Slashdot Mirror
Strong Passwords Not As Good As You Think
Jamie noticed that Bruce Schneier wrote a piece on a paper on strong passwords that tells us that the old 'strong password' advice that many of us (myself included) regard as gospel might not be as true as we had hoped. They make things hard on users, but are useless against phishing and keyloggers. Everyone can change their password back to 'trustno1' now.
If your computer is hacked than you're boned.
Seems to me that the solution is to have a strong password and keep your computer free of malware.
Is that really so hard?
It breaks my pluginses, my precious!
I wouldn't expect that anyone smart enough to come up with a strong password would be dense enough to somehow expect it to be immune to keylogging. However with the number of brute force methods out there for cracking weak passwords, I don't see how this in any way reduces the value of strong passwords on systems where passwords are critical.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
Biometric authentication.
No problems there!
Finally had enough. Come see us over at https://soylentnews.org/
So because something that's good against brute-force attacks, but isn't against phishing and keyloggers, we should stop doing that? Phishing and keylogging are a result of strong passwords. So you need to implement adequate measures against those instead of saying strong passwords are useless.
If users have a hard time remembering their passwords, train them in it. Using phrases from which you take letters of which some are substituted with letters are very easy to remember for a user, yet very hard to bruteforce because you can make them quite long easily.
But maybe it's just the summary? I'll go RTFA right after this, or at least skim it. But since phishing and keyloggers are only two threats, and people can still guess passwords (or brute-force them) I think I'll keep using randomly generated passwords.
"Wrote a piece" apparently means "wrote a sentence" because all Bruce said about the paper is that it was "Interesting", then he C&P'd the abstract. Why not link directly?
Okay, I read the first page of the paper and they say you only need about 20 bits of password so long as there is a three strikes policy in place. However, this ignores the type of attack where a remote hole allows retrieval of a file, and that hole is used to retrieve the password list. There are also other attacks which would allow one to get ahold of your encrypted password, not least by sniffing, which can then be brute-forced without having to worry about three-strikes policies.
In other words, keep your complicated passwords, they are still necessary to defeat dictionary attacks. Security is not something you can buy in the store, it is a mindset that you must adopt. The more factors of security, the better. If you can't memorize a complex password after using it twenty or thirty times, you should start playing memory games or something. Even I can do that and my memory is poor enough to be a liability (and always has been since childhood.) We're all different and excel in different ways, but you owe it to yourself to sharpen certain skills.
I guess the bottom line is that I'd be concerned about employing someone who can't remember a password. You write it down until you memorize it, you treat that piece of paper as precious and secret, you burn it and scatter the ashes (or eat it, or whatever) when you no longer need it. It shouldn't be that difficult for a modern human who can understand how to operate a computer.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
In particular many *NIX environments still don't natively allow spaces in passwords, so that approach would fail there.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
I signed up for a forum a couple of weeks ago. I used the same generic password that I use for every other throw-away site out there, so it's easy to remember the damn thing. When I clicked submit, I got an error message telling me that my password needs a number in it. So I append a '1' on the end to satisfy the filter, and click submit again. I get *another* error message telling me that it needs to be mixed case, so I capitalized the first letter. Now I'll forget the password and never be able to guess the damn thing again, so the next time I want to log in to whatever forum this was, I'll need it to send me an email with a reminder.
It would be really nice if they'd just turn those damn filters off. This forum site isn't a bank. I couldn't give two shits if someone hacks my account there, not that my regular password is particularly guessable anyway. Seriously, I my password to your dipshit forum shouldn't have to contain mixed case, three numbers, nine punctuation marks, Egyptian fucking hieroglyphs, and that goddamn symbol the artist formerly known as Prince uses. Failing that, it would be nice if they at least provided some instructions with the password box that say something to the point of "Capitalize the first letter of your generic password and append a 1."
[/rant]
According to the article (cited by the citation):"Users are frequently reminded of the risks: the popular press often reports on the dangers of ïnancial fraud and identity theft, and most ïnancial institutions have security sections on their web-sites which oïer advice on detecting fraud and good password practices. As to password practices traditionally users have been advised to . . . "
-Choose strong passwords
-Change their passwords frequently
-Never write their passwords down
I would suggest that this is a case for the popular quip: "Pick two".
I am not a crackpot.
An other hurdle to usability is when you have multiple systems at work place that require a rotating complex password where you can't remember what password belongs to what system. Where I use to work we would have a password for the NT/domain PC login, and a password for the UNIX terminal thing everyone had to log into do anything. And withing the software on the UNIX terminal they used, for certain subsystems there was "shared" passwords that never changed, while remembered, they was still semi-complex, e.g. real word that substitutes a couple numbers for letters. I counted once, I had to know 25 different passwords, two-personal, and two "shared" to do my job, and I wasn't even working in a IT or IT-like postion.
There's a bigger problem that I've yet to see written about and that's the shared username/password issue. I have at least 2 dozen different accounts, if you include Amazon, EBay, credit cards, bank account, youtube, blog/forums, etc.There's no way that I'm going to use different user names for each of them.
And of course, I'm going going to use the same passwords for the accounts as well. While I'm not too worried about using the same username + password for both Amazon and Ebay, what if I have the same password for MyFavoriteBlog.com. A single nefarious employee at a large blogging/forum site has access to many username/password combinations. What's to stop that user from trying those username/password combinations through eBay, every major bank, every major credit card, etc?
In truth, I user different user names for more "secure" sites like Amazon and banks than I do for ones that I don't trust, but I'll bet that most people don't bother.
As all things in security, it's not black and white.
What exactly does "strong" mean? That's the important password.
In most circumstances, your threat model why you need a "strong" password is password guessing. It is rarely an actual brute-force attack, because most systems these days prevent a brute-force attack (e.g. they lock you out or reset your password to a random one that they send you per mail if you try it more than X times).
If your threat model does not include brute-force attacks, what you need is a "difficult to guess" password. That means you don't use "password" or "secret" and you don't use your own name, the name of your significant other or dog, your birthday and so on.
And that's all there is to it, really. All the bullshit about using numbers, special characters, etc. is just that - bullshit. It's defense against a threat that's not important anymore.
IANAL, but I am a security professional. Most of my passwords contain no numbers, and where the systems enforce them, there's usually a single number at the end or beginning. But I can type all my passwords in about a second on a standard keyboard. That makes shoulder-surfing a lot more difficult. In fact, I can make fairly good guesses at most "hunt and peck" people's passwords when I watch them type it in from across a small room. And the more difficult it is, the longer it takes them to type it in, and the easier it is for me to spot it.
So it all depends on your threat model, as always. Know what you need to defend against, and you'll have a pretty good idea of how you need to defend.
Assorted stuff I do sometimes: Lemuria.org
Keepass only works so well if you have a keylogger AND configure it properly. If you have a trojan + keylogger where they can log the entry and download the file, the whole concept is moot.
figure out your password + copy your credential + copy your keepass file? It's not like keepass originated yesterday.
There is no perfect solution. There are "best practices" and thats about the best an average person can hope for.
1. "But the worst possible password constraint I can think of is limiting the maximum number of allowed characters." There is a maximum because some backend systems can't handle a password longer than that.
2. Always set the maximum number of attempts allowed: 3 or 5, depending on how smart/dumb your user base is.
3. Use Self Service Tools. Have a user answer security questions (At least 3 different ones). So when they forget their password, they can log into a system themselves to change their password (Using a secure kiosk or guest account, with access only to the self service tool).
4. Leverage single sign on technologies. Having 10 different applications with potentially 10 different passwords causes people to write the password own on sticky notes (Or on a excel spreadsheet). Using SSO mitigates that.
5. Force password changes frequently. Every 3 months, I would suggest.
6. Not allow users to use their previous 6 passwords at least and make sure that at least 2 characters are different between passwords. So they can't just go from Password1 to Password2.
It's not a fool proof solution, but that combination of rules I have seen work the best at corporations.
What annoys me is when the security people demand passwords that are, in terms of strength, way out of proportion to the data they protect.
My bank password? Yes, that should be strong. The forum where I go for auto repair advice? No, I shouldn't have to memorize an 8 character password with at least one upper case, one number, and one symbol character.
But then if you allow trivially simple passwords, but have thousands of login names in your system, then you pick a single common password and try it with a dictionary attack against every user instead...
09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
T
Laws are horrible moral guides, moral guides make even worse laws.
Keepass will work fine and dandy until enough people are using it where it's worth exploiting. The targets of most of this stuff aren't individual users. They're the broad audience, which a percentage will do a compromising activity.
I'll admit, I once worked for a company who sent spam. This was before the days of it's evilness, and laws, and ... well, what it's become.
The general thought at the time was, for every 100 emails sent out, there would be approximately 3 paying customers. Those were targeted towards previous account holders, which still is in the gray areas of legal. Even though the customer base continued to grow through this method, but more of affiliate marketing, the returns on sending the notices dwindled as spam became a bigger problem. 3% became 1%. We never sent any more mailings after the conversion rate dropped to something like 0.02%. I spoke with someone later (probably about 7 years ago) who was still in that business. He said no matter what the product was, the conversion rate was down to 0.0003%. That business folded from ISP pressures, and they went into the business of handling mailing list transfers. They acted as the neutral intermediary, to ensure both parties would be satisfied with the transaction. That dried up as the conversion rates dropped down below 0.0001%. Who wants to send 1 million emails, to make a single $29.95 sale? Well, they still try, or our spam boxes would be empty.
The same will happen with this market. As users become smarter or have better technology protecting them, the market will dry up. But in our current state, key loggers grabbing passwords, bank info, etc, is a lucrative business. I am very happy to say that I have never, nor ever will, be involved in that line of work. It's one thing to market and sell something. It's another to blatantly steal from an oblivious user.
How will this market dry up? It won't be better antivirus/antispyware applications. Those are just chasing the problem. How was a big dent put into the spam industry? Innovation and education. You can ask even the barely computer literate "Should you buy something from an email that someone you don't know sent you?". The majority of answers will be "No".
Such malware isn't quite as in your face, and masquerades itself quite gracefully. If it's a well written piece, you'd never know it was there. Fortunately, most of them aren't as well written as they should be.
Serious? Seriousness is well above my pay grade.