CorrectHorseBatteryStaple isn’t a good password. Here’s why.

We all know that complexity and length make for good passwords, but much has been made of combining dictionary words to make long passwords.

XKCD made a big deal of choosing 4 random dictionary words with the amusing ‘correcthorsebatterystaple’ suggestion for an amazingly strong password, but this is really quite misleading. Why

Cracking of password hashes has evolved a lot. Before, we had John the Ripper, which is a great tool for brute forcing passwords. Not so great for long passwords though.

Now, we have hashcat. What does this change?

Hashcat has some great concatenating and mangling tools which make passwords made up of multiple dictionary words look rather weak.

Start by collating a wordlist. You could start with commonly used English words – a wordlist of the most common 5,000 will include the words from the above XKCD example.

Or perhaps grep your local language version of Wikipedia, if you suspect the passwords aren’t UK English or might not feature in a dictionary.

Use hashcat utils to concatenate a few words, e.g. correct+horse+battery+staple and so on. The ‘combinator’ utility can help you do this, though there are many other ways of concatenating your wordlist.

And then start attacking the hashes.

The effect of using combined dictionary words is pretty much the same as extending your character set. Instead of 26 characters (or 52 when including uppercase) you are now using 5,000 words in the above common wordlist example.

BUT, your password length now becomes effectively 4 characters e.g.
correct = 1
horse = 2
battery = 3
staple =4

So 4 common dictionary words used as a password, such as correcthorsebatterystaple, offers around 5,000 to the power of 4 combinations , or around 6×10^14. EDIT: We’re not sure how XKCD got to 2^44, as a brute force of that would take a maximum of around 2 x 10^35 attempts, which we think was the point he was trying to make.

Given the fastest GPU crackers are now working at around 7 Tera hashes per second, that hash will take around 1.5 minutes to crack.

Of course, this is hugely dependent on the words you choose. If use choose common words for your password, you’re wasting your time. You might as well use ‘Password1’… or perhaps not.

Advice

Long passwords are usually better than short ones, providing you don’t use common dictionary words

It’s imperative to extend your character set by using uppercase too, plus numbers and non-alpha chars (!”$% etc.).

Hashcat rules allow for all sorts of mangling, but inserting anything between your combined words, or in the middle of them will help significantly. ‘Padding’ will help too e.g.

$$MyName6IsMich66aelCaine$$

Or if that all sounds too complicated, in many cases you can use a password vault to create uber complicated passwords that you don’t need to remember. There are loads on the market, examples include Keepass and LastPass.