, as are passwords that are simple modifications of entries in such lists. Either can be quickly tried. For some decades, investigations of passwords on multi-user computer systems have shown that 40% or more are readily guessed using only computer programs, and more can be found when information about a particular user is taken into account during the attack.[citation needed]

Similar to 0 things you like: