Substitute numbers for letters that
look similar (for example, substitute
“0” for “o” or “3” for “E”.Agreed; that is bad advice.
I tell people: If you think of a trick then the attackers, who have expertise and think about these issues all the time, have thought of it long ago and have written it into their password-cracking software. That applies to visual substitutions (such as GoToMyPC recommended), phonetic substitutions (e.g., AmeriKa), patterns on your keyboard, etc.
In a more technical sense, that applies to tricks that can be defeated with an algorithm and affordable computing resources.
I've noticed that the OSX Keychain 'memorable' password suggestions are almost always /(\w+\d+[[::punc::]]+\w+)/, which is enough of a pattern to probably make an explicit generator for which will match much faster than a naive brute-force.
Two answers:
1) It's not worth trying to keep up with, unless that's your specialty. There are people who spend days thinking up attacks; how much time will you need to spend to keep up with them?
Far more time-effective than trying to anticipate all the specific attacks is to use provably secure defenses: Passwords that are mathematically too expensive to brute force, and which cannot be guessed by other means (e.g., by knowing personal information about you). That shifts the weak link from your password to the security of your OS, network, and applications, which probably have a couple of holes in them.
2) This will give you an idea of the scope of possible attacks. Note that it's 9 years old: https://www.schneier.com/blog/archives/2007/01/choosing_secu...
Diceware[1] is a nice example of how such a system works, and how you can generate a strong 'memorable' password by hand (and dice ;-). In short, there's a dictionary of short words, letter combinations, and numbers that form the "symbols" of the generated password. A random input (here, rolls of dice) are used to select a series of symbols. You could just as well create your own table and generate the password from that, but if you've got enough randomness as input then it doesn't so much matter what encoding you use. In fact, the general assumption is that you should assume your attacker knows your encoding.
(And yes, by putting it out there I realize it is now a bad password.)
There is a great scene in DoctorWho where a door password is a series of concepts (spoken mentally) that one thinks about in a particular order. Fiction, but the person writing that scene knew a thing or two about password complexity.
They reduce complexity: It reduces the number of possibilities on the first character, and the attacker knows that one word must be a (conjugated? present participle?) verb yet, when otherwise it could be anything.
It doesn't, but it does make it easier to remember :)
For a normal 5 letter (alpha-numeric only) password:
36 factorial, which is (36 * 36 * 36 * 36 * 36) = 60 million possible combinations.
However, for a 5-word password, the calculation is as follows:
Assuming the number of possible words in the English language is 1.025109 million, then:
1,025,109 factorial, which is (1,025,109 * 1,025,109 * 1,025,109 * 1,025,109 * 1,025,109) = A really big number.
So, granted, the amount of possible words is much smaller than that. But the attacker can't know that for sure. To put the number above in scale, just 69 factorial is equivalent to 1.711224524 * 10^98.
> For a normal 5 letter (alpha-numeric only) password: > 36
With the "normal" recommendation of numbers, uppercase and lowercase letters, and punctuation, it's up around 100.
> factorial
The calculation is X^Y, where X is the number of possibilities per element, and Y is the number of elements (letters or words in these examples). So using only only lowercase letters (26) in an 8 character password would be 26^8. It's not factorial because you can reuse characters (e.g., your password could be X92m-sXp/)
> the amount of possible words is much smaller than that. But the attacker can't know that for sure
They will search the more likely words first. I read someplace that 10,000 words covers most people's vocabulary. That's still 100 times better than numbers + uppercase + lowercase + punctuation.
You're absolutely right, not sure why I got ahead of myself with using factorial so incorrectly.
Still a big number, but not astronomically big.
I'd guess the words used in that password fall into the top 10k words, easily. No need to check words like pediatrician, when the password contains the word cat.
From the quote on their front page, assuming their target audience is of the "mycat00" at the best variety.
If this is what their "security team" recommends, they might need to upgrade the team.