Is your password secure?
by Doug Anger, Technology Columnist

One of last months columns mentioned a few ways to make your password more secure, but password security is only the first step to protecting your privacy and pocketbook online. 
The security of a password is directly related to the difficulty in guessing it. This is known as breaking the password. This difficulty can be measured by the number of possible combinations. The average number of attempts required to break a password equals one half the total number of possibilities. For example a 4 digit PIN number is limited to four digits (obviously), each of which can be a number between zero and nine, leaving us with ten possibilities for each digit. The number of possible combinations can be computed mathematically as nd where n equals the number of possibilities for each digit and d equals the number of digits. In this case, 104 equals 10,000. There are 10,000 possible combinations for a four digit PIN number, which makes sense because the PIN can be any number from 0 to 9999. One half of 10,000 is 5,000, so it will take an average of 5,000 attempts to break a four digit PIN number.
The same method can be applied to passwords containing letters, numbers, and symbols. For the sake of simplicity I have included them in a table below.

Type of Password
Number of Possibilities
Average Number of Attempts to Break

4 Digit PIN
10,000
5,000

6 Digit PIN
1,000,000
500,000

4 character password  lowercase letters only
456,976
228,488

4 character password  lowercase letters and numbers
1,679,616
839,808

8 character password  lowercase letters only
208,827,064,576
104,413,532,288

8 character password  lowercase letters and numbers
2,821,109,907,456
1,410,554,953,728

An English word.
400,000 to 1,000,000
(depending on the dictionary used  this includes scientific and technical terms)
200,000 to 500,000


As you can see, it takes over one trillion attempts, on average, to break an eight-character password that contains both letters and numbers.
While all of these may seem like large numbers, crackers (criminal hackers) have computers that can automatically guess all of the possible combinations and an average computer can try hundreds or thousands of passwords every second.
The actual speed at which a password can be broken depends largely on the system of which it is part. Some servers and firewalls will not accept attempts to log in for a certain amount of time after a bad login attempt. If a hacker tries to break into one of these systems and guesses the wrong password, he can not try another until that amount of time has passed. If this time period is set to five seconds (although this is unusually long), it will take an average of 25,000 seconds (almost seven hours) to break a four digit PIN and 7,052,774,768,640 seconds (over 223 thousand years) to break an 8 character password with letters and numbers. Unfortunately, most systems do not have this kind of protection, and hackers can find ways around many that do.
Password Secrecy
Even the most secure passwords can be broken if they are not kept secret. Here is a list of no-nos to help you keep your passwords secret.
Never
Tell anyone your password.
Send your password through email. This includes having it emailed to you from a forgot password link. If you must do this, change your password immediately.
Write your password on a PostIt note and stick it to your computer (or anything else for that matter). It is often better to use a less-secure password that you can remember than a more-secure password you have to write on a sticky note.
Make your password the same as your username.
Use the same password for unrelated things (ie at work and for your personal email account) or for a long period of time.
