London, June 2 (ANI): Over 55s pick passwords that are double the strength than those chosen by under 25s, a study has revealed.

Passwords of nearly 70 million Yahoo! users was analysed by computer scientist at the University of Cambridge, Joseph Bonneau, New Scientist reported.

To ensure that he did not have access to the individual accounts, the data had been protected using a security technique called hashing. He then calculated the password strengths for different demographic groups and compared the results.

After comparing different nationalities, it was found that German and Korean speakers choose the strongest passwords, while Indonesians picked the weakest.

People with a credit card stored on their account do little to increase their security other than avoiding very weak passwords such as 123456.

But people who change their password from time to time tend to select the strongest ones.

Usually, security researchers look at the difficulty of breaking every password in a database, but that makes the problem seem much harder than it is, because the most secure randomly-generated passwords are not possible to crack.

Instead, Bonneau looked at more realistic attacker scenarios.

Maybe an attacker is happy to only break one per cent of accounts they have access to, or 50 or even 90 per cent. Those are all very different than 100 per cent. he said.

Another important factor is whether attackers are trying to guess the password of a particular user by typing it onto a login screen, or attempting to crack an entire leaked database of passwords. These are known as online and offline attacks respectively.

Password strength is measured in bits, where cracking one bit is equivalent to the chance of correctly calling a fair coin toss, and each additional bit doubles the password's strength.

On average, Bonneau found that user-chosen passwords offer less than 10 bits of protection against online attacks, meaning it would only take around 1000 attempts to try every possible password, and around 20 bits of security against offline attacks.

That's shocking, because even a randomly chosen six-character password composed of digits and upper and lower case letters should offer 32 bits of security.

Bonneau said that the inconsistency is due to people picking much easier passwords than those theoretically allowed. He suggests assigning people randomly chosen nine-digit numbers instead, which would offer 30 bits of security against every type of attack - a 1000-fold increase in security on average.

I think it's reasonable to expect people to have the capacity to remember that, because they do it for phone numbers, he said.

Bonneau presented the findings at the Symposium on Security and Privacy in San Francisco, California, on May 23. (ANI)