Slashdot Mirror
Passwords That Should Never Be Used
The Original Yama writes "Strong passwords are your first step in securing your systems. If a password can be easily guessed or compromised using a simple dictionary attack, your systems will be vulnerable to hackers, worms, Trojans, and viruses. PCLinuxOnline provides an alphanumerical list of list of commonly used weak passwords that should never be used. If any of these passwords look hauntingly familiar and are being used, you should change the password immediately."
I worked ISP tech support and the one I remember showing up way too often was:
thx1138
I've protected my privacy and use Gator for all my passwords.
I use PASSWORD for everything.
10. iluvalqueda
9. idareyoutoguessthis
8. oldfattylumpkinwhosewisenoseledushere
7. *******
6. (my actual password)
5. cowboyneal
4. pencil
3. neo
2. secret
1. password
Don't blame Durga. I voted for Centauri.
Your users shouldn't require anything more than a 4 digit pin & a magnetic card. If it's enough to protect their money, it's surely enough to protect some stupid data.
Any lame brained security system that depends on people choosing difficult to remember passwords and changing them every 3-6 months is broken by design.
Q54arwms is a commonly used password? Is this some part of the collective unconscious I'm unaware of? Half the things in the list seem like they came out of a random generator, yet they are common?
For great justice.
OK, every once in a while we get an article similar to this. The links change but the article is the same. Passwords are inherently insecure to some sort of guessing attack, is the statement.
I'm going to suggest something here that is perhaps a little controversial. Perhaps, if password zealots spent less time complaining about passwords and spent more time protecting machines from this sort of attack (w/o making an easy path to a DOS attack) this wouldn't be an issue. Imagine this: Passwords are never transfered as plain text. Any systematic attempt at guessing a password is prevented before the attacker gains access. Users make mistakes a few times, even for the most simple passwords, one must sample tens of passwords to break in. Systematic attempts are predictable, just like trolls on slashdot are (generally) identifiable (remember those page lengthening posts?) and spam is filterable.
In my not so humble opinion, password guessing attacks are an administrator problem, not a user problem. And the administrators seem more interested in pestering users than actually developing systems to prevent this type of attack.
-Sean
From what I can tell, John runs a dictionary-based attack against your master.passwd file, then runs the dictionary with various shifts in capitalization, then runs the dictionary again with an assortment of numeric digits inserted into its guesses.
Finally John just runs a brute-force attack, generating passwords with successively longer and longer lengths until it lucks out.
In my case John finally did luck out, finding one of my passwords after 18 days of crunching numbers. This particular account had a relatively weak password -- though no dictionary attack would have found it, it was still only five bytes long. That's a wakeup call for me. I've been using shorter passwords for years, thinking that by avoiding common words I was safe. But I can see that they're breakable now.
It's one thing for someone to preach that you should really have longer passwords; it's quite another to see it for yourself. If your passwords are easy to guess, or are variants of dictionary words, or can be generated easily by brute force -- there are widely available tools that can give the keys to the city to any lowlife that wants into your machine.
Run one of the password crackers on your own system today, and become enlightened! And don't be comforted by the 18 days it took to crack my easy five-character password on a 300MHz Celeron notebook: there's also a distributed version of John the Ripper that divides up the work of cracking your password file among many computers.
The more I learn about security, and the tighter I make my systems, the more afraid I am. If you aren't afraid, you are either very very good at what you do -- and I humbly bow before you -- or you haven't much of a clue.
(January)
...
...
...
User: Tim
Password: NEWUSER
YOU MUST CHANGE YOUR PASSWORD EVERY 30 DAYS
PASSWORD MUST HAVE AT LEAST 6 ALPHA AND 2 NUMERIC/OTHER CHARACTERS
New Password: password
PASSWORD MUST HAVE AT LEAST 6 ALPHA AND 2 NUMERIC/OTHER CHARACTERS
New Password: password01
OK
(February)
User: Tim
Password: password01
YOU MUST CHANGE YOUR PASSWORD EVERY 30 DAYS
PASSWORD MUST HAVE AT LEAST 6 ALPHA AND 2 NUMERIC/OTHER CHARACTERS
New Password: password01
THIS PASSWORD HAS BEEN USED RECENTLY
YOU MUST CHANGE YOUR PASSWORD EVERY 30 DAYS
PASSWORD MUST HAVE AT LEAST 6 ALPHA AND 2 NUMERIC/OTHER CHARACTERS
New Password: password02
OK
(March)
User: Tim
Password: password02
YOU MUST CHANGE YOUR PASSWORD EVERY 30 DAYS
PASSWORD MUST HAVE AT LEAST 6 ALPHA AND 2 NUMERIC/OTHER CHARACTERS
New Password: password03
OK
repeat ad nauseum
Here come da fudge!
It is true, for example that excluding 5-and-under passwords reduces the keyspace. But that is still a win if that part of the keyspace was overpopulated.
Put differently, if everyone has passwords 8 characters or less, choosen from a set of 64 characters (I realise there's more, but some are much more used than others, so the effective strength of a password choosen by a user is seldom more than 6bit/char)
- There's 2^(5*6) = 2^30 passwords that are exactly 5 characters long.
- There's 1.015 * 2^30 passwords that are 5 or less characters wrong.
- There are about 2**(8*6) = 2**48 passwords in total.
- So, by excluding the shorter ones, you've excluded 0.00038% of your keyspace.
If users choose passwords randomly, then one in 262000 users would choose a password with 5 or less characters, and for an attacker, searching this keyspace would be no more fruitful than searching any other random part of the keyspace.Problem is, users do NOT typically choose passwords anywhere close to randomly. A more typical scenario is that 10% of all the users choose passwords 5 characters or less.
In that case, searching the 5-or-less part of the keyspace is 26000 times more likely to net you a working password than choosing a random part of the keyspace to search.
In practice, you can brute-force the 30-bit 5-and-under keyspace in minutes, and you'll have passwords for 10% of the user-accounts, allthough you only searched less than one thousandth of one percent of the keyspace.
THAT is why requiring users to have passwords over a minimum length does not, as you claim, harm security. (instead it helps quite a bit)