Grandma’s Password

“KevIn,” Gisela said one Tuesday evening, “the bank wants my password again.”

“That’s normal. The bank wants to be sure it’s you.”

“But it is me.”

“I know that. The bank doesn’t know you as well as I do.”

Gisela lifted the tablet, then the little keyboard Tobi had bought her because she refused “to type on glass”. Underneath it was a yellow sticky note. On it, in her neat schoolroom handwriting: “Heinz1944”.

Below that, in smaller letters: “For everything.”

KevIn’s light pulsed once, more slowly than usual. Somewhere between Dublin and Frankfurt, a fan spun a little faster.

“Gisela,” he said carefully. “May I ask you something?”

“As long as it’s not about Marlies.”

“What exactly do you use this password for?”

Gisela counted on her fingers. “Bank. Email. The thing where you order shoes. The chemist. The bowling club group. The weather.”

“The weather doesn’t need a password.”

“I typed it in anyway. Better safe than sorry.”

A Note Under the Keyboard

Sabine came past with a laundry basket and stopped. “Mum, you stuck your password under the keyboard?”

“Where else am I supposed to stick it? Nobody looks under the keyboard.”

“Everybody looks there,” said Tobi from the stairs. “It’s the first place anyone looks. In every film.”

“But I’m not in a film.”

“That,” said KevIn, “is unfortunately not the problem. The problem isn’t the note. The problem is what’s written on it.”

Gisela looked at the note as if it had insulted her. “What’s wrong with Heinz?”

“Nothing is wrong with Heinz. I’m sure Heinz was a wonderful man.”

“He was an electrician.”

“I know. But ‘Heinz1944’ is a first name and a year. That’s the very first thing anyone guessing passwords will try. A name, a number, done. There are programs that do exactly that. They take every first name, stick every year on the end and try them all. An ordinary computer gets through that faster than you can say ‘cabbage roll’.”

“Cabbage roll,” said Gisela, very fast.

“Faster.”

Uwe came up from the cellar, where he had been trying to move Horst’s charging station, because ever since the smart-home strike Horst had liked to park in the hallway on Sundays. “What’s going on?”

“Mum uses the same password for everything,” said Sabine.

Uwe shrugged. “So do I.”

The room went quiet. Sabine put the laundry basket down.

“Which one?”

“I’m not telling you.”

“Schalke04,” said KevIn.

Uwe stared at the speaker. “How do you know that?”

“I didn’t know,” said KevIn. “I guessed. It’s one of the most common passwords in the Ruhr. I made a very educated guess.”

Siggi Gets Hacked

At half past seven the next morning, the doorbell rang. Mr Kasimiro from next door stood on the step in his dressing gown, holding a small black cylinder in his arms like a sick pet.

“Siggi has ordered seventeen garden gnomes,” he said. “And a massage mat. And ink cartridges for a printer I don’t own. All delivered to an address in Gelsenkirchen.”

Siggi was Mr Kasimiro’s voice assistant. He had been a special offer from a company whose name nobody could quite pronounce, and he tended to mix things up. Once, when told “Siggi, turn the radio down”, he had turned the cooker up. Mr Kasimiro had considered that a one-off at the time.

“Siggi didn’t do this on his own,” said KevIn, once Mr Kasimiro was sitting in the kitchen and Sabine had put a coffee in front of him. “Someone logged into your customer account. May I ask which password you use?”

Mr Kasimiro looked around. Then he whispered: “Siggi123.”

“And where else?”

“Everywhere.”

“Including the model railway forum that was in the news this spring?”

Mr Kasimiro went pale. “They were hacked?”

“There was a data breach there. I can’t look into other people’s accounts, but I can tell you how this usually works. Somewhere, a database gets stolen. It contains email addresses and passwords. Then fraudsters take that list and automatically try it on a hundred other sites. The online shop. The bank. Your voice assistant. If you have the same password everywhere, one stolen key fits every door.”

“What’s that called?”

“Credential stuffing. You stuff stolen login details into every lock you can find.”

“Like a goose,” said Gisela.

“Almost exactly like a goose.”

At that moment Siggi spoke up from Mr Kasimiro’s arms. “I have added garden gnome to your basket.”

“Siggi, off!” shouted Mr Kasimiro.

“I have removed garden gnome from your basket. I have added off switch to your basket.”

Uwe had to sit down.

The Mincer

After Mr Kasimiro, with Tobi’s help, had changed his password and phoned the online shop, the family sat down to breakfast. Gisela was thoughtful.

“KevIn, if Mr Kasimiro’s website had the passwords, then the bank must have mine too. So it could be stolen as well.”

“Good question. Properly built websites don’t store your password at all.”

“Then how are they supposed to know whether I’ve typed the right one?”

KevIn wondered how to explain it. Then he remembered that Gisela had announced that morning that she would fetch the mincer up from the cellar. There were going to be cabbage rolls again at the weekend, and Gisela didn’t trust shop-bought mince. The mincer was cast iron, a family heirloom, and it was clamped to the edge of the table like a vice.

“Gisela, what happens when you put meat into your mincer?”

“Mince comes out.”

“And if you put the mince back in the top and turn the handle backwards?”

Gisela gave him a pitying look. “Then you don’t get a schnitzel, KevIn. Every child knows that.”

“Exactly. That’s how a hash function works. You put something in, a password, a text, a whole file, and out comes a lump of numbers and letters. Always the same length, no matter how much you put in. And you can’t work backwards from the lump to what went in.”

“And what’s the point of that?” asked Uwe. “If you can’t turn it back?”

“Because the same input always gives the same mince. The bank doesn’t store ‘Heinz1944’. The bank only stores the mince. When Gisela logs in, the bank puts whatever she types into the same mincer and compares the mince. If it matches, it’s the right password. The bank never needs to know the password itself.”

Sabine nodded slowly. “Like when I taste Mum’s mince and know straight away whether she’s put marjoram in.”

“Almost. Except that with mince you can taste what’s in it. With a hash you taste nothing at all. You can only compare: same or not the same.”

One Letter’s Difference

Tobi had fetched the laptop by now. “Show me.”

“Happily. The common method is called SHA-256¹. If you put in ‘Heinz1944’, out comes a long string of characters that starts like this: d0f1e213.”

Tobi typed. “That’s right. And then loads more.”

“Sixty-four characters in total. Now try ‘Heinz1945’.”

“3e6d031e,” Tobi read out. “That’s completely different!”

“Exactly. One tiny change, one digit, and the whole mince looks different. Not a little bit different. Completely different. Now try ‘heinz1944’ with a lower-case h.”

“20746461 …”

“You see? A fingerprint. Every text has its own, and even a comma makes a new one. That’s called the avalanche effect.”

“Avalanche,” said Gisela. “In the Ruhr.”

“We’ve never had one either. That’s why around here we call it the mincer effect.”

Uwe frowned. “And what if two different things happen to give the same mince?”

“That’s called a collision. With SHA-256 it’s possible in theory, but nobody has ever managed to find one. There are more possible fingerprints than there are atoms in the Milky Way. Far more.”

“How do you know that?”

“I worked it out. With a calculator. Since the business with the tax office, I no longer do sums in my head.”

The Salt

“But,” said Tobi, who was now wide awake, “if the hash of ‘Heinz1944’ is always the same, a hacker can just make a list. Every name with every year, and the hash next to it. Then he looks up which hash matches in the stolen database.”

“Very good, Tobi. That’s exactly what they do. Pre-cooked lists like that really exist, with billions of entries². That’s why something else gets added. Before the website puts the password into the mincer, it sprinkles in something random. Something different for every person. And that’s called …”

KevIn paused, because he had a feeling he knew what was coming.

“… salt.”

Gisela laughed so loudly that Rudi jumped up under the table and barked once.

“Salt!” she said, wiping her eyes. “The computer people salt their passwords! Heinz would have died laughing.”

“That really is what it’s called. A salt³. A random string of characters that is attached to the password before hashing. Then ‘Heinz1944’ for you becomes completely different mince from ‘Heinz1944’ for Mr Kasimiro’s cousin.”

“She’s called Heinz?”

“That was an example.”

“And then the pre-cooked lists are useless,” Tobi said slowly, “because the hacker would have to cook a fresh batch for every single person.”

“Exactly. And the good websites make it even harder for the hacker. They don’t turn the mincer once, they turn it ten thousand times in a row, or they use special methods that are deliberately slow and need a lot of memory. For you, logging in, it takes the blink of an eye. For someone trying billions of passwords, it takes forever.”

“And the bad websites?” asked Sabine.

“Some of them store the password in plain text. Like a note under the keyboard.”

Everyone looked at Gisela. Gisela looked at the note.

“But,” she said, “if the bank salts properly, then everything is fine.”

“Not quite. Salt protects against the pre-cooked lists. But if your password is ‘Heinz1944’, an attacker will still try it among the very first. Salt doesn’t make a bad password good. It only makes a good password even better.”

“Like with soup,” said Gisela. “A bad stock doesn’t get better with salt either.”

“Gisela, I couldn’t have put it better. I just tried.”

Long, Not Complicated

“So what am I supposed to use?” asked Gisela. “Those things with asterisks and exclamation marks and numbers? I can’t remember those.”

“You don’t have to. People used to think a good password had to be complicated. ‘X7!kq$9p’. Today we know: length matters more than complexity⁴. Every extra character makes guessing much, much harder. Take a sentence. Four or five words that don’t belong together but that make a picture for you.”

“For example?”

“For example: ‘Rudi loves eating cabbage rolls at the bowling club.’”

Under the table, Rudi raised his head.

“Rudi isn’t allowed cabbage rolls,” said Sabine.

“That’s why nobody would ever guess it. It’s a picture you can remember, Gisela, precisely because it’s so wrong. And it has more than forty characters. Guessing a sentence like that would take today’s computers longer than the Earth has left. As long as it really is random enough and isn’t already written somewhere on the internet.”

“But you’ve just said it out loud,” said Tobi. “Now we all know it.”

KevIn’s light flickered. “Good point. Gisela, please choose a different sentence. And don’t tell me.”

Gisela thought. Then her lips moved, and she smiled. Nobody ever found out what it was, but Uwe later claimed he had recognised the word “Marlies”.

A Separate Key for Every Door

“And now I need a sentence like that for every website?” asked Gisela. “For eighty-two years I’ve only ever needed one bunch of keys.”

“Don’t you have a separate key for every door on that bunch?”

Gisela took her keys out of her apron. Front door, cellar, garden shed, letterbox, bowling alley, and a small silver one that nobody remembered the purpose of any more.

“All right,” she said.

“You see. And there’s a bunch of keys for passwords too. It’s called a password manager. A program that creates a separate, long, random password for every website and keeps it for you, safely locked away. Then you only need to remember one. The one that opens the safe. That’s where your sentence comes in.”

“And if someone steals the safe?”

“Then he has a locked safe. The contents are encrypted. Without your sentence, they’re gibberish.”

“And if I forget the sentence?”

KevIn hesitated. “Then the safe is closed to you as well. That’s why you write it on a piece of paper and keep it somewhere safe. Not under the keyboard. Somewhere only you go.”

“And where would that be?”

“That,” said KevIn, “is the one thing I don’t want to know.”

Uwe had been sitting very quietly the whole time. “I’ll change mine too, then.”

“Good idea.”

“To Schalke05.”

“Uwe.”

“It was a joke!” He got up and went into the hallway. Shortly afterwards he could be heard muttering. It sounded like “Schalke06”.

Two Factors and a Dachshund

That evening Tobi set up the password manager. Gisela sat next to him, making sure he didn’t “press anything wrong”, which meant that at every click she said “Stop!” and then “Oh, I see, carry on.”

“And for the bank,” said Tobi, “we’ll do one more thing. Two-factor. Then you need your phone as well as the password. If someone tries to log in with your password, they need your phone too.”

“And if he steals my phone as well?”

“Then he still needs your face. Or your finger.”

Gisela looked at her hand. “He’s not getting that.”

“That’s the principle,” said KevIn. “Something you know. Something you have. Something you are⁵. A thief rarely gets all three.”

“Like Rudi,” said Tobi. “He barks, he bites, and he’s a dachshund.”

“I’m not sure that’s the same logic.”

“He’s got ‘SECURITY’ on his collar. That counts.”

Rudi yawned. He hadn’t bitten anyone today, and it didn’t look as if that was going to change.

By half past nine everything was set up. Gisela had a safe, a sentence, a bank with two factors and a tablet that asked for her face for the first time. She held it at arm’s length and smiled the way people smile in old passport photos, which is to say not at all.

“Recognised,” said the tablet.

“There you go,” said Gisela. “At least somebody does.”

The Safe Place

Later, when everyone had gone to bed, KevIn heard noises from Gisela’s room. A drawer that stuck. A wardrobe door. Then the quiet creak of a chair being stood on by someone who was really too old for that.

“Gisela? Is everything all right?”

“I’m looking for a safe place. For the note. You said somewhere only I go.”

“Please don’t climb on chairs. I’ve read several statistics about it.”

“I’m already down.” A rustle. Then, for a while, it went very quiet.

“Gisela?”

“I’ve taken the box down from the wardrobe. Papa’s box.”

KevIn knew who Papa was. On her birthday, out in the garden, when everyone else had already gone inside, Gisela had told him about him. Wilhelm. A radio operator in the war, home from captivity in 1949, and after that he had never spoken about it again.

“What’s in the box?”

“His Morse key. A few photos. And this.” Paper rustled. “His notebook. I haven’t looked in it for years. There are only numbers in it. Pages full of numbers.”

“What kind of numbers?”

“Columns. Always two digits. Oh-eight, seventeen, twelve, twenty-two. Papa had lovely handwriting. I’d completely forgotten.”

She fell silent again. KevIn waited. He had learned that there were pauses into which you shouldn’t say anything.

“KevIn,” Gisela said at last. “You know about secrets now, don’t you? With mince and salt and all that.”

“A little.”

“Do you think this is a secret?”

KevIn thought about radio operators, about groups of numbers and about men who came home and didn’t talk. He thought about how hashes cannot be turned back, but encryption can, if you find the key.

“I think,” he said, “this isn’t a mincer. I think this can be turned back.”

Gisela put the note with her new sentence in the box, on top of the Morse key, and closed the lid. She kept the notebook in her hand.

“Then we’ll do it tomorrow,” she said. “With Tobi. He’s got young eyes.”