Slashdot Mirror
Strong Passwords Not As Good As You Think
Jamie noticed that Bruce Schneier wrote a piece on a paper on strong passwords that tells us that the old 'strong password' advice that many of us (myself included) regard as gospel might not be as true as we had hoped. They make things hard on users, but are useless against phishing and keyloggers. Everyone can change their password back to 'trustno1' now.
If your computer is hacked than you're boned.
Seems to me that the solution is to have a strong password and keep your computer free of malware.
Is that really so hard?
It breaks my pluginses, my precious!
surely we should all be changing our passwords back to "Joshua"?
I wouldn't expect that anyone smart enough to come up with a strong password would be dense enough to somehow expect it to be immune to keylogging. However with the number of brute force methods out there for cracking weak passwords, I don't see how this in any way reduces the value of strong passwords on systems where passwords are critical.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
I advise people to use unusual sentences as passwords.
For example, look at the previous sentence.
It contains uppercase letters, lowercase letters, spaces and punctuation.
It's easy to remember, and hard to guess, so users are unlikely to forget it/write it down.
And even if you did write down your sentence/password near your computer, people might not even guess that it was your password.
Biometric authentication.
No problems there!
Finally had enough. Come see us over at https://soylentnews.org/
So because something that's good against brute-force attacks, but isn't against phishing and keyloggers, we should stop doing that? Phishing and keylogging are a result of strong passwords. So you need to implement adequate measures against those instead of saying strong passwords are useless.
If users have a hard time remembering their passwords, train them in it. Using phrases from which you take letters of which some are substituted with letters are very easy to remember for a user, yet very hard to bruteforce because you can make them quite long easily.
In particular many *NIX environments still don't natively allow spaces in passwords, so that approach would fail there.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
Slashdot is an excellent source of many of these sentences, as with spelling mistakes they're even harder to brute-force.
I sometimes set my password to ******** It sounds stupid but it has two advantages:
1. I know that I've typed in a * because I can see it
and, most importantly
2. When I have to repeat my password to confirm it, I can just copy and paste the previous field, saving me literally seconds of typing
Summation 2
I signed up for a forum a couple of weeks ago. I used the same generic password that I use for every other throw-away site out there, so it's easy to remember the damn thing. When I clicked submit, I got an error message telling me that my password needs a number in it. So I append a '1' on the end to satisfy the filter, and click submit again. I get *another* error message telling me that it needs to be mixed case, so I capitalized the first letter. Now I'll forget the password and never be able to guess the damn thing again, so the next time I want to log in to whatever forum this was, I'll need it to send me an email with a reminder.
It would be really nice if they'd just turn those damn filters off. This forum site isn't a bank. I couldn't give two shits if someone hacks my account there, not that my regular password is particularly guessable anyway. Seriously, I my password to your dipshit forum shouldn't have to contain mixed case, three numbers, nine punctuation marks, Egyptian fucking hieroglyphs, and that goddamn symbol the artist formerly known as Prince uses. Failing that, it would be nice if they at least provided some instructions with the password box that say something to the point of "Capitalize the first letter of your generic password and append a 1."
[/rant]
According to the article (cited by the citation):"Users are frequently reminded of the risks: the popular press often reports on the dangers of ïnancial fraud and identity theft, and most ïnancial institutions have security sections on their web-sites which oïer advice on detecting fraud and good password practices. As to password practices traditionally users have been advised to . . . "
-Choose strong passwords
-Change their passwords frequently
-Never write their passwords down
I would suggest that this is a case for the popular quip: "Pick two".
I am not a crackpot.
Ha! Dumbass. You need a better password now, like the one I have on my luggage: 1-2-3-4-5
1-2-3-4-5? That's amazing. I've got the same combination on my planetary air shield!
My password ends in:
3...
4 PROFIT!.
It's a reward for whoever cracks it - they'll probably profit.
Nobody brute forces anymore. Nobody. Any sensible password challenge/response system (I doubt there is such a thing if it relies only on that, but I ramble...) will lock you out and disable the account after so many tries, and usually the amount of tries is far lower than the threshold where guessing yields a meaningful chance to succeed. If it doesn't, steer clear of such a system altogether, if it doesn't come up with one of the simplest security "features", it probably is hellish insecure altogether.
Take, just for example, various game account or freemail system that let you retry infinitly, because their support would be flooded if they locked you out after 3 tries. Yes, you could keep guessing. And probably it is done. So a "strong" password means more security. Usually, no. Because they invariably also feature some braindead password recovery feature (ya know, the supersecret questions like "what was the name of your pet dog", again with infinite tries) that is usually even easier to defeat than the password guessing game.
You can, essentially, really go back to "12345" style passwords. There are way more than three possible easy to remember passwords, from birthdays to loved ones' names to even your CC pin number, and three being the usual number of retries before lockout. And without lockouts, the average "guess-hacker" won't go for your password. They go for the other venues that are usually far easier to break.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
An other hurdle to usability is when you have multiple systems at work place that require a rotating complex password where you can't remember what password belongs to what system. Where I use to work we would have a password for the NT/domain PC login, and a password for the UNIX terminal thing everyone had to log into do anything. And withing the software on the UNIX terminal they used, for certain subsystems there was "shared" passwords that never changed, while remembered, they was still semi-complex, e.g. real word that substitutes a couple numbers for letters. I counted once, I had to know 25 different passwords, two-personal, and two "shared" to do my job, and I wasn't even working in a IT or IT-like postion.
As all things in security, it's not black and white.
What exactly does "strong" mean? That's the important password.
In most circumstances, your threat model why you need a "strong" password is password guessing. It is rarely an actual brute-force attack, because most systems these days prevent a brute-force attack (e.g. they lock you out or reset your password to a random one that they send you per mail if you try it more than X times).
If your threat model does not include brute-force attacks, what you need is a "difficult to guess" password. That means you don't use "password" or "secret" and you don't use your own name, the name of your significant other or dog, your birthday and so on.
And that's all there is to it, really. All the bullshit about using numbers, special characters, etc. is just that - bullshit. It's defense against a threat that's not important anymore.
IANAL, but I am a security professional. Most of my passwords contain no numbers, and where the systems enforce them, there's usually a single number at the end or beginning. But I can type all my passwords in about a second on a standard keyboard. That makes shoulder-surfing a lot more difficult. In fact, I can make fairly good guesses at most "hunt and peck" people's passwords when I watch them type it in from across a small room. And the more difficult it is, the longer it takes them to type it in, and the easier it is for me to spot it.
So it all depends on your threat model, as always. Know what you need to defend against, and you'll have a pretty good idea of how you need to defend.
Assorted stuff I do sometimes: Lemuria.org
Conventional "strong" passwords protect against someone trying to guess or brute-force the password. They're really good at this.
The problem is, few attackers try to guess or brute-force passwords anymore. It's too time-consuming and too readily detected. Most of them will try to get you to tell them the password by one means or another. Phishing e-mails, keyloggers, traffic sniffing, man-in-the-middle attacks, the whole point of all of them's to get your password directly without having to figure out what it is. And against that sort of attack, "secret" is precisely, exactly as secure as "wkL3jfo*Zle". To guard against those attacks you need to strengthen things other than the password itself. And part of what you have to harden against attack is the user themselves, which makes it unlikely you'll succeed.
1-2-3-4-5?
Newbs. The highly secure password on US Nuclear weapons used to be:
00000000
http://en.wikipedia.org/wiki/Permissive_Action_Link
On the other hand, at least the US weapons actually have locks. Other countries' nukes don't.
"lepassword"?
What annoys me is when the security people demand passwords that are, in terms of strength, way out of proportion to the data they protect.
My bank password? Yes, that should be strong. The forum where I go for auto repair advice? No, I shouldn't have to memorize an 8 character password with at least one upper case, one number, and one symbol character.
Years ago one of my co-workers was asked by management to do a global password change on the systems (s)he supported. It was to be done late Friday afternoon for the "usual" reasons. The systems were such that you couldn't just expire them so they were individually reset to new ones. (S)He did this and then put post-its on everyone's monitor to let them know what their new password was when they came in on Monday. Shortly thereafter there was a new global password change.