How to Create a Strong 1Password Account Password

The challenge that we face is to have account passwords that are not going to be guessed by password cracking programs, yet ones that we mere mortals are capable of remembering and typing without it being a burden.

What makes this a particular challenge is the fact that the bad guys know at least as much about how people pick passwords as we do. They are not only reading the same password picking advice that gets posted in places like this, but they have studied millions of stolen passwords.

Here is an important principle that we need to keep in mind:

The strength of a password creation system is not how many letters, digits, and symbols you end up with, but how many ways you could get a different result using the same system.

Don’t worry if this principle doesn’t make sense yet, you’ll have a better understanding after I walk through an example.

I have two dogs: Molly and Patty. Let’s say I wanted to make an account password from that and came up with Ihave2dogs:Molly&Patty. It looks good at first because it is long, has mixed case, and has punctuation. But with that as an example, I’ll work through why it isn’t as good as it might first appear.

Use spaces to make things easier for you

Your account password can include spaces between words. So you can make things easier to type and remember by using spaces, even though it adds little to the actual security. Our first improvement to my password will be to change this to I have 2 dogs: Molly & Patty.

Don’t tell the truth

If your account password is to be based on something meaningful, remember that there are more ways to lie than to tell the truth. There are more ways for me to lie about my pets than tell the truth, and so I should use a lie to create my password. So let’s try, I have 3 bats: Larry, Moe & Curly.

Don’t make sense

There are more ways for a sentence to not make sense than to make sense. So let’s change my three bats to thirty-five bats, but still list three: I have 35 bats: Larry, Moe & Curly.

Avoid predictable phrases

For those of us of a certain age and steeped in American culture, once we begin a list of names with “Larry…” following it with “Moe and Curly” is very predictable. So even though the Moe & Curly adds 11 characters to the password, those 11 characters are so predictable that they add very little actual strength. Even though it is shorter, using I have 35 bats: Larry & Amy is actually stronger than I have 35 bats: Larry, Moe & Curly.

Along the same lines, the “e” after “I hav” isn’t doing much good either. Because it is easily guessable from the rest of the password it isn’t actually adding much strength. There is nothing wrong with that “e”, but I’m mentioning it to help illustrate the point that the number of ways things can be different is often more important than length itself.

Avoid secrets or things that are personally meaningful

The more personally meaningful something is to you the fewer alternatives there are. There are more things that don’t have personal meaning to you than do.

In particular avoid personal secrets. Twice in my life, when I’ve been asked to find weak passwords where I worked, I had the embarrassing task of telling my friends and colleagues to change passwords that also revealed their secret crushes. Also, there may be a time when you actually do need to reveal your account password to a loved one. When I spot passwords like IloveUVicky along with the owner’s email address among 26,000 email addresses and passwords exposed from a pornography site, I certainly hope that this won’t cause too much trouble for the owner.

Avoid obvious punctuation

Capitalizing the beginnings of words or changing “for” to “4” really doesn’t add much security. Remember, if you can think to do this, the people who write password cracking systems have already done the same. Unfortunately adding punctuation in truly random manner makes the password too hard to remember. Certainly add the obvious punctuation, but recognize that it doesn’t strengthen your password as much as it might appear.

What we’ve learned

At every stage in working though this example, we made some real improvements. Remember that we’re not trying to reach perfection here. We’re looking instead to create better account passwords that remain usable. Don’t create trouble for yourself by picking a account password that’s too difficult to type or too hard to remember.

But we’ve also learned that human behavior really isn’t very random. The schemes we come up with can be coded into password cracking systems. A good account password isn’t just limited by what a human can remember, but it’s also limited by what a human can create. We can get digits and punctuation into passwords easily enough, but our selection methods involve a lot of predictability. Human behavior is more predictable than we like to imagine. That predictability can be exploited in password guessing programs.

Roll the dice to avoid predictability

If people are so predictable, how can we create memorable passwords that aren’t predictable? It turns out that Arnold Reinhold published a solution to this back in 1995 to help people create strong and memorable pass phrases for PGP. It’s called Diceware.

Because words have meaning, we can remember a sequence of words even if it doesn’t create a meaningful statement. And because there are many more words than there are individual characters, selecting a random sequence of five or so words provides a hard to crack password.

Reinhold produced a list of 7776 short words or sequences (that is “6 to the power of 5” for people who care about such things). A word can be selected from the list by rolling five dice (or rolling one die five times). Here’s a small excerpt from the English Diceware Word List:

35443 knew 35444 knick 35445 knife 35446 knit 35451 knob 35452 knock

If you roll your dice and get the sequence 3 – 5 – 4 – 5 – 1, then your Diceword would be “knob”. Another five rolls of the dice will get your next word. If you rolled 3 – 2 – 6 – 5 – 6 then your next word would be “hike”.

The great thing about Diceware is that we know exactly how secure it is even assuming that the attacker knows the system used. The security comes from the genuine randomness of rolling the dice. Using four or five words for your account password should be sufficient against the plausible attacks over the next few years given the current observed speed of password crackers.

For those who really want to use this system and get the most security out of it, you should combine Diceware with your own private system. Create a short random password, including digits and symbols and use that in place of one of the Dicewords in your final password. So going back to my dogs, Molly and Patty, I might create a weak password like 2dM&P, and suppose my rolls of the dice gets me cleft cam synod lacy, I could then create an account password like cleft 2dM&P cam synod lacy, which would be a very good account password. With repetition, it’s something that you can learn to type quickly.

What’s a Secret Key?

Your Secret Key keeps your 1Password account safe by giving you an additional level of security on top of your account password. Your Secret Key is an auto-generated combination of 34 letters and numbers which are separated by dashes. This key is stored on all devices you’ve used to sign in to your account as well as in the Emergency Kit you downloaded when you signed up. Your Secret Key is designed to work in tandem with your account password, which only you know, in order to fully to encrypt your data and keep it safe.

As I mentioned earlier in this article, it’s practically impossible to use and remember an account password that is stronger than the encryption in 1Password. This is where your Secret Key comes in. It doesn’t need to be memorized, so it can be much stronger. The Secret Key that is generated by the system has 128 bits of entropy, which makes it nearly impossible to guess no matter how much money or computing power an attacker may have at their disposal.

No one has access to your 1Password data without your Secret Key, even if they manage to crack your account password. However, since no one has access to this key, even us, if you lose it you can lose access to your 1Password account. Keep it secret, but keep it safe.

In conclusion

I would like to remind you of some crucial points I made near the top:

We’re working toward better passwords, not perfect ones. You should take only as much advice from this as you are comfortable with and no more. Remembering and typing in your account password should not become a chore.
If you do change your account password, practice with it regularly so that you don’t forget it. Don’t be afraid to write it down on a piece of paper for a while if you keep it in a safe place.
The kind of account password that you need will depend on who may try to break it. Even though a typical criminal may have access to sophisticated cracking tools, it is unlikely that they will dedicate hours – much less days, weeks, years, or decades – to your particular data.
Don’t lose your Secret Key. We can’t recover it, so if you lose it you can lose access to your entire 1Password account.

This article was followed up by a geek edition which discussed an XKCD comic and some of the mathematical concepts behind the account password theories.
Once the password cracking tool, John the Ripper, was adapted for taking a shot at 1Password account passwords, we looked at how well 1Password holds up with these sorts of account passwords.
If you want to learn more about the format of the Secret Key and how it is used in encryption, check out our 1Password Security Design White Paper.

Jeffrey Goldberg

Principal Security Architect

How to create a strong 1Password account password

SECURITY

Change a weak account password, otherwise leave it be

Passwords in need of changing

After you change your account password