Slashdot Mirror
Password Memorability and Securability
NonNullSet writes "Who would have thought that that something new could be said about how best to select passwords? Ross Andreson of Cambridge University and some of his colleages have performed new empirical studies and found some pretty non-intuitive results. For example:
1. The first folk belief is that users have difficulty remembering random passwords. This belief is confirmed.
2. The second folk belief is that passwords based on mnemonic prases are harder for an attacker to guess than naively selected passwords. This belief is confirmed.
3. The third folk belief is that random passwords are better than those based on mnemonic phrases. However, each appeared to be just as strong as the
other. So this belief is debunked.
4. The fourth folk belief is that passwords based on mnemonic phrases are harder to remember than naively selected passwords. However, each ap-
peared to be just as easy to remember as the other. So this belief is debunked.
5. The fifth folk belief is that by educating users to use random passwords or mnemonic passwords, we can gain a significant improvement in security. However, both random passwords and mnemonic passwords suffered from a
non-compliance rate of about 10% (including both too-short passwords and passwords not chosen according to the instructions). While this is better than the 35% or so of users who choose bad passwords with only cursory instruction, it is not really a huge improvement. The attacker may have to work three times harder, but in the absence of password policy enforcement mechanisms there seems no way to make the attacker work a thousand times
harder. In fact, our experimental group may be about the most compliant a systems administrator can expect to get. So this belief appears to be debunked."
So take a look at quepasa. It combines remembering a passphrase, with cryptographically generated passwords (SHA-256 hashing of the passphrase and account name followed by mapping of the hash to typeable characters).
The combination means that I can always "recall" the password for any of my accounts using the quepasa application (all I remember is a single passphrase), and the passwords are not stored anywhere.
John.
Mitnick had a neat suggestion in the Art of Deception. The Consonant-Vowel Method. It provides an easy to remember password because it is pronounceable. You take the following template and swap in consonants and vowels: CVCVCVCV. The examples he gave are MIXOCASO and CUSOJENA. The point is they won't be in the dictionary but you can remember these nonsense words.
Support the First Amendment. Read at -1
One area I'd like to see would be strength of a password in terms of randomness, requireing use of characters, etc. vs length. Is an 8 character password with a punctuation mark better than a 10 character pasword with all lower case characters? If so, by how much?
Then we can determine a good password policy that fits with the security model at the facility.
There are a couple things i do....
1) On my servers te password changer forces them to not use dictionary words, has to have numbers, letters and nonnumeric characters, and they can't use their previous so many passwords
2) For my password I use a few things from my childhood that no one will ever come up with.
3) There is nothing like keeping up on your security patches.
Evolution or ID?
I used to work on a military installation with really elaborate guidelines for choosing passwords. It would usually take me at least a dozen times to choose a valid, unused password. My buddy had a trick that would get him a good password every time. Being fluent in Korean, he would come up with a phrase in Korean and spell it out phoenetically to produce a new password. I wonder how many foreign language workers in the US do the same thing?
"God fights on the side with the best artillery." - Napoleon, Marshal of France - speaking truth to power
I'm sure I'm not the only one who occassionally uses keyboard patterns for passwords. I'm not talking qwertyuiop or asdfg (obvious) but things like !@()ZX>? Hell, half the time I remember friend's phone numbers by the way you punch in the numbers. Sometimes when asked what a number is I'll even do the "phantom phone dial finger wiggle" so I can recite the damned thing.
Looking at the above example it appears to be a password which follows the "strong password" methodology but have there been any studies on the effectiveness of using such a method? I know there are dictionary-based attacks which have some of the obvious patterns (qwerty, poiuy etc) but is such a method random *enough* to be feasible?
It seems to me that it would be much easier to train users to use a muscle-memory-like password than picking some word out of their ass. The human brain has one seriously developed pattern recognition/matching capability... why not use it?
Amoeba
Do not taunt Happy-Fun Ball
Just use pattern passwords: ;-)
:-/
1) Put both hands on our friend, QWERTY
2) Move fingers into a natural, systematic position
3) Bang out a pattern using all fingers
4) Randomly include the shift key and those keys at the top, including the Back Space
5) Keep hitting some keys even after you've hit Enter; Then hold the Back Space key (optional)
6) "Practice, practice, practice!" so it can be typed very fast
Results?
* I rarely mistype a password
* I don't know my own password
* I couldn't share my password with security unless a keyboard was around
* I type it in so fast, it would take a video recording to spy-capture it (me thinks)
Of course, nothing can help you with key logging
If someone gets to post as Allen Zadr to slashdot, the worst that would happen is my karma would be burned. No big deal. I drop the account, start a new one, give Slashdot another 5 bucks.
The passwords I use on anything important, are far more secure.
For this reason, I would be far more suspicious of the 10% that use extremely complex passwords. Likelyhood is that those passwords will match their online banking account and work passwords.
Kinetic stupidity has a new brand leader: Allen Zadr.
I read a story about a book method for developing crypto keys. It was a fairly common method in the past before computers. I thought about it and have used it for years for choosing my passwords. Then tend to be mnemonics, but I can right down a hint sheet that is pretty safe.
It works like this. I choose a book at random from my work area, choose a page at random and then pick a line. I develop a mnemonic password from that line. If I need a hint, I write down the page and line number on a piece of paper, I can even stick it to my monitor if I need to. My average library of reference books at work is over 50 books. How big a hint to an atacker is 347 12? All I have to remember is what book I chose.
My last job, my boss couldn't remember any password that wasn't part of his name until I introduced him to mnemonic passwords.
Or use SHA2. Cause I don't have rainbow tables to crack that. Yet. For those of you who don't or cannot follow security, the new buzz is creating your own crack tables in a couple of weeks or months. There is more info at the project rainbowcrack page.
The misconception that everyone has about passwords now (because we as sysadmins pushed it so hard in the late 90s, early 00s) is that alphanumeric is the way to go. With the advent of generating your own cracking tables, that is no longer the case anymore.
An alphanumeric md5 set of rainbow tables can be generated in about a weeks time with a 2.4 ghz processor. That's my rough estimate based on the couple days it took me to make the alphanumeric one for LM hashes.
I would highly suggest that if you want your users to come up with good passwords you have them make a "one-time" password, seed with a 20-character salt that looks like someone pounded the keyboard, and store it inside a SHA2 hash.
A good administrator is going to salt their passwords with a string of characters that already satisfies the "alpha-numeric-symbol" requirement. If there is any reason to do something other than the first name of your child it is to stop coworkers or friends or people that already know about you.
When using brute-force/guess method this is what I try first and my guess is that at least 1% of Slashdot fathers use this or a form of it as their pass. It's okay to be proud of your kid, but don't think you're honoring them by including them in your password.
When I was working at NASA, I was still using a very simple password consisting of a very unusual word plus a number. One day the sys admin sends me a mail and says "Hey, I cracked your password. You must be a fan of [band name who had a song by this title]". I was embarassed enough that I immediately changed my password to something much stronger, and use a strong password to this day.
It works well because many people (myself included) just didn't get how easy it is to crack simple passwords until someone does it. If it's your friendly sysadmin, a normal desire to appear less idiotic is a sufficient motivator to choose a strong password.
Reading this article I remember a time -when I was still an application-manager for a large hospital- when I went to a small department to instruct a group in using the application.
It went something like this:
- Me: "What are your usernumbers? "
- Women of the group: "xxxx, yyyy, zzzz, dddd, ffff"
- Women: "Do you want our passwords too?"
- Me: "No, I just need your login-info so I can fill in the necesarry forms."
- Women: "It's okay, we all share the same password, you can have it."
- Me [frowns]: "You shouldn't do that, and I don't want to know what your password is. If I don't know your passwords I cannot be blamed for anything that goes wrong when one of your accounts is used"
- Woman: "No, it's okay, the password is 'fill-in-a-simple-4-letter-word"
- Me: flabbergasted. Surrenders. Gets on with instruction.
Before I left that place I should have written a simple script that processed through all accounts trying just a few (not more than 10) password like diskette, floppy, computer, etc. etc. It would have probably hit 25% of users. It wasn't part of my job though and would have probably led to me being suspected of cracking-activity.
luckily there were also other security-measures in place....
Siggy.This unique sig is intended to make this user more recognisable.
Before implementing any security measure, one should ask "Why?" What is the hard reason? (not just feel good).
When it comes to forced password changes, it's "Because the password may be compromised".
So the next question is, if it 'may' be compromised, then how long are you willing to live with it compromised?
And that is your password change rate. So, if you force password changes every 90 days, it means you're willing to live with passwords being compromised for 89 days.
So what, force them every day?
The real answer is that if you think your users' passwords are being compromised, then you need some other form of security. Forced password changes are changes for not reason.
I use a modified method of this, picked it up here a few years ago. Pick a sentance from a big book (LoTR, Illiad, Odyssy etc) then take the first letters (Tell me Oh Muse...) Now if the word is a noun use the number of letters in the word, if it's a verb use the last letter, if none of these use the first letter of the word. From the line above you would have the password lmo4oti4wd3a4ahhdtf4o4. What you remember is, "Tell me oh muse of that ingenious hero who travelled far and wide after he had sacked the famous town of Troy." You have enough for two passwords there. If you wanted extra security you could add a rule to use the symbol (shift+number) of letters in pronouns or linking words. Feel free to improve on my letter swapping method, all that matters is consistency. This method has the advantage that you can leave your cypher book near the computer as long as and the basic scheme (and rotation frequency and method) is memorized.
Degaussing scares the bad magnetism out of the monitor and fills it with good karma.
... the real problem with passwords is nobody ever teaches anybody how to make a strong password that is easy to remember.
;-)
Yeah, but there's something that makes it worse: Every time you have to make up a password, your first try is rejected because it violates the rules of that software. So you keep trying until you stumble across something that is acceptable.
As a result, my file of passwords now has 68 entries, and that doesn't even include the half dozen logins that I use often enough to remember. I don't keep them on paper, of course. I keep them on my web site, so I can find them from anywhere.
Of course, the file has a misleading name, is hidden behind a number of index.html files, and has a name that starts with a dot so that the server doesn't give it out even during server changes when the index.html files are sometimes ignored for a short time. I know I should still be worried about the URL being intercepted in transit. But so far, this is the best solution I've found to what is a rather intractable problem.
The real problem is security dummies that impose such complex password rules on users that we are forced to resort to schemes like this to "remember" our passwords.
Those who do study history are doomed to stand helplessly by while everyone else repeats it.