Why you need a strong password

For many people, their first exposure to using a secret code to secure something valuable may have been a bike lock. These locks typically have four wheels with the number 0...9 around the edge and are unlocked with only one combination. A four-digit combination has 10,000 possibilities.

10×10×10×10 = 10⁴ = 10,000

If the code were set at the factory, this would generally be secure enough to keep your sworn nemesis from riding off with your bike. If the lock is one that you could change the combination, you may have set it to be something you can easily remember; 1234, 6789, 8888, or your birthday, 0625. "It is just as secure, right?" No, it isn't. By choosing your combination, you've removed the randomness.

Let's look at it differently. You work at the monkey reserve and are responsible for keeping the strategic banana supply safe. You put them in a locked room so the monkeys can't get them. You put a lock on the door because monkeys are intelligent and mischievous. After a while, one of the monkeys watches you punch in a code and retrieve bananas, so he plots his "great banana caper" and waits for the right time to strike.

If it takes him one second to try a combination before moving on to the next one, it could take him as long as 10000 / 60 * 60 = 2.77 hours, or just over 2 hours and 45 minutes. Long enough to risk being noticed. But let's say he knows that there are 100 bananas in the room, so he recruits 10 of his monkey friends, and collectively they can try ten combinations a second. He has now reduced the complexity by a power of 10, and the troop of monkeys can enter the room in just over 16 minutes.

In a battle of wits, you add another dial to the combination, bringing the number of combinations up to 100,000. It would take the monkey troop almost 3 hours to enter the room again. But there is another problem; humans are not terribly great at remembering a set of numbers without context, and one morning you have to deal with an angry troop of monkeys as you desperately try to remember the code. After cleaning yourself up, you decide to try something different.

What if you replace the lock with a computer and pick a random word from a collection of 7000 words instead of numbers? Let's say you randomly choose the word recycled. You have a password that is easy to remember, albeit less secure than the original 4-digit pin. The monkey troop can enter the banana vault in just under 12 minutes. "You've made things worse" Not entirely; you recognize that one word is too easy to guess, so you choose a passphrase from two random words, say horse and bowling. The new passphrase, horse-bowling, immediately evokes images of horses dressed in bowling shirts and shoes. You have no problem remembering it, but how secure is it?

One way to look at it is as a string of 13 letters, which would be 26×26×26×26×26×26×26×26×26×26×26×26×26× or 2,481,153,000,000,000,000 combinations. But, regarding security, we always want to look at the worst-case scenario; in this case, it's Bobo. Bobo knows you have used random words, but he doesn't know what those words are, so he instructs others in the monkey troop to try pairs of words systematically, acorn-acquire, acorn-acquit, acorn-acre, and so on. The total possible combinations, 7000×7000 or 49,000,000 combinations, but even with ten monkeys working around the clock, it would take over 56 days to enter the vault. Much longer than the half-life of an average banana.

The monkeys are determined and have one more trick up their sleeve, Samantha. Samantha is one of the night interns and has decided to help the monkeys. Sam uses a computer that can try 100,000 passwords a second, giving the monkeys banana goodness in just over 8 minutes.

You decide enough is enough and add two more random words to your passphrase. Your new four word passphrase is clumsy-insects-lives-cones. You adjust your mental image and imagine a bunch of clumsy insects living in ice cream cones. You've raised the possible combinations to 7000×7000×7000×7000 or 342,999,993,000 combinations. Even if Sam were to increase the output to 1,000,000 passwords a second, it would take over a year to try every possible combination.

You've won; the monkeys have given up and turned their attention to stealing visitors' cameras. Monkey selfies aren't your responsibility.