Slashdot Mirror
Password Memorability and Securability
NonNullSet writes "Who would have thought that that something new could be said about how best to select passwords? Ross Andreson of Cambridge University and some of his colleages have performed new empirical studies and found some pretty non-intuitive results. For example:
1. The first folk belief is that users have difficulty remembering random passwords. This belief is confirmed.
2. The second folk belief is that passwords based on mnemonic prases are harder for an attacker to guess than naively selected passwords. This belief is confirmed.
3. The third folk belief is that random passwords are better than those based on mnemonic phrases. However, each appeared to be just as strong as the
other. So this belief is debunked.
4. The fourth folk belief is that passwords based on mnemonic phrases are harder to remember than naively selected passwords. However, each ap-
peared to be just as easy to remember as the other. So this belief is debunked.
5. The fifth folk belief is that by educating users to use random passwords or mnemonic passwords, we can gain a significant improvement in security. However, both random passwords and mnemonic passwords suffered from a
non-compliance rate of about 10% (including both too-short passwords and passwords not chosen according to the instructions). While this is better than the 35% or so of users who choose bad passwords with only cursory instruction, it is not really a huge improvement. The attacker may have to work three times harder, but in the absence of password policy enforcement mechanisms there seems no way to make the attacker work a thousand times
harder. In fact, our experimental group may be about the most compliant a systems administrator can expect to get. So this belief appears to be debunked."
Freaking PDF files. Link to a version translated into HTML. By the time this goes live, maybe the FTP will be slashdotted, too. Thanks, Google.
I suppose I should make a comment. Okay, here it is: looks like users are still the weakest link in security. Whoever said that social engineering was the ultimate hack is a genius.
Google's HTML Cache Version
Hmmm.
oops!
And if you thought that was boring you obviously havn't read my Journal ;-)
Not RTFA has never been so easy! How am I supposed to have an uninformed opinion like this?!
So take a look at quepasa. It combines remembering a passphrase, with cryptographically generated passwords (SHA-256 hashing of the passphrase and account name followed by mapping of the hash to typeable characters).
The combination means that I can always "recall" the password for any of my accounts using the quepasa application (all I remember is a single passphrase), and the passwords are not stored anywhere.
John.
Mitnick had a neat suggestion in the Art of Deception. The Consonant-Vowel Method. It provides an easy to remember password because it is pronounceable. You take the following template and swap in consonants and vowels: CVCVCVCV. The examples he gave are MIXOCASO and CUSOJENA. The point is they won't be in the dictionary but you can remember these nonsense words.
Support the First Amendment. Read at -1
Sometimes even the most vigilant sys admin as not able to halt these problems.
Where I work the passwords are changed by internal support and logged into a database as well as entered into the system.
Despite requests to us strong passwords the internal support view is get as quiet a life as possible and just accept whatever password a user chooses.
The number of times I've seen summer1 is ridiculous.
Personally I think users should choose their own passwords and the system should limit them to >8 characters and a %age difference from their last 10 passwords. But I don't make up the policies.
Matt Thompson - Actuality - Insert product here.
Yeah, passwords and standards are fine as long as you keep snickers out of the office
One area I'd like to see would be strength of a password in terms of randomness, requireing use of characters, etc. vs length. Is an 8 character password with a punctuation mark better than a 10 character pasword with all lower case characters? If so, by how much?
Then we can determine a good password policy that fits with the security model at the facility.
On the other hand, I don't have a password retention policy either, so really if someone is in my employ for more than six months, there's a good chance of a password getting lost into the wrong hands. Yes, I know this is a bad idea.
Kinetic stupidity has a new brand leader: Allen Zadr.
How many passwords have you got? turn on pc, open email, encrypted files, bank account login's, ftp login's, forum memberships, the list goes on. How many have you forgotten? We need a better authentication system than text passwords. Security agencies have developed stunning biometrc identification technologies, perhaps these could be put out for the general public to use?
Do you need a website upgrade?
I'm confused as to why you would care how strong the passwords your users select are. As long as you control the authentication system, you can prevent repeated guessing--the days of globally-readable encrypted password files are gone. If you get more than a small number of failed guesses on a given account or from a given address, you cut off access, at least for a time.
The key is to detect the attack.
"Hello, I'm doing a study for the Cambridge University Computer Laboratory on passwords..."
What's next? Long passwords better than short ones?
dmiessler.com -- grep understanding knowledge
There are a couple things i do....
1) On my servers te password changer forces them to not use dictionary words, has to have numbers, letters and nonnumeric characters, and they can't use their previous so many passwords
2) For my password I use a few things from my childhood that no one will ever come up with.
3) There is nothing like keeping up on your security patches.
Evolution or ID?
Seriously, even if you are using something other than passwords, say biometric authentication, security will remain as shabby as it is today unless users understand the importance of keeping the system secure. And that is a tall order.
declare @consonants char(20),
@vowels char(5),
@password varchar(255),
@length tinyint -- passed to sp
select @consonants = 'bcdfghjklmnpqrstvwyz',
@vowels = 'aeiou',
@length = 8 -- maximum of 254. any more will overflow
while (@length > 0)
begin
select @password = @password + substring(@consonants, convert(int, ( round (rand()*100/5, 0) )),1)
if (@length > 1)
begin
select @password = @password + substring(@vowels, convert(int, ( round (rand()*100/25, 0) )),1)
end
select @length = @length - 2
end
select @password
Silpon Designs
Scented Paper Products
If IT keeps warning, they're told to stop worrying. If something happens, IT is blamed. These morons (leaders) need to figure out that IT isn't something that helps them do business. Their business runs on IT. Without it, they have no business.
Hoist Number One and Number Six.
Back in the days of limited capacity, 8 or 10 character passwords made sense. Today, there's no reason why we shouldn't be moving towards pass phrases of 20-50 characters. How difficult would it be for someone to remember "It was the best of times, it was the worst of times." as their password, and yet, how difficult would it be to crack a 52 character password?
It's really just a matter of changing mindset to use passphrases instead of passwords.
Statistically speaking, a 400 person focus group is going to so accurately represent the population from which they were selected it is almost overkill. Bear in mind, however, that they don't represent users in general, but computer users that are smart enough to get into college, aged roughly 18-19 years old, and open minded enough to participate in a college survey regarding passwords on computers.
But yes, 400 people is way more than enough - heck you can usually predict the outcome of most elections using exit polls asking less people than that.
Glonoinha the MebiByte Slayer
Most of the time, people just don't care. And why should they?
I probably have 200 passwords floating around in cyberspace, and 90% of them are "password". For example, I have to supply uid/pwd in order to read the Washington Post (my local newspaper). Is it important to keep this password secret? No, because I'm not very worried about someone reading the newspaper under my name.
Unless I have confidential personal information at stake, I am not usually motivated to create a strong password.
So, sysadmins, if the security of your overall network is more important than Joe User's individual data, you need to enforce strong password rules. Relying on users to create strong passwords voluntarily under such conditions is foolish.
The most rabid believers in American Exceptionalism are the exact same people whose policies are destroying it.
It just doesn't matter. It still going to be written on a yellow sticky and stuck on the screen.
All your i286 are belong to us.
Kinetic stupidity has a new brand leader: Allen Zadr.
I used to work on a military installation with really elaborate guidelines for choosing passwords. It would usually take me at least a dozen times to choose a valid, unused password. My buddy had a trick that would get him a good password every time. Being fluent in Korean, he would come up with a phrase in Korean and spell it out phoenetically to produce a new password. I wonder how many foreign language workers in the US do the same thing?
"God fights on the side with the best artillery." - Napoleon, Marshal of France - speaking truth to power
Perhaps I'm crazy but I've always felt an application which allows a brute force attack is flawed.
Surely by this point in software development it should be regarded as standard for every program to LOCK access for a given account after X consecutive failed logon attempts?
Even setting this to something arbitrarily high like, say 1000, is more than any user would ever try before asking for help, but much MUCH MUCH less than any dictionary attack would require. Combine this with the possibility of real time notification for admins (facilitated by email/inter application messaging, or a small add-on service for the OS) when more than Y accounts are locked for this reason in Z minutes, and as a community we'd effectively end all dictionary attacks - or at least turn them into DOS attacks, but at least we'd know it was going on...
I find that a good way of generating passwords is to come up with a sentence or a phrase that makes sense to you, take the first letter of each word, and then 1337 it up. For instance, Windows XP loves the Sasser worm becomes: WxP175W It's cryptic enough and easy to remember
The perfect sig is a lot like silence, only louder
1. generate a password using some word algorithm: I was born on a Monday = "IwboaM"
2. come up with some kind of replacement strategy: w=m, a=1. IwboaM = Imbo1M
3. bookend it with the year you were born: Imbo1M = 19Imbo1M69.
It looks totally random, but there is a method to the madness. If you need to change it, you can just inc the year, or use some other rule on it. The strength is that you completely make up the rules, and they don't have to make any sense. All you have to do is remember the original phrase (easy) and your rules (easy to complex).
(and the example I gave is completely arbitrary)
You could also do one where your password is the answer to the question. Remember the question "What month was I born?" Answer: October
Password starting point = HalloweenMonth. Then apply crazy rules to it. In this way, you can write down your reminder phrase "Month born?" and it is nowhere near what your password is.
My beliefs do not require that you agree with them.
I'm sure I'm not the only one who occassionally uses keyboard patterns for passwords. I'm not talking qwertyuiop or asdfg (obvious) but things like !@()ZX>? Hell, half the time I remember friend's phone numbers by the way you punch in the numbers. Sometimes when asked what a number is I'll even do the "phantom phone dial finger wiggle" so I can recite the damned thing.
Looking at the above example it appears to be a password which follows the "strong password" methodology but have there been any studies on the effectiveness of using such a method? I know there are dictionary-based attacks which have some of the obvious patterns (qwerty, poiuy etc) but is such a method random *enough* to be feasible?
It seems to me that it would be much easier to train users to use a muscle-memory-like password than picking some word out of their ass. The human brain has one seriously developed pattern recognition/matching capability... why not use it?
Amoeba
Do not taunt Happy-Fun Ball
Some people have been claiming that using things like "fsa7ya" or "4sa7ya" as the 1st letters of "four score and 7 years ago" is a good way to make up paswords. I've got a friend who has a dictionary of about 20,000 such phrases and it took a few of us about a half hour to find a common quote that wasn't in his list. He also happens to have a 50 word lists that is very effective at brute force attacks.
1. password must be at least 64 characters long, with no dictionary words, and at least 8 special characters
2. Passwords expire in 24 hours
3. Account is locked out after two mistakes
4. A given character may be used only once in a particular password (No repeated characters)
5. Account locks out on second attempt
I'd love to see someone implement this policy at some corporation - just so long as I'm not the administrator there.
Looking at through cynical eyes it doesn't matter how secure your method is because, you are ultimately placing trust in the typical user who will most likely do something stupid when given the chance.
Gibber...
Gentoo Linux - another day, another USE flag.
My menmonic, which should have been hard for people to guess, was "Please ask sister sally where's our rottweiler dog"
And the thing is, we didn't even have a rottweiler, it was a shepherd. But people still guessed it, so I don't use mnemonics anymore.
Do not taunt Happy Fun Ball(TM)
So, basically, you're saying that Slashdot is impenetrable?
Alito: A vote for Alito is a punch in the eye to put that bitch back in her place!
I used to do that back in the USMC - I converted my walllocker combination to base 7 and then put that on tape on the back of the lock. Everyone in the barracks tried it and failed. Meanwhile I had a nicely documented combination. Of course, I suppose I was fairly lucky that nobody simply removed the tape - but the same combination was also in my wallet along with all my pin numbers. Again in base 7...
Just use pattern passwords: ;-)
:-/
1) Put both hands on our friend, QWERTY
2) Move fingers into a natural, systematic position
3) Bang out a pattern using all fingers
4) Randomly include the shift key and those keys at the top, including the Back Space
5) Keep hitting some keys even after you've hit Enter; Then hold the Back Space key (optional)
6) "Practice, practice, practice!" so it can be typed very fast
Results?
* I rarely mistype a password
* I don't know my own password
* I couldn't share my password with security unless a keyboard was around
* I type it in so fast, it would take a video recording to spy-capture it (me thinks)
Of course, nothing can help you with key logging
Using the term "folk belief" more than once in a paragraph can become very annoying. This belief is confirmed.
----------------------------------
I'd rather not take sides until I hear the monkey's version - PHB
If someone gets to post as Allen Zadr to slashdot, the worst that would happen is my karma would be burned. No big deal. I drop the account, start a new one, give Slashdot another 5 bucks.
The passwords I use on anything important, are far more secure.
For this reason, I would be far more suspicious of the 10% that use extremely complex passwords. Likelyhood is that those passwords will match their online banking account and work passwords.
Kinetic stupidity has a new brand leader: Allen Zadr.
I read a story about a book method for developing crypto keys. It was a fairly common method in the past before computers. I thought about it and have used it for years for choosing my passwords. Then tend to be mnemonics, but I can right down a hint sheet that is pretty safe.
It works like this. I choose a book at random from my work area, choose a page at random and then pick a line. I develop a mnemonic password from that line. If I need a hint, I write down the page and line number on a piece of paper, I can even stick it to my monitor if I need to. My average library of reference books at work is over 50 books. How big a hint to an atacker is 347 12? All I have to remember is what book I chose.
My last job, my boss couldn't remember any password that wasn't part of his name until I introduced him to mnemonic passwords.
"However, both random passwords and mnemonic passwords suffered from a non-compliance rate of about 10% (including both too-short passwords and passwords not chosen according to the instructions). While this is better than the 35% or so of users who choose bad passwords with only cursory instruction, it is not really a huge improvement."
The problem here is giving the users the ability to choose their password.
ugh. Don't give users a choice. When their password expires, give them a new one. Let them hit the "re-generate" button until they are happy or tired.
What really bugs me is that most ERP vendors don't recognize this as a problem. Most use screens/forms that have to be significantly customized to remove the "enter bad password here" choice.
Or use SHA2. Cause I don't have rainbow tables to crack that. Yet. For those of you who don't or cannot follow security, the new buzz is creating your own crack tables in a couple of weeks or months. There is more info at the project rainbowcrack page.
The misconception that everyone has about passwords now (because we as sysadmins pushed it so hard in the late 90s, early 00s) is that alphanumeric is the way to go. With the advent of generating your own cracking tables, that is no longer the case anymore.
An alphanumeric md5 set of rainbow tables can be generated in about a weeks time with a 2.4 ghz processor. That's my rough estimate based on the couple days it took me to make the alphanumeric one for LM hashes.
I would highly suggest that if you want your users to come up with good passwords you have them make a "one-time" password, seed with a 20-character salt that looks like someone pounded the keyboard, and store it inside a SHA2 hash.
A good administrator is going to salt their passwords with a string of characters that already satisfies the "alpha-numeric-symbol" requirement. If there is any reason to do something other than the first name of your child it is to stop coworkers or friends or people that already know about you.
When using brute-force/guess method this is what I try first and my guess is that at least 1% of Slashdot fathers use this or a form of it as their pass. It's okay to be proud of your kid, but don't think you're honoring them by including them in your password.
You can easily generate mnemonic passwords using pwgen.
It's definitely easy to remember mnemonic passwords. I've been able to not log into a machine for months, come back to it and remember the mnemonic password unique to that machine.
Well when going through a really rough divorce (I had an easy one too) I was in serious fear , and justifably so of my Ex hacking accounts using some of my known Passwords , I like many others have a cycle of about 10 that are used interchangably. All these were , with the exception of 1 personal passwords. I found she was accessing my work mail and personal mail almost immediatley , Soooo I decided to have some fun with it, passing all kinds of bogus information into forged emails to myself. Then came court, she was ACTUALLY Stupid enough to bring up several points in court, my Attorney was aware and asked where she found this informationout, "Around, friends, etc" Bwwwahhaaaa talk about someone looking stupid she bought it hook line and sinker.
:)
Sometimes easy to crack passwords are a GOOD thing
On another note, after I took her to the cleaners at court I decided to TIE one One, well....NEVER....and I mean NEVER....change you passwords while really drunk..it took me 2 days to reconfigure redit and reset all my passowrds I changed on that drunken celebration. I still have NO idea what some of them were or how I came to decide on their usage
I'd be interested in a password cracking study comparing passwords where this DLL was turned on (for Windoze domains) and where users are given a free choice. The DLL enforces stronger passwords, but IME few companies use it.
When I am king, you will be first against the wall.
There are so many places online where i am required to use a password, and there are so many ways for those different accounts to be linked together with some form of datamining on the other end. What I am concerned about is malicious intent from the other end. How can i trust that insiders with access to these password databases don't use my password info to sign into other account i may have on the net (i.e. financial accounts)?
I try to used different passwords depending on the level of trust i have for a certain company. For example, all of my banking passwords are different than say a password i would use to log into /. or hotmail. The problem with this is trying to remember which passwords are for which sites.
Of course, i then run into the problem of accounts where i must change my password monthly or quarterly, and i can't use previous passwords. This seems to be another huge security risk (unless a strong form of hashing is used) as the system now has a list of all my previously used passwords, and once again i have more passwords to rememeber as i can no longer stick with the few i would like to.
I feel that my passwords are relatively random and reasonably strong, and wish i could keep them. Does anyone what to test this theory and post AS ME from this /. account?
-The Libra
"You've got no kids, no wife, no job, and you're not in The Tigger Movie!!!"
- my best friend's son, Gabe, at 5 years old.
-The Libra
"Please be patient--The future will begin momentarily."
I occasionally like memnonic passwords, but another good alternative is a randomly-generated but pronounceable password. It turns out that we're much better at remembering passwords that we can pronounce. (Where "Voolakun5" is pronounceable and "zqx17yvy" is not).
FIPS-181 describes a NIST-endorsed system for producing pronounceable passwords. There is a GPLed FIPS-181 implementation here.
Sample run:
$ apg
dyijenuloa
bifliecar
yishjied&
IfHydrovia
yutsOlg/
DipUkcat
APG is a lot more sophisticated than this, and allows you to do a lot of tweaking of the types of passwords it outputs, print pronunciation guides. It's a good tool, IMHO, for security-conscious types to have around.
For Fedora Core 2 users, Red Hat does not package apg in the base distribution, but it is available from freshrpms.
May we never see th
The password for a particular login is then the random rubbish for that login plus the memorable word. The memorable word can be the same for every login.
A brute force attack remains unfeasible without obtaining the piece of card; not perfect but it makes it a good deal harder as it requires the physical presence of the attacker. At the same time the user is more likely to obey your instruction not to write their word down as there is only one, easy to remember word to remember.
Stealing the password then requires both physical access to the bit of card and a brute force attack. That raises the bar quite a bit from needing only one of those two.
The question I would like looked into is how many "old" passwords should a system remember and not allow a person to reuse.
I'll give you an example, a place I used to work required all the standard things: caps, non-alpha, 90 day expiration, etc. but what bugs me is that your new password can't be the same as any of your previous 6. Now, I have three or four good solid passwords that meet (or can be made to meet) all those requirements, but when I have to come up with 7 different ones, they start getting weaker and weaker near the end. I know that in most systems you can just run through half a dozen passwords in about two minutes and get your old one back, but they also instituted a minimum age so you couldn't do that.
All these things are generally considered good network security, at what point do you start doing more damage than good though? How many passwords does your system require, and does anyone else find themselves in the same situation I'm in?
Never underestimate the power of human stupidity -RAH
Is this a typo, or is there a new meaning of "mnemonic"? The whole point of mnemonic passwords is that they're easy to remember. That's what mnemonic means.
Am I part of the core demographic for Swedish Fish?
Wonder how well it would improve secuirty at aparrtment buildings at houses if we required users to change physical keys every 90 days ... got to prevent someone from sneaking in every morning and raiding the cookie jar and kids' piggy banks.
Infuriate left and right
If you have a lot of passwords, use a program to store them in encrypted form and have one good rotating password to open them all up. Ultimately I guess one of these could be cracked but it's a distant chance and thus a good compromise for someone who's got a lot to keep track of.
...you can solve this one by throwing money at it.
Buy one of these and relax. You'll never have to worry about passwords again.
When I was working at NASA, I was still using a very simple password consisting of a very unusual word plus a number. One day the sys admin sends me a mail and says "Hey, I cracked your password. You must be a fan of [band name who had a song by this title]". I was embarassed enough that I immediately changed my password to something much stronger, and use a strong password to this day.
It works well because many people (myself included) just didn't get how easy it is to crack simple passwords until someone does it. If it's your friendly sysadmin, a normal desire to appear less idiotic is a sufficient motivator to choose a strong password.
IANAL&IneverRTFA
Oh wait... did I just give away John Katz's password?The best weapon of a dictatorship is secrecy, but the best weapon of a democracy should be the weapon of openness.
oops, must remember to preview next time
I've seen [dictionary word][non-alphanumeric character][dictionary word] (e.g. chrome=turnip) or even [dictionary word][dictionary word] (e.g. purplegearbox), where the concatenated words do not form a dictionary word. Googlewhackers could have fun generating (in)secure passwords along these lines.
This is hardly new research.
Sigs. We don't need no steenking sigs.
You can get software to enforce the policy to avoid the 10% non-compliance mentioned above. In the Unix/Linux world, you can use something like NPasswd to do it. For you Windows' people, something like Password Bouncer would do the trick.
my scheme: math
grab a simple equation:
4+6=10
spell out one or two words
4+six=ten
bingo. easy to remember, hard to guess.
Basically it assigns random chars/numbers/symbols to each letter of the alphabet ... Now I print this nice little table and use it for passwords all over the place. For example I could just remember "slash" which maps to the password Z?+JTLZ?4&
The table itself isn't a terrible idea, but where you really go wrong is printing it out. If anyone gets a look at your "alphabet," and you've used a simple dictionary password, then it's as simple as doing a dictionary attack -- just with your modified alphabet instead of the standard one.
This is why, as the article states, user-devised password schemes aren't very good (although yours is probably somewhat better than many), as they only give the illusion of security.
Cheers,
IT
Power corrupts. PowerPoint corrupts absolutely.
He was briefly in Chile for a US$420 a seat conference, and the head of the Computer Science Dept. asked him if he could give the students a little talk.
A representative answered exactly this:
Thank you for your inquiry. Kevin is indeed in Chile next week-- and would love to address your students. He does, however, charge a fee for his presentations (it's how he earns his livelihood)--- A standard presentation is 45 min. long plus 15 min. Q&A and covers the information presented in his book, The Art of Deception. The cost for a presentation like that is typically $15,000 US; however, due to the fact that you are an educational institution and Kevin will already be in the area delivering his other presentation, I could offer you a discounted price of $9,000 US (a savings of 40%)plus any related travel costs to/from your organization to his hotel.
Take a song that you like, and use the first letters of each line as your password.
If your password requires numbers or special characters, use the line number of the song, plus its shifted equivalent.
If it requires both upper and lower case, use one upper-case letter, the same position each time.
For example:
A long long time ago,
I can still remember
How that music used to make me smile.
Month 1: aLlta1!
Month 2: iCsr2@
Month 3: hTmutmms3#
etc.
Each year, pick a new song.
Those who sacrifice security to condemn liberty deserve to repeat history or something. - Benjamin Santayana
Before implementing any security measure, one should ask "Why?" What is the hard reason? (not just feel good).
When it comes to forced password changes, it's "Because the password may be compromised".
So the next question is, if it 'may' be compromised, then how long are you willing to live with it compromised?
And that is your password change rate. So, if you force password changes every 90 days, it means you're willing to live with passwords being compromised for 89 days.
So what, force them every day?
The real answer is that if you think your users' passwords are being compromised, then you need some other form of security. Forced password changes are changes for not reason.
I use a modified method of this, picked it up here a few years ago. Pick a sentance from a big book (LoTR, Illiad, Odyssy etc) then take the first letters (Tell me Oh Muse...) Now if the word is a noun use the number of letters in the word, if it's a verb use the last letter, if none of these use the first letter of the word. From the line above you would have the password lmo4oti4wd3a4ahhdtf4o4. What you remember is, "Tell me oh muse of that ingenious hero who travelled far and wide after he had sacked the famous town of Troy." You have enough for two passwords there. If you wanted extra security you could add a rule to use the symbol (shift+number) of letters in pronouns or linking words. Feel free to improve on my letter swapping method, all that matters is consistency. This method has the advantage that you can leave your cypher book near the computer as long as and the basic scheme (and rotation frequency and method) is memorized.
Degaussing scares the bad magnetism out of the monitor and fills it with good karma.
So my idea was to store a hash of the concatenation of the username AND password, ensuring with a high probability that no two hashes will be alike.
d = hash('password')}
Old way:
I wonder if anyone's password is just 'password'.
forall(user){test(user.hashedpasswor
New way:
I wonder if anyone's password is just 'password'.
forall(user){test(hash(user.login + 'password') = hash('password')}
2nd way requires more hashing to be done through the loop, but isn't really much harder.
... the real problem with passwords is nobody ever teaches anybody how to make a strong password that is easy to remember.
;-)
Yeah, but there's something that makes it worse: Every time you have to make up a password, your first try is rejected because it violates the rules of that software. So you keep trying until you stumble across something that is acceptable.
As a result, my file of passwords now has 68 entries, and that doesn't even include the half dozen logins that I use often enough to remember. I don't keep them on paper, of course. I keep them on my web site, so I can find them from anywhere.
Of course, the file has a misleading name, is hidden behind a number of index.html files, and has a name that starts with a dot so that the server doesn't give it out even during server changes when the index.html files are sometimes ignored for a short time. I know I should still be worried about the URL being intercepted in transit. But so far, this is the best solution I've found to what is a rather intractable problem.
The real problem is security dummies that impose such complex password rules on users that we are forced to resort to schemes like this to "remember" our passwords.
Those who do study history are doomed to stand helplessly by while everyone else repeats it.
3. The third folk belief is that random passwords are better than those based on mnemonic phrases. However, each appeared to be just as strong as the other. So this belief is debunked.
Its always confounded me as to why people have insisted on this folk belief. I, for one, have always insisted that mnemonic phrases are no less secure than random numbers. (Likewise for the memorability vs. single-phrase passwords.) I'm glad there's finally some proof so that I can get people to use sane passwords (neither easy to guess, nor difficult to remember).
~/ssh slashdot.org ssh: connect to host slashdot.org port 22: too many beers
Take if from someone whose been in IT for a long long time. User's are so sick of passwords they completely hate that they have to keep multiple passwords and then they hate it when the passwords expire.
The password police are constantly tightening the password rules. It used to be 90 days till a password expired. Now it's 60 days. It used to be 6 characters now it's 8 characters. You used to be able to re-use an old password, now you end up having to wait until it's 15 passwords old before you can re-use it. All passwords must contain 8 characters and include at least one number. You cannot set a password that is too similar to the old one. Many words have been outright banned from use as a password.
As an IT person with access to a lot of things, I have 28 different passwords just for work alone! There's about 8 mainframe ones, 4 PeopleSoft ones, 2 Windows Domain, etc., etc., etc. I actually set up an encrypted file on a USB pen drive that I unlock and reference when I need to see my password list. I have a couple of Mac's at home and I love the KeyChain solution!
The average user has about 5-10 passwords they have to worry about. User's write them down, come up with elaborate rotation schemes, etc. Mostly they just call the Help Desk repeatedly because they lock themselves out in the process of changing their password.
I am all for a smart-card or USB keychain along with a single sign-on system to everything. It would cut 600 calls to the help desk every month and it would make thousands of employee's very very happy.
National brand 31-120 Handi Notes notepad, 60 Sheets / 3 x 5 Narrow Ruled White Paper . Sanford Expresso Extra Fine in green or blue or Bic SOFTFeel Medium in black.
I figure by 2030 or so my 6-digit UID will be something to brag about.
A solution that works for many is PasswordSafe. This is a small application that keeps all passwords encrypted (using the Blowfish algorithm). Entries are presented either as a flat list or tree, and double-clicking an entry decrypts the password and copies it to the clipboard. The project originally came from Counterpane, Bruce Schneier's company, and is regarded as a useful and secure application.
PasswordSafe has random password generation that can be customized rather nicely.
Of course, the PasswordSafe database itself needs to protected by a passphrase...
[Disclaimer: I'm currently the project admin for PasswordSafe.]
Ubi dubium ibi libertas: Where there is doubt, there is freedom.
and everyone seems to have their own way of generating them. I know one person that uses license plate numbers he memorizes while on the highway. I use Cloak on my Palm to keep the 40 or so that I have to use to get my job done - yes, I said 40. I'm of the firm belief that none of these practices are secure at all. If it's a password; it will be broken eventually. Where I can use passphrases; I do. Even those can be broken given time. When they come up with reliable, inexpensive biometrics; and combine them with digital certificates or encryption keys (pick your flavor) - I think we'll be far more secure. I know that privacy can be an issue with biometrics but what if you encrypt the biometric data itself and don't make any of it personally identifiable except to its owner?
I think with the interesting people, their lives can't possibly be wrapped up into a nice little package.