We all know that we don’t get enough sleep. But how much sleep do we really need? Until about 15 years ago, one common theory was that if you slept at least four or five hours a night, your cognitive performance remained intact; your body simply adapted to less sleep. But that idea was based on studies in which researchers sent sleepy subjects home during the day — where they may have sneaked in naps and downed coffee.

Enlarge This Image

AMERICAN SLUMBER Number of hours of sleep (self-reported) on weeknights.

Enlarge This Image

Antonio Bolfo for The New York Times

Enter David Dinges, the head of the Sleep and Chronobiology Laboratory at the Hospital at University of Pennsylvania, who has the distinction of depriving more people of sleep than perhaps anyone in the world.

In what was the longest sleep-restriction study of its kind, Dinges and his lead author, Hans Van Dongen, assigned dozens of subjects to three different groups for their 2003 study: some slept four hours, others six hours and others, for the lucky control group, eight hours — for two weeks in the lab.

Every two hours during the day, the researchers tested the subjects’ ability to sustain attention with what’s known as the psychomotor vigilance task, or P.V.T., considered a gold standard of sleepiness measures. During the P.V.T., the men and women sat in front of computer screens for 10-minute periods, pressing the space bar as soon as they saw a flash of numbers at random intervals. Even a half-second response delay suggests a lapse into sleepiness, known as a microsleep.

The P.V.T. is tedious but simple if you’ve been sleeping well. It measures the sustained attention that is vital for pilots, truck drivers, astronauts. Attention is also key for focusing during long meetings; for reading a paragraph just once, instead of five times; for driving a car. It takes the equivalent of only a two-second lapse for a driver to veer into oncoming traffic.

Not surprisingly, those who had eight hours of sleep hardly had any attention lapses and no cognitive declines over the 14 days of the study. What was interesting was that those in the four- and six-hour groups had P.V.T. results that declined steadily with almost each passing day. Though the four-hour subjects performed far worse, the six-hour group also consistently fell off-task. By the sixth day, 25 percent of the six-hour group was falling asleep at the computer. And at the end of the study, they were lapsing fives times as much as they did the first day.

The six-hour subjects fared no better — steadily declining over the two weeks — on a test of working memory in which they had to remember numbers and symbols and substitute one for the other. The same was true for an addition-subtraction task that measures speed and accuracy. All told, by the end of two weeks, the six-hour sleepers were as impaired as those who, in another Dinges study, had been sleep-deprived for 24 hours straight — the cognitive equivalent of being legally drunk.

So, for most of us, eight hours of sleep is excellent and six hours is no good, but what about if we split the difference? What is the threshold below which cognitive function begins to flag? While Dinges’s study was under way, his colleague Gregory Belenky, then director of the division of neuroscience at the Walter Reed Army Institute of Research in Silver Spring, Md., was running a similar study. He purposely restricted his subjects to odd numbers of sleep hours — three, five, seven and nine hours — so that together the studies would offer a fuller picture of sleep-restriction. Belenky’s nine-hour subjects performed much like Dinges’s eight-hour ones. But in the seven-hour group, their response time on the P.V.T. slowed and continued to do so for three days, before stabilizing at lower levels than when they started. Americans average 6.9 hours on weeknights, according to the National Sleep Foundation. Which means that, whether we like it or not, we are not thinking as clearly as we could be.

Of course our lives are more stimulating than a sleep lab: we have coffee, bright lights, the social buzz of the office, all of which work as “countermeasures” to sleepiness. They can do the job for only so long, however. As Belenky, who now heads up the Sleep and Performance Research Center at Washington State University, Spokane, where Van Dongen is also a professor, told me about cognitive deficits: “You don’t see it the first day. But you do in five to seven days. Unless you’re doing work that doesn’t require much thought, you are trading time awake at the expense of performance.”

And it’s not clear that we can rely on weekends to make up for sleep deprivation. Dinges is now running a long-term sleep restriction and recovery study to see how many nights we need to erase our sleep debt. But past studies suggest that, at least in many cases, one night alone won’t do it.

Not every sleeper is the same, of course: Dinges has found that some people who need eight hours will immediately feel the wallop of one four-hour night, while other eight-hour sleepers can handle several four-hour nights before their performance deteriorates. (But deteriorate it will.) There is a small portion of the population — he estimates it at around 5 percent or even less — who, for what researchers think may be genetic reasons, can maintain their performance with five or fewer hours of sleep. (There is also a small percentage who require 9 or 10 hours.)

Still, while it’s tempting to believe we can train ourselves to be among the five-hour group — we can’t, Dinges says — or that we are naturally those five-hour sleepers, consider a key finding from Van Dongen and Dinges’s study: after just a few days, the four- and six-hour group reported that, yes, they were slightly sleepy. But they insisted they had adjusted to their new state. Even 14 days into the study, they said sleepiness was not affecting them. In fact, their performance had tanked. In other words, the sleep-deprived among us are lousy judges of our own sleep needs. We are not nearly as sharp as we think we are.

Maggie Jones (margueritepjones@gmail.com) is a contributing writer for the magazine. Editor: Tony Gervino (t.gervino-MagGroup@nytimes.com).

Security companies and IT people constantly tells us that we should use complex and difficult passwords. This is bad advice, because you can actually make usable, easy to remember and highly secure passwords. In fact, usable passwords are often far better than complex ones.

So let's dive into the world of passwords, and look at what makes a password secure in practical terms.

Update: Read the FAQ (updated January 2011)

How to hack a password

The work involved in hacking passwords is very simple. There are 5 proven ways to do so:

1. Asking: Amazingly the most common way to gain access to someone's password is simply to ask for it (often in relation with something else). People often tell their passwords to colleagues, friends and family. Having a complex password policy isn't going to change this.
2. Guessing: This is the second most common method to access a person's account. It turns out that most people choose a password that is easy to remember, and the easiest ones are those that are related to you as a person. Passwords like: your last name, your wife's name, the name of your cat, the date of birth, your favorite flower etc. are all pretty common. This problem can only be solved by choosing a password with no relation to you as a person.
3. Brute force attack: Very simple to do. A hacker simply attempts to sign-in using different passwords one at the time. If you password is "sun", he will attempt to sign-in using "aaa, aab, aac, aad ... sul, sum, sun (MATCH)". The only thing that stops a brute force attack is higher complexity and longer passwords (which is why IT people want you to use just that).
4. Common word attacks: A simple form of brute-force attacks, where the hacker attempt to sign-in using a list of common words. Instead of trying different combination of letters, the hacker tries different words e.g. "sum, summer, summit, sump, sun (MATCH)".
5. Dictionary attacks: Same concept as common word attacks - the only difference is that the hacker now uses the full dictionary of words (there are about 500,000 words in the English language).

When is a password secure?

You cannot protect against "asking" and "guessing", but you can protect yourself from the other forms of attacks. A hacker will usually create an automated script or a program that does the work for him. He isn't going to sit around manually trying 500,000 different words to see if one of them is your password.

The measure of security must then be "how many password requests can the automated program make - e.g. per second". The actual number varies, but most web applications would not be capable of handling more than 100 sign-in requests per second.

This means it takes the following time to hack a simple password like "sun":

• Brute-force: 3 minutes
• Common Word: 3 minutes
• Dictionary: 1 hour 20 minutes

Note: "sun" has 17,576 possible character combinations. 3 letters using the lowercase alphabet = 26³

This is of course a highly insecure password, but how much time is enough for a password to be secure?

• a password that can be hacked in 1 minute is far too riksy
• 10 minutes - still far too risky
• 1 hour - still not good enough
• 1 day - now we are getting somewhere. The probability that a person will have a program running just to hack your account for an entire day is very little. Still, it is plausible.
• 1 month - this is something that only a dedicated attacker would do.
• 1 year - now we are moving from practical risk to theoretical risk. If you are NASA or CIA then it is unacceptable. For the rest of us, well - you do not have that kind of enemies, nor is your company data that interesting.
• 10 years - Now we are talking purely theoretical.
• A lifetime: 100 years - this is really the limit for most people. Who cares about their password being hacked after they have died? Still it is nice to know that you use a password that is "secure for life"

But let's take a full swing at this. Let's look at "100 year - secure for life". It has good ring to it and it makes us feel safe. There is still the chance that the hacker gets lucky. That he accidently finds the right password after only 15 years instead of 100. It happens.

Let's step that up too and go for the full high-end security level. I want a password that takes 1,000 years to crack- let's call this "secure forever". That ought to be good enough, right?

Making usable and secure passwords

Now that we have covered the basics, let's look at some real examples, and see just how usable we can make a password, while still being "secure forever".

Note: The examples below are based on 100 password request per second. The result is the approach that is the most effective way to hack that specific password - either being by the use of brute-force, common words or dictionary attacks.

First let's look at the common 6 character password - using different methods:

In this example complexity clearly wins. Using a password with mixed case characters, numbers and symbols is far more secure than anything else. Using a simple word as your password is clearly useless.

Does that mean that the IT-departments and security companies is right? Nope, it just means that a 6 character password isn't going to work. None can remember a password like "J4fS<2", which evidently mean that it will be written on a post-it note.

To make usable passwords we need to look at them differently. First of all what you need is to use words you can remember, something simple and something you can type fast.

Like these:

Using more than one simple word as your password increases you security substantially (from 3 minutes to 2 months). But, by simply using 3 words instead of two, you suddenly got an extremely secure password.

It takes:

• 1,163,859 years using a brute-force method
• 2,537 years using a common word attack
• 39,637,240 years using a dictionary attack

It is 10 times more secure to use "this is fun" as your password, than "J4fS<2".

If you want to be insanely secure; simply choose uncommon words as your password - like:

A usable and secure password is then not a complex one. It is one that you can remember - a simple password using 3+ words.

It is not just about passwords

One thing is to choose a secure and usable password. Another thing is to prevent the hacker from hacking password in the first place. This is a very simple thing to do.

All you need to do is to prevent automatic hacking scripts from working effectively. What you need to do is this:

1. Add a time-delay between sign-in attempts. Instead of allowing people to sign-in again and again and again. Add a 5 second delay between each attempt.

   It is short enough to not be noticeable (it takes longer than 5 seconds to realize that you have tried a wrong password, and to type in a new one). And, it forces the hacker to only be able make sign-in requests 1 every 5 seconds (instead of 100 times per second).

2. Add a penalty period if a person has typed a wrong password more than - say - 10 times - of something like 1 hour. Again, this seriously disrupts the hacking script from working effectively.

A hacker can hack the password "alpine fun" in only 2 months if he is able to attack your server 100 times per second. But, with the penalty period and the 5 second delay, the same password can suddenly sustain an attack for 1,889 years.

Remember this the next time you are making web applications or discussing password policies. Passwords can be made both highly secure and user-friendly.

Update: Read the FAQ (updated January 2011)

Let's cut to the chase.

Say you decide to go on a fast, and so you effectively starve yourself for a week. At the end of seven days, how would you be feeling? You'd probably be hungry, perhaps a little weak, and almost certainly somewhat thinner. But basically you'd be fine.

Now let's say you deprive yourself of sleep for a week. Not so good. After several days, you'd be almost completely unable to function. That's why Amnesty International lists sleep deprivation as a form of torture.

Here's what former Israeli Prime Minister Menachem Begin had to say in his memoir White Nights about the experience of being deprived of sleep in a KGB prison: "In the head of the interrogated prisoner a haze begins to form. His spirit is wearied to death, his legs are unsteady, and he has one sole desire: to sleep ... Anyone who has experienced this desire knows that not even hunger and thirst are comparable with it."

So why is sleep one of the first things we're willing to sacrifice as the demands in our lives keep rising? We continue to live by a remarkably durable myth: sleeping one hour less will give us one more hour of productivity. In reality, the research suggests that even small amounts of sleep deprivation take a significant toll on our health, our mood, our cognitive capacity and our productivity.

Many of the effects we suffer are invisible. Insufficient sleep, for example, deeply impairs our ability to consolidate and stabilize learning that occurs during the waking day. In other words, it wreaks havoc on our memory.

So how much sleep do you need? When researchers put test subjects in environments without clocks or windows and ask them to sleep any time they feel tired, 95 percent sleep between seven and eight hours out of every 24. Another 2.5 percent sleep more than eight hours. That means just 2.5 percent of us require less than 7 hours of sleep a night to feel fully rested. That's 1 out of every 40 people.

When I ask people in my talks how many had fewer than 7 hours of sleep several nights during the past week, the vast majority raise their hands. That's true whether it's an audience of corporate executives, teachers, cops or government workers. We've literally lost touch with what it feels like to be fully awake.

Great performers are an exception. Typically, they sleep significantly more than the rest of us. In Anders Ericcson's famous study of violinists, the top performers slept an average of 8 ½ hours out of every 24, including a 20 to 30 minute midafternoon nap some 2 hours a day more than the average American.

The top violinists also reported that except for practice itself, sleep was second most important factor in improving as violinists.

As I began to gather research about sleep, I felt increasingly compelled to give it higher priority in my own life. Today, I go to great lengths to assure that I get at least 8 hours every night, and ideally between 8 ½ and 9, even when I'm traveling.

I still take the overnight "redeye" from California to New York, but I'm asleep by takeoff — even if takes an Ambien. When I get home at 6 or 7 a.m., I go right to bed until I've had my 8 hours. What I've learned about those days is that I'd rather work at 100 percent for 5 or 6 hours, than at 60 percent for 8 or 9 hours.

With sufficient sleep, I feel better, I work with more focus, and I manage my emotions better, which is good for everyone around me. I dislike having even a single day where I haven't gotten enough sleep, because the impact is immediate and unavoidable. On the rare days that I don't get enough, I try hard to get at least a 20-30 minute nap in the afternoon. That's a big help.

Here are three other tips to improve the quantity and quality of your sleep:

• Go to bed earlier — and at a set time. Sounds obvious right? The problem is there's no alternative. You're already waking up at the latest possible time you think is acceptable. If you don't ritualize a specific bedtime, you'll end up finding ways to stay up later, just the way you do now.
• Start winding down at least 45 minutes before you turn out the light. You won't fall asleep if you're all wound up from answering email, or doing other work. Create a ritual around drinking a cup of herbal tea, or listening to music that helps you relax, or reading a dull book.
• Write down what's on your mind — especially unfinished to-do's and unresolved issues — just before you go to bed. If you leave items in your working memory, they'll make it harder to fall asleep, and you'll end up ruminating about them if you should wake up during the night.