Slashdot Mirror
Password Complexity in the Enterprise?
andrewa asks: "What's the deal with passwords in a corporate environment these days? The company I work for has introduced layer upon layer of complexity on passwords over the years, and now it is simply ridiculous. We have to enter a 16 character password each month that cannot compare in any digits to the previous twelve passwords, nor can it be a simple string -- it has to be a mixture of upper- and lower-case characters including numerals and non-alphanumerical characters. What's next? A mixture of non-keyboard accessible characters and several varieties of DNA? It's not like we are even a government institute -- we are a software company that does telecom stuff, for goodness sake. Anyway ... you know what this makes me do? Write it down somewhere. How secure is that? The question is, I think my company is completely anal with the password requirements, what other security policies are in place in other companies that either completely exceed the banality of my company, or -- God forbid -- have a security system that makes sense?"
I work at a call center. The password I was given, was "apple123". After 6 months I was prompted to change it. So now my password is "apple456". If I were to work here for another 6 months, I would change it back to "apple123" but I quit because I value my sanity.
"0123456789aBcDeF"
That's amazing. I've got the same password on my 6-piece luggage set!
Those requirements don't sound too tough, though 16 charaters is a little long.
As for remembering strong passwords, my method is this: think of a phrase, take the first letter of every word, substitute in some h4x0r numbers for letters, and make a few letters uppercase. It takes an afternoon or so before I can type it without thinking.
Example:
Slashdot is full of bad grammer,misspellings and inaccuracy
=
s1F0bgMaI
The phrase is easy to remember; the number and uppercase substitutions come with repetition.
Jan: 0123456789abcDE_
Feb: 123456789abcDE_0
Mar: 23456789abcDE_01
You get the idea
No digit will ever be the same as the same digit in any previous 15 passwords. It contains numbers, lower and upper case letters, and a non-alphanumeric character.
One of the best I'd seen was to take first letters (or last, or second, etc.) from words in a song that you know the lyrics well. They have a decent amount of randomness and each album you buy will supply a couple of years' worth of passwords.
Writing them down in a safe location is a helpful aide-memoir. You could just have a lyrics file saved to a thumb drive or scrawled in a diary.
I know a few...
"Theta alpha two seven three seven blue"
"One one A"
"One one A two B"
"One B two B 3"
"Zero zero zero destruct zero"
But usually, voice identification is enough.
Make the passwords to hard to remember and people write them down because thay have to.
Some advice Bruce Schneider once gave: there is nothing so terribly wrong with writing your password down on a piece of paper and putting it into your wallet. Your wallet is a security mechanism that you already use, and you are very practiced at keeping it secure.
Myself, I use muscle memory to store mine. I make up an entierley random password and spend 20 minutes typing it over and over again until my hands remember how to make that sequence of twitches. Works great; and no risk of me acidentally telling someone my password because I don't know what it is.
~~~~~ BigLig2? You mean there's another one of me?
Every company has some information that needs to be secure. With a network, you're only as secure as the weakest link--one machine is all it takes for someone to infiltrate it.
While your company's password policy is much more stringant than my company's, it doesn't sound too paranoid at all. As far as remembering the password, you should write it down and carry it with you if you're having trouble remembering it. It should only take a couple days of logging in before you have it down, so then make sure you destroy the paper it's written on.
The thing is, you really need to worry about someone hacking your password remotely and a simple password of only lower-case letters and maybe some digits is a heck of a lot quicker to hack than mixed upper/lowercase, digits, and symbols. If someone got the piece of paper in your wallet, they probably would also get your keycard into your office, too. Once they had physical entry into your office, the password wouldn't be that big a deal. They could just steal your data drive and take all the time in the world to hack into it.
Picture Password: A visual login technique for mobile devices
"16 character password each month that cannot compare in any digits to the previous twelve passwords, nor can it be a simple string"
this is an exaggeration. I can believe 8-character password every 45 days that cannot be the same as any of the previous 6, but there's no way that the stated requirements are correct. every user would have sticky notes on the bottom of their keyboard or phone or on their laptops in order to remember their password.
no real enterprise security shop would condone such a moronic password policy.
if a company were that paranoid, they'd have invested in PKI or use SecurID.
tell us what the real requirements are and maybe we can offer some concrete suggestions.
Mind the gap...
The key is not how complex you can make a password.
... 288 a day ... 864 over a 3 day weekend. Round that up to a thousand and it's still a "one chance in a million" to guess the password over 3 days of trying.
The key is how will an attacker defeat it.
So, a simple password is sufficient if the attacker will not have enough chances (statistically) to defeat it. This is easy to accomplish by having a time delay between authentication attempts or a lock-out period. But this is only sufficient if you have a person actively monitoring the authentication logs.
Example: Suppose you have a list of 10,000 common words. You take a random word, a digit (0-9) and another word, that will give you 10,000 x 10 x 10,000 possible combinations (1,000,000,000 or "one billion"). So, if you get 3 guesses before you're locked out for 15 minutes, then you can guess 12 passwords an hour
As long as there is someone reviewing the logs, the attempts will be noticed and actions can be taken before there is any real chance of your password being cracked.
And WordNumberWord is not that difficult to remember.
Now, this is NOT a good practice for passwords for encrypted files or anything else that can be cracked off-line.
I use two complementary password generation schemes:
e ! (Uppercase I intentional; exclemation point included.)
(1) I pick a word or pair of words and convert them to 31337. Example: supersecure->sp3rs3cur3. This is 10 chars long, which is Good Enough for a commonly rotated password, easy to remember but hard to guess.
(2) I choose a phrase, such as a quote I like, and use the whole thing, For a while my root password was: myvoiceismypasswordverifyme. Now, technically that's not very secure because it's all lower case letters. But due to the length the amount of time it would take to crack is quite high. Again, good for a commonly rotated password.
For added security I use method 2 with method 1. Here's a secure password I no longer use: Iseemt0behavingtremend0usdifficultywithmylifestyl
You get the idea.
I want my Cowboyneal
Unless there's some flaw that I don't know about, I've always liked the password method where it's two random English words (DoorAsphalt or MessHeave). It's easy to remember, and assuming, say, a 40,000 word dictionary, that gives 1.6 billion combinations.
Sometimes it's best to just let stupid people be stupid.
I've always found it a total pain to remember passwords for different resources, so I came up (probably stole the idea from someone, too long ago) with a method of using the keyboard as a sort of encoder/decoder. What I do is I have a memorable word or phrase, but I always type in the letters above or below the actual characters. This means I can turn a memorable phrase, say, "slashdot.org", into gibberish, like "woqwye95l94t". (No, that isn't my Slashdot login, so don't even think about it :).)
I've found that, while you need to think about it at the start, it doesn't take too long before you're used to using it. Of course you can (as I have) obfuscate it even more. For example, you could change the case (upper/lower) on alternate letters, type your memorable word/phrase in backwards, alternate above and below keys, etc.
Just an idea, real good for the corporate logins... you can easily remember a word or name, and quickly turn it into something the IT Dept. would approve of.
At my former employment i had at least as many, with the same problem, and much the same solution. Several of my coworkers kept the usual piece of paper in their desk with passwords, and many just kept text files on the system they used most often.
I complained at one point and was told i should just use the same password everywhere. Sadly, every system had different password requirements, expired at different times, and several had different allowable characters (one was case-insensitive, others had different non-alphanumeric symbols missing or required)---just keeping track of all the systems required a list. I used to get password expiration notices from systems i'd never even logged into.
A lot of co-workers just rotate through all 8 or 12 iterations of passwords and then restore their original password.
That was also a solution i used a few times out of frustration. Problem was that around iteration 7 or so i'd lose track and forget some subtle detail of iteration 6, and end up locked out of the system, requiring a reset anyway.
The end result was:
What they protecting so obsessively through password schemes i'll never know. Guess it worked though, i often couldn't get into the system i needed to get work done.
This is surprisingly secure, as long as you write it somewhere safe. Security pioneer Dorothy Denning does this, as do a number of other "security professionals". There are simply too many places a password is needed now to follow good security rules for all of them. The human-factor limitations lead to the obvious conclusions that people must either:
Writing down a password is safe if nobody can get hold of what it's written on. Storing it online is pretty much just like writing it down, except there are opportunities to make it safer. There's really no safe way to use the same password lots of different places or a really simple password.
Use a password generator to create some truly horrific 20-character monster and write it down. Keep that paper safe!
How many times have banks/people lost money due to weak passwords?
vs
How many times have backs/people lost money due to social engineering?
Forcing people to have crazy passwords may reduce the number of
times that password is cracked (from near zero to nearer zero).
But stopping social engineering will have a *far* greater impact -
because its actually pretty common for people to hand over their
passwords and account details to nigerians or email from pay pal.
So its not about the size of your password. For example: PIN codes
are pretty secure, but they are only 4 digits. The reason: You need the card
and you get 3 tries before the card is swallowed. 16 digit pins with
alpha numeric would *reduce* the security because many people will write
their pin on their card or keep it with their card.
For a bank - any simple 8 letter word will do for a password. A bank just needs
to be sure you can't have more than 3 tries before your account is locked
out.
And that holds true for any authentication system.
Lock your users out (so they have to come to you) after 3 tries.
so basically, passwords are irrelevant, but are a tangible element to everyone. so when the boss asks for better security, the IT admin implements greater password complexity, the boss notices because he has to type the damn password every day, and the IT admin get kudos. because of course, if user convenience decreased, security obviously increased. yay.
what is the value of having a complex password? it should be complex enough an attacker can not guess it. everything else relates to an attacker's ability to *crack* passwords, which is irrelevant in the world of windows these days. in a few years, NTLM will have died and kerberos will rule the day. then things might be different.
I've started using what I think is a great was to create what appear to be rather secure passwords that are easy to remember and recoverable (that's a highly qualified statement as I am in no way a security expert). Go to:
http://www.hashapass.com/
and enter your "parameter" (e.g. "march2006") and "master password" (e.g. "mysecretpassword") and you get a password (e.g. "K0u4CUXG") generated from the two. Of course you still have to remember the password, but at least if you forget it you can recover it from wherever you are, without having to write it down. It's all local JavaScript on the browser, so there's no network exposure...
t.
They're easy to remember and extremely difficult to brute force. Just tell your users "Write a snippet of something which is meaningful to you". We can all type at 30+ words a minute so entering a 30 character password in natural English (perhaps without spaces) goes supringly fast. For example, supposing I liked classical literature, I could use socaesarmaythenlesthemayprevent (this is part of Brutus' soliliquy in Act 2 Scene 1 of Julius Caesar, which I had to memorize way back in high school). If you want to be reaaaaally anal you can obfuscate it a bit (l33tify, what have you). There is no convinient dictionary of "meaningful phrases in English" out there, although I suppose it would be somewhat less than secure if someone were able to find out you were, e.g., a Star Trek fan. And they're guaranteed to be easy to remember -- humans are a lot better remembering natural language they have an emotional connection to than remembering arbitrary alphanumeric strings. In fairness, I stole this tip from a Slashdot discussion about a year back sparked by advice from Microsoft, and have been using rediculously long passphrases since for all my "if that breaks, I'm "#$"#"#$%ed" logins (I still go with crazy insecure for trivial things like my slashdot login). I've got about 12 of them at the moment and have no problems with remembering them and changing with the security policy, whereas beforehand I had a discrete post-it.
Help poke pirates in the eyepatch, arr.
Passwords suck. They always have, and they always will. Unlike smartcards, they don't protect against man-in-the-middle atttacks. They are easy to forget, easy to guess (in many cases), and, with a bit of social engineering, easy to steal. Many sites (Slashdot included) don't even bother to use SSL for logins. That's just sloppy.