Slashdot Mirror
Passwords From PHPBB Attack Analyzed
Robert David Graham writes "The hacker who broke into phpbb.com posted the passwords online. I was sent the password list, so I ran it through my analysis tools and posted the results. Nothing terribly surprising here; 123456 and password are the most popular passwords as you would expect. I tried to be a bit more creative in my analysis, though, to get into the psychology of why people choose the passwords they do. '14% of passwords were patterns on the keyboard, like "1234" or "qwerty" or "asdf." There are a lot of different patterns people choose, like "1qaz2wsx" or "1q2w3e." I spent a while googling "159357" trying to figure out how to categorize it, then realized it was a pattern on the numeric keypad. I suppose whereas "1234" is popular among right-hand people, "159357" will be popular among lefties.'"
The numeric keypad is on the right ... how exactly does this work out?
someone 'analyzed' another password list for correlations and found nothing of inherit value to security of than 'people are a problem'.
Chalk yet one up for the Adams team.
What the hell, Slashdot? Stop posting all my passwords!
It's a horrible problem of having leaked passwords, and the only way around it is to avoid logging the cleartext password and do a hash of the password combined with a salt before storing it.
In that way it's at least not too easy to recreate the password used by various users.
It's of course standard procedure, but it just makes it evident how incredibly trivial some systems are built.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
With so many other methods of user verification why do we still continue with passwords? My work uses so many passwords for each application, and forces you to change them montly, and some of them force you to use different passwords, that you can look at any monitor and find a postit note with complete access to the system. When I mentioned this to the SA's. They said they need all of the passwords for security? Why not use thumbprints or cards for verification like the hospital I used to work at? Never typed a single password. Had to take the gloves off once or twice, but never a password.
The idea is that lefties are mousing with their left hands - they have the right hand free to do the typing.
chillax137
Comment removed based on user account deletion
That's the first time I've heard of one-handed typing being commonplace. I thought it was restricted to certain kinds of websites. :)
I've never moused with my left hand on anything approaching a regular basis- it's simply too awkward. I was just taught to use my right hand to mouse like everyone else in elementary school so that's what I do.
--Southpaw
Sex and God are not even on the list.
People are the weakest link in any security program. But does that make them the "problem" or does it mean that we're approaching security from the wrong angle?
Passwords suck. People are not capable of memorizing enough entropy to provide more than one or two decent passwords.
So do not focus on "strong" passwords as your only defense against attack.
One approach is to encourage "weak" passwords (word.number.word) that users can write down ... but then focus on monitoring and login delays so that any attack will be detected before it even has a one in ten million chance of success.
Thank you for registering at slashdot. Your password is kitten6apple. Please write it down. If you wish to change it, click HERE. There will be a 10 second delay enforced between login attempts and a 10 minute delay after 3 failed login attempts.
There. As long as they don't store the passwords in the clear (or as hashes without including a random salt) you should be fairly "secure". At least "secure" enough for a "social networking" site.
For your bank or other financial institution, you'd want a second, non-Internet-based, channel for verification of transactions. Such as an automated call to your phone.
People are not the "problem". People's limitations SHOULD be part of the design specifications for the security program.
How many key patterns are used by people who type with dvorak or colemak? I've always liked the extra security that comes with using an obscure (albeit superior) keyboard layout ;)
I use the mouse with either hand, if the hand gets tired I switch hands.
Can be misinterpreted in so many ways.
I group passwords two ways.
1. Sites that have no personal info or I don't really give a damn about. Those share 2 or 3 different passwords depending on their lame (no special characters!) requirements. Pick two words, use 7334 spelling and separate them by a punctuation mark. For example "mad money" becomes "M@d;m0n3y". Good luck guessing stuff like that.
2. Sites that I care about, like online banking or ones that contain personal information (LinkedIn, for example), have random line noise for passwords and I just write them down. There is a notebook in my desk with all the passwords. The desk is locked and in my home office. That is far more secure than trying to make them easy enough to memorize.
3. If you use Firefox, make sure you use a Master Password if you allow it to remember passwords.
Someone posted this earlier and it is a useful BASH script.
dd if=/dev/random bs=200 count=1 | tr -cd 'A-Za-z0-9!@#$%^&*()_+'; echo
Copy a group of 10-15 out of the middle of that and use it for a password.
Learning HOW to think is more important than learning WHAT to think.
I'm a leftie, and my mouse is on the right, like.. well.. all the other lefties I know. Actually, I have never seen someone use a mouse of the left, though I'm sure that weirdo exists.
I have mice on both sides.
I'm almost ambidextrous so this way I can reach for a mouse with whichever hand isn't currently holding my coffee.
I do get a lot of "oh, you're left handed?" from people who see me reach for things with my left hand though. I never understood why people limit themselves to 50% of their usable hands.
You can't take the sky from me...
Are you suggesting that those sites aren't commonplace?
Comment removed based on user account deletion
Who needs a list of the 500 worst passwords. What we need is a list of the 500 best passwords.
I keep it the same as my cat's name, so it's easy to remember. My cat's name is HZpn8BINlP5Lows2Y@z2I%L!Cvlga&GE128 but I change it every month.
Dude, you actually had to google 159357 to realize it was a num-pad thing? Time to hand in his geek card Robert!!!