WEBVTT

NOTE
Subtitles for the Passwords and passphrases walkthrough. They match the captions drawn on the video,
and there is no spoken narration. The music is an original score. Cue times follow
the film timeline in seconds.

1
00:00:00.400 --> 00:00:04.530
What makes a secret hard to guess, and why do the rules keep changing?

2
00:00:04.730 --> 00:00:09.250
The promise: you will watch a real generator and see the math behind strength.

3
00:00:09.450 --> 00:00:13.770
Our job: learn what makes a secret strong, then build habits you can keep.

4
00:00:14.900 --> 00:00:20.800
First, how passwords get guessed. Attackers try lists of popular and leaked passwords before anything else.

5
00:00:21.000 --> 00:00:25.510
A leaked password is tried on other sites. That is called credential stuffing.

6
00:00:25.710 --> 00:00:30.130
After a breach, stolen hashes can be guessed on the attacker’s own machines.

7
00:00:30.330 --> 00:00:34.510
And phishing tricks you into typing it, so there is no guessing at all.

8
00:00:35.900 --> 00:00:41.320
Strength is a count of guesses. For a random choice, bits equal length times log two of the pool.

9
00:00:41.520 --> 00:00:44.520
Every extra bit doubles the number of guesses.

10
00:00:44.720 --> 00:00:48.900
Eight random lowercase letters are about 38 bits. Sixteen are about 75.

11
00:00:49.100 --> 00:00:53.660
Words work the same way: each word from a 7,776-word list adds about 12.9 bits.

12
00:00:53.860 --> 00:00:58.420
So six words are about 78 bits. But these numbers only hold for random choices.

13
00:00:59.900 --> 00:01:05.890
In the video, watch the Password tab first: the length slider, four character sets, and the strength readout.

14
00:01:06.090 --> 00:01:11.410
Then the Passphrase tab: the word count, the delimiter, and how the bits change with each word.

15
00:01:11.610 --> 00:01:16.700
Predict: how many random words make a passphrase as strong as 16 random lowercase letters?

16
00:01:17.900 --> 00:01:22.990
Here is PrivacySafe Bot. Sixteen lowercase letters give about 75 bits, in its strong tier.

17
00:01:23.190 --> 00:01:29.370
Add uppercase letters, numbers and symbols, and the estimate climbs. Then make it longer: 30 characters, then 32.

18
00:01:29.570 --> 00:01:34.460
Switch to the Passphrase tab. Six words give about 78 bits, and eight words about 103.

19
00:01:34.660 --> 00:01:39.940
Four words are about 52 bits and labeled good. Three words are about 39 bits and labeled weak.

20
00:01:41.400 --> 00:01:44.870
So how many words match 16 lowercase letters? About six.

21
00:01:45.070 --> 00:01:49.770
Six random words come to about 78 bits, against about 75 for 16 lowercase letters.

22
00:01:50.900 --> 00:01:54.370
Passwords and passphrases both work, if they are random.

23
00:01:54.570 --> 00:01:59.600
A password is random characters, harder to remember, and best kept in a password manager.

24
00:01:59.800 --> 00:02:05.840
A passphrase is random words, easier to remember and type, and best for your master password and device login.

25
00:02:06.040 --> 00:02:11.080
Both must be random, so use a generator. People are poor at making unpredictable choices.

26
00:02:12.400 --> 00:02:18.390
Strength is not the whole story. Use a unique secret for every account, so one breach cannot open many doors.

27
00:02:18.590 --> 00:02:23.820
A password manager remembers long random secrets, so you remember only one strong passphrase.

28
00:02:24.020 --> 00:02:28.010
A second factor or a passkey means a stolen password is not enough.

29
00:02:28.210 --> 00:02:32.580
And check for breaches, and change a password after one, not on a schedule.

30
00:02:33.900 --> 00:02:36.900
Here is your password plan. Eight steps.

31
00:02:37.100 --> 00:02:40.520
Use a password manager, and make every password unique.

32
00:02:40.720 --> 00:02:46.710
Use 16 or more random characters for accounts, and a six-word random passphrase for your manager and devices.

33
00:02:46.910 --> 00:02:52.140
Turn on a second factor or passkeys, and never build secrets from personal facts or patterns.

34
00:02:52.340 --> 00:02:58.380
Check whether your accounts appear in known breaches, and change a password after a breach, not on a schedule.

35
00:02:59.400 --> 00:03:02.400
Two questions for the room.

36
00:03:02.600 --> 00:03:08.160
Why do some sites still demand symbols and monthly changes? What would you change about their rules?

37
00:03:08.360 --> 00:03:14.450
Where should a password generator run, on your device or on a server? What would you check before trusting one?

38
00:03:15.900 --> 00:03:19.700
That is the lesson: strong secrets are long, random and unique.

39
00:03:19.900 --> 00:03:23.370
Use a manager, a second factor, and a plan you can keep.

40
00:03:23.570 --> 00:03:26.570
Start with one step this week.