I've received a multitude of requests to write about internet security: why it matters and what you can do about it. Seeing as it is a pivotal topic that has paramount consequences for every individual in today's society, I've decided to write this blog on the most popular medium available to our generation. In part to spread the word to all four corners of the free world as efficiently as possible, and in part to placate the people most important to me - you guys. I will draw from my indoctrination by Professor Weaver here at Berkeley in CS 161: Computer Security in particular, and my personal ventures in general.

  The one item you'll need is 1Password. If you take away anything from this article, it is that a password manager will make your internet presence considerably more secure.

Motivation

  Why should we care about the security of our internet accounts? There are a plethora of reasons, but let us consider a few. I'm sure most of us have an Amazon, Facebook, and/or Google account. And I contend that most people would not want someone obtaining access to their Amazon account and purchasing items via their credit card linked to that account - or worse, their debit card linked to the account. Furthermore, I would not want someone else "hacking" my Facebook account and sending random messages to my family and friends; and I presume most people would not want that either. And finally, almost everyone has a Google account these days that is linked to their mobile devices, tracking their location, containing personal emails, etc. So there are plenty of reasons to care about securing your online presence. And if you think you're not a target, you're mistaken.

  Let us examine how most people choose and manage their passwords. Most passwords fall into one of three categories: we usually have one or two simple passwords like "password" or "letmein", and we use those on most websites that don't require us to have complicated passwords. And then we have another password with a little more complexity for websites that force us to have numbers and alphabet characters in our password, e.g. "password123." Then we have our much more complicated "Password123!" for the third category that requires special characters and capitalization. Now this does make it convenient enough for us to remember all our passwords because we have 20+ different accounts over numerous websites. Who's gonna remember 20+ different passwords? Much easier to just use 3 or 4 and be done with it.

  Imagine you have a Tumblr account and you used your Gmail to sign up. Now also suppose Tumblr suffers a data breach to a malicious entity, where all the user account information, including email addresses and passwords, is compromised. Why should you care? It was just your Tumblr account after all. But wait! You used that same email address and password to make your Amazon account! You have been pwned...

  You don't have to imagine, because this exact data breach happened in 2013, where 65 million Tumblr accounts were compromised. The data was later put up for sale on a dark market website and included all the email addresses and passwords. Now, Tumblr didn't store these passwords in plain text (i.e. as "password") on their database. They used SHA1, a hash function, to turn the raw passwords deterministically into 128 seemingly random bits. The best way to think about hash functions, like SHA1, is to imagine them as meat grinders. You put some meat or password in, and whatever comes out is indistinguishable from what was put in.

  Here is what the password "welcome" would look like after applying the SHA1 function to it:

echo "welcome" | shasum -a 1

85fcd345dd2c8f9e3199adb5459a5e1dc2d4e76c

  This 85fcd345dd2c8f9e3 199adb5459a5e1dc2d4e76c does look like a lot of mumbo-jumbo. How could an attacker ever figure out that my password was "welcome" by just looking at this? These SHA functions are deterministic functions, which means that it will always spit out the same exact thing if you give it the same input. So the attacker looks at this and goes, "oh, let me look up the list of the most common passwords on Wikipedia and let me apply this function to them." When the attacker applies the SHA1 function to the twelfth most common password, "welcome", they hit the jackpot. "Let me try the username 'eilen50@aol.com' and password 'welcome' on Amazon, Twitter, Facebook, etc." - and if I was like most people, that would have been a nice exploit.

  You may at this point object with, "Well this seems so time-consuming. Why would the attacker bother with my information? Surely computing the SHA1 of each password takes some time." With eight modern NVIDIA graphics cards put together on a computer, the attacker can compute 240 million of these per second! And worse, all this computation has already been done and it is publicly available on Github. They're colloquially known as "rainbow tables." So it is relatively cheap for attackers to try this exploit. The most effective measures to protect ourselves from such attacks are strong, unique passwords and two factor authentication. I will discuss the latter in more depth in the next article.

Password Strength

  Following the motivation from above, we can see that common passwords are easy pickings for attackers with modern computers. Let us examine the complexity of various passwords. Suppose you were using a simple password that only includes alphabet characters and no capitalizations. This configuration gives us 26 unique characters to work with (since the lowercase alphabet is that many characters). Thus, the amount of entropy a 10 character password would contain is \[26 \cdot 26 \cdot\ 26 \cdot 26 \cdot 26 \cdot 26 \cdot 26 \cdot 26 \cdot 26 \cdot 26\] \[= 26^{10} \approx 1.41 \times 10^{14}\] That is to the order of 141 trillion possible unique passwords using only the lowercase alphabet. With the computational capabilities available today, that password can be cracked within 3 days. There are two ways to increase the entropy. One is to lengthen the password. The second is to include more characters in the domain.

Suppose now that we also include numbers in our password, which means we retain the 26 lowercase alphabetical characters and add 10 more digits (0 - 9) \(\implies 36\) possible characters. \[36^{10} \approx 3.66 \times 10^{15}\] This configuration gives us 3.66 quadrillion amount of entropy for a 10 character password. As you can notice, just adding 10 more characters in our domain of possible characters increased our entropy by an order of magnitude.

Now suppose we included special characters as well, which are the following characters:

 !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~

That is 33 special characters (including space). Continuing from our previous domain of lowercase alphabet characters and 10 digits, adding the 33 special characters gives us 69 possible characters to choose from for each character in our 10 character password. \[69^{10} \approx 2.44 \times 10^{18}\] This is 2 quintillion possible unique 10 character passwords with the domain of 69 characters. It would take an attacker 160 years to crack a password of this configuration with one computer that attempts 240 million hashes a second. With 20 computers, it'll take around 8 years.

There is one more thing we can do to optimize the complexity of this 10 character password, and that is to include the uppercase alphabet. That gives us an additional 26 characters to add to our previous 69. We now have 95 unique characters to choose from in our domain. \[95^{10} \approx 5.99 \times 10^{19}\] We now have 59 quintillion amount of entropy in our passwords with this new domain. It would take an attacker around 3,955 years to break this password. That's pretty good. However, this is what a possible password would look like:

Xi-9[qZT$t

And for some people, \(5.99 \times 10^{19}\) is not too reassuring. Since we've exhausted our method of adding more characters to our domain to increase the entropy, we must now explore lengthening our password. Suppose that we double our length to 20 characters. \[95^{20} \approx 3.58 \times 10^{39}\] That would take an astounding \(2.36 \times 10^{23}\) years to break - to put that in perspective, that is 1.79 times the age of the universe. But as before, we have our passwords looking like this:

T!qFoCMq@KcVFn#3KvPV

Managing Passwords

  As we saw, reusing passwords across multiple websites puts users in a vulnerable position. Once one is compromised, the rest are too. Thus, using unique passwords across different websites is essential to maintaining a secure online presence. And as we just discussed, those passwords need to be strong with a lot of entropy. That brings us to, how in the world are we supposed to maintain 20+ unique passwords that look like "T!qFoCMq@KcVFn#3KvPV"? We can barely memorize one of those, let alone 20 or more? As it turns out, using passwords comprised of 5 random words from the dictionary, like

correct-horse-battery-staple-pilgrim

gives us approximately the same amount of entropy as something like "T!qFoCMq@KcVFn#3KvPV". It also turns out that we're pretty good at remembering a few passwords like "correct-horse-battery-staple-pilgrim" as opposed to a bunch of random special characters, numbers, capitalizations, and whatnot. But as I mentioned, we're only good at remembering a few of these, not 20 or 30. And that's where password managers come in.

  A password manager is a program which runs on your computer and/or phone. To use it, you enter a master password to unlock an encrypted store where all your passwords are stored. It can then enter passwords for you in websites, and also generate strong, unique, random passwords. You then only have to remember your one master password, so you better make sure your master password is good.

  There are a plethora of great password managers out there, with some popular, premium ones being 1Password and LastPass, among others. There is also a great free option available, KeePass. KeePass is an open-source password manager that's available across all platforms. Since it's free and open-source, it requires a certain amount of effort to set up. Professor Weaver, whom has reasons to be paranoid and extra cautious, uses 1Password and I can attest that the user experience is sublime. However, I'd recommend doing some extra research on the options out there before committing to anything.

Actionable Items

• Password Manager - Acquire one and change all your passwords.

"Be careful and you will save many men from the sin of robbing you."

  This is the first in the series of "A User's Guide to Security." Check out the second article to learn about protecting yourself from the single most common attack -- Two Factor Authentication: Teach a Man to Phish.