Analysis of 32 Million Breached Passwords

An anonymous reader writes "Imperva released a study analyzing 32 million passwords exposed in the Rockyou.com breach. The data provides a unique glimpse into the way that users select passwords and an opportunity to evaluate the true strength of these as a security mechanism. In the past, password studies have focused mostly on surveys. Never before has there been such a high volume of real-world passwords to examine." Most interesting to me was that in the sample, less than 4% used any non alpha-numerics in their #$#%'ing passwords.

Comments

My password

[Anonymous Coward]

Is password. So damn obvious, nobody would think to try it =)

Re:My password

[Anonymous Coward]

This comment was also posted the last 5 times this "unique" glimpse was given into what kind of passwords people use. Whoever wrote the description must be 6 years old for them to think this is actually unique.

Re:My password

[Anonymous Coward]

Here's two more "unique" glimpses into what kinds of passwords people use.
http://www.schneier.com/blog/archives/2009/02/another_passwor.html

Oh look another "unique" look at what passwords people use
http://blog.jimmyr.com/Password_analysis_of_databases_that_were_hacked_28_2009.php

This site gets dumber and dumber every day. The Onion insults my intelligence far less often.

Re:My password

[Panaflex]

I used to think the same thing! What a co-inkidink! Than someone hacked into a (fortunately, base install, nothin else) machine and I no longer think that.

Re:My password

[praxis]

Well, those three studies looked at 30k, 30k, 110k passwords. While that's enough to get some interesting patterns, it's not as solid as looking at 32M passwords. One could argue that's what makes this a "unique" look. No, studying users' passwords isn't new, but getting such a large glimpse certainly can be.

Re:My password

[Anonymous Coward]

unless the sampling method was better, the increased sample size will not help in most analysis. This is basic statistics.

Password strength vs. how often you change it

[Anonymous Coward]

My company wants me to change my pass every 2 months. Guess what happens to the password strength over time.

Re:Password strength vs. how often you change it

[celardore]

Agreed. We use an old accounting system called JDE, which has a caseless, mandatory 8 digit password - no more, no less. It forces a change every 2 months. You could pretty much calculate anybodies password by taking their surname, and their length of employment. So Joe Bloggs who worked for the company 3 years would likely be bloggs18, for example.

They would be better off allowing us to keep one $EcúR3 password for the duration of employment really.

Re:Password strength vs. how often you change it

[Rockoon]

My company (over 10,000 employees, not in the computer industry) does the same thing, but the really annoying part..

..it must be EXACTLY 2 letters, followed by EXACTLY 4 digits.

So even allowing for upper case (which I am not sure that it differentiates), the total password space is only 2704000000.

The size of this space can conveniently fit into a 32-bit value, which is probably what they are doing: storing passwords in an integer field.

Did I mention that they pay our IT department $11/hour?

Yeah, all my coworkers do the same thing: use the same 2 letters every time they need to change it, followed by "1111" then "2222" then "3333" and so forth...

Re:Password strength vs. how often you change it

[mrcaseyj]

For places that require password changes I'd suggest to take a very long base password with a month appended and hash it, then convert the hex hash into printable characters. Maybe something like this:
echo -n "LongUnchangingBasePasswordSiteNameJan2009" | sha512sum | xxd -r -p | tr -cd [:print:]
This has the advantage of being highly secure and easily memorable, but someone shoulder surfing your password wouldn't be able to figure out what your password is next month. People more familiar with windows could suggest a command available on that system. Be careful to do this on a computer where the command will not be stored in a command history.

I'm planning to go all lower case with my passwords though. I'll have to make my passwords 50% longer, but I think they'll be easier to type and almost as easy to remember as totally random ones. In fact my error rate with the totally random ones is an issue with shoulder surfing because I make mistakes and have to retype it so often, giving shoulder surfers repeated sightings, and because the numbers and symbols and shifts slow me down.

Re:Password strength vs. how often you change it

[R0UTE]

And guess how people end up remembering these passwords. Post-it notes within the vicinity of the PC seems to be a favourite.

Enforcing people to change passwords regularly seems to have many drawbacks. I really don't understand the point.

Re:Password strength vs. how often you change it

[Anonymous Coward]

At my work we are all required to logon with Smart Card and PIN. Nobody has these "passwords" of which people speak. Shoulder surfers don't have my Smart Card, so lots of luck if they think getting my PIN was very important.

Re:Password strength vs. how often you change it

[WuphonsReach]

My company wants me to change my pass every 2 months. Guess what happens to the password strength over time.

It's a leftover idea from a bygone decade.

The primary advantage of a required monthly or bi-monthly change is that if a password is compromised, it's only useful for about 1/2 of the expiration period. So it's a way of reducing risk in the case of accidental or nefarious disclosure.

But the big downside is that it requires users to be constantly learning new passwords every month or so. And unless these passwords are automatically assigned, users WILL pick weaker and weaker passwords over time or passwords that fit into an easily remembered sequence. So you really end up back where you started.

Forced password renewal is a valid strategy in a small number of cases. Such as a system which protects billions of dollars in assets or is super super critical to the business. But in those cases, there should be 2-factor authentication in play anyway and the passwords probably only need to be changed every 3-6 months and should be randomly assigned.

For end users? Limit their permissions, force complex passwords, but don't require them to change frequently (*maybe* once every 2 years). Tell them to go ahead and write the passwords down and store them in their wallet next to their credit cards. Which is at least a huge step up from putting it under the keyboard or stuck to the monitor.

Longer passwords are also easier to remember if they are used frequently (at least daily). But for some users, it may take as long as 2-3 weeks for them to remember it without looking.

Re:Password strength vs. how often you change it

[KlaymenDK]

They would be better off allowing us to keep one $EcúR3 password for the duration of employment really.

Not really, no. If someone gets hold of your password, that person is able to access your systems potentially without you detecting it until you change your password.

The quality of the password doesn't matter, and that's why even digital signatures have a given life span. It's more a matter of damage control than anything else. The side-effect that this tends to lower the overall password quality points more to the user employing a poor password construction strategy.

Of course, if the attacker changes your password or makes other obvious changes, then that's a different game. I'm talking about the surreptitious scenario.

Re:Password strength vs. how often you change it

[Hurricane78]

That’s why I chose “visual pattern” passwords. I draw symbols on the keyboard, e.g. while holding Mod3. (NEO layout. Hover the mouse above “Ebene 3”.)
Like a N. Which results in “#\.../|{[” or “#u...1_a~e]4” (where ... is one character […], that Slashdot does not accept.)

(This is an example. The real type of pattern I use is something different. ;)

Re:Password strength vs. how often you change it

[Spazztastic]

Did I mention that they pay our IT department $11/hour?

Yeah, all my coworkers do the same thing: use the same 2 letters every time they need to change it, followed by "1111" then "2222" then "3333" and so forth...

Shit, I thought I had it bad with pay.

We moved to a required 8 digits and 3 of the 4: Upper case, lower case, symbol, number. Resets every 30 days. What has happened with me? My strong 20 digit password has been trimmed down to the bare minimum because I will have to change it in 30 days anyway. Completely defeats the purpose.

Re:Password strength vs. how often you change it

[Ploum]

That's highly annoying. Even more if this is a web proxy password and that, each month, you have to change the proxy password for every f*** application that connect to the web (That Windows OS is really really bad).

I took another approach :

1) informing the computer dpt that it's a very bad idea. Here are some links:
http://www.cerias.purdue.edu/site/blog/post/password-change-myths/
http://ploum.frimouvy.org/images/dilbert.png
http://ploum.frimouvy.org/?177-le-gilet-de-sauvetage-et-le-tgv (in french)

2) of course, they won't change. So consider : what will you loose if you password is corrupted ? Nothing personal. Only stuffs from the company that didn't want to hear you. Should you have a more complicated life because they are too dumb ?

3) if the answer is no, simply change your password to :
yearmonth. That makes it : january2010. Easy to remember and will change all the time.

4) Share the tip with your collegues. Anyway, they should have access to my files, you are working together, isn't it ? Guess what ? Most thought it's a good idea and do the same.

Result : easier work for everybody.
Security ? You tried to improve it, you were not listened. That's their problem now.

PS: of course, be careful to analyse what you are sharing and what are the risk. I will never do that for my personal stuffs.

PPS: even better solution. Try to think about systems that cannot change their password, like the backup system. Usually, that login/password has access to everything in the company, doesn't change and is really easy to find if you know where to look. (and is, 99%, something like "permanent_pass" or "autologin"). That's make your life even more easier.

Re:Password strength vs. how often you change it

[zx75]

I need to change my company password every month, but the password strength for my company account remains strong.

My password strength for a website forum where I never need to change it however, is usually weak.

The password strength I use is highly correlated with the sensitivity of the information it allows access to and the importance of the systems.

I would fall into the 96% of people who don't use non-alphanumerics for "Rockyou.com"

Re:Password strength vs. how often you change it

[Anonymous Coward]

.., followed by "1111" then "2222" then "3333" and so forth...

Dont you mean so 4444th.

Re:Password strength vs. how often you change it

[wwwillem]

unless these passwords are automatically assigned

In which case it is guaranteed to be written down somewhere on a piece of paper. Talking about "improved security".....

Re:Password strength vs. how often you change it

[mrand]

I'm planning to go all lower case with my passwords though. I'll have to make my passwords 50% longer, but I think they'll be easier to type and almost as easy to remember as totally random ones. In fact my error rate with the totally random ones is an issue with shoulder surfing because I make mistakes and have to retype it so often, giving shoulder surfers repeated sightings, and because the numbers and symbols and shifts slow me down.

Going all lower case would not be a wise move... more and more stupid password systems are requiring mixed case alpha letters plus at least one digit. The most silly part of this is that I had to do this to download an update for a piece of commercial software. A piece of software that requires lmserv!

Re:Password strength vs. how often you change it

[gmack]

It's a trade-off you are trading the possibility of locking someone out of the system for the possibility of the passwords all being easy to guess or worse yet writes the password down on a piece of paper.

Re:Password strength vs. how often you change it

[Opportunist]

You get what you pay for.

But rest assured, they'll hire a security expert when (not if) they encounter a security breach and his 1.something million $ advice will be to change it. And then it will change.

Re:Password strength vs. how often you change it

[Cyner]

I'm IT at my company. Two years ago a non-technical owner read an article about security where the article suggested passwords should be changed every other week in high security environments. We deal with sensitive data, so the owner thought this would be a good idea. It took quite a bit of convincing to get that idea out of his head, but you can imagine the results. Every's password would eventually be [favorte word][month][1-2] or similar.

We change passwords every 90 days as it is and I know of a user who was using [season][month #][day #], so something like "winter0121".

It's funny how much good advice there is on the Internet for passwords, and how often everyone ignores it.

Re:Password strength vs. how often you change it

[Demonantis]

A lot of people use the same password on multiple sites. Makes me wonder why a breach or phishing site is needed. All you need is their email and their password. Easily available on most sign up forms for websites. All you need is your own website people want to join...

Re:Password strength vs. how often you change it

[nine-times]

..it must be EXACTLY 2 letters, followed by EXACTLY 4 digits.

That's retarded.

I've thought about this sort of thing before, where password policies also have the effect of narrowing the number of possible passwords. For example, it's pretty standard for a company to have a policy like, "Your password must be at least 10 characters, contain at least one capital letter and one lower case letter, contain at least 1 number and one non-alpha-numeric character." And yes, it's true that keeping these policies has the effect of increasing the number of combinations, but it also is simultaneously narrowing the combinations.

If a hacker knows this policy and were to try a brute-force attack, they would be able to disregard any possible passwords made of 7 characters or less. They would be able to get rid of all combinations that were all lower-case, all upper-case, or even all alphanumeric. I haven't done the math and I'm sure that requiring some of these things are still a net gain, but it struck me as funny. Like if someone were to try a very clever brute-force attack that didn't bother trying all-alphanumeric passwords, then "password" would in that case be a safer password than "*pQQ\K6"XSiM". It might take him a million years to get to "*pQQ\K6"XSiM", but he'd never try "password".

Re:Password strength vs. how often you change it

[Anonymous Coward]

JDE isn't necessarily old, but the version of it your using might be. The caselessness is configurable (or your using it on an AS400). The version I use, which is only a few years old runs on a Wintel platform, so we have BOTH cases, non-alphanumerics and passwords up to 30 chars. Sounds like time your company upgraded! The password longevity is also configurable, ours is set to about 30 days and stops you repeating the last ten.
I do however totally agree with the point that constantly changing your password means you either weaken your password or implement some password storage system, personally I have an app (KeyPassSD) on my phone that keeps them all in an encrypted format.
The best method I've heard of is to create a story, and every time you log on you get given a different small section of it, and have to continue it. This plays to the strength of the human brain - its very good at remembering stories, and stops anyone copying what you type - as next time you will have to type another part of the story.

=D

Re:Password strength vs. how often you change it

[Richard Steiner]

I have 70+ passwords I have to remember for work, and they tend to change in cycles of 30, 60, or 90 days (depends on the system).

I try to figure out hard to guess passwords that I can remember, and normally embed at least one numeric and one non-alphanumeric character (and some systems enforce that), but it's difficult to remember some of the ones I don't use on a daily basis. At least I've developed a system, *and* I have a program I store the passwords in just in case I forget. :-) But it's a real pain.

Re:Password strength vs. how often you change it

[Opportunist]

Hey, I used to use a password that could be found on my coworker's monitor, in plain view. I had the idea when they required me to come up with a secure, 10-digit-or-more password containing alphanumeric characters and his monitor's serial number fit the bill.

Re:Password strength vs. how often you change it

[RalphSleigh]

Don't blame windows if your applications fail to ask it for proxy settings and instead each store them individually. It's possible to set the proxy settings using the control panel without opening IE (I am not sure what happens if you uninstall IE, but suspect the settings panel will still be there).

AFAIK both firefox and chrome will use these settings.

Re:Password strength vs. how often you change it

[ottothecow]

technically an all lowercase password is just as secure as any other password. You could take a set of random characters and have them all end up as lowercase letters. It is only bad because of the common belief that brute force attacks (and god forbid--dictionary attacks) check all of the lowercase options first. In that case, it is probably also better to start all of your passwords with a 'z' since they tend to check in alphabetical order.

I hate it when systems specifically require odd crap though...requiring a mixed password (must have 2 of the 3 following features or something) is good but saying that my 8-character password must include at least two numbers is actually decreasing the keyspace fairly significantly since you can limit several parts of the password to 0,1,2,3,4,5,6,7,8,9 as opposed to every single letter/number/punctuation.

Re:Password strength vs. how often you change it

[koreaman]

Worse: at the high school I went to (I only graduated last year), people's passwords were six-digit numbers that had been assigned to them when they first entered the school district (grade school for most people). The first two digits were determined by the elementary school the person went to. The last four digits were arbitrary (although I strongly suspect that the elementary schools started at 0000 and just counted up from there). Worst of all, the last three digits were included in the username. Someone with one of those passwords could have deleted someone else's work, surfed CP on someone else's account and gotten them expelled, or, yes, embezzled lunch money.

Re:Password strength vs. how often you change it

[Celestialwolf]

My company forces me to do the same, only it's even more often. Yes, strength does decline...

Re:Password strength vs. how often you change it

[Chris Mattern]

But rest assured, they'll hire a security expert when (not if) they encounter a security breach and his 1.something million $ advice will be to change it. And then it will change.

Mind you, the new change won't be any more secure than the old way, but at least it'll change...

Re:Password strength vs. how often you change it

[pastafazou]

That's nothing. At my job, the passwords are randomly generated, so nobody has any passwords OR smart cards/pins to steal. We have to use a password removal tool to reset the password to "12345" just so we can log on in the morning!

Re:Password strength vs. how often you change it

[dintech]

Did I mention that they pay our IT department $11/hour

So it's true that if you you pay peanuts...

Re:Password strength vs. how often you change it

[orlanz]

For end users? Limit their permissions, force complex passwords, but don't require them to change frequently (*maybe* once every 2 years). Tell them to go ahead and write the passwords down

This is where auditors will fail your computer security policies. And they would love the 2 factor auth. As a former IT auditor, I get what you are saying and I agree. But almost all auditing is "I see no evil...: so no one is even allowed to think of the secondary effects of having the 2 factor with nothing but "can't write this anywhere..." policy.

Re:Password strength vs. how often you change it

[clodney]

It may narrow the nominal keyspace, but it almost certainly increases the average keyspace that needs to be searched. Without the complexity requirements most people will use a dictionary word or something like that. And the company wants to keep all the accounts secure, so it has to care about the average password.

And think of it this way - in a keyspace that requires 10 numeric digits, what percentage of the total keyspace is consumed by anything containing less than 10 digits? seems to me you have only given up 10% of the space, and an even smaller percentage if you consider the full printable range of characters instead of just numerics.

Re:Password strength vs. how often you change it

[nine-times]

Yeah, like I said, I'm sure it's a net gain in terms of security even without having done the math. Still, it strikes me as funny.

Re:Password strength vs. how often you change it

[Monkeedude1212]

We assign our users passwords. The turnover rate at our company is surprisingly high, so we don't bother giving them strong passwords. They'll be out the door and the account disabled by the time anyone shares their password.

Re:Password strength vs. how often you change it

[zorg50]

Hopefully he doesn't decide to get a new monitor any time soon.

Re:Password strength vs. how often you change it

[Inda]

So, so easy.

This month my company password is January2010. Notice how it respects company policy by containing a mix of upper and lower case, plus two or more digits?

Next month my password will be February2010.

I jest but I know people who use this method.

Re:Password strength vs. how often you change it

[AniVisual]

Y'know, that seems fairly secure to me, as long as nobody catches you staring at the serial for too long.

Re:Password strength vs. how often you change it

[Hoi Polloi]

At the very least they should create a list including passwords like the one in the article and block those from being used (the "lazy list"). Restricting you to a specific pattern is nuts though. What a great way to simplify things for a password cracker.

Friend of mine in college once out of curiosity tried to see how many systems he could get into just by trying obvious passwords. He told me he found approx 10 of them that used "password" as the password. He also found a number of databases and routers that were still using the factory default passwords.

Re:Password strength vs. how often you change it

[Anonymous Coward]

What happens when you show up for work one day and he has a new monitor?

Re:Password strength vs. how often you change it

[Anonymous Coward]

My non-alpha character was 1 the first month, 2 the second month, 3 the third... it's cycled around to zero now.

Forcing users to use random strings as passwords doesn't actually increase security -- it just forces users to write their password down on a post-it note. I've captured passwords by 1) Looking in an employees top desk drawer for the post-it 2) Writing a trojan that emulates a log-in screen on a dumb terminal, waiting for someone to log in, logging the information, then pretending there was an error so they need to log in again, and 3) Writing a program that put a Sun workstation into promiscuous mode, then monitored all traffic for telnet username/password sequences (this actually netted the admin password for all Oracle HQ computers). A "strong" password would have done NOTHING to lessen the effectiveness of any of these techniques! Why would anybody attempt to brute force a password by dictionary attack when there are much easier methods available? (E.g. social engineering.) Locking out an account after too many failed logins is effective against brute force attacks, and is already implemented in every system I know of. Requiring arbitrarily complex passwords just means the admins have to reset passwords more often, 'cause people forget them. That being said, forcing periodic password changes actually IS a good measure; it limits access to shared passwords.

Re:Password strength vs. how often you change it

[Anonymous Coward]

Luxury! At my job, every morning we have to beat a confession out of a captive Yorkshireman, and hash that with each employee's ID number.

Re:Password strength vs. how often you change it

[runningman24]

If all you're doing is changing the number after the password, as most people are doing, making the password expire isn't accomplishing anything.

Re:Password strength vs. how often you change it

[Rastl]

My company (over 10,000 employees, not in the computer industry) does the same thing, but the really annoying part..
..it must be EXACTLY 2 letters, followed by EXACTLY 4 digits.
So even allowing for upper case (which I am not sure that it differentiates), the total password space is only 2704000000.

Making the assumption that they're not storing it in plain text which would kind of negate the 'integer' part (alpha?) If they're that strict about password format then they're probably not doing much on the back end either.

Re:Password strength vs. how often you change it

[kalirion]

My password on one of my company's UNIX servers expired recently, so I was forced to change it. The rules weren't advertised, so the only way to find out what kind of new password is allowed is to keep trying different passwords. When your new password doesn't qualify, it only tells you a single one of the rules that was broken.

So I had to discover the following rules the hard way:

1. Cannot "share the first 512 characters of the previous password".
2. Has to have at least 8 characters
3. Has to have at least 2 upper case letters
4. Has to have at least 2 lower case letters
5. Has to have at least 2 numbers
6. Has to have at least 2 special characters

So my password?
abAB12!@

Oh, and then I used sudo to change it to something I liked.

Re:Password strength vs. how often you change it

[Anonymous Coward]

...which, as the GP points out, is a pretty poor password construction strategy.

Re:Password strength vs. how often you change it

[kalirion]

Given the above policy, a smart hacker would bruteforce the following template:

(1 capital letter)(7 lower case letters)(1 number)(1 special character). With a dictionary attack for the first 8 characters.

Password1!

Re:Password strength vs. how often you change it

[rickb928]

Funny.

People familiar with Windows won't be recommending a command available on Windows. Your example is several commands. Which one?

Seriously, strong passwords require some creativity and of course some investment by the user. If you've administered a fairly large (or even small) corporate network for any length of time, you know users generally are not overly concerned about security until they are personally inconvenienced. Then they blame everyone else.

This is a corporate issue, as important as financial controls and marketing. Some corporations, of course, suck at those functions too, so no surprise. But security is a core process nowadays. If you value your job, you will be diligent at your password management. If not, well, you take the change that you will be reading about the reasons for the demise of your employer while you search for your next I Hate Passwords job.

Where I work, I currently have 12 unique passwords, used on 27 differnet systems. My personal passwords are a different matter, when I use over 50 unique passwords for various online stuff.

I use combinations of

- variations on a theme; like password1, password2, password03, passwordH, passordT%
- reversed passwords; carrot, torrac, trouble, elbuort
- word-sounding passwords; c@rr0T, St!ck, b@g3!, myb!rtH@^, these are bad examples.

Since my eBay account was compromised about 2 years ago, I've gotten harder about passwords.

Now my wife, she seems to cling to passwords like lost children. I'm working on her.

Passwords are as necessary as rain.

Re:Password strength vs. how often you change it

[Tim C]

In which case it is guaranteed to be written down somewhere on a piece of paper.

And you can have that piece of paper when you manage to get my wallet off me without me noticing. (And if someone does steal my wallet, I'll inform the system's administrators of the theft along with my bank, credit card company, etc)

Seriously, there's nothing wrong with writing passwords down and protecting the piece of paper. Now if you're writing them down along with the rest of the authentication details (or they're obvious from context) and putting the paper somewhere stupid, that's different.

Re:Password strength vs. how often you change it

[Anonymous Coward]

Shit, gotta change my password now.

Re:Password strength vs. how often you change it

[Anonymous Coward]

Hey, that gave me a great idea!

I just changed all my passwords to the 10 digit number on the $1 bill in my wallet. Now, whenever I need my password all I have to do is find a dollar bill!

Re:Password strength vs. how often you change it

[Opportunist]

It actually happened once and I had to get my password reset.

As for having to change passwords, simply rotate by the number of the month.

Re:Password strength vs. how often you change it

[exploder]

I wish someone (ISO? NIST? DOHS?) would establish an honest-to-god STANDARD for what makes a strong password. For instance, >=8 characters, at least one each of upper, lower, numeric, other.

Why? Because I use a fantastic Firefox addon called Password Hasher (and there are other good ones for the same purpose), which uses a hashing algorithm to combine the site's domain name with my own personal master password to create a different, secure password for every account, while only forcing me to remember one nice, strong password.

The problem is, different sites require different kinds of passwords, to the point where NO combination of settings for length and content of the generated password can work for every site. PH does a good job of remembering the individual sites' settings on my own computer, but it gets a lot less convenient when I'm on someone else's.

Re:Password strength vs. how often you change it

[DeanLearner]

What method? I don't see it! My passwords are always the direct competitor for the site I am on. My facebook password is work My twitter password is work My slashdot password is wo... Hmmmmm.

Re:Password strength vs. how often you change it

[Anonymous Coward]

My roommate's company (actually a US Government agency) requires passwords to be at least 20 characters.

One evening he walked around looking under keyboards, a majority of them had cryptic 20 character messages written on post-it notes underneath them.

Re:Password strength vs. how often you change it

[vegiVamp]

Yeah, those caseless digits are annoying, aren't they ?

Re:Password strength vs. how often you change it

[Anonymous Coward]

Fine. Until one day you come in and Doh! New monitor!

Re:Password strength vs. how often you change it

[JWSmythe]

    Better than that. One place I worked, they assigned passwords for a payroll/HR site. Once assigned, there was no way to change it. Their method was:

    [first initial][last name][last 4 of your SSN]

    So, mine would have been...

    jsmythe0000

    If I had switched to our office's HR persons account, I could have fired everyone. :) There were other options. I could have given raises, demoted people, dropped their health insurance, or signed them up for the most expensive coverage. Most folks weren't paid that well, so signing them up for full health coverage would have made them OWE the company at the end of each week. :)

   

Re:Password strength vs. how often you change it

[fprintf]

this is not actually a bad idea. I carry a spare $20 bill in my credit card wallet. If find it highly unlikely that anyone would guess to try the numbers on that bill before any password safety systems would lock out my account due to too many attempts.

If the passwords need frequent changing just swap out the $20 for another every 30 - 60 days.

Re:Password strength vs. how often you change it

[Anonymous Coward]

Where I work, if I find a system account logging in where it shouldn't be, and it turns out someone is using the system account for "convenience", they will be terminated. But there is a very good reason for that -- we require everyone except MIS to change their passwords regularly, and allow MIS employees to use static passwords. It's assumed if you're using a system daemon account for something other than its purpose you're trying to hide something.

No, that doesn't add any security, but the concept is that MIS already has access to everything (via static daemon/service accounts and passwords if nothing else) and the added frustration of having MIS change their passwords when test software (logged in as the user), Terminal Services sessions (logged in as the user), and network shares connected from multiple servers (all logged in as the user) is too much. Only MIS isn't required to logoff from all servers at the end of the day for this reason.

And since MIS is responsible for enforcing these rules, we can easily exclude ourselves. Our VP knows and understands and that's what matters.

Anon for obvious reasons.

Re:Password strength vs. how often you change it

[Maxo-Texas]

I think a base which is not a legitimate word plus a changing part based on context (the site) plus a number is fairly secure.

However, after seeing the report, I think I'll experiment with symbols. The problem is if symbols are not allowed everywhere then it messes me up.

I've been to some sites months or years later and I'm able to rebuild the unique password because I have a system.

Easiest non english word is based on the first letter of a sentence.

Zoos have grey elephants (ZHGE).

Then a pre or postfix for the context.
Then an arbitrary number (3711) which

I do like your idea of a sentence as a password if allowed, but most places limit passwords length more severely than that.

Re:Password strength vs. how often you change it

[StuartHankins]

I can't imagine anyone working in IT -- unless you're just Help Desk -- making that low of a salary. Time to upgrade your skills in a way that either your company will appreciate or find a new company. Best of luck.

Re:Password strength vs. how often you change it

[socz]

You gave me a good idea, how about issue passwords on a credit card size card that also has direct access to your payroll. THAT WAY you have the NEED to protect it and prevent other people from seeing/gaining access to it! Sure, you can still have direct access, but it'll go through a holding phase on that card!

Re:Password strength vs. how often you change it

[Rockoon]

Shit, I thought I had it bad with pay.

This is the same IT department that purchased 100 custom touch-screen terminals for my department for nearly a million dollars about 5 years ago, but failed to ever get them to network correctly (my educated guess is that packet collisions were responsible.) The systems sat there taking up space for almost a year before they were finally removed, never to be seen again.

They eventually got a new system for the same purpose, and for about 3 months that too was unworkable for seemingly the same reason. I suspect that a member of the IT department finally discovered the wonders of Token Ring.

Re:Password strength vs. how often you change it

[epine]

technically an all lowercase password is just as secure as any other password

You must have missed the bulletin which explains that security consists of becoming a less inviting target than the guy beside you. If the sheep tend to use all lower-case passwords (baaaaaa), then you're best off wearing a different cloak.

it is probably also better to start all of your passwords with a 'z' since they tend to check in alphabetical order [citation needed]

I thought script kiddies were all playing on the streets of the Facebook favela these days, and that unemployed Russian PhDs were out there flexing their combinatorics.

From that training set, it would be pretty easy to code up a Markov letter bigram or trigram model and enumerate from least entropy on up (a near approximation to this is plenty good enough). My guess is that that nine letter all-lowercase passwords would be on roughly the same tier as six letter passwords with multiple punctuation marks.

This study was a bit stupid in reporting password strength. A nine letter password from two symbol sets will be close in strength to an eight letter password from three symbol sets, as long as the nine letter password doesn't build upon trivial substrings.

I think this is why the recommendation demands three symbol sets: it gives users less scope to squander entropy that a longer, ordinary character password ought to have.

One time, as a joke, a very long time ago, a devious coworker put a keystroke logger on a paranoid coworker and the password revealed was 6uldv8. Apparently there's more than one reason to keep your passwords secret.

I generate all my own passwords starting from suggestions offered by OpenBSD's apg utility. For crap sites, I try to achieve an estimated entropy in the vicinity of 30 bits and scale up to about 60 bits at the paranoid end: 5*6 (a brief burst of line noise), 6*5, 7*4, 8*4, 9*3, 10*3 (baby talk).

For longer passwords, you can pair two words from a large dictionary (about 13 bits entropy each) and then add another four bits with a single symbol corruption. Routinely sticking an ! in between two obscure dictionary words is not a good idea if you're concerned about cross entropy, where the attacker already knows some of your passwords by other means. I avoid consistent corruption templates, because I don't want to lower the cross-entropy on a set of partially exposed passwords too severely.

For most purposes, even 20 bits of entropy is a good start, if the attack involves knocking on the front door. Not so good if the hashed password file is compromised behind the scenes. Even 30 bits is pathetic in the latter case, but this reasonably well mitigated by never sharing a password across multiple sites.

At 40 bits, the attacker begins to ask whether there's any money involved. A high-end video card, properly coded, would sneeze at 40 bits. However, properly coded still isn't free,

By the time you get to 50 bits, it's time to start asking whether you've seriously pissed off the wrong person. Quite doable, with a modicum of enmity, but not worth the bother if the game is shooting fish in a barrel at least expense. Armour piercing rounds are deployed sparingly.

I wouldn't be the least bit surprised that the NSA has accumulated a dictionary of the trillion most common passwords, sorted by descending order of frequency, covering all languages and source lexicons of the world (pets, pet names, Klingon, Thalassian, Qenya) permuted into all manner of imposed password template schema. I'd be shocked if they hadn't. For that matter, Google could build a good approximation to that dictionary just using their lexigram index, on roughly the terascale.

Shedding about 10 bits of protection per decade, we'll soon need to return to Beowulf era culture where reciting your ancestors back to the garden of Eden was the gold standard for accurate recall.

I wish every login box on every site had a

Re:Password strength vs. how often you change it

[Anonymous Coward]

Suggesting they change their policy can't hurt, but in most cases password changing happens because it is mandated, for instance by the credit card security rules. It's (unfortunately) rare that companies will increase password requirement complexity without being forced. Left to their own, most companies will store plaintext passwords in their database, as well as on a sticky affixed to their monitor.

Re:Password strength vs. how often you change it

[Anonymous Coward]

u.%;Z9HLG%-AJ"?+6?d.Fb\3L!\ is easy to remember?

Re:Password strength vs. how often you change it

[stewbacca]

My company requires 15 character passwords with alpha-numeric-special character requirements, no English words, and no two keys can be adjacent (and we have to change them every two months)...riiight.

Thankfully I speak fluent German and Arabic as well.

I wonder which project I charge for the two hours it takes me to come up with a new password every two months.

Re:Password strength vs. how often you change it

[stewbacca]

My work detects if your BasePassword remains, and requires you to change it...can't contain any consecutive keys from your previous password. Stupid.

Re:Password strength vs. how often you change it

[legio_noctis]

SuperGenPass is rather good for this: it's a bookmarklet that uses the current website address as the seed for an md5 hash of your master password. So you type your master password in, run the bookmarklet and it changes it to the actual password that it generated when you signed up. Some people have suggested that the master password is at risk even being typed in in the first place (Javascript on a hijacked site could recover it), but Chrome has a 'SuperChromePass' extension that does the same and I assume it's more secure. I don't actually think it's a particularly big risk in the first place.

Re:Password strength vs. how often you change it

[Anonymous Coward]

I can't imagine anyone working in IT -- unless you're just Help Desk -- making that low of a salary. Time to upgrade your skills in a way that either your company will appreciate or find a new company. Best of luck.

Is it acceptable to "woosh" a post that misses the point of a serious post, rather than simply missing a joke?

FYI - GP was not in IT, GP was pointing out that his company vastly underpaid its IT staff and got predictably incompetent results.

Re:Password strength vs. how often you change it

[Rockoon]

I don't work in their IT department. I see the job posting, then nudge my direct co-workers who are standing around looking at the latest postings with me, and point at it and say "thats why."

"Thats less than half of what we make. Why did they post that here?"

Re:Password strength vs. how often you change it

[Anonymous Coward]

yearmonth. That makes it : january2010. Easy to remember and will change all the time.

Wouldn't that make it 2010january ?

Re:Password strength vs. how often you change it

[Creepy]

my previous employer had us change passwords monthly, they had to be a minimum of 8 characters and max of 20, had to contain at least one number, one special character (of 6 allowed), and one of each upper and lower case characters.

I personally thought it was a bit silly because the restrictions made it easier to guess (IMO), but the 3 tries before getting locked out pretty much kills any hacking of it, at least without social engineering.

Re:Password strength vs. how often you change it

[Spazztastic]

This is the same IT department that purchased 100 custom touch-screen terminals for my department for nearly a million dollars about 5 years ago, but failed to ever get them to network correctly.

I've never understood not testing things. Most vendors will send you a trial product to try things out. You usually have to sign a waver that you'll return it if you don't like it or if it doesn't work out.

Re:Password strength vs. how often you change it

[ottothecow]

I wish every login box on every site had a metadata link for the allowable password lengths and allowable characters. My worst scenario for remembering passwords is where I've forgotten what crazy password I originally had to comply with, so it isn't in normal form.

I struggle with this all of the time. One of my bank accounts has two passwords: one entered on the keyboard and one entered with an on screen keyboard. I am almost always within attempt of locking myself out of the account when I finally get the two passwords right. The two had different length/character requirements (beyond the obvious on screen keyboard not having funny symbols) but I can never remember which is which and what abominations of a password I had to create to fit. If they would just tell me on the damn password form the same info they put on the new account form, I would log in fine every time (actually I often end up getting deep enough into the "forgot password" dialog that it shows me the password requirements for a new one which jogs my memory).

Re:Password strength vs. how often you change it

[Anonymous Coward]

Store your password hash source on the web. By using your forum posts as the hash source, adding a few keywords or a generated identifier using the same hash function.

$ openssl dgst -sha512 -binary <<-DONE \
> | openssl base64 | cut -c 1-14
> me@accounts.example.com
> DONE

Then you just have to find an excuse to put N331hp4 in one of your posts every so often. You can bring it up with a date-limited google search for your forum name and the key text, paste the entire post into the hash function and type a master password before entering the DONE line to salt it.

By going with an "all lowercase" password, you don't have to make your password 50% longer. An eight character lowercase password has roughly 37 bits of strength, an eight character mixed-case + numbers password has only 47 bits of strength, corresponding to an all lowercase password of 10 characters. Assuming true randomness in all cases (and rounding in the "safe" direction since you can't make a password 9.2 characters long).

The extra length required for equivalent security goes like the ratio of the logarithms of the numbers of symbols in the character set. So yeah, you'd have to double your password length if you were planning to use just numbers and a keyboard on which the 6 and 3 keys have been removed by Clinton administration interns.

Re:Password strength vs. how often you change it

[BrokenHalo]

As soon as you standardise a password template, you reduce the amount of work someone has to do to crack it. Though of course it doesn't take long to brute-force the stupid "password" passwords.

What bothers me is the number of institutions (including, I am ashamed to say, one of my banks*) that actually *limit* password length to 8 characters and/or don't allow the use of any non-alphanumerics.

What I'm saying is that it is perfectly possible (in fact easy) to construct good passwords based on some memorable phrase such as "I must down to the seas again, to the lonely sea and the sky," -> "1mds2tsa,2tls&75," which is strong enough to resist brute-forcing and not easy to catch by shoulder-surfing. Of course, not everybody is going to be constitutionally adept at memorising longer and more complex passwords or passphrases, but given that just about any computer system is capable of dealing with them, there is absolutely no reason to prevent users constructing them.

* Fuck it, in the public interest, I'll name names: guilty parties here in .au are Bendigo Bank which has BOTH an 8-character limit and a prohibition against non-alphanumerics, and St. George Bank which appears to just restrict the use of non-alphanumerics. To be fair, the former does at least offer a one-time keygen device to supplement security, while the latter asks for your PIN, but I see no objective purpose for such a limited authentication code.

Re:Password strength vs. how often you change it

[GroovinWithMrBloe]

One thing some companies do, is require X of Y characteristics. i.e. Your password must be at least 8 characters long, and contain at least 3 out of the following 4: {lowercase letter, uppercase letter, number, special character}.

So your keyspace is far larger than: Must have a lowercase, uppercase, digit and special character. I think it's a nice compromise - but of course as this report shows, a hacker would still probably target [a-z0-9]{8}.

What would be interesting if the change password form predetermined the password requirements for this particular password, and these requirements are randomised each time the user wants to change the password. E.g. one time it may require a password of at least 8 characters, the next time it might require it to be 10 characters. One time it may require digits, another time it may require special characters. So an attacker in this case couldn't rely on a large populus having simple passwords of the bare minimum length as the system forces some variances in those minimums. Sure, it'll probably piss off users even more... (And I'm the first to admit I'd be pissed off by such an approach too).

Re:Password strength vs. how often you change it

[MobyDisk]

but it almost certainly increases the average keyspace that needs to be searched

Not really. As the original poster pointed out, everyone starts using easily predictable passwords because the limitations are so strict, and because they have to change passwords so often. Even if the search space is theoretically good, it discourages people from using good passwords.

Furthermore, the same benefits can be achieved in other ways. Password rules should always set minimums, not maximums. So, using the original poster's example. Instead of coding a rule that says use EXACTLY 2 letters followed by EXACTLY 4 digits, make the rule that you must use AT LEAST 2 letters and AT LEAST 4 digits. That gives you at least as much complexity, without forcing the user into a pattern. All the benefits, but none of the disadvantages.

Re:Password strength vs. how often you change it

[nine-times]

Sure, it'll probably piss off users even more... (And I'm the first to admit I'd be pissed off by such an approach too).

Yeah, I'll admit that I chose the password requirements for my own network, and I still get completely confused when it comes time to change my password. Windows won't tell you what the requirements are, but instead just says, "Your password doesn't meet the requirements." I'll make a 12 character password with uppercase and lowercase letters, numbers, and symbols and it will still come back and say, "sorry, that password doesn't meet the requirements." Drives me nuts, but I don't force password rotation very often, so I never get around to finding a good fix.

Re:Password strength vs. how often you change it

[machine321]

You didn't mention that your user names are random, 20 digits, and can't be re-used.

Re:Password strength vs. how often you change it

[machine321]

I used to work at a place where the help desk did more or less the same thing... they'd put administrative account names and passwords on their monitor on post-it notes. I guess that's not so insecure after all.

Re:Password strength vs. how often you change it

[steelfood]

Which is at least a huge step up from putting it under the keyboard or stuck to the monitor.

This depends, again, on the application. If there are multiple security levels within an organization, then putting a password next to the terminal may not be a good idea. Or, it may be an excellent idea if there are many other post-its and odd notes with various alphanumeric combinations. The best place to hide a tree is in a forest.

But if there's only one security level for the majority of the company, and that's whether a person is an employee or not, then a password on a post-it wouldn't matter so much. Anybody who'd be able to gain entrance into the premises would already be vetted. In such a case, the only advantage is to prevent one person from mascarading as another person, or to prevent someone from digging into the private files of another person. But that's only an issue for upper management where people might conceivably want to dig into their private files.

Re:Password strength vs. how often you change it

[Dare nMc]

It does, until people give up. At my work the "must have a capital, and a character, and a number, be 8-10 chars, change every month, not be too similar to the last 7 attempts". means most people choose a section of keyboard near the numbers, and just change the capitalization point. So I am guessing it wouldn't take long to come up with a new dictionary set of "qwERty5%" "qwERty6^" ... will hit at my company pretty fast. I think the username being 8 characters of last name +first initial means I could choose a few key combination and hit a bunch of user names and would get a login fairly quick. (see I tried using something very unique, but the whole figuring out what would get past the next password change was painful. the computer similar pattern knows "Qwerty" to "qWerty" are same keys. It doesn't know that "34%^" and "#$56" are the same keys.

Re:Password strength vs. how often you change it

[BrokenHalo]

Your example is several commands. Which one?

All of them. The example given is an illustration of "pipes", where the output of succesive commands is fed into the preceding command. Once you get the hang of this, it's a very useful and powerful feature.

Re:Password strength vs. how often you change it

[Anonymous Coward]

And this is why people hate passwords.

People just want to get to their info / do their work. They don't want to have to be a mathlete to do their simple mind-numbing data entry job.

2-factor logins on secure, network unreachable devices is the best way to go. Or 3 factor with biometrics or something.

Spending 20 minutes generating the password to your slashdot account is not time well spent.

Re:Password strength vs. how often you change it

[BrokenHalo]

I know it's a solecism to reply to oneself, but this one is necessary owing to my brainfart: the output of the preceding command is, of course, fed into the next command.

Re:Password strength vs. how often you change it

[Rockoon]

Packet collisions wouldnt be an issue on a small test rollout. Its when there are a hundred such devices all chattering on the network where suddenly nearly all packets fail to arrive.

Re:Password strength vs. how often you change it

[Blakey Rat]

Even more if this is a web proxy password and that, each month, you have to change the proxy password for every f*** application that connect to the web (That Windows OS is really really bad).

Windows has an API for requesting the proxy info from the OS. It's not Microsoft's fault that your applications suck and don't make use of it. (So does OS X, for the record. I'm not sure about Linux.)

Re:Password strength vs. how often you change it

[Spazztastic]

Packet collisions wouldnt be an issue on a small test rollout. Its when there are a hundred such devices all chattering on the network where suddenly nearly all packets fail to arrive.

Packet collisions don't occur on modern networks, though. Were they actually running token ring (or pre-token ring), or was that just sarcasm?

Re:Password strength vs. how often you change it

[Enleth]

Oh my, that's really an awful case of stuttering...

Re:Password strength vs. how often you change it

[mikein08]

If passwords where hashed and then encrypted BEFORE entry into a password file/table, there'd be no problems about stolen passwords. Esp. if the hashing and encryption are one-way only. But that's too simple.

Re:Password strength vs. how often you change it

[Rockoon]

To put this in perspective, the devices were evenly placed on the gaming floor (its a casino) in a public area. This casino has been there for 20 years, and the area in question originally had no network connections (or even power outlets.) Still further, they could not close down the entire area for any length of time because it is a significant 24/7 revenue stream (even in the wee hours of the morning its thousands of dollars per hour in profit) that could not be moved.

Combine the logistics of it all with the pay rate of an IT staff that is only skilled at maintaining a 2 decade old network, and it isnt a very long stretch to believe that they didnt even know what token ring was, or at best failed to actually make a ring.

Re:Password strength vs. how often you change it

[Carnildo]

On Linux, you simply read the HTTP_PROXY environment variable. There's not even a special API needed to access it.

Re:Password strength vs. how often you change it

[Medievalist]

It may narrow the nominal keyspace, but it almost certainly increases the average keyspace that needs to be searched.

That's highly questionable. Especially since there is strong pressure for enterprises to use exactly the password strength criteria required by their auditors, and the auditors of public companies are published data, and auditor checklists are easily obtained. Hell, you might be able to find out the password recipe for a major corporation by spending two nights in the closest bar to their site and listening to people complain. Forcing people to use less secure passwords just seems wrong, I refuse to do it (and I get harassed by auditors every year, even if I run John on the db for a month to prove my point).

Have you considered just analyzing the people's password hashes for crackability instead? Use a shared history file and a dictionary and run rainbow tables on the hashes automatically and swap the tables and dictionaries every once in a while. If you can't crack it within a couple of seconds with a dedicated engine, nobody's ever used it before, and it's not in the dictionary then it's probably better than your recipe permits.

Re:Password strength vs. how often you change it

[Carnildo]

I wish someone (ISO? NIST? DOHS?) would establish an honest-to-god STANDARD for what makes a strong password.

That's impossible. A password's strength is related to its Kolmogorov complexity, and Kolmogorov complexity is incomputable.

Re:Password strength vs. how often you change it

[Carnildo]

Forget social engineering: I could get 75% of the password by entering the building and grabbing the Post-It notes from under everyone's keyboard. Requiring passwords to change monthly doesn't increase security, it just encourages people to write their passwords down.

Re:Password strength vs. how often you change it

[The Archon V2.0]

I hate it when systems specifically require odd crap though...requiring a mixed password (must have 2 of the 3 following features or something) is good but saying that my 8-character password must include at least two numbers is actually decreasing the keyspace fairly significantly since you can limit several parts of the password to 0,1,2,3,4,5,6,7,8,9 as opposed to every single letter/number/punctuation.

My personal favorite dumbass password requirement was an internal company one that checked your password for dictionary words and ruled any dictionary word in a password invalid. I thought that was stupid, and then I found out by accident that the dictionary contained "it". And then I realized it contained every two letter word I could think of. So "4!h8B^%iT2" was a weak password because iT is a dictionary word (?!?) and thus the password will be ZOMG dictionary hacked.

We also had like, six different internal systems, each with their own password requirements. One needed at least one number, another normalized mixed case to lowercase, one just didn't care about anything, etc. Passwords all had to be changed, but the dates on which they did was different. (Payroll password changes once a month. I only needed to access the payroll system once a month.)

Ultimately, even the dedicated never-write-it-down people like me had to give up and write their passwords down. I had my cheat sheet in my wallet, but a lot of people just had them at their desks. (Only monitor post-it-notes were caught by management. Paper under the keyboard? Never caught. In a desk drawer? Like the managers are gonna go around opening every drawer in the building!)

So, yay security?

Re:Password strength vs. how often you change it

[BobMcD]

So, using the original poster's example. Instead of coding a rule that says use EXACTLY 2 letters followed by EXACTLY 4 digits, make the rule that you must use AT LEAST 2 letters and AT LEAST 4 digits. That gives you at least as much complexity, without forcing the user into a pattern. All the benefits, but none of the disadvantages.

Except the one disadvantage of not being compatible with the system. Did you miss the part about storing as an integer?

Re:Password strength vs. how often you change it

[BobMcD]

We would be lucky to have a Yorkshireman! At my company we are beaten mercilessly until the password changes on its own!

Re:Password strength vs. how often you change it

[rickb928]

I know pipes, and redirects. Windows does that.

I'm looking for a solution that does

echo -n "LongUnchangingBasePasswordSiteNameJan2009" | sha512sum | xxd -r -p | tr -cd [:print:]

on Windows. They say I can find a sha512sum.exe for Windows... cool. now all I need is an xxd replacement for Windows, and finish it with a >{filename} if I want to save the result for actual use... I'll have to delete it, so maybe juyet letting ti echo is ok, but will run it in a CMD window, not from the start->run line, where it will complete and close the window on the way out before I see the result.

Windows misses the CLI. Linux has its moments, and this is one of them.

Seems a hard way to do it... Must be some other password-maker.

Re:Password strength vs. how often you change it

[rastos1]

Now my wife, she seems to cling to passwords like lost children. I'm working on her.

Me too.

Re:Password strength vs. how often you change it

[FooHentai]

Deciding off your own bat that their password changing policy isn't particularly secure, then deliberately subverting it to use an even weaker password than the spirit of the policy, then attepting to propogate this out to other employees? Wow, you're an epically arrogant and irresponsible employee.

Re:Password strength vs. how often you change it

[rdnetto]

A 4 digit PIN is about as a secure as a 3 letter, all lowercase alphabetic password (i.e. not very). Still, the point about 3 factor authentication was a good one.

Re:Password strength vs. how often you change it

[rickb928]

You got no shot.

Re:Password strength vs. how often you change it

[rdnetto]

That's nothing! At my company we have to use butterflies...

(oh come one, you knew it was coming)

Re:Password strength vs. how often you change it

[MobyDisk]

Yes I saw it, but that was a guess that the person made, not a statement of fact. It isn't the driving force here. One does not design password restrictions just so they can store the password in the fewest bits possible. If the guess is true, it is most likely someone designed the password restrictions, then realized a nifty artifact of it.

Exception to the above: If the year is 1980 and all the users passwords must fit on a 360k floppy disk. :-)

Re:Password strength vs. how often you change it

[mrcaseyj]

If I ran Windows, I'd look for some way to implement it that could be implemented on every Windows machine, in case I needed to regenerate on, for example, a work computer where I couldn't install arbitrary executables. Under Windows, something implemented in Javascript might be the way to go. It might also have the advantage of leaving no command history. But then it could leave something in your browser cache. Maybe you could temporarily turn off the cache.

If you can install executables, something like cygwin may enable you to execute this command unaltered. You might also consider booting a linux CD with no partitions mounted and swap disabled to prevent traces being left on your hard drive. Something like Damn Small Linux would probably boot fairly quickly. I'm not sure if it would have all the tools though. You might have to go with Knoppix.

Re:Password strength vs. how often you change it

[techno-vampire]

In Soviet Russia, the captive Yorkshireman beats the confession out of you!

Re:Password strength vs. how often you change it

[thesappho]

not 2704000000
but 27040000 = (26+26) * (26+26) * 10 * 10 * 10 * 10 ?!!
correct me if i am wrong

Re:Password strength vs. how often you change it

[Opportunist]

If nobody may enter that room except people who are allowed to have root access, it's not really that insecure.

Re:Password strength vs. how often you change it

[Opportunist]

Generally, using passwords from other items that you carry around or have around your work place is not a bad idea. For a time my password used to be the first letters of the ingredients list on a Red Bull can. There was one on my desk pretty much all the time and if there wasn't, a trip to the fridge cured that problem. It's available, it looks inconspicious (because, hey, a RB can on a programmer's table, that's basically inventory) and you can look it up. Serial numbers are great if you happen to have some spare hardware lying around your desk all the time (just make sure you don't RMA that faulty HD the SN of which is your password before you change it).

The only thing you have to make sure is that nobody knows where you draw your password from.

Re:Password strength vs. how often you change it

[rickb928]

Cygwin is too much work.

Booting an alternate OS ditto.

The solution has to be practical. I once used a 'pronouncable password generator' that had potential.

Re:Password strength vs. how often you change it

[clodney]

No argument whatsoever on that score. And for the record, I've usually felt that the complexity requirements and short password lifespans do lead to formulaic passwords and passive resistance from the user population.

But I still say that the corporation is trying to keep all the passwords secure, even if that means that the policies actually decrease security in some cases - usually the people who would have secure passwords without ever having to be told to do so.

Re:Password strength vs. how often you change it

[cp.tar]

Impressively stupid.
I think I would have switched to such an account, fired several people high up and then feigned surprise that such a thing could have happened.

Re:Password strength vs. how often you change it

[JWSmythe]

    Ya, silly me, I'm too nice to do such illegal things. :)

    There were a few choice people I would have liked to terminate their employment though. It would have been funny when they didn't get paychecks any more. :) I'm sure the list of "suspects" would have been huge, but I'd always be in the top 10%. I'm fairly sure that the others who would be prime suspects thought the same way.

Re:Password strength vs. how often you change it

[Anonymous Coward]

unless these passwords are automatically assigned

In which case it is guaranteed to be written down somewhere on a piece of paper. Talking about "improved security".....

Everyone in this office picks their own password, and we all update every six weeks. Most have their password on a post-it stuck to the monitor or computer. It's such common practice to do the same for phone passcodes, sticking those to the bottom of the phone, that it might as well be policy; the only reaction is surprise when it doesn't happen. This is so temps and new employs can access the phone they're sitting at when staffing changes. And, since many here access several different systems with their own log-in, with different password requirements, you often see sheets of paper with all passwords thumb-tacked to the wall of the cubicle.

Re:Password strength vs. how often you change it

[Anonymous Coward]

Can we ad a "like" button to SlashDot? I think I just saw a dire need - ka5vjl

Re:Password strength vs. how often you change it

[cp.tar]

Remember: it is only illegal if you get caught. ;)

Re:Password strength vs. how often you change it

[MathiasRav]

technically an all lowercase password is just as secure as any other password. You could take a set of random characters and have them all end up as lowercase letters. It is only bad because of the common belief that brute force attacks (and god forbid--dictionary attacks) check all of the lowercase options first. In that case, it is probably also better to start all of your passwords with a 'z' since they tend to check in alphabetical order.

I hate it when systems specifically require odd crap though...requiring a mixed password (must have 2 of the 3 following features or something) is good but saying that my 8-character password must include at least two numbers is actually decreasing the keyspace fairly significantly since you can limit several parts of the password to 0,1,2,3,4,5,6,7,8,9 as opposed to every single letter/number/punctuation.

Your password must be 8 characters long. It must contain two digits and three uppercase letters. Characters must be ordered in strictly ascending ASCII order (no lowercase before uppercase; no uppercase before numerals; alphagram order). ... Strength: Weak. Your password is not strong enough. Try again.

Re:Password strength vs. how often you change it

[Anonymous Coward]

I wouldn't imagine a brute-force on your company's passwords would take very long

Re:Password strength vs. how often you change it

[jp10558]

Maybe you could do this in Powershell which is in most new Windows installs? Not that I know how to do so, just that it might be more possible.

Re:Password strength vs. how often you change it

[exploder]

Yeah, you're right, but you've missed the point. The reason we have "strong password" conditions is to prevent the most common ways of generating really weak passwords. Given that, as you so correctly pointed out, there's no way to ensure that a password is strong in Kolmogorov's sense, such a standard should clearly be interpreted as a "best practice for discouraging the use of weak passwords".

Better now?

Have they released the list anywhere?

[damn_registrars]

I think it would be interesting to search the passwords I use against the list. I like to think that my passwords are pretty good, but it would be interesting to see how similar they are to the passwords that were obtained and used in the study.

Re:Have they released the list anywhere?

[Anonymous Coward]

You could try typing them into Google or Bing...

Re:Have they released the list anywhere?

[Anonymous Coward]

"love", "secret", "sex", not necessarily in that order. And don't forget "god". System operators love to use "god".

Re:Have they released the list anywhere?

[g0bshiTe]

Why not just hash out your password, and try to crack it with John The Ripper or something similar?

That would give you a good indication of how good it is.

Re:Have they released the list anywhere?

[QuantumRiff]

Post it here, I'll check it for you.. Don't worry, Slashdot blanks your password.

My password is *******

See, blanked out!

Re:Have they released the list anywhere?

[damn_registrars]

Why not just hash out your password, and try to crack it with John The Ripper or something similar?

That would give you a good indication of how good it is.

Yes, but that wouldn't answer the question I am after with the password list. I want to know how common my passwords are, or if they are even similar to common passwords. 32M passwords is a pretty good set for checking against to answer that kind of question.

Re:Have they released the list anywhere?

[Asclepius99]

Cool! Try mine: *************. Thanks.

Re:Have they released the list anywhere?

[damn_registrars]

Post it here, I'll check it for you.. Don't worry, Slashdot blanks your password.

My password is *******

See, blanked out!

Wow, I just tried to match "*******" against a list of bad passwords, and it generated a really long list of matches. Your password must be really bad!

Re:Have they released the list anywhere?

[FooAtWFU]

My password is https://www.google.com/accounts/o8/id.

Re:Have they released the list anywhere?

[Panaflex]

And cuss words... had to break a system we got from a company buyout, not a friendly happy "synergistic" one either. About 30%...

Re:Have they released the list anywhere?

[bcmm]

hunter2

Re:Have they released the list anywhere?

[Anonymous Coward]

Wonderful, mine is also blanked out: hunter2 :)
See?

Obligatory bash.org reference: http://www.bash.org/?244321

Re:Have they released the list anywhere?

[Monkeedude1212]

You take your mothers maiden name - reversed. Then you replace every second letter with its numeric value on a telephone keypad. Then you replace every second number with its symbol associated above it on the keyboard. tough to remember, but unlikely to be cracked.

Re:Have they released the list anywhere?

[Anonymous Coward]

Really? wow. My pw is hunter2 also!!!

What are the odds?

Re:Have they released the list anywhere?

[Anonymous Coward]

you can go hunter2 my hunter2-ing hunter2
haha, does that look funny to you?

Re:Have they released the list anywhere?

[Anonymous Coward]

hunter2.

Cool.

Re:Have they released the list anywhere?

[Anonymous Coward]

Let me try that

My password is starfish ...hey how come I can see it? Mail me at bgates@msn.com

Re:Have they released the list anywhere?

[Anonymous Coward]

It's hunter1.

Re:Have they released the list anywhere?

[steelfood]

Hey, how'd you know my password is hunter2?

The Top 10

[goldaryn]

1. 123456
2. 12345
3. 123456789
4. Password
5. iloveyou
6. princess
7. rockyou
8. 1234567
9. 12345678
10. abc123

By a massive coincidence, these happen to be the passwords for their respective /. userids!

Re:The Top 10

[Anonymous Coward]

Not anymore they're not!

Re:The Top 10

[Anonymous Coward]

Is there a reason to have a really strong password on "rockyou.com"?

Maybe since it integrates with facebook and the like?

I'm really annoyed when all I want to do listen to some online music (ie pandora, etc) and the web site gets pissy because I choose pandora as my password.

Why should I care?

Re:The Top 10

[L4t3r4lu5]

Whatever happened to love, secret, sex, and God?

Re:The Top 10

[R.Mo_Robert]

Dear mods: funny? No, this is fact--read the article. (I was surprised too.)

Re:The Top 10

[Anonymous Coward]

Yes, it's factual, but I think the 'funny' mods are for the comment he added at the end.

Re:The Top 10

[Anonymous Coward]

The report mentions this:

If a hacker would have used the list of the top 5000 passwords as a dictionary for brute force attack on Rockyou.
com users, it would take only one attempt (per account) to guess 0.9% of the users passwords or a rate of one
success per 111 attempts.

Interesting but how does this really apply to any other instance of password cracking? You would not know the top 5000 passwords ahead of time in anything other than this specific RockYou instance? I guess some of the general trends apply though, I'm sure more hotmail users use hotmail as their password then would use RockYou. Where is the list of usernames that you are running against this list of top 5000 known passwords? I guess my point it, if you already have a list of passwords and usernames that are in use, comparing cracking statistics for dictionary attacks and the additional password complexity of using special characters and non dictionary words does not apply. Just run the known passwords against the known usernames.

Re:The Top 10

[BlueBoxSW.com]

Really? "Password" as password? I'm so disappointed.

Re:The Top 10

[goldaryn]

Yes, it's factual, but I think the 'funny' mods are for the comment he added at the end.

And the 40% Informative is from whoever now controls CmdrTaco's account

Re:The Top 10

[operagost]

Missing: hunter2.

Re:The Top 10

[Opportunist]

If it had to include numbers, it'd be Passw0rd. What? It has a number, neither at beginning nor end, it has one capital letter, it certainly satisfies the requirements.

Re:The Top 10

[Junior J. Junior III]

2. 12345

By a massive coincidence, these happen to be the passwords for their respective /. userids!

I use same combination on my luggage!

Re:The Top 10

[SpitfireSMS]

Something tells me that a lot of these come from meaningless accounts that people make when they know theyre never coming back to the site.
Iv made something like asd123 as username and pass for stupid sites that MAKE you sign up just to access something.

I have a feeling that if you actually surveyed people to find out what they used for passwords and they were honest, like 90% of people would have their pet's name or something similar.

Re:The Top 10

[Anonymous Coward]

12345!
That's incredible! I have the same combination on my luggage!

Re:The Top 10

[Anonymous Coward]

You're old. Nobody gets that reference anymore, except old people, like me. Also, these passwords are too short to be used on systems with modern password-nazi checks. Hack the planet.

Re:The Top 10

[Anonymous Coward]

I think I might stand a chance at remembering a few of the top 10 -- I should start using them for my online accounts!

Re:The Top 10

[Darinbob]

However, this is for a site that doesn't necessarily need high security. For a lot of throwaway web sites I use pretty basic passwords, often the same ones. If someone steals the account, there's nothing there to lose. It's not like this was a bank or a repository of critical personal information.

Re:The Top 10

[Anonymous Coward]

They're trashing it!

Re:The Top 10

[mantissa128]

Whatever happened to love, secret, sex, and God?

They are too short to be accepted by most any password-requiring system nowadays. Perhaps "iloveyou" has replaced them.

Re:The Top 10

[ObitMan]

1. 123456

Crap. now i have to change the password on my luggage.

Why does password strength matter?

[geekmux]

...Most interesting to me was that in the sample, less than 4% used any non alpha-numerics in their #$#%'ing passwords.

Er, does it REALLY matter anymore the strength of your password with the FBI using post-it notes as a search warrant? I mean I hate to say that, but seriously.

On a related note, what pisses me off even more is going to a website and trying to use a strong password and their system doesn't allow it.

Re:Why does password strength matter?

[AndersOSU]

Well it doesn't matter (and it never did) if you're selecting passwords so the FBI can't read your secret diary.

If, on the other hand, you're concerned about someone in Russia gaining access to your credit card it still matters.

Re:Why does password strength matter?

[xgadflyx]

I have to agree. It's especially frustrating when FEDERAL sites don't allow the use of complex (~!@#$%^&*-+) passwords. "Eight characters with at least one capital and one numeric" just doesn't sit well with me.

Re:Why does password strength matter?

[Omegium]

Do you really think that the FBI is your greatest enemy online?
IT IS NOT.
It is nice to think that you are enemy of the state nr 1 and that everybody cares about your secrets, but that's not the case. You should worry about phishers and other criminals, not about law enforcement. And they don't use search warrants. They need to crack passwords

Re:Why does password strength matter?

[Anonymous Coward]

I completely agree with this. What really ticks me off is dealing with financial institutions which refuse to allow special, non-numeric characters. The reason so few people's passwords include special characters is because so many people like to reuse 2-4 password sets. If you get 3 tries, and you have 3 password sets, you're really pushing the likelihood of using last month's iteration.

Re:Why does password strength matter?

[martyros]

On a related note, what pisses me off even more is going to a website and trying to use a strong password and their system doesn't allow it.

Tell me about it. I got a good idea from a slashdot comment about a way to easily have secure, diverse passwords for my websites: use a password generator to make a grid of passwords, and devise a mapping from the website name onto the grid. Print the grid on a business-card size sheet. Put a photocopy in your wallet, and the original somewhere you will absolutely not lose it. (I put mine with my passport folder.) Instant, close-to-unique, strong passwords for each site without memorization, ready on-demand.

But the federal tax payment system, of all people, won't allow some of the characters. Oh, they require some characters, like $ or %. But forbid others, like ) and ;. (Afraid of an SQL injection attack, perhaps?) *sigh*

Re:Why does password strength matter?

[Anonymous Coward]

trying to use a strong password and their system doesn't allow it

We are not representative of "normal" users.

Here is what an average teh noob thinks about strong passwords

Re:Why does password strength matter?

[jittles]

On a related note, what pisses me off even more is going to a website and trying to use a strong password and their system doesn't allow it.

I'm afraid of using a good password at some sites because I fear they store passwords in cleartext. No point in wasting a good password on that!

Re:Why does password strength matter?

[HappyHead]

The eight-character limit is due to them using the standard Unix crypt() function, which Unix passwords were traditionally encrypted with - it's a one-way encryption, so brute force is generally the only way to recover the passwords, and at the time the computations needed to guarantee cracking a password would take too long to make it worthwhile.

Of course, modern computing systems can run through all of the possible passwords in an 8-character password pretty quickly, so it's a good thing modern systems are switching over to md5 for password encryption.

The big problem I see is that a lot of sites on the internet (where most of the cracking is probably happening) won't allow non-alphanumeric characters, and refuse to allow you to use that password if you try to include them - that automatically cuts off multiple possible digits, and reduces the maximum password strength on their site by a massive degree. My own university is sadly one of these offenders - anything that isn't a letter or number gets your password disqualified, and yet they also complain when your password is "too simple"...

Re:Why does password strength matter?

[2obvious4u]

Whats even worse is when that website is your bank.

Re:Why does password strength matter?

[Kozz]

I have to change my password at work every 90 days. The result is that I'm creating passwords that don't have non-alphanumerics, but are usually phrases of two or more words together, like "anappleaday" or "lookatmenow" or "changingpwsucks". Am I more or less secure than people forced to use non-alphanumerics who create passwords like "judy1" or "maroon5"? I think so...

Re:Why does password strength matter?

[Anonymous Coward]

Er, does it REALLY matter anymore the strength of your password with the FBI using post-it notes as a search warrant?

I don't live in America, you insensitive clod!

Re:Why does password strength matter?

[Hijacked Public]

Or, what should also piss you off, is you using a strong password and the web site storing it clear text on a vulnerable SQL server.

Re:Why does password strength matter?

[Anonymous Coward]

The eight-character limit is due to them using the standard Unix crypt() function, which Unix passwords were traditionally encrypted with - it's a one-way encryption, so brute force is generally the only way to recover the passwords, and at the time the computations needed to guarantee cracking a password would take too long to make it worthwhile.

Of course, modern computing systems can run through all of the possible passwords in an 8-character password pretty quickly, so it's a good thing modern systems are switching over to md5 for password encryption.

The big problem I see is that a lot of sites on the internet (where most of the cracking is probably happening) won't allow non-alphanumeric characters, and refuse to allow you to use that password if you try to include them - that automatically cuts off multiple possible digits, and reduces the maximum password strength on their site by a massive degree. My own university is sadly one of these offenders - anything that isn't a letter or number gets your password disqualified, and yet they also complain when your password is "too simple"...

Good thing and md5 in the same sentance? MD5 was cracked a long time ago it has no salt it is useless.

Re:Why does password strength matter?

[antifoidulus]

Thats usually a very good indication that the site uses Windows to store your information and thus should be avoided. Windows is the only major OS that is still so primitive that it still has trouble handling special characters, real operating systems moved beyond that years ago.

Re:Why does password strength matter?

[The FBI]

Do you really think that the FBI is your greatest enemy online?

IT IS NOT.

It is nice to think that you are enemy of the state nr 1 and that everybody cares about your secrets, but that's not the case. You should worry about phishers and other criminals, not about law enforcement.

I concur, you are absolutely right, Sir.

Re:Why does password strength matter?

[Hurricane78]

Well, in a properly designed system all private data is encrypted with that password, and only when you enter it, and it is cached in the current session, can that data be decrypted.
Of course, how many properly designed systems are there out there. I heard in the US, not even banks do this properly. (Except maybe if you consider WoW a bank. ;)

Protip: Data that is shown to everyone on Facebook, is never encrypted. ;)

Re:Why does password strength matter?

[Known Nutter]

*cough* Chase *cough*

Re:Why does password strength matter?

[jgs]

And financial institutions that do their best to keep you from using a password manager.

Re:Why does password strength matter?

[Anonymous Coward]

But I do care about his secrets.

Re:Why does password strength matter?

[sildur]

Try PasswordMaker. There is a firefox addon also.

Re:Why does password strength matter?

[Anonymous Coward]

On a related note, what pisses me off even more is going to a website and trying to use a strong password and their system doesn't allow it.

What really pisses me off is that my ISP (MTS, that's Manitoba Telecom Services) only allows 3 to 8 character alphanumeric passwords. God help you if you try to put anything else in there.

Re:Why does password strength matter?

[martyros]

And if I want to log in from somewhere other than the computer I made the password on? Or if I make the password in Linux, and then want to log in when I'm in Windows? Or if someone manages to get ahold of my laptop / get some malware on it?

This method allows me to have:

• Physical security. I'm not a spy, so the set of people who want to steal my password are people much less likely to be able to pick my pocket than break into my computer.
• Not tied to a specific computer, so I can type in the password from anywhere.
• Physically backed up in a way that won't deteriorate for hundreds of years.

The only disadvantage so far is one site (albeit a very high-level one) that doesn't like the base character set. :-)

Re:Why does password strength matter?

[Anonymous Coward]

Well if you allow special characters you run the risk of...

http://xkcd.com/327/

Re:Why does password strength matter?

[captainpanic]

About the FBI:

As an organisation, they are the good guys.
But does that guarantee that each and every one of their employees (or agents) is a good guy?

That's why it's worrying they can get warrants with a post-it, or don't need to crack your passwords.

Re:Why does password strength matter?

[Anonymous Coward]

Selecting a password at all doesn't really do much if the FBI wants to search your data. No password will matter as soon as they just bypass it. The reality is that you are using passwords to fend off criminals elements that do not have direct access to you systems and who are looking for drive by attacks. Anyone, FBI or otherwise with their cross hairs specifically set on you and with enough time, will be able to compromise your wonderful password of Super.Dick in short order.

Re:Why does password strength matter?

[Opportunist]

Oh the number of webpages that won't allow a "'" as a password character because it messes with their database...

Bonus points if you actually manage to crash the DB because you tried to use it.

Re:Why does password strength matter?

[marcobat]

Someone in Russia can just hack into a fbi account using some IE or PDF hole, then send a false subpoena to gain access to my account. The subpoena will never be looked on twice or reviewed by anyone and my provider will promptly comply. There is no escape :-)

Re:Why does password strength matter?

[Opportunist]

I once got into troubles for trying a strong password even. I dunno why, they claimed I tried to hack them. No idea how they got the idea.

In case you're wondering, the password was "';drop table passwords;"

Re:Why does password strength matter?

[Rogerborg]

Any relation to Ob Bobby Tables?

Re:Why does password strength matter?

[gmack]

More likely it's a good indication that they are paranoid about sanitizing their inputs to avoid things like SQL injection or shell command attacks.

Re:Why does password strength matter?

[Anonymous Coward]

Windows is the only major OS that is still so primitive that it still has trouble handling special characters, real operating systems moved beyond that years ago.

Where the fuck did you get your information? My XP passphrase was 87 characters and Vista has no issues with my 109 character one. Windows will warn you that longer passwords will not work with older OSes, but we're talking goddam Windows 98 and earlier.

Do not get confused with silly network password policies that limit the length of the password. XP onwards have been able to cope with long passwords/passphraes without issue.

Re:Why does password strength matter?

[BlackPignouf]

+1

I use pwdhash for all my Internet passwords.
This gives me a unique password for each domain, that looks like this : 7CqCEk+Gw or B5Ra7Yt8+
That should be enough, even for sensitive bank accounts.

The only problem is that my bank doesn't allow any password that includes non alpha-numeric character.
WTF????

Re:Why does password strength matter?

[tibman]

It seems to me that even 8 characters would be fine with Crypt as long as you had a strong enough (and secret) salt. A person could litterally use the password abc123 and never be bruteforced. If the salt was exposed though, that's a different story. I suppose a person could create a new hash with your system and using the known password and the resulting hash.. they could bruteforce the Salt. So the salt would have to be quite strong.

Re:Why does password strength matter?

[Panaflex]

Generally, you've got to be a real, authentic, piss in the wind asshole to get an agent after you. Generally boring people aren't that much fun to tango with.

FBI are generally great people - they get paid crap for the job they do, even if some of they are bullies.

Re:Why does password strength matter?

[Hoi Polloi]

What pisses me off even more is that every damn website requires a username/password so either I use the same password for every site, making me vulnerable to a hack on one breaking all of them, or I choose different ones. If I choose different ones I have to either write them down somewhere or use a password manager, again making me vulnerable to a single point of failure.

Re:Why does password strength matter?

[zorg50]

My Windows password begs to disagree with you.

Re:Why does password strength matter?

[Panaflex]

If you stick to longer phrases, then yes. Password strength is calculated as such, generally:

alphanumeric: charspace ^ length (in this case, 26 for alpha, and 46 for special+alpha+numeric).

So, for a phrase length of 10, an alpha password is 1 in 141167095653376,
Compare that to a short 6 length, special char password and that's 1 in 20047612231936

So, it's about 10x better overall. Adding one special char increases the search space significantly, though.

Re:Why does password strength matter?

[Panaflex]

And, your point is?

Re:Why does password strength matter?

[DiegoBravo]

>> ...Most interesting to me was that in the sample, less than 4% used any non alpha-numerics in their #$#%'ing passwords.
> On a related note, what pisses me off even more is going to a website and trying to use a strong password and their system doesn't allow it.

I always avoid non-alpha chars in my passwords because I have to deal with several layouts of keyboards and is really a PITA when you inadvertently enter a "super strange password" but you really don't know what you actually typed because it is unreadable.

Because of that rule, I had to try a lot to figure out if my passwords were x\-x( or x~/xx= ... etc.

Re:Why does password strength matter?

[maxume]

Most password encryption utilities generate them for free.

The only case where it is sort of inconvenient is when accessing some throwaway site from a semi-trusted computer (but the phone capable utilities handle that one).

Re:Why does password strength matter?

[wtbname]

No shit.

Nothing annoys me more. I've already complained about this in another post, but I have FINANCIAL INSTITUTIONS that don't allow non-alphanumeric. And arbitrarily limit the size.

WHAT THE SHIT. WHAT IS WRONG WITH YOU ASSHOLES.

On a related note:

I once called my companies support desk to tell them their password change website did not accept !@#$%^&*()[]{} characters. And further, that the error message REPEATED THE PASSWORD YOU TYPE IN BACK TO YOU IN THE ERROR MESSAGE? The help desk lady told me that it was too much work to fix the issue just for me since NO ONE ELSE HAS THIS PROBLEM????

WHAT THE SHIT. WHAT THE SHIT.

Re:Why does password strength matter?

[Aeros]

while im not a huge windows fan I have to disagree with this. If this is a site that doesn't allow special characters this is a development issue and has nothing to do with the OS.

Re:Why does password strength matter?

[Aeros]

I know, so many people think their data is so sensitive and the FBI is out to get them. Get over yourselves. Unless your doing something very wrong the FBI couldn't give a crap about you. Get over yourselves and worry about the true criminals that are out to get your banking or your little sex site login information to use it for their own purposes.

Re:Why does password strength matter?

[Panaflex]

Nearly everybody depends on physical security, network perimeter security, and dumb luck. Encrypted hard drives protect data at rest, VPN's and variants are generally used to protect data in motion.

Re:Why does password strength matter?

[whoisisis]

Well it doesn't matter (and it never did) if you're selecting passwords so the FBI can't read your secret diary.

If, on the other hand, you're concerned about someone in Russia gaining access to your credit card it still matters.

That's beside the point. If the FBI can get your passwords with just post-it notes, so can anyone with a post-it block!
(or anyone who speaks english -- the article implicitly referred to mentions a verbal request being enough)

Re:Why does password strength matter?

[Opportunist]

OMFG, if that was possible here I'd finally have a reason to have kids.

Re:Why does password strength matter?

[WuphonsReach]

Cheap systems can run through a very large volume of brute-force attacks per second now. Especially with the addition of NVIDIA CUDA cards, which are amazingly good at doing brute-force attacks. For md5 passwords, even salted, anything of 8 chars or less can easily be cracked in under a day.

Past a certain salt size (say 16 or 24 bits), having a longer salt really doesn't change things. The attacker is going to have to switch to a brute-force attack in that situation anyway, so having a 32bit vs a 64bit salt isn't a big improvement. Once you get into brute-force, your only hope is that password length and complexity will take too long to crack.

Basically: 8 chars or less, even randomly typeable characters, is pretty much trivial to break in under a day. And that's with a system costing maybe $800. Going with 10-12 characters is going to be safe against all but the most determined adversaries (who have 10k host botnets to throw at the problem).

Re:Why does password strength matter?

[WuphonsReach]

If you're using complete words in your pass phrase, the combinations are actually a lot smaller then that.

There are roughly 300k words in english and related languages that can easily be typed on an english keyboard. So 3 words is only (300k ^ 3) or about 27,000,000 billion combinations. In reality, it's generally a lot smaller (25k ^ 3) which is only 15625 billion combinations. An 8-char password (approximately 72 possibles per position) is around 722200 billion combinations.

Basically, a randomly generated password is around 6.0 to 6.2 bits of entropy per character. A word is a lot lower, down around 3-4 bits of entropy per character.

Re:Why does password strength matter?

[EkriirkE]

...

On a related note, what pisses me off even more is going to a website and trying to use a strong password and their system doesn't allow it.

Notable offenders for me:
American Express only allows 8 characters. Hell, they even have a javascript alert telling you "Invalid password" if you type in more than 8.
Discover Card only allows 10 characters. These guys are a little more HTML savvy and have a MAXLENGTH=10 on the password field

This suggests to me they store the password as-is or with some lame cypher so that it may be recovered plaintext. (The user database password field length limited to 8) If they hash the passwords, then you could use any length password resulting in a same-length hash to store in the DB.

Re:Why does password strength matter?

[_Sprocket_]

That's where the Post-It note comes in. Hackers can't write a Post-It note remotely. Is there no aspect of security that a Post-It note can't handle?

Re:Why does password strength matter?

[horatio]

Use a password generator like Password Hasher to generate a unique password for that site (you can give the hasher the same password for every site, it generates a password for you based on your password and a key for that site like the domain name), or use a throw away password that you don't care if anyone gets it.

Re:Why does password strength matter?

[Anonymous Coward]

Really? (26 + 26 + 10) ^ (n) from n=[1-8] is more than 221,918,520,426,688 passwords... how many can a modern pc do per second? Sure it wouldn't take a powerful cluster long, but i'm guessing that your above average 2009 desktop pc will still be taking years to get through that list.

Re:Why does password strength matter?

[Physics Dude]

A person could litterally use the password abc123 and never be bruteforced

You've got to be kidding me. Just what do you think "Brute Force" means anyway, and how do you imagine such an attack is carried out?

Hint: during such an attack, there has to be SOME mechanism for determining success of each attempt.

Re:Why does password strength matter?

[BobMcD]

I once heard an attorney describe this scenario as a reason to never, ever, ever talk to an investigator whatsoever:

Officer: I'm investigating Joe Schmoe. Did you see him come or go from his apartment on Friday?

You: I was on a cruise Friday, so no, I was not able to see his apartment.

(time passes)

Your Neighbor to the Officer: Are you sure he was gone on Friday? I thought that was Saturday?

Officer: Why would he to cover for Joe Schmoe?

Your Neighbor: I think they're good friends...

And suddenly you're a person of interest in an ongoing investigation, even though your neighbor likely made an honest mistake.

Re:Why does password strength matter?

[tibman]

I'll bet you i can run "abc123" Through crypt like 'crypt($passwd, '$1$'.$salt)' and trim the salt from the output... and it would take you a long long time to brute force. There are ~18,000,000,000,000,000 possible salt combinations. Even at 10mil tries per sec that's 57.12 years to exhaust the possibilities.

And that's if you already know the password! You would be better off trying to sneak a peek at the Salt.

Re:Why does password strength matter?

[ladadadada]

Salt is, by definition, exposed when the hash is exposed. They are stored side-by-side and the salt is not encrypted.

Salt does not prevent brute-forcing of a single hash. What it prevents is users with the same password from having the same hash. With salt, an attacker must brute-force each password individually (or create a separate rainbow table for each different salt, which defeats the purpose of a rainbow table). With a rainbow table and no salt, every hash can be reversed in seconds to minutes.

It's worth noting that the algorithm you are using to generate the hash (or rather, the resultant hash itself) has an inherent complexity limit. MD5 hashes are 128 bits which is 16 bytes. Any password longer than 16 bytes has another password that is shorter than 16 bytes that will have the same MD5 hash. Yes... an attacker doesn't need to know your password, just a password that, when hashed, collides with your password.

SHA1 hashes have a length of 160 bits so passwords longer than 20 characters will have an equivalent password shorter than 20 characters that produces the same hash if you are using SHA1.

Not that you should be using MD5 or even SHA1 for hashing passwords. Both hash functions are inappropriate for this purpose. If you are using raw hash functions for protecting passwords, even if you are using salt, then you need to read this now: http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow-tables-what-you-need-to-know-about-s.html

Re:Why does password strength matter?

[Anonymous Coward]

I'm just sitting down at the compy for the day and i'll read that link over coffee in a bit. But i wanted to say that you don't have to output your salt along with the hash. I always remove the salt from hashes prior to storage or viewing. /me reads the article

Ok, gotcha. I'll start a switch to blowfish over this next month. But my point still stands over weak passwords. You can cryptographically use weak passwords if your salt is strong enough and kept secret.

Limited in Password size and chars

[realsilly]

I can't tell you how frustrating it is to try to keep information secure on various web sites or with companies that still use antiquated password styles. 6-8 chars or numbers only? Really? Still? After all the identity theft you'd think companies would at least step up their need to have users have strong passwords. But nope, places like Earthlink still use limited password capability.

Re:Limited in Password size and chars

[Scutter]

The report makes it painfully obvious that passwords are an ineffective way to secure information because too many people find strong passwords cumbersome. Maybe we need to come up with something better.

Re:Limited in Password size and chars

[Anonymous Coward]

You mean like Verified by Visa? 6-10 chars and no special chars. ARGH!

Re:Limited in Password size and chars

[BigSlowTarget]

This, definitely. Does anyone actually think users remember all of their twenty or so ideally ideally special character, varying length hopefully different passwords used at infrequent but varying intervals? Obviously they would be written down somewhere and that place is probably not secure.

We've got to get people to change to better solutions en mass and with a single standard.

Re:Limited in Password size and chars

[jellomizer]

Every attempt at doing so creates a serious privacy problem, adds an extra level of security problem, or is very complicated that it is difficult to deploy on a large scale.

Re:Limited in Password size and chars

[Anonymous Coward]

The report makes it painfully obvious that passwords are an ineffective way to secure information because too many people find strong passwords cumbersome. Maybe we need to come up with something better.

no please don't make it be a question for a passphrase with an example, we all know that the examples will come out top in the next accidential list of passwords revealed...that would take the belief in mass intelligence away completely and make all our lives more meaningless and horrible.

Re:Limited in Password size and chars

[Skater]

I just counted: at work I have 27 passwords on my list. Maybe 4 of those are for defunct systems, but everything else I use at least occasionally. Just about all of them have to be changed every three months, to a new 13-character string. There's no way I could remember all of them. And these are all different from my my "personal" passwords for things like root/admin, websites, banks, etc. I requested software to manage passwords, but of course it was ignored. I'm pretty sure everyone has a list somewhere, because they don't want to spend all day on the phone getting passwords reset. We definitely need a better solution. I'm starting to think fingerprint readers on our computers WOULD be a good idea, except that I know our security office: they'd require the fingerprint AND a password.

Re:Limited in Password size and chars

[mdarksbane]

Especially since when you consider ease of memorization, more characters is a much easier way to increase security than adding asterisks and numbers.

ThisIsMyStupidPasswordForSlashdot is just about as hard to crack than !jd*8Wgd or H3xK@raCtre, but guess which is more likely to be remembered?

Re:Limited in Password size and chars

[Spatial]

My bank's password requirement:

"6-8 characters, lowercase letters only. (No numbers permitted!)"

Needless to say, I don't use their online services.

Re:Limited in Password size and chars

[andyh-rayleigh]

Compare that to the password "PIN" on your credit card. 4 digits, that's all
(perhaps 3 more for the validation code on the back)

Most of the web sites I access are likely to be of much lower value than my credit account.

Andy

Re:Limited in Password size and chars

[Anonymous Coward]

Well... We could do like the military and issue everyone an access card with their passkey on it... now doesn't THAT sound secure...

Right up there with the idea - above - about keeping your password in your wallet.

Re:Limited in Password size and chars

[rjstanford]

I love the way that Priceline does it - since you can use your "secret question/answer" to set a new password anyway, they got rid of the passwords and when you want to log in, you're given one of your chosen questions. Less work, just as secure.

Re:Limited in Password size and chars

[horatio]

The talx website, which was where my former employer made us go to fetch our pay statements and W2s, only allowed digits, and IIRC had a minimum length of 8. So I picked an old 10-digit phone number I don't use anymore for my password. How the hell else am I going to remember a random 8 digit number that *isn't* my birthday or something similarly obvious?

Re:Limited in Password size and chars

[Scutter]

I have a feeling that, widely executed, it would be just as bad as insecure passwords. I frequently run across websites with four or five pre-set password reset questions based on easily-obtainable information: "What was your mother's maiden name?", "What year did you graduate high school?", etc. Besides being far too personal (for example, when setting up business-class DSL for your customer, role/company-based, rather than personal-based questions would be far more appropriate - I'm looking at you, SBC.), the information is far too easy to find. Absent some sort of industry-wide standardization, websites (and their users) will still default to the least-intrusive method.

Re:Limited in Password size and chars

[dangitman]

Maybe we need to come up with something better.

I know! How about a password for our passwords?

Most of them are zip codes anyway

[140Mandak262Jamuna]

At least in Alaska, ZIP codes seem to be the most popular choice, according to a survey of one known case.

Re:Most of them are zip codes anyway

[mdvolm]

Is there more than one zip code in Alaska?

Re:Most of them are zip codes anyway

[Myopic]

Yes of course. I've lived in 99507, 99802, and 99801. There are hundreds of others.

We only have one area code, though: 907.

special characters

[Anonymous Coward]

Adding a special character increases the base. Adding a character - i.e. increasing the length of your password - increases the exponent. Either method helps provide strong passwords. Shoulder surfing special characters is easier, because they are a reach from the home keys, and most pause to hit them.

actual list of passwords?

[naz404]

Does anyone have the list of passwords itself?

It would be fun to perform one's own statistical analysis of the list :)
Here's the top 20 most common passwords used according to the report:
Rank Password # of Users
1 123456 290731
2 12345 79078
3 123456789 76790
4 Password 61958
5 iloveyou 51622
6 princess 35231
7 rockyou 22588
8 1234567 21726
9 12345678 20553
10 abc123 17542
11 Nicole 17168
12 Daniel 16409
13 babygirl 16094
14 monkey 15294
15 Jessica 15162
16 Lovely 14950
17 michael 14898
18 Ashley 14329
19 654321 13984
20 Qwerty 13856

Re:actual list of passwords?

[khchung]

Amazing! All small letters "password" is not in the top 20?!

Re:actual list of passwords?

[Asclepius99]

I think the numbers after the spaces are the amount of times they showed up, not actually part of the passwords themselves. Could be wrong about that.

Re:actual list of passwords?

[Anonymous Coward]

Maybe it isn't case sensitive. Nicole is #11? Looks like Nicole peaked as a baby name in 1996, so either this is a bunch of teens/tweens using this site or Nicole is really hot.

Re:actual list of passwords?

[Inda]

Number 7 makes me giggle. When I ran a site of 3,000 members, the name of the site also ranked 7th in the list of passwords.

Re:actual list of passwords?

[enbody]

http://thepiratebay.org/torrent/5232943/RockYou.com_UserAccount-passwords

Re:actual list of passwords?

[Locke2005]

Damn, those girls Nicole, Jessica, and Ashley must REALLY get around!

Re:actual list of passwords?

[andyh-rayleigh]

I wonder what proportion use their telephone number?
Not easy to do a check on the data.

Re:actual list of passwords?

[Anonymous Coward]

20 Qwerty 13856

Why not use the home row keys (asdf)?

Re:actual list of passwords?

[Aeros]

sounds right since they decrease in the list

Re:actual list of passwords?

[Anonymous Coward]

Torrent: http://thepiratebay.org/torrent/5232943/

Re:actual list of passwords?

[Blakey Rat]

Where does "princess" come from? Is that used as a password in a movie or TV show or something? Seems odd that it would be number 6 on the list.

Re:actual list of passwords?

[KnownIssues]

I find this password list very interesting. There's some interesting human psychology in there that I'd really like to understand. I get the kid's names. I get the series of numbers. I get Password and Qwerty. But why iloveyou and rockyou? There has to be a story with those. And why are all the girl names capitalized, but michael is lower case? And is this list statistically significant enough to make a password cracking dictionary more effective than any already are?

Re:actual list of passwords?

[Asclepius99]

Looking back over what I wrote now, I totally misread the comment I responded too. I'm sure they realized that also.

obligatory

[Anonymous Coward]

hunter2

Re:obligatory

[Anonymous Coward]

http://www.bash.org/?244321

Given the sample set, is it a surprise?

[Anonymous Coward]

I vary the strength of my passwords based on the importance of them being secure.

More secure passwords are typically harder to remember. My financial related passwords are much more secure than my Facebook password because I really don't give a damn if someone breaks into my facebook account.

Re:Given the sample set, is it a surprise?

[Blade]

Until they break into your facebook account and use that to socially engineer access to something else and escalate their way into something beyond that. Or they access your facebook account and start taking guesses are the answers to the security questions you're forced to use (what school did you go to, what was your first pet called, etc., etc.)

There are so many links between so much of what we do online that you would do well to treat it all as worth securing equally.

Re:Given the sample set, is it a surprise?

[MattBurke]

Indeed. Facebook, or anything that has either personal information on you, or where you've established relationships with others are valuable sites. Having your login to such a site compromised can cost you dearly - what would your friends think if "you" posted pictures of kiddie pr0n on your Facebook page? Have you 'friended' your boss?

Even somewhere like a gaming forum, you may build up a friendship with people over the time you may have invested there - that's worth something too.

Some random site you spent 30 seconds checking out once and didn't feed with personal information on the other hand... Who cares... unless you've used the same login credentials as a site you DO care about...

Re:Given the sample set, is it a surprise?

[jpate]

Or they access your facebook account and start taking guesses are the answers to the security questions you're forced to use

This is why I always bang on the keyboard for 20 seconds when giving answers to those security questions—except for my current bank account, which requires me to provide my answers to the ``security'' questions to log in to online banking....

Re:Given the sample set, is it a surprise?

[Blade]

I tend to answer a different question but keep the association in my head.

So I know if it asks me the name of my first pet, I tell it the place I was born (not actually like that, I usually provide a meaningless answer, but know that it's always that answer to that question), because so many places use the same stupid questions.

Re:Given the sample set, is it a surprise?

[Manfre]

This is why should never provide honest answers to the security questions. I treat them like less secure password fields.

Re:Given the sample set, is it a surprise?

[Cro Magnon]

Of course, if you lie on the security questions, it's usually harder to remember what you put.

Re:Given the sample set, is it a surprise?

[Anonymous Coward]

Ah, but there are ways to defeat security question guessers as well. Use strings of random digits as the answers to those questions!

My first school was 5f,7i9dg3
My first pet was called ,fnNs09c,d(, and my tongue still hasn't recovered.

Re:Given the sample set, is it a surprise?

[NorthernerWuwu]

Precisely. I have intentionally (and laughably) insecure passwords I use for certain sites that require an account to view content. I pair that with a throw-away email account and other general measures on purpose so I'll be conscious of my insecure state when accessing such sites and don't give out any information I care about. Now, for other purposes I have a dozen or so high to very high strength passwords that I rely on and by limiting their use I can limit their exposure. It is still a compromise but hey, for things that actually require extremely high levels of security I rely on physical means.

Why such a search isn't advisable

[tepples]

I think it would be interesting to search the passwords I use against the list. [...] This year we confirmed that indeed you can buy everything in New York City.

But can you buy a log of searches?

Nicole... :-)

[alobar72]

funny - this girl seems to be quite popular *cough* :-) Anyone has a picture ?

Re:Nicole... :-)

[Spazztastic]

funny - this girl seems to be quite popular *cough* :-)
Anyone has a picture ?

That's my sister you insensitive clod!

Re:Nicole... :-)

[Culture20]

funny - this girl seems to be quite popular *cough* :-) Anyone has a picture ?

That's my sister you insensitive clod!

So that's a yes?

Re:Nicole... :-)

[Spazztastic]

funny - this girl seems to be quite popular *cough* :-)
Anyone has a picture ?

That's my sister you insensitive clod!

So that's a yes?

It's a yes if you have enough money on you...

Look at the user base for RockYou...

[adosch]

RockYou is a MySpace photo/video sharing site (from what I could gather from googling, never used it myself) and it's certainly no excuse that people implement bone-head password choices such as the 10 shame shame list FTFA. However, I didn't really see the article address or even consider that their target users on the RockYou site aren't generally what geek, wanna-be security folks on /. are security conscious. I'm glad the analysis and study was done, but I'm really not surprised. If people are picking '123456' as the #1 password, as much as we have a PEBKAC situation on our hands, fault RockYou for not implementing some sort of semi-secure password standard.

Re:Look at the user base for RockYou...

[Anonymusing]

From the source report (PDF, 387kb), we also read this: "Passwords were stored in cleartext in the database and were extracted through a SQL Injection vulnerability."

So RockYou was rather security unconcious from the beginning. Cleartext instead of hashed? C'mon.

Re:Look at the user base for RockYou...

[Anonymous Coward]

Any programmer that stores passwords in cleartext should be taken out back and shot - immediately followed by the yoyos that make up their own "secure" password storage functions, like the Indian coders I had to clean up after who thought BASE64 was an encryption method...

Keep in mind, this is RockYou.com

[tunabomber]

Is it even worth the effort of coming up with a secure password for that site? If I had for some reason found it necessary to register with such a vapid site I would have just re-used one of my low-security passwords (which many other sites have access to). It isn't too surprising that nobody cares whether someone else is using their account to steal their noisy, eye-burning flash videos. What is far worse is if people are re-using passwords from much more important sites. In this case, it doesn't matter if your password is a random string of letters, numbers and special characters.

Re:Keep in mind, this is RockYou.com

[tunabomber]

To clarify here, I only reuse passwords for accounts which could not be used for anything too nefarious if they were hacked. My logins for more important sites (like /.) have unique passwords.

Re:Keep in mind, this is RockYou.com

[Anonymous Coward]

Exactly. I do have a habit of reusing the same relatively weak passwords for web accounts of low importance, but that does not mean that I use the same passwords on my computers, routers, bank accounts, etc. Some web accounts are for single use only, and others cannot be used for anything nefarious as you point out: why care about the password?

Re:Keep in mind, this is RockYou.com

[roju]

Why not just generate a new random password for every site and just let firefox remember it? Security and convenience.

Why Is That Interesting?

[Dun Malg]

Most interesting to me was that in the sample, less than 4% used any non alpha-numerics in their #$#%'ing passwords.

Why is it any surprise that people tend to approach passwords as a pass-WORD? It has to be something they can remember, and remembering a string of characters they can't pronounce is far more difficult than remembering (say) their favorite basketball team and the year they graduated high school.

Re:Why Is That Interesting?

[Megane]

There's no reason something can't be both pronounceable and secure. Start with two nonsense syllables, and add a special character between them. Not quite as "secure" as a completely random password, but much less likely to be written down, plus some of the letters can be l33t3d for variant forms. Make three base words for various levels of usage (one for regular web stuff, one for login passwords, and another rarely used for important stuff), and you can even keep around hints for rarely used passwords with one letter and a bunch of ## or @@ symbols for the parts that change.

A good way to make something pronounceable is with the old "D&D character name generator" type of program, making a CVCCVC name. So you get, for instance, DORLOT (FWIW, I cheated just now and used an alpha D20), and don't tell me you can't pronounce that. Then some variant passwords from that would be "dor%lot", "d0r##lOt", and "D0r:*!o+". They're still "dorlot", but the result is a lot more secure than picking a dictionary word and puts you into that tiny wedge on TFA's pie chart. And while they're all similar, they're different enough that a compromise in one place won't let someone get into every account you have anywhere.

Re:Why Is That Interesting?

[Inda]

"L33ting" your words is poor and should not be given as good advice. All the brute-force password crackers I've played with have the option to substitute normal letters for "l33ted" letters.

You ain't fooling no one.

Re:Why Is That Interesting?

[BrewDad]

Why is it any surprise that people tend to approach passwords as a pass-WORD? It has to be something they can remember, and remembering a string of characters they can't pronounce is far more difficult than remembering (say) their favorite basketball team and the year they graduated high school.

Dammit! How did you figure out my system? That's ok, I'll just change to my graduation year THEN my favorite basketball team. Try cracking THAT password!

Re:Why Is That Interesting?

[Anonymous Coward]

"L33ting" your words is poor and should not be given as good advice. All the brute-force password crackers I've played with have the option to substitute normal letters for "l33ted" letters.

You ain't fooling no one.

Well he's fooling the novice amateur or the very unsophisticated would-be criminal hacker. Just like simple door lock defeats anyone without much motivation, strength, or the appropriate tools and/or skills to open it. Of course, in both the online and in real world security, these types of people are rather low on the priority list precisely because what will work against more serious threats will defeat them as well.*shrug*

Re:Why Is That Interesting?

[Anonymous Coward]

Or will graduate highschool...

Re:Why Is That Interesting?

[DMUTPeregrine]

A better way is to type a passphrase normally, but move your hands up a row on the keyboard.
" i.cc.9 t'5 yl c, c54. ' 4'll4g9'l. r,9h'0052 dpc h,n. 5,p9 g'rfl p4 ' 9,t ,r cg. u.5d,'9f3
That's the same sentence, but using a DSK keyboard. "Password" becomes "%'llt,9f". You get letters, numbers, and symbols, and don't have to remember any of them. Of course it's just a simple substitution cypher, but it's far less common than 1337 speak. "Drawing" shapes is an easy one too. "HI" becomes "1'a3.e',.2,o123aoe"

Alphanumeric

[Anonymous Coward]

As being a developer I was grown up with US layout which is far the best for coding. But in most countries nowadays you really have to look hard to find such a keyboard. Or not to mention configuring the damn layout on a random OS on a random machine. Everyone around me uses some strange layout I wouldn't find non-alphanumeric characters on. And there are even worst places where even simple digits are hard to be entered, e.g. Belgium.

but...

[polle404]

Most interesting to me was that in the sample, less than 4% used any non alpha-numerics in their #$#%'ing passwords.

but... there's no non Alpha-numericals in 'CowboyNeal'?

Not really suprising

[jmauro]

Since most sites have a bunch of silly restrictions (no special characters, no more than 8, etc) most systems if the don't enforce strength, randomness, etc will degrade down to the lowest level where the password will work on all the systems.

Security should not depend on strong passwords

[AbbeyRoad]

The article says that in 20 years users have not gotten better at creating good passwords.

Logically then the solution is NOT to get users to take "password security seriously". This is like trying to stop VD by convincing teens to abstain from sex - it's in the never-going-to-happen catagory.

The solution is to mitigate the damage of a brute force attack - when bots make password guess attempts, you need counter-"bots" to detect patterns of access and then block IPs, warn users, or disable accounts. This is a form of intrusion
detection.

This is not to mention that for most web accounts, a break in doesn't matter - what damage can the hacker really do? Like post things-you-didn't-say and trash your reputation on www.social-site-for-people-who-spend-to-much-time-online.com? Heck, that's major dude.

Just a wild guess here, but let's ask: Are there web site owners who think the logins they host are way more important to their customers than they actually are?

Hmmm

-paul

Re:Security should not depend on strong passwords

[FlyingBishop]

Security is hard. There's no way to secure something if users don't take steps to secure their logins.

Strong passwords strike a tricky balance, and people are perfectly capable of keeping passwords strong. They simply choose not to.

Doing counter-bruteforce work takes a lot of time and resources, and it has a dubious gain, since no one has found a way to do it with 100% effectiveness. Things always slip through the cracks. The best you can do is provide people a doable means of keeping their data secure. The rest is up to them.

Re:Security should not depend on strong passwords

[Anonymous Coward]

This is like trying to stop VD by convincing teens to abstain from sex - it's in the never-going-to-happen category.

Nonsense. Just give them slashdot accounts. They'll be abstaining from sex, alright - just not voluntarily.

Made-up words

[Pojut]

My passwords tend to be words that I make up on the spot, with a couple of numbers thrown into the mix. They don't seem too difficult on the surface...but then again it is a word that I make up, some of which don't even have vowels lol. I have a series of seven different ones that I use.

It's worked quite well for me over the years :-)

Re:Made-up words

[Anonymous Coward]

So you find it easy to make up words with no vowels in them.

You're not Welsh are you? ;-)

Re:Made-up words

[dex22]

Your passwords sound fabulous! Can you release them under a GPL-style license so we can ALL use them? :)

Re:Made-up words

[Myopic]

So, your password is cr0mulent?

Re:Made-up words

[Pojut]

nope, but I AM a fluent in mumble ;-)

Re:Made-up words

[Pojut]

::begin shameless self promotion::

no, but I tell you what I can do: here are four tracks off the ambient album I'm currently producing, DRM-free and at no cost to you!

http://www.livingwithanerd.com/music/

Enjoy :-) ::end shameless self promotion::

Re:Made-up words

[Pojut]

Simpsons did it!

Lock-out after a certain number of attempts?

[mdm-adph]

Does one really need to worry about "brute force" attacks if it's a system that enforces a lock-out of a user account after a set number of incorrect passwords (say, 5 in 10 minutes or so)?

Re:Lock-out after a certain number of attempts?

[spleck]

Absolutely! That is one of the major points TFA makes. The top 5 passwords account for 1.75% of all the accounts, and the top password alone accounts for 0.9% of accounts.

If a hacker would have used the list of the top 5000 passwords as a dictionary for brute force attack on Rockyou.
com users, it would take only one attempt (per account) to guess 0.9% of the users passwords or a rate of one
success per 111 attempts. Assuming an attacker with a DSL connection of 55KBPS upload rate and that each
attempt is 0.5KB in size, it means that the attacker can have 110 attempts per second. At this rate, a hacker will
gain access to one new account every second or just less than 17 minutes to compromise 1000 accounts. And the
problem is exponential. After the first wave of attacks, it would only take 116 attempts per account to compromise
5% of the accounts, 683 attempts to compromise 10% of accounts and about 5000 attempts to compromise 20%
of accounts.

Re:Lock-out after a certain number of attempts?

[tibman]

Most bruteforce attacks are done on stolen password hashes with a dedicated server/cluster/botnet. Say i found an SQL exploit to grab MD5 hashes for any user account. I would do some research and find an old admin's name. Use the exploit to get the admin's passwd hash. Queue them up in the cluster and forget about it for a few days (or minutes sometimes!). Login with the admin's name and passwd and flex his long unused admin powers to upgrade my own personal account in non-obvious ways. The server logs won't show any login failures.

Re:Lock-out after a certain number of attempts?

[mdm-adph]

If we're talking about an intruder that has somehow gotten admin powers, I'd say there's not much individual users could do about it, fancy alphanumeric passwords or not. :P

Re:Lock-out after a certain number of attempts?

[Jake Griffin]

... And the problem is exponential. After the first wave of attacks, it would only take 116 attempts per account to compromise 5% of the accounts, 683 attempts to compromise 10% of accounts and about 5000 attempts to compromise 20% of accounts.

It bothers me how much people throw around the word "exponential" to try to sound smart. The graph on their site clearly shows that it is in fact the opposite of exponential: logarithmic, which has diminishing returns. So 116 attempts gets you 5% of accounts, multiplying your attempts by 6 gives you twice as many, then multiplying your attempts by more than 7 will give you twice as many. Exponential would be getting a rapidly increasing rate of results for relatively constant increase in attempts, not a relatively constant increase in results in return for an increasing rate in the number of attempts.

Impenetrable

[G2GAlone]

Surely no one uses God, Sex, Money, or Love as their password! I use my birthday or sometimes my mother's maiden name... no one will ever guess that, right? =X

Why surprising?

[argStyopa]

"Most interesting to me was that in the sample, less than 4% used any non alpha-numerics in their #$#%'ing passwords."

Not surprising at all, because the rules for what you CAN use as passwords are so inconsistent. Some places REQUIRE non alphanumerics, but have a limited choice of what you can use. Some don't accept ANY non alphanumerics, some will accept them but again it's different from site to site.

I don't know about you, but I've probably got 100 different passwords rattling around in my brain. I'd guess most people are like me in that they see passwords as a necessary evil but otherwise a giant pain in the ass, and so accept the slight increase in security risk by using a system that changes predictably (at least for me) from site to site. So I'm not going to use a base-password or base-concept that includes any characters that might be disallowed on some other site.

Re:Why surprising?

[Anonymous Coward]

The finnish government's gambling monopoly Veikkaus's website requires users to have password consisting only of numerals, at most 8 of them. When I created an account for myself a while back I was stunned by the sheer stupidity.

Re:Why surprising?

[DrinkDr.Pepper]

Southwest.com allows you to create a password with non alpha-numeric characters, but then you can't log in with your password!

Re:Why surprising?

[nine-times]

I don't know about you, but I've probably got 100 different passwords rattling around in my brain.

Yeah, I've begun to think that we should really implement some kind of a universal public key system to take care of this problem. Instead of trying to keep a different password for every service you use, you would only have 1 private key to manage.

A good enough system should also be able to cut back on things like identity theft. I've run into too many companies and government organizations who treat "knowing your social security number" as a valid form of identification and authorization.

Of course, that's easier said than done.

Re:Why surprising?

[troll8901]

I've probably got 100 different passwords rattling around in my brain.

Let me guess ... hotmailpassword, yahoopassword, googlepassword?

Re:Why surprising?

[Dr_Barnowl]

I keep wanting a full keystream to be acceptable as a password - including backspaces and other control characters, which would allow you to define passwords like "type 'tortoise' then move two left and press backspace THEN delete", but I think that would seem a bit too hardass for some people.

Re:Why surprising?

[StormReaver]

I don't know about you, but I've probably got 100 different passwords rattling around in my brain.

Save yourself some hassle, and do what I do. I put all my passwords on my Facebook profile so I don't have to remember any of them. Since no one ever looks at my Facebook profile, it's totally secure.

Re:Why surprising?

[Blakey Rat]

I came across one site that didn't consider "-" a punctuation mark. That pissed me off enough that I put in a support ticket over it: don't force me to include punctuation marks in the password if your system is so retarded it doesn't even know what punctuation marks look like.

Re:Why surprising?

[Agent ME]

>we should really implement some kind of a universal public key system to take care of this problem. Instead of trying to keep a different password for every service you use, you would only have 1 private key to manage.

OpenID?

Re:Why surprising?

[nine-times]

Yeah, except I mean something even more robust. Something where you could use it as legal proof of identification or maybe even as an ATM card. I've just had experiences where various companies and government organizations have weird requirements of proof of ID, and the worst in my opinion is treating your SSN as authentication. I've even had places refuse to accept my passport as evidence of ID but require my birth certificate instead-- in spite of the fact that anyone can request a birth certificate. It just seems like you could address a lot of real-world identification problems by creating a robust infrastructure for public-key signing/encryption.

Though it might sound like I'm off-topic and conflating two different problems, they're really part of the same problem in my mind. So much of our professional, commercial, and governmental interactions are impersonal, and sometimes even online or over the phone. You never see people, and so they couldn't possibly know you personally, yet they need to be able to be sure you are who you say you are. It's the same problem whether you visit your bank online, visit the ATM machine, or go to the bank in person.

So it's really an issue of an authentication scheme and associated infrastructure that extends to both cyberspace and meatspace-- a single simple way to verify that you are who you claim to be. Of course there would be technical concerns, security concerns, usability concerns, and even privacy concerns that would need to be addressed.

Re:Why surprising?

[RealGrouchy]

I work with a similar, poorly-designed, IE-based system. The password is generated as sufficiently random alphanumeric, but the username is based on their name. People (especially Francophones) with accented characters in their name can't log in in certain browsers because the character encoding isn't properly defined.

- RG>

Re: *password*

[conureman]

IIRC it was in the text of TFA last time.

Too often is bad too.

[suso]

I dealt with a bank once that expected its customers to change its passwords every 2 weeks. So obviously what happened is every time a customer needed to check their bank account, probably once a month, they were locked out. Now this isn't necessarily the problem here. The problem is that with people having to call in every time to reset their password, it becomes such a norm that it probably drastically increases the potential for social engineering.

Re:Too often is bad too.

[Opportunist]

What's worse is that my bank actually has "phone question" security in place. I can call them and place orders. But they will ask me security questions. Namely:

My account number.
My birthday.
A recent transfer from my account or the name of the guy at the bank dealing with my account.

In case you're wondering, the latter two are easily to find on a bank statement. Which I could easily get provided I have the ATM card (which, incidentally, also contains the account number).

My question how this is secure was met with "umm... well, when you explain it like that, it kinda ain't..."

Re:Too often is bad too.

[operagost]

With people having to call the staff all the time, it removes the most important point of having self-service banking.

Re:Too often is bad too.

[Anonymous Coward]

My water company requires the strongest password I've ever used. I use a weaker (pwgen'ed password) for my bank. The water company locks me out after 5 attempts at remembering a password I only use once a month and then I have to call them up. The system has been in place for three months now and I can't see how it would last much longer.

Re:Too often is bad too.

[DiegoBravo]

My bank makes me dial my card number and even pin number in the phone for fast attention or "securing" some operations... it's a big bank and for sure they have passed a lot of security audits (i.e. the paperwork well done.) I really don't want to think what kind of "security" they have in their internet portal.

Re:Too often is bad too.

[Sandbags]

We swap every 30 days, with a 10 character minimum that must include at least 1 capitol letter, at least 1 special character, at least 1 digit, can't be similar to your name, ID, or the last 12 passwords used, can't be a password used in the last 365 days, and it patched against a dictionary of thousands of words and hundreds of common passwords.

I'll pick 3 or 4 in a row before it even lets me keep one. It's a big PITA. More so that once I change the default password (which effects multiple systems) I still have to manually change the password in several other apps to match, and I've got about 2 minutes to change it in my PDA before it tries the old password enough times to lock me out.

most people here have a "system" and systematically make a password based on the month, some known factor, and a few things that swap occasionally around. This creates a system where the password itself taken alone might be strong, but the differences between passwords are minimal for the same user, and although it's against company policy, most users havre to jot it down or use a reference system somewhere near their desk to help them remeber azs the more often you change a password, the harder they get to remember (and keep seperate), wors so when certain systems require alternate passwords you need to have or if you have multiple user accounts. (I have 3 just in AD, another in AIX, and severall apps I use have their own password system, ALL of which have the same password enforcement, but all of which do NOT support the same formatting).

Being so restrictive, and also being able to eliminate names and a dictionary, and enforcing special characters and "must begin with a letter" rules actually make the password LESS secure!

Re:Too often is bad too.

[AniVisual]

What's worse is that my bank actually has "phone question" security in place. I can call them and place orders. But they will ask me security questions. Namely:

My account number. My birthday. A recent transfer from my account or the name of the guy at the bank dealing with my account.

In case you're wondering, the latter two are easily to find on a bank statement. Which I could easily get provided I have the ATM card (which, incidentally, also contains the account number).

My question how this is secure was met with "umm... well, when you explain it like that, it kinda ain't..."

Account number, check. Recent transfer, check. Birthday? Let's be friends on Facebook.

Re:Too often is bad too.

[Anonymous Coward]

I once banked with a company that implemented a password policy that matched their ATM password policy (so the same password could be used for both). Passwords were thus restricted to 4 digits and could not start with 0. Talk about a very small pool of password options.... When I questioned the policy for security concerns, I was told that it was done to cut down on customer confusion. They didn't seem to have an explanation as to why I couldn't use a more secure password if I was smart enough to remember something longer than 4 digits.
I don't have an account there any more.

Re:Too often is bad too.

[Locke2005]

I deal with a much worse bank. They put a cookie on each computer to verify they have "seen" that computer before. If they fail to find it, they force the user to reply to an email to reestablish credentials. I've got Firefox configured to delete all cookies every time it exits. I've simply given up on logging into that account.

Re:Too often is bad too.

[daniel de graaf]

Look into the CookieCuller extension for firefox; it will let you keep the cookie for your bank's site while still deleting all other cookies on exit.

Re:Too often is bad too.

[Amouth]

my bank has an intresting way of doing that. Any time your account fails a login (typeo or what ever) the next suceeful login is required to answer a personalized security question (it selects one of 5 at random - and yes you pick the question and answers when you set the account up). They also track via cookie what computer you last logged in from - and from one of the last 2 IP's you came from then no question. if you are coming from the last IP and don't have a cookie again no question.. it works quite nice.. using my laptop home/work i get prompted maybe once a month if that - but go out of town or a friends and hey - answer a question. oh and you get 5 tries at the question because it is an exact string match (i can't spell if you've noticed so yes i've locked my self out of my account) I've been happy with their policies

Re:Too often is bad too.

[Opportunist]

I'm doing security audits. And there's a lot of snakeoil peddled there as well. There are some good certs, but 99% is no better than an ISO9001. Basically, it documents a security protocol and that everyone has to stick with it. REad the fine print, usually it makes no assumptions or requirements to actually BE secure. Only that the security situation is documented.

Re:Too often is bad too.

[Opportunist]

C'mon, pick up a random wallet and ponder for a moment if it gets stolen. What will the thief know?

Name? Any credit card gives that away. It's no legal document of course, but the average person out there (I'd wager over 99% of the people out there) have THEIR credit card in their wallet, unless you just stole from another thief.

Address? Any long term ticket you might have for your subway or bus system will probably contain that. A student ID card will too. Library card? Of course, a drivers license would be the jackpot.

Birthday? See address.

It's not like you'll have to go to external sources for such information. You usually steal a whole wallet full of personal info, not just an ATM card.

Re:Too often is bad too.

[socz]

I don't know about the CookieCuller, but the idea is that keeping a cookie to identify YOU is a bad thing, especially when it comes to YOUR bank account. The best thing would be to have no cookies so no one else could look into it or steal it.

Re:Too often is bad too.

[socz]

Why doesn't anyone mention the banks by name? Chase.com leaves cookies in this manner. I've also called security into question with sprint.com and their CSR's over the phone. Why do I have to give my "login password" when we have a separate account password? Why would I give them the password to my account so they could go login from home and gain full access to my accounts? After many years, they finally changed this. But it was ridiculous when they asked.

Re:Too often is bad too.

[daniel de graaf]

The cookie is not to identify you (what do you think your username is for?) but to identify the browser/computer that you are using. Obviously, since you're signing in to an account, the privacy issues of storing a cookie are rather irrelevant.

At least on all the systems like this that I have used, the username and password are still required; the cookie just bypasses that additional email/question/whatever. That means that stealing the cookie doesn't get you anywhere useful, as compared to not having the system at all. Requiring this cookie does make some attacks harder (for example, phishing attacks that impersonate/proxy the real site), so it's not a useless measure or just to irritate you.

Re:Too often is bad too.

[socz]

Oh I understand it's use perfectly, but for people who have no clue about "security" (deleting cookies that could still contain plain text account info on poorly designs sites) they help people who WANT to get into their accounts.

so, if Chase leaves a cookie with some info in it, that makes me an easier target because now the attacker would know where I bank, as opposed to not requiring it.

And we all know that the weak point is the user, not the login/pass system... because the user will have firstnameLastname for user, and birthdate for pass.

It's a HUGE hassel because everytime I would login it's requesting to send a email or txt msg for a pin # I need to enter, it sucks! But interestingly enough, I have found a workaround that doesn't require me keeping their cookie or requesting a pin # so that's why I haven't contacted them. So as long as that works let everyone else be frustrated.

Re:Too often is bad too.

[RealGrouchy]

that must include at least 1 capitol letter...

We get that too. It's problematic because you can't log in when the President is on vacation and his staff won't write them on his behalf.

- RG>

Re:Too often is bad too.

[Sandbags]

lol, nice catch...

Your account has been breached.

[Anonymous Coward]

How else do you explain all these people posting as "Anonymous Coward"?

Silly password requirements

[Kupfernigk]

One thing that bugs me is the people who think that requiring at least one capital and one non-alphanumeric makes the password a lot stronger. Using lower case alphanumeric gives a range of 36 symbols at each point. Adding the new constraint increases this to around 70, given the limited set of non-alpha likely to be used. It doesn't take a genius to work out that, for instance, an 8-character plain lower case alphanumeric has more possible values than a 6-character mixed password. And I can easily generate a highly insecure password with the stricter requirement which will still be memorable for me and perhaps guessable - e.g. Fred-41

As a simple example, test installing SQL Server 2008 refused to accept an sa password which was highly secure - 11 random lower case alphanumerics - but was quite happy with Micro$0ft. Childish I know, but I wanted to check if they had implemented an algorithm to detect "obvious" password variants.

Perhaps someone is still using MD5 hashes for passwords. Or not using any hashes at all.

Re:Silly password requirements

[itsdapead]

One thing that bugs me is the people who think that requiring at least one capital and one non-alphanumeric makes the password a lot stronger.

I don't think the point is to increase the number of raw combinations so much as to prevent the use of "dictionary" words, which could be brute-forced.

ISTR this was an issue with older Unix-style systems where /etc/password was world readable, contained the hashed passwords for all users and used a crypt algorithm which had seemed awfully compute-intensive when the fastest thing around was a PDP-8...

Insisting on numbers helps, but could be subverted by using 1337-speak number/letter substitutions - which a cracker could still search for systematically, especially if they were using something a few orders of magnitude faster than a PDP-8.

Re:Silly password requirements

[jefu]

The password strength checkers seem odd to me sometimes. I recently had to generate a new password for a site and used my standard method, pick a sentence related to the site (sometimes rude, sometimes nonsensical), then use the first letters, changing one or two to numeric or symbols (so the first sentence in this post might have given me "Tpscs02ms"). My first picked sentence gave me 16 characters (even all lower case that would probably have been good as there were no dictionary words or other simple patterns). The site told me that that password was seriously insecure - and playing around a bit I discovered that the same string truncated at 13 characters was rated highly secure. I should have looked at the code (javascript) to see why adding three characters made it so much worse but was trying to get things done.

Layered security

[Anonymous Coward]

I have three different "layers" of security. I have my "throwaway" password that gets used for sites I just don't care about. I have my "kind of important" password that gets used for sites that I kind of do care about. And I have regularly changed, per-site passwords for anything that involves my identity, personal information or money--paypal, facebook, etc. And, frankly, the throwaway password ain't much. Posted anonymously for the obvious reason--I'd hate for everyone to be trying to hack my Slashdot account now.

12345?

[selven]

That sounds like a combination that an idiot would put on his luggage.

Re:12345?

[catbertscousin]

Whoosh!

Re:12345?

[Anonymous Coward]

1, 2, 3, 4, 5?

That's amazing! I've got the same combination on my luggage!

Password strength is relative

[ugen]

Strength of a chosen password is a function of information it protects. I am sure most users follow this rule even without specifically identifying it.
In this sense, services like Rockyou are at the very bottom - the only reason users select a password for such a service is because it requires them to. I would bet that if it let users have an optopn of not having a password at all - they would gladly do so.

While I don't have a sample to prove this, it would be interesting to compare these to passwords selected for a major email provider (gmail, yahoo) and an online banking service. I would bet that (even without any specific controls and limits on characters used) these would be quite a bit more complicated, proportionately. I.e. somewhat more difficult to guess for the email, depending on how important the particular mailbox is to its owner, and quite complex for a bank account.

In any case, this selection of users is hardly a random sample and drawing any general conclusions based on it would be premature to say the least.

Re:Password strength is relative

[mdarksbane]

I definitely agree with this. I use one lame-ass easy to remember password for all of my low-sensitivity information (forum accounts, random sites that require you to register for no important reason) because the damage done by someone hacking into my slashdot account is much less than the damage done if I accidentally use the same "secure" password for my bank login as I use to read silly tech articles and slashdot doesn't store it properly.

can't use md5

[jasonhamilton]

md5 in my company (very large multinational corp) is a big no-no. We can't use it. SHA1 is what everything had to be hashed with.

repost from my comment on nyt:

[circletimessquare]

intelligent password management:

pick something you will always remember say "frankie45"

lets say the website you are visiting is facebook.com

so your password there will be "frankie45face"

and your password at twitter.com would be "frankie45twit"

in other words, you want to use what's called an algorithm

make your ALGORITHM unique, not your password. so maybe your algorithm would be "'twenty23' plus the second through fifth letters in the website's name plus my daughter's birthday" or whatever

the point is: having one password across all websites is a vulnerability, and having simple passwords is a vulnerability. so instead, don't remember a password, remember an ALGORITHM that you can use to recreate your password for any site on the fly

by the way, i got this idea from a slashdot thread, and it was an eureka moment for me, and i went about resetting all my passwords

i forget the thread or the user id of whoever made the comment, but it was a password related subject matter and i think it was in the last 6 months or so

whoever you are, and i hope you read this: thank you!

Re:repost from my comment on nyt:

[Culture20]

pick something you will always remember say "frankie45" lets say the website you are visiting is facebook.com so your password there will be "frankie45face" and your password at twitter.com would be "frankie45twit"

And if you use the same username on all of the sites, all it takes is one unscrupulous (or incompetent) site manager to quickly have your other accounts accessed.

Re:repost from my comment on nyt:

[Anonymous Coward]

When a hacker gets access to an unencrypted database of one site's passwords (like in the case the story is about), he has your password to all other sites if he can link your usernames (Your Slashdot alias is "circletimessquare", your gmail address is "circletimessquare@gmail.com"...). The scheme you propose is hardly better than using the same password everywhere.

Re:repost from my comment on nyt:

[pavon]

I agree that this isn't a good idea to use for important websites. But it would be an improvement over using a single throwaway password for all the less important sites.

I have about 10 important accounts that I visit often. Those passwords are randomly generated passwords and memorized. I have another 10 or so important accounts that I visit infrequently, and so those passwords are randomly generated and stored in an encrypted file. Then there are about 100 stupid sites that required me to create an account, and for which I used one of a handful of throwaway passwords (more than one due to differences in password policies).

Re:repost from my comment on nyt:

[CaptBubba]

This system totally breaks down with sites or passwords that require you to change your password every XX days, and many times will reject a password if a certain number of the characters match with previously used passwords.

Great idea for everyday low-importance stuff though.

Re:repost from my comment on nyt:

[Anonymous Coward]

A better variation of this would be to "tier" your passwords according to the needs.

Tier 1) personal email accounts or any site dealing with money
    What:
        * Use full strength hardened passwords with Alpha/Caps/Num/Special
    Why:
        * Identity theft - you don't want these to ever be compromised or guessed
        * Your personal email may contain information that can be used to compromise other accounts.

Tier 2) social networking
    What:
        * Use hard-to-guess patterns, and use several variations of the algorithm
    Why:
        * You want hard-to-guess to keep others from impersonating you
        * The variations I think would help in case one or more site gets compromised.
        * You may want to split tier 2 into an A and B group
                * 2A would be "serious" sites that probably have decent security
                    or your reputation is important or you can be personally identified
                * Whereas 2B sites would be random sites that may not know what they are doing
                    or where your reputation is not so critical or where it is unlikely that
                    you can be personally identified

Tier 3) subscriptions for news and information
    * Use whatever you want to make it easy.

Re:repost from my comment on nyt:

[BlackCobra43]

How is this insightful? It could apply to literally ANY login and/or password system. Managers have powers over the things they manage? Really? I hadn't the faintest!

Re:repost from my comment on nyt:

[Culture20]

And if you use the same username on all of the sites, all it takes is one unscrupulous (or incompetent) site manager to quickly have your other accounts accessed.

How is this insightful? It could apply to literally ANY login and/or password system. Managers have powers over the things they manage? Really? I hadn't the faintest!

It's almost like using the same password everywhere, and once someone finds out that your /. password is "FOO@slashdot.org", maybe they'll try a username password combo of BlackCobra43/FOO@myspace.com over at myspace. Sure, Taco can fiddle with your /. account night and day, but do you really want him modifying your myspace? Even if he wouldn't, kdawson might. Circletimesquare responded a bit ago with a better alternative, but the originally stated plan was a bad example.

Re:repost from my comment on nyt:

[Hillgiant]

Until you run into a site that does not accept your algorithm. Either not h4rd enough or does not support the right length/character type. So you figure out a "special" one for that. Then you find another one that doesn't work for different reasons.

I agree with other commenters: The implementation (and possibly the concept itself) is broken on a fundamental level.

Re:repost from my comment on nyt:

[Anonymous Coward]

the point is: having one password across all websites is a vulnerability, and having simple passwords is a vulnerability. so instead, don't remember a password, remember an ALGORITHM that you can use to recreate your password for any site on the fly

by the way, i got this idea from a slashdot thread, and it was an eureka moment for me, and i went about resetting all my passwords

i forget the thread or the user id of whoever made the comment, but it was a password related subject matter and i think it was in the last 6 months or so

whoever you are, and i hope you read this: thank you!

Passwords selection, like encryption, are subject to some fundamental rules to be effective.

One of THE most fundamental rules is that the the system SHOULD be just as secure regardless if you know the algorithm or not. Security through obscurity is just a time bomb because once the algorithm is discovered, everything protected by it's secrecy is easier to get at. This is why encryption algorithms themselves are open and the only secret is the keys.

I agree that practically speaking it is a convenience that helps the user remember and that security and convenience are 'trade offs'. However, the real game is in making the system COMPUTATIONALLY difficult to crack. Creating that difficulty is all about forcing the most exhaustive key search possible.

Password selection algorithm or encryption algorithm, if the password space can be reduced by knowledge of either algorithm, you have reduced the computational difficulty a great deal because you have introduced a pattern.

Realistically, it is a great approach as long as you never disclose the password algorithm. Also, you just have to assume the encryption algorithm is known. DES, DES3, Blowfish, AES, IDEA, etc... are algorithms that are freely available - there is even implementation code published in multiple languages such as C, C++ and Java.

Its a fine idea I think - a good balance of security and practicality. However, I think it's wise to ASSUME the password gen algorithm is compromised when estimating the real security of the password. By the same token, ideally, it's wise to account for the encryption algorithm used in the system. I'd certainly knock down DES a lot vs. AES when using the same password for example.

Say the encryption algorithm is subject to a known plain text attack - if you have a pattern in your password generation (by using an algorithm), its that much easier to get a known plain text to use.

Or if say two passwords generated by the same algorithm are known (however), a differential attack could help find the rest. At that point the encryption algorithm doesn't matter.

Or say you use a system with a weak algorithm (which you may not know). Your password is discovered and then a differential attack on the password could bipass the far stronger encryption algorithms used in other systems. (unknown to you, a gaming site uses ROT13. Your password is found in a second. Now that password is used to find or predict other password that are used on say, your banking website even though it uses AES). In a case like that, the AES didn't help - the weakness of ROT13 + the predictability of the fact you use an algorithm for your password means there is a much smaller keyspace to attempt on your strong AES bank's site.

Attackers don't go for the strong link in the chain - your bank's encryption algorithm. They go after your weak links - the game site you logon to and your password gen methods.

Be computationally unattractive and computationally unpredictable. Also consider the value of what your are protecting. The bank should have strong encryption and the password should be strong, random and not predictable. Your game forum site that uses ROT13 isn't that important so use 123 for all that it matters.

Key management is as important as key selection is as important as the encryption algorithm - the first should be lock tight, the second should b

Obligatory Spaceballs Reference

[Pollux]

Roland: One.
Dark Helmet: One.
Colonel Sandurz: One.
Roland: Two.
Dark Helmet: Two.
Colonel Sandurz: Two.
Roland: Three.
Dark Helmet: Three.
Colonel Sandurz: Three.
Roland: Four.
Dark Helmet: Four.
Colonel Sandurz: Four.
Roland: Five.
Dark Helmet: Five.
Colonel Sandurz: Five.
Dark Helmet: So the combination is... one, two, three, four, five? That's the stupidest combination I've ever heard in my life! The kind of thing an idiot would have on his luggage!

-----

President Skroob: What's the combination?
Colonel Sandurz: 1 - 2 - 3 - 4 - 5.
President Skroob: 1 - 2 - 3 - 4 - 5?
Colonel Sandurz: Yes.
President Skroob: That's amazing! I've got the same combination on my luggage!

Re:Obligatory Spaceballs Reference

[Anonymous Coward]

I like using movie phrases to generate passwords:

5p@c3b@1157h3p@55w0rD!

Same problem as 20 years ago

[petes_PoV]

The study makes reference to another analysis down on Unix systems 20 years ago and concludes nothing (much) has changed.
All this tells us is that the exhortations to choose more secure passwords reaches a certain level and then has no more effect. The implication is that ways of educating users has not improved in the past 20 years.

Let's not blame the users -they are only doing what they're told. The problem is that we (i.e. IT people) are not telling them the right things in a way that they are willing to accept. That's the problem, not laziness, incompetence or ignorance - motivation. The users ARE motivated to choose passwords, but not to go to the inconvenience of choosing complex ones.

In every other area of computer use, the trend has been to making things simpler to use. Maybe it's time this process was applied to passwords. Of course it's possible we don't really want better security - we just want someone to blame for lapses.

Re:Same problem as 20 years ago

[CaroKann]

The article concludes that after 20 years of dealing with this problem, "It’s time for everyone to take password security seriously". That is the wrong conclusion. If things have not improved after 20 years, then they are not going to improve ever.

The password concept needs to be replaced with a better concept. I think the password idea has been proven to be a bad concept due to human nature.

Re:Same problem as 20 years ago

[itsdapead]

The implication is that ways of educating users has not improved in the past 20 years.

Its not a case of educating them - its a case of stopping asking them to do silly things: do use a complex password; don't write it down do change it every six weeks; do create a persistant account (with a unique password) for every web service you use, even if you only use it once; do grow fluffy purple wings and fly around the room...

Re:Same problem as 20 years ago

[Anonymous Coward]

agree... and a lot of the problem at places I've worked is the app developers. They should use something like NTLM to verify the identify of the user and that they have authenticated, but its easier to throw up a login screen and check a database. End result users end up with half a dozen passwords for the various apps they use, so they pick passwords that are easy.

there really should be an iPhone/android app that would get your phone to send a special code via bluetooth to your browser to supplement your login. it could generate a unique code for every website, so if one website is compromised it won't affect the others. you'd still want a password in case someone steals your phone, but password strength would be far less important.

Problem is getting sites to actually implement it. And of course getting users to actually use it, as they'd just see it as another inconvenience to set up an app, get bluetooth working, etc. And of course not everyone has a smartphone (I don't) ... so I guess it won't happen.

Not Important Website = Not Important Passwords

[TheNinjaroach]

I don't know about everyone else, but I don't use my work credentials or my root password when I visit sites that look like rockyou.com. They just aren't important enough for me to use secure passwords. Five letters and a digit is more than enough for me to use on most forums, Myspace, and other unimportant sites -- all of whom I don't trust to actually store my passwords in a secure manner. So I am refraining from commenting on the horrible state of passwords when it concerns a horrible state of a website, because I don't think I'm the only one who acts this way.

Re:Not Important Website = Not Important Passwords

[WuphonsReach]

I don't know about everyone else, but I don't use my work credentials or my root password when I visit sites that look like rockyou.com. They just aren't important enough for me to use secure passwords. Five letters and a digit is more than enough for me to use on most forums, Myspace, and other unimportant sites -- all of whom I don't trust to actually store my passwords in a secure manner. So I am refraining from commenting on the horrible state of passwords when it concerns a horrible state of a website, because I don't think I'm the only one who acts this way.

I just tell a program like EPG or md5 (or some other hash program) to generate a 15-20 random alphanumeric password, use that, and store the result in a text file for throwaway accounts on unimportant sites. Then I have the browser remember the darned thing. Usually I'll GPG encrypt the contents of the text file (along with other information about the site).

If the site is unimportant - it doesn't matter to me if I can't get immediate access to it without decrypting a text file using my GPG key. Doubly so if the program (such as the e-mail program or web browser) can remember the password in exchange for my using a more secure pass phrase to guard all stored passwords. If the computer can remember it - why not use a completely random password?

Re:Not Important Website = Not Important Passwords

[TheNinjaroach]

Because your browser doesn't GPG encrypt the saved passwords.
Because I access the web from more than one PC.
Because entering a long, secure password just to access a text file full of low value passwords strikes me as completely backwards.
Because if that one password is compromised, they all are.
Because hexadecimal hashes only use 16 of 70+ characters that are easily available on my keyboard.

I think that's enough reasons for now.

One had to dig deep for this gem...

[pongo000]

I don't know if anyone bothered to read the full report, but I found this recommendation tucked in at the end of the report:
ast character in the password. (pg. 3)

Allow and encourage passphrases instead of passwords. (pg. 5)

And I say amen, amen to that. I've done quite a bit of personal research in this area, and have found passphrase systems to be far superior in terms of security and ease of use/recall over random combinations of characters. For years I've used the list provided at Diceware to generate my passphrases, and I have no problem still recalling little-used 5- or 6-phrase passphrases years later.

The idea that random sequences of characters is somehow superior to a passphrase of equal entropy is a myth borne of ignorance and a resistance to change. So long as companies that know better keep forcing their minions to adhere to a strict range of letter/number combinations, we'll continue to be saddled with the problem presented by the Rockyou.com crack.

Re:One had to dig deep for this gem...

[Anonymous Coward]

Did you follow the Diceware instructions exactly???

"For maximum security make sure you are alone and close the curtains"

Re:One had to dig deep for this gem...

[Anonymous Coward]

"I've done quite a bit of personal research in this area, and have found passphrase systems to be far superior in terms of security and ease of use/recall over random combinations of characters."

So instead of a random password your are advocating a non-random password and calling it a passphrase. Sorry, but that is just stupid. Passwords are weak because they get in the way of what users want to do (along with a whole lot of other reasons). Passphrases are not a solution to that problem.

It would be better to encourage users to use strong passwords, not change them, write them down and keep them secure. Users could be asigned passwords. Sites could not require the use of passwords. Why exactly do I have to have a password to buy something online? Mail order companies happily took my CC number and shipped my product. Brick and mortor stores don't require an account.

Re:One had to dig deep for this gem...

[pongo000]

So instead of a random password your are advocating a non-random password and calling it a passphrase.

I usually don't reply to ACs, but this warranted a response.

I advocated no such thing, and you obviously haven't RTFA. While I'd rather not disclose the random number generator I use for passphrase generation, I can assure you that the passphrase generated is certainly not "non-random." There's no need to spread FUD about passphrases...this is the very reason we're in the quagmire we are when it comes to password security.

PKI authentication solves password hell

[gnieboer]

One of the best things the government IT folks have done is the use of the PKI infrastructure. Must have a physical token (smart card) and then an unchanging PIN to access the physical token. The private key never leaves the card itself. And all internal sites are mandated to use that authentication, so no more password hell.
Yes, the cards expire every couple years, but it's about worn out by then anyways.

Intentionally weak passwords?

[MattBurke]

I don't know about anyone else, but I have accounts on so many sites it would be impossible to use strong passwords without reuse. I really don't see the harm in using the same weak passwords if I don't care if my account on the site's compromised.

I have a number of site-specific strong passwords I use on sites I care about, and a further handful of very strong passwords I use for accounts that have the ability to charge my credit cards. My unix passwords are completely different too, and I run sshd needing key auth. If I have anything worth protecting (personal information more than an email address, an identity within a community, etc) on a website, I'll use a better password, but if I just want to comment on someone's blog or see what a site's about, I don't care - I certainly wouldn't shed a tear if one of my weak passwords were compromised! Boo hoo, someone's pretending to be Asdf Asdf from Qwer (postcode AA1 1AA) over at www.dontcare.com/phpbb/ and www.whogivesarats.as/blog/ and sending me spam on email addresses I'll just blacklist...

I would bet money that if you look at the password complexity of users of a busy registration-required forum both before and after you discount people with less than 5 posts, there'd be a substantial difference. Likewise, it'd be interesting to see the strength distribution of the subset of these "32 million" accounts on rockyou.com that belonged to people that actually used them or had valid personal information attached. Otherwise I think it's a pretty worthless study

Stop calling it "passWORD"

[R2.0]

People only use letters and numbers because when they thing "word" it implies some meaning or coherence. We all understand what letters and numbers stand for or "mean". Non-alphanumerics? Hell, we can't even decide what to call "#" - is it "hash" or "pound?"
Is "." "dot" or "point?" For that matter, I still associate "$" with "string" in Fortran.

Start calling them security codes, pass codes, mystery keys, whatever.

Re:Stop calling it "passWORD"

[Khashishi]

passstring?

The definition of insanity

[ZorbaTHut]

is doing the same thing over and over while expecting different results.

I quote the end of this paper:

"The problem has changed very little over the past 20 years," explained Shulman, referring to a 1990 Unix password study that showed a password selection pattern similar to what consumers select today. "It's time for everyone to take password security seriously; it's an important first step in data security.

He's correct, of course. The problem hasn't changed. That's because the vast majority of people don't care. We've been telling people to use good passwords for 20 years, and it hasn't worked. People don't use good passwords, people have never used good passwords, people never will use good passwords.

Maybe it's time to come up with a solution that may actually work, instead of pushing the same old obviously-failed solution yet again?

Re:Password strength vs. Validation Rules

[wwwillem]

It is not just the mandatory password changes that increases the mess. It is also that each and every site has different validation rules. If I could use one-and-only strong password for many sites, then I could remember that. However, some sites _require_ special characters, while others _forbid_ it, etc, etc. So each time you end up inventing something on the spot, and then two months down the road you've forgotten it.

I guess that I've 50 passwords to remember, so if I can't do that with just a few (I don't use the same password for my online banking as for my slashdot login :-) then it quickly becomes Post-it time again. Or worse, that little file on the PC desktop with a list of userid/passwd combo's.

Password Utils

[Lummoxx]

I know it's been said around here before, but...

Dropbox + Keepass.  It's been working great for me.

A couple questions about passwords

[JSBiff]

I have a couple questions for some more security minded folks here on slashdot, about the 'conclusions' of the analysis in the linked article. . .

* "The shortness and simplicity of passwords means many users select credentials that will make them susceptible to basic forms of cyber attacks known as 'brute force attacks.'"

      Is this really true? Here's why I ask - most websites (though unfortunately not all), seem to lock your account if you don't get the right password in 3-5 attempts. Then, it may stay locked for 15 minutes, or 24 hours, or until you go through a process of some sort to verify the account (such as an automated email to the address on record, with a link you have to click in the email).

      If the website takes such measures, doesn't that shut down brute force attacks pretty fast, even with fairly simple passwords? If the website is doing that, and it shuts down brute force attacks, doesn't that mean that even a somewhat weak password can provide 'good enough' protection?

* While I'm sure that adding special symbols does make the password harder to brute force, isn't even an alpha-num password pretty strong if it's about 10-12 characters long and mixes both upper and lower as well as some numbers? Personally, if I was guiding someone about a password, and I know they have a hard time remembering complex passwords, I would urge them to a longer password instead of a more complex one, because the length makes the complexity grow exponentially, right?

* Sort of touching on the parent's point - appropriateness. We can't remember lots of complex long passwords, so I would think that we should get people to concentrate on remembering complex passwords for the things that most need them - particularly things which can be attacked 'offline'? By 'offline', I'm thinking of something like, say, an encrypted file (like a zip file or TrueCrypt volume file), and online passwords which protect truly important stuff like access to your network account at work, your bank account, Tax-site password, etc.

Of course, there are always 'password safe' type applications, but I've never really liked the idea of a password safe, simply because I don't necessarily have access to it whenever I need a password. Take, for example, going to a library, FedexKinkos, or college computer lab, and needing to access a password protected site. Even if you *do* have your password safe file, on a USB key (for example; or maybe you can download your 'safe' from a site online), you may not be able to run the password safe software to decrypt it. Even if you *can* run the password safe file from the USB key, on the public computer, do you really trust that public computer to decrypt all your passwords? I just don't like the concept of password safes, for these reasons.

Re:A couple questions about passwords

[GroovinWithMrBloe]

One thing to think about - If you try brute force a username, yes, you probably will lock out that account for a period of time. But what if you try the same password against random usernames. There is over 200,000 users with the password 123456. All you need to do is guess the username for one. Most websites don't detect and block against this sort of attack.

Re:A couple questions about passwords

[JSBiff]

Well, obviously, 123456, abc123, password, etc are *aweful* passwords. I'm not saying people should pick downright *stupid* passwords like that, I was just pointing out that the original linked article makes much of the fact that people aren't using passwords like r2u8K%Z1&qW3$, so 'they are open to brute force attacks'. For 'online' systems which lock accounts after a small number of tries, it would *seem* like an 8 digit alphanum password (which isn't one of the trivial ones discussed earlier) would be sufficient, wouldn't it?

Re:A couple questions about passwords

[GroovinWithMrBloe]

For 'online' systems which lock accounts after a small number of tries, it would *seem* like an 8 digit alphanum password (which isn't one of the trivial ones discussed earlier) would be sufficient, wouldn't it?

More than likely it would be fine. I guess I was commenting more on your question of brute force attacks being relevant in the days where you get X tries then the account is locked. If you choose even a moderately sane password (i.e. no sequential numbers, no keyboard sequences, no common words) then you'll be a lot safer than most people.

But attackers these days are more interested in *any* account, not a specific account. So brute force hacking has shifted from brute force passwords to brute force usernames. Imagine trying tonnes of common usernames (johnsmith@gmail.com) against the top 3 most common passwords. You're bound to strike gold soon enough. Attackers will most likely have access to large email databases of legitimate addresses to use in their attempts. Sites allowing / encouraging / requiring you to use your email as your username these days only make such attackers easier.

Re:A couple questions about passwords

[david_thornley]

A few answers, for what they're worth.

Brute force attacks on the login screen aren't real useful when there's account lockouts, no. However, what would have happened if this site had been in the least security-conscious? We'd be looking at a very long list of salted hashes of passwords, and the bad guys could do brute force attacks on them, trying passwords and seeing if they matched, at leisure. It's really unwise to rely on the hash scheme being a secret. Still, if the site uses account lockout, and you are sure for some reason that the passwords will never be compromised (and I never am), any password better than "12345" will work.

The strength of a password depends on how it's made. If somebody is creating, say, a length 12 alphabetic, it's likely to include words or names, and will be a lot less secure. Twelve letters, upper and lowercase, randomly chosen, will take a long time to brute-force, but people in general don't do that. Requiring a punctuation mark may shake that up.

I choose passwords based on how valuable and vulnerable things are. My passwords for financial websites are pretty good, and I don't use one on two different sites. For local stuff, or forums, I tend to use lower security, easily memorable ones, and do reuse them.

One piece of advice: have some idea of the threat you're protecting against. Is it willing to spend a lot of resources on cracking your password? Is it after you in particular or anybody it can get? (For example, while a criminal might well want to crack PayPal accounts, there'd be no particular reason in cracking mine rather than the ones with the weaker passwords.) What are the consequences to you of compromise? What's the exposure to attack? What are likely attack scenarios? For example, a TrueCrypt volume password might seem less consequential, but if you're using TrueCrypt to hide something illegal, the most likely attack scenario is that the government already suspects you, in which case they have a lot of time and resources to try to crack your specific password, and if they get it it would be very bad, so you want a very high-security password. If you're using it to hide your pr0n from your roommate, the password quality is much less important.

As far as the password safe goes, it's all a matter of tradeoffs. The unfortunate fact is that the average person can't memorize and enter unbreakable passwords at all easily, so there's a range of choices here. One is less secure passwords, one is a piece of paper in your wallet, one is a password safe. You're entirely correct to distrust public computers, but there's a kicker here: unless you've booted it yourself from known good media (like a Linux Live CD), you can't trust it to keep anything secret. There could easily be a software keylogger (and unless it's at a reputable place might have a hardware keylogger), so trusting anything at a public computer is iffy. If you enter a password in any way, somebody might be able to read it.

What do you do on other computers?

[JSBiff]

I looked into KeePass once upon a time, but I ended up avoiding it, simply because I've not figured out a way to get around what seems like a fundamental problem to me. . .

What do you do if you need to use a public computer? A lot of times, computers at places like libraries, college computer labs, etc won't allow you to run any programs which weren't installed by an Admin. If you rely on something like KeePass, don't you run the risk that you won't be able to access one of your passwords when you need to? Also, with KeePass, you run some possibility that once you decrypt the password database, some sort of spyware on the computer might hoover up all your passwords?

I mean, granted, if the computer is compromised, it could snatch your password anyhow when you enter it into the browser to login to a site, but at least in that case, the spyware only steals the password for 1 site, instead of every password you have?

Re:What do you do on other computers?

[StripedCow]

isn't there a cellphone/iphone version of keepass to remedy these problems?

Re:What do you do on other computers?

[Lummoxx]

Use a USB key, copy your database to it, when needed.  Portableapps.com has Keepass as a utility.

The only real hassle is the database isn't synced, have to remember to overwrite the copy.

I rarely, if ever, use a public computer, so...non-issue for me.

Re:What do you do on other computers?

[Anonymous Coward]

I use the Windows Mobile version of KeePass on my phone/pda. It is free and, I find, essential for my day-to-day.

Re:What do you do on other computers?

[WuphonsReach]

What do you do if you need to use a public computer? A lot of times, computers at places like libraries, college computer labs, etc won't allow you to run any programs which weren't installed by an Admin. If you rely on something like KeePass, don't you run the risk that you won't be able to access one of your passwords when you need to? Also, with KeePass, you run some possibility that once you decrypt the password database, some sort of spyware on the computer might hoover up all your passwords?

a) Don't.

That's pretty much what it boils down to. Personally, I use a set of GPG-encrypted text files to store my passwords, no more then 1 site per file. For the sites that I don't care if I can't get access to them until I can decrypt the text files, I simply generate a random passphrase (completely randomized, not pronounceable at all) and use that.

For sites that I do need to get into, I use a more memorable passphrase.

But really... if you can't trust the computer with your GPG key, do you REALLY want to be logging into a sensitive website using the same computer?

(We really need an open hardware solution like a credit card sized calculator where you type in a 4 digit challenge and get back an 8 digit response that you have to key in. Combined with passwords it would be "good enough" and a big step up from today's systems.)

Re:What do you do on other computers?

[muckracer]

> But really... if you can't trust the computer with your GPG key, do
> you REALLY want to be logging into a sensitive website using the
> same computer?

> (We really need an open hardware solution like a credit card sized
> calculator where you type in a 4 digit challenge and get back an 8
> digit response that you have to key in. Combined with passwords it
> would be "good enough" and a big step up from today's systems.)

So why not go the easy and direct route: Instead of putzing around
with passwords the user on registration gets asked to upload his
public GPG key. On each subsequent login the site sends an encrypted
challenge that gets decrypted with the secret key (obviously). A
signed (and optionally encrypted) response gets sent back and
voila...login succeeded. I can't believe we reinvent the wheel 20
times over and still have no single sign-on (via your GPG passphrase)
even though we got all the tools.

Re:Password strength vs. Validation Rules

[Synn]

Or worse, that little file on the PC desktop with a list of userid/passwd combo's.

Just use a password store utility instead of a text file. They encrypt a file that stores the passwords.

passwords and websites

[Shivetya]

I have two password styles.

On frivolous sites, like Slashdot or game fan site, I use a dead simple password along the lines of "ilikedogs1" or "iamfrank". Why? Because nothing of interest to me is on those sites. Nothing anyone finds there gives anyone financial or other leverage.

On sites where I need to secure I use complex passwords not related to me or the entity I am using. Keep is simple where it really doesn't matter and password security becomes less of a burden. Still I like the one time keys provided by devices similar to what Blizzard uses for WOW access (authenticators)

security now had a show about this

[jollyreaper]

I understand why you don't want to use dictionary words for passwords, too easy to brute-force. Though how likely is it that servers these days would sit still while a single account fails login ten thousand times? I know once the hacker is in, he can then run the hash file against the dictionary and back into the passwords of other accounts. But wouldn't even a dictionary word with a number or two after it be fine? duck1234 should be just as secure as duck!@#$, right?

I'm running through the ways you can get hacked and what a secure password would mean.

1. Guessing by a person sitting at your computer, brute force hacker from outside, running the dictionary against the hash -- strong is good.
2. Your PC gets rooted, your keystrokes are captured -- strength doesn't matter a bit, you typed it in for the hacker and he won't even have to touch the keyboard when his scripts hit your account and drain it.
3. Data breach and your password is stolen -- Why was it stored in plaintext? Regardless, they have it and can copy and paste if they use it.

The consensus on security now was that draconian policies on the part of IT without any seeming rhyme or reason to the employee will simply foster non-compliance and animosity towards IT.

Re:security now had a show about this

[Anonymous Coward]

I understand why you don't want to use dictionary words for passwords, too easy to brute-force. Though how likely is it that servers these days would sit still while a single account fails login ten thousand times? I know once the hacker is in, he can then run the hash file against the dictionary and back into the passwords of other accounts. But wouldn't even a dictionary word with a number or two after it be fine? duck1234 should be just as secure as duck!@#$, right?

I'm running through the ways you can get hacked and what a secure password would mean.

1. Guessing by a person sitting at your computer, brute force hacker from outside, running the dictionary against the hash -- strong is good.
2. Your PC gets rooted, your keystrokes are captured -- strength doesn't matter a bit, you typed it in for the hacker and he won't even have to touch the keyboard when his scripts hit your account and drain it.
3. Data breach and your password is stolen -- Why was it stored in plaintext? Regardless, they have it and can copy and paste if they use it.

The consensus on security now was that draconian policies on the part of IT without any seeming rhyme or reason to the employee will simply foster non-compliance and animosity towards IT.

The average person understands the need to lock their door when they leave for work. Yet, that is also a barrier... as intended, it's a barrier for you, but more so for a thief. When it comes to passwords, the average person sees only a barrier to them and then just don't understand enough (or plays dumb) to see the thief in the first place. Ultimately, it doesn't matter if they don't care, don't know they should or just aren't competent enough to understand - the end result is the same - a weak link in the staff that forces a weak link in the system just so the system can run AT ALL no matter its level of security.

You forget. The people that understand the issue (and I think you've articulated it well and in simple terms) are the techs in the field and we/they see it as a security issue for the customer and the company. Those that are in control still don't/can't/refuse to acknowledge they understand - you know: the C-Team (CEO, CFO, COO, etc...). The C-Team doesn't care about the customer or the company - they care about the shareholder first no matter what.

Regardless of the reasons (read: there is no liability YET but it would cost money and time and training to implement), it just doesn't happen in the real world. I think they are doing their jobs, but in an extremely and unbelievably myopic way.

The technical reasons TO do something for the sake of security even when its obligatory for legal, ethical or even moral considerations (to the customer) are often ignored.

The business reasons TO do something for the sake of security only come into play when the legal and ethical considerations (to the shareholder) can't be ignored.

It's rare that a business (non-profit, public or private) considers the cost of prevention (pennies right now) over the cost of cure (dollars they see 'possibly' yet you know 'definitely sometime' in the future). They don't want to hear your argument, let alone sign off on something, because then they have to make a decision - that, at least, they know.

Regardless if those that authorize the time and money to invest in security as a bunch of products AND practices get it or not, the purse strings only open when it's right on time for the shareholder's interests. By then, however, it's already too late for the customer's interests.

This is why we still use passwords rather than things more effective and convenient. That said, since the average joe doesn't get to make that decision, we live with passwords. Since we live with passwords, we have to deal with the fact that although a pain in the ass, there must be rules for said system to actually work.

If you have ever tried to get a member of the C-Team to authorize a security related capitol expense, securit

No kidding

[Sycraft-fu]

For example I use the same password on most forums online. It is short, alpha numeric and so on. Why? Because I really don't give a fuck. They are forums. Oh no, you hacked my forum account, whatever will I do? However it is not the same password as my e-mail, that is longer, and has special characters. My bank password is longer still, used only for my bank, and also requires the use of a physical identification token to get in.

The amount of effort I put in to a password is directly related to what that password protects. For a large amount of stuff on the internet it is one of a couple simple passwords that are reused all over. Reason is that what it protects is just not important. There is no reason to spend time coming up with and memorizing a unique, hard, password for Youtube or something. If it gets found out, oh well, I'll go change it on other sites I use enough to care about. If one of those happens to get owned in the interim, oh well, I'll make a new account.

However something like my bank account, or my admin account at work, yes, those passwords are strong, and they are never reused anywhere. They protect something that matters, so security is taken seriously.

no, just use a good algorithm

[circletimessquare]

something like "if the website's name begins with the letter m or lower, use the weekday my son was born, if above m, the weekday my daughter was born. plus the last 3 letters of the website name backwards rotated plus 2"

if a hacker gets access to one database they have no idea what your algorithm is

Design your own coding system

[aussersterne]

so that you don't need to be sitting in from of your own Linux command line to remember your passwords. I use a base of two nonsense pairs (things like AkB and jzQ) and then use positions 4 and 5 in the password as a code for the type of site and "rank" in terms of frequency of use, for example (these aren't mine but you get the idea):

! (shift-1) = social networking
@ (shift-2) = banking
# (shift-3) = utilities / bill payments

1 = site in this category I use most
2 = second most used site
3 = third most used site

and so on. So the base for something like Facebook using a system like this might be A@B!1jzQ, for Twitter maybe AkB!2jzQ, and for my primary bank account AkB@1jzQ (invariant components AkB and jzQ, with @ [for banking] and 1 [for most used] sandwiched in between them).

Then, I postfix the password with the number of the instance of the password.

A = first use
B = first mandated change
C = second mandated change
D = third mandated change

and so on. So after the third change, my primary banking password at a bank might be:

AkB@1jzQD

After they ask me to change it again, it will increment to:

AkB@1jzQE

and so on.

This way, there is always a base of predictability to my passwords (usually enough to get it within three tries) and the variable information is context-based in a way that is only meaningful to me and no two sites will ever share the same password.

The only place this falls down is when sites mandate their own password structure (max or min length, etc.) but it usually works (includes uppercase, lowercase, symbols, and numbers, which is enough to make most of them happy) and the few sites that don't allow such passwords are far enough between to stand out in my memory, meaning that I don't forget the specially-formed exceptions that I created for those sites.

A system like this won't work for everyone, but for most people with a reasonable IQ, it's good enough, once you can get them to buy into the need for password security and for them to design their own system.

Re:Design your own coding system

[exploder]

Lots of sites with mandatory periodic password changes won't let you pick a password that is "too similar" to a previous one. Do you run into that problem?

It just occurred to me...if they do that, does it imply that they're storing the passwords in plaintext, or is there another way to judge when passwords are similar? That is, does a sufficiently one-way function (a hash) necessarily discard information about similarity?

Re:Design your own coding system

[Whyte Panther]

Judging based on the shocking reveal of millions of passwords from TFA that started this thread, I'd say that quite a few password systems must store in plaintext.

Re:Design your own coding system

[TheBig1]

A cryptographic hash will discard any information about similarity... if not, then it is not a strong hash. I can't think of any other way to determine that, so I think it is safe to assume that the passwords are stored in plain text (or at best a reversible obfuscation / encryption). Also remember that all services which provide an 'email me my password' option store the password in a retrievable form in the DB.

Cheers

Re:Design your own coding system

[BrokenHalo]

if they do that, does it imply that they're storing the passwords in plaintext...

That's what it implies to me. I don't see how anyone can easily extract a useful pattern from a SHA-11 or MD5 hash.

Re:Design your own coding system

[BrokenHalo]

Oops, of course SHA-11 isn't quite ready yet - my meatspace preview facility isn't up to scratch this evening...

Re:Design your own coding system

[scot4875]

One of the main purposes of a hash function is to generate a completely unpredictable, but reproducible, key from an input, and to try to avoid collisions as much as possible. So even two similar passwords with only a few differing bits should produce completely different hashes if the system is doing its job.

--Jeremy

Re:Design your own coding system

[johny42]

I can't think of any other way to determine that, so I think it is safe to assume that the passwords are stored in plain text

They can just ask you to enter your old password in addition to the new one, which can then easily be verified and compared to the new one you entered. Most sites ask for old password anyway, for security reasons.

Re:Design your own coding system

[TheBig1]

Well of course that is possible, but that was not what the GP was asking... he was asking if a system which says passwords are 'too similar', must it necessarily be storing a reversible (plaintext, obfuscated, or encrypted) password in the DB, or is it possible to do 'similar' checks with cryptographic hashes. But yes, you are correct in your pedantry, if you enter the old password and the new one, the system can compare them for similarity without needing a reversible password stored in the DB.

Cheers

Re:Design your own coding system

[Cro Magnon]

Lots of sites with mandatory periodic password changes won't let you pick a password that is "too similar" to a previous one. Do you run into that problem?

Awhile back, one of my systems kept rejecting attempts to change my password. The stated reason was unclear, but I suspect it was because it was "too similar". Ultimately, I used a pw that would have gotten my mouth washed with soap.

Re:Design your own coding system

[Anonymous Coward]

Any strong password generating scheme like that is great until the password you enter is rejected for being out of the acceptable length range or not containing "only letters and numbers" or some other such rules. I've met at least two sites, one of which a banking site, that rejected non-alphanumeric characters.

Anyone else use two-factor authentication?

[spamking]

We use a smartcard/PIN combination to access our systems . . . but some still require at least an 8 digit alphanumeric password. Admins must use at least a 16 digit password, and we must change them every 90 days. I really hope we're able to switch to 100% two-factor authentication soon . . . and that it works.

Wow

[Quiet_Desperation]

No "swordfish", huh?

Password hashing on the databases

[coulbc]

The article states the passwords were obtained through an SQL injection attack. They were stored as plaintext in the database. Having a strong password would have done nothing to prevent this problem. Passwords need to be encrypted during transport and when stored.

bullshit

[circletimessquare]

you just need a good algorithm

then someone has to hack two databases or more, zero in on the password for the same username, and calculate your algorithm

this is assuming the same username is the same person across websites, and that the hacker has the time or inclination out of millions of passwords to devote the analysis

furthermore, if your algorithm is something like

"if the website's name begins with the letter m or lower, use the weekday my son was born, if above m, the weekday my daughter was born. plus the last 3 letters of the website name backwards rotated plus 2"

then there is still not enough unique information from 2 or maybe even 3 hacks to successfully derive your algorithm

plus, i just thought up this algorithm on the spot. i'm certain there are plenty of clever algorithms out there that you can use to generate your password from the website name on the fly that no hacker could isolate. something like "the second letter of each website name corresponds to someone you know in college. use their room number. then take the last letter of the website, get the ascii value of that, divide by 2, and write the last name of the relative who was born on that day of the month"

the kinds of algorithms you use can be endless, and beyond the time or effort or even possibility (depending up the algorithm) of any hacker deriving it. the last algorithm i just wrote is still kind of hard: your algorithm assumes you are memorizing 26 college names and 13 birthdays. so maybe you only take the last digit of the ascii value of the 4th letter of the website name or whatever, so you only need to memorize 10 birthdays, or whatever: you just need a good algorithm

the point is: a well chosen algorithm can be foolproof from a hacking perspective in terms of generating a complex password, and foolproof in terms of having a unique password for thousands of sites. and all you have to remember is a good creative algorithm only you know

Re:Password strength vs. Validation Rules

[nickyj]

KeePass is an excellent utility, available for Windows, Linux, and other platforms. It's simple, quick to use, and configured correctly, you will only have to learn one password the one to unlock the encryption file.

Re:Password strength vs. Validation Rules

[Grizzley9]

Oh but I use a password to open my word document that contains all my passwords. That's pretty secure. /s

It seems that a lot of industry security is a waste for most users, esp those that require password resets every X number of days or months. There is nothing on my pc that anyone, competitors included, would care about. Even if they had access to the numerous systems I use internally.

I remember a Dilbert cartoon about this once (fitting as he came from the same company) where he asked that if he tried, could he ever find anyone that cared about the "proprietary" marking on documents.

Re:Password strength vs. Validation Rules

[Chris Mattern]

And keep the encrypted password store on a USB drive, not a computer's hard disk.

High quality report

[Smallpond]

Most interesting to me was that in the sample, less than 4% used any non alpha-numerics in their #$#%'ing passwords.

Most interesting to me was that the chart showing use of case, numbers and special characters is titled "Password Length Distribution"

Too many applications don't allow passphrases

[pavon]

At every large site that I know of that has tried to implement passphrases, the end result is that the user has to memorize two secrets - the passphrase that works on most systems, and another password for all the legacy systems that don't support long passwords. So users still need a password, but use it less often so it is harder to remember. Heck I still see shit around that has an 8 character password limit.

Re:Too many applications don't allow passphrases

[canajin56]

My bank limits me to 8 characters, alphanumeric only. But any time you log in from a new IP, it gives you a couple random security questions. What is your favorite childhood cartoon character? What is the middle name of your spouse's youngest sibling? What is your favorite chocolate bar. In general, security questions aren't secure. But you've gotta choose good ones! But out of those examples, I doubt anybody but my wife knows all 3! And I've never explicitly mentioned my favorite chocolate bar to her, she just probably picked up on it because it's quite literally the only one I ever buy ;) But since that's once or twice a year, I doubt anybody sifting my trash would pick up on that, (especially now, since our apartment has a communal dumpster for the whole building).

Passwords

[Stooshie]

I worked for a company that ran a birth/death/marriage certificate site. People were having problems logging in, so we kept a log of passwords that did not result in a successful login.

We found that one of the most commonly typed passwords that was denied was "case-sensitive".

Needless to say, we soon took off the "Your password is case-sensitive" text from the login page.

Re:Passwords

[Myopic]

That's hilarious; I laughed. I hope it's true, even though it sounds made-up.

"Case-sensitive" might be my next password.

Re:Passwords

[Stooshie]

It is true. I would even name the company but that might get me on trouble.

all I'll say is I am based in Scotland.

Weak passwd OK if guessing cost high

[redelm]

A strong passwd is only a small part of the entire security system. It is important to address _all_ parts. One of the most important is to make the cost of guessing passwords high.

A non-shadow /etc/passwd has extremely low guessing costs, just a few CPU cycles. An ATM that eats cards after 3 wrong guesses has an extremely high guessing cost. Account lockouts, timed or manual are somewhere in-between.

The important point is these guessing costs are largely under the control of the admins and not subject to variable user compliance or resentful coersion.

It really bothers me when service people try to blame me for some inefficiency when they are not doing all they can. I'm not supposed to do their job, or even make it easy. They're there to make mine easy.

What about the account importance?

[Anonymous Coward]

I wonder how applicable this is for "real" passwords -- the kind of password you'd use to secure your on-line bank account or your personal email, for example? It's generally a good idea not to use the same password you use for your on-line bank account when creating a shopping cart account for every Tom, Dick, and Harry.com website that you happen to buy chotchkies from. I wonder how many of these passwords are weak because of people just really not caring so much about their account on rockyou.com rather than being clueless about creating strong passwords...

Difficult Passwords

[ears_d]

I once worked for a company where the server passwords were the names of Inca gods. Just try and remember "Apocatequil" and "Guachmines."

Re:Password strength vs. Validation Rules

[IndigoDarkwolf]

And either require the user to remember - you guessed it - yet another password, or they keep the decrypt key on the hard drive where anyone can can find it.

"But at least the user only has to remember one password, instead of many."

That is an improvement, but god willing they'll also be making good backups and won't suffer catastrophic data loss, else they've lost all their passwords.

I know it's taboo to write passwords on post-its. At an office I'd agree that post-its and the undersides of staplers are the worst places ever to keep passwords. But why is it so bad at home? If someone breaks into your home, wouldn't you try to change as many passwords as you can remember just to be safe anyways?

Cypher Lock

[gznork26]

Many years ago, I worked on a secret DoD project in a room with a cypher lock, which only had digits to choose from. The password was 1234. One day, we came in after a weekend, and discovered that the wall next to the door was missing. When we dutifully reported the problem to security, we learned that contractors had been in over the weekend doing some work that entailed removing the wall, and they didn't replace it when they were done. I suspect that either the construction contract didn't require the replacement of the wall, or the contract was a fixed bid, and they 'ran out of money', like the robocops chasing THX1138.

---
Google returns over 50M results on a search for political short stories. Why is my blog first?

Re:Cypher Lock

[Anonymous Coward]

Ah, the memories. Long, long ago I worked in a secure military facility - actually in a vault. Thick concrete walls, heavy steel doors, gun ports, civilian workers carrying holstered sidearms (being in the military, I wasn't trusted with a gun). Great stuff.

Sadly, when the facility was built a couple of years earlier, no one had bothered to consider how to securely hang the large steel doors which opened from the vault to the outside world for large equipment access. Result being that those doors were hung outward-opening with their massive hinges on the outside - removable hinge pins fully exposed and vulnerable to anyone with a hammer and a drift pin.

One Monday morning as I approached the facility there were MPs all over the place - aggressively guarding the doors which for probably two or three years, could have been breached by a kid in about 5 minutes. Much activity around the clock for a couple of days while the doors were modified and re-hung.

Good times.

Re:Password strength vs. Validation Rules

[AniVisual]

I personally have an alphanumeric password string with the aforementioned coding system that I convert some characters into leet for my password, retaining the alphanumeric as a fallback. The central problem that I now encounter is when several sites fail to accept passwords that are too short or that are too long.

Re:Password strength vs. Validation Rules

[ottothecow]

not that using the same password for every site is necessarily a good idea...but I also hate it when sites have stupid password requirements that make me unable to use a password that I would like to use.

I don't generate a new password for every site, although I have thought about moving to pattern based password for different sites along the lines of taking a password and integrating the first two letters in a non obvious way. Something like 12s34l56 for slashdot and 12a34m56 for amazon (with a real password...not 123456). Don't do it an obvious way...no passslashdot7, passebay7, passamazon7 as it would make it immediately obvious to anyone looking at your password what your google password would then be.

Since I don't do that...I instead use password tranches until I actually make the switch. I've got some crap password that some of my friends even know--easy to type, easy to crack--that gets used for things like the screen lock on my desktop and what are essentially public shares on my home network. As things move up in importance, they get better passwords.

On a side note, whenever a bank or something gives you a login where you have to choose a picture and a phrase to be displayed at login, does anyone else pick something like a picture of a daisy and the most gratuitously awful phrase you can think of? No phisher is ever going to try to fake that and I secretly wonder if the customer service people can see it when I talk to them on the phone.

Re:Password strength vs. Validation Rules

[Dameian]

However, some sites _require_ special characters, while others _forbid_ it, etc, etc.

Indeed. Oddly enough, my WoW account allows for a stronger password than my bank account.

DLP - Dead Language Passwords

[Anonymous Coward]

I use passwords from a long-dead language that very few people know, so they are almost as good as a random password, but easy for me to remember.

Biometrics?

[RivenAleem]

Many computer keyboards and laptops (even a good enough webcam) can use biometrics to grant access.

The laptops we have here at work all have fingerprint scanners, eliminating the need to remember the password. A webcam can take a picture of the user (not a retinal scan, just a regular picture of the face, though to protect against someone using a photo, a panoramic shot is usually used and the user turns head in left/right directions to snap the sides of head too) and compare that against a database.

Where I work, our signature on paper, and electronic, is very important, so I usually have to type in a password 20 times a day. Having a long and awkward one is great, but I rarely need to type it as I can scan my fingerprint.

Websites should start offering this feature too, though there would be issues regarding who you would trust your one, universal, password with. A PasswordPal (Paypal) service should be created so that you can trust your password with one secure, insured and trustworthy group, and the other sites would operate with some sort of single sign-on. So if you log in to your computer then that IP becomes you wherever you go.

I hope that functionality such as this gets incorporated into the new version of the internet that is in the works.

#$#%'ing passwords

[backwardMechanic]

Some of us want to type our passwords on different language keyboards. #$#% are amongst the first to move (y's and z's are bad too).

you can still use an algorithm

[circletimessquare]

something like "rotate the names of the days of the week, plus the last name of the person who lives in the apartment number of the numerical value of the day of the week we are on"

or "the last name of the person in the next cubicle, moving east and north from the southwest corner of my floor plus a numerical value on a scale of 1 to 4 of how much i dislike that person"

or whatever

even if you forget which particular day of the week you or on, or what cubicle you are up to, you still have a pretty good idea of approximately where you left off, so you try a few passwords plus or minus where you think you are in your sequence/ cycle if you can't login. you should get it in 3-4 tries

the number and kinds of algorithms are endless, only your creativity is a hurdle. and it really is easy to remember than dozens of passwords, and just as effective as a unique complicated password for each site/ sequence of changing passwords

you can even remember 3-4 different wacky algorithms. say a weak algorithm for your social networking sites (where a weak algorithm still generates unique, strong passwords for dozens of sites), and some really far out algorithm you rotate for your bank website

Use pass phrases

[yalap]

Which of the following is a better password: "v6@!Tt3#" or "The name of my dog is Spot." ? 8 chars vs 27 chars The *length* of the password is more important than the complexity of the password. And users are more likely remember (and not write down) a pass phrase.

Re:Password strength vs. Validation Rules

[Anonymous Coward]

I use 3-4 base passwords that change over time (as I reset passwords I phase in new keywords and remove old ones). To those I add the required symbols, numbers or capital letters that each site requires to get in. Anyone unfamiliar with a site's password option, even if they know my keyword, will struggle with the exact letter/number/symbol combo I used for that particular site. And like the parent I also don't use the same pass for facebook as for my bank. Banking gets one theme, social networking gets another, games get another... I even have a default, less-secure password I use when I need to register for, say, a news site that I want to leave a single comment on, because I'm unlikely to make frequent visits, but if I do come back and attempt to log in I'll remember it.

I'm sure it's not the most secure method, but I rarely log in where someone could shoulder-surf and I don't share passwords, and thus far those basic precautions have served me well. I change my passwords when I feel it is necessary, and dislike forced changes (our school network forced a change every 6 months; I alternated between two basic passwords every time, because the first time I deviated from that I forgot and it took a full 24 hours to re-set through their system).

Passphrase NOT Password

[Temujin_12]

I often wonder how much stronger passwords could be if the word "password" wasn't used to describe them and wasn't what users thought of when coming up with login credentials. You can solve many weak password issues if you train your users that they are creating a "passphrase" NOT a "password". A way to do this (that's easy for users):

1) Think of a phrase that you can memorise but is unique to you (ie: not common or easily guessable). Bonus if guessing that phrase would require intimate knowledge about you.
2) Take the first letter of each word (bonus points if you take second, or third, etc.)
3) Replace some of the letters with numbers/capitals/symbols (ie: cipher it)

So, for example:
1) "I do two sets of six pushups when I workout"
2) idtsospwiw
3) id2$o6pwiW

It will take entering it several times to develop the coordination until entering this becomes natural, so practising it on the keyboard is a good idea. But "id2$o6pwiW" is MUCH more secure than "workout123" and it is something that can be easily memorised since they're really just memorising "I do two sets of six pushups when I workout" (which is something they already know) plus the minor tweaking of the characters they are entering.

Re:Passphrase NOT Password

[Myopic]

"id2$o6pwiW" is MUCH more secure than "workout123"

Why? On what do you base that conclusion?

Re:Passphrase NOT Password

[Temujin_12]

"id2$o6pwiW" is MUCH more secure than "workout123"

Why? On what do you base that conclusion?

The fact that it contains:
1) lower case letter(s)
2) upper case letter(s)
3) number(s)
4) symbol(s)
5) does not contain word(s)
6) is not an abbreviation of a common phrase

Am I missing another set of criteria for secure passwords?

Re:Passphrase NOT Password

[Myopic]

Yeah, okay, you described the first password. I know it has those properties. I'm wondering why a password with those properties is more secure?

Ancedote

[Locke2005]

Many years ago, the Amdahl UTS admins sent out an email to all developers, stating "We've changed the admin password for the development machines, and we can't tell you what the new password is because it's a secret." I rushed to try logging in as admin, and sure enough, their new password was "Asecret"!

Some banks limit password strenght

[aggressivepedestrian]

I have a credit card with Chase: they don't even allow non alpha-numeric characters in hteir passwords. What possible reason could they have for limiting characters to letters and numbers?

Re:Some banks limit password strenght

[Tim C]

Indeed. I have a Visa debit card (via my bank) and their "Verified by Visa" system did not allow non-alphanumeric characters in passwords when I signed up for it.

Re:Some banks limit password strenght

[Aaron B Lingwood]

Heritage Building Society in Australia only allow a 5 character password for netbanking.
Case-insensitive alpha-numeric only.

Furthermore, the login interface uses a 'virtual keyboard' which is unusable from my secure Blackberry.
I need IE with Javascript to log in.

Re:Password strength vs. Validation Rules

[Golddess]

As long as you keep it encrypted with a sufficiently strong key, is it really any different from using "one-and-only strong password for many sites"?

USPTO wireless password for working from home

[Anonymous Coward]

If you see an access point and running WEP (yes, they are still this retarded) the key is all numbers in the obvious sequence.

My usual password is "password"

[_TinCho]

Most of the time, I don't care about the supposed security.
You have to create an account for some random forum to read a comment? You'll never probably log in again? Even if you go there once in a while, do I really care if someone discovers what my password is?
Do I have a secure and unique password for my bank account? Sure.
My Facebook account? Yes.
My Slashdot account? Maybe.
My somerandomforumthatmademeregistertoseeapic.com? "password". Or "Password", "password1", "Password1!", if the admin is paranoid.
Is it secure? No.
Who cares?

Re:Password strength vs. Validation Rules

[exploder]

Utilities (such as the Password Hasher addon for Firefox) neatly sidestep the "catastrophic data loss" problem by using a hashing function to combine the single strong master password with the site's domain name (or other key you choose) to create a different, strong password for every account.

Re:Password strength vs. Validation Rules

[anagama]

Your point about the importance of the password seems not to be analyzed much in rockyou.com data. Has anyone gone to rockyou.com to see what it is? If I was a member of that site, my password would be my weak easy throwaway because the site isn't that important. If it was banking, or the password for my encrypted data backups, that's a completely different matter. But junk sites don't require much more than junk passwords.

Passphrases and passwords

[spaceyhackerlady]

My favourite algorithm for passwords is the classic first letter of each word in a phrase. My standard example is "Tbontb,Titq!". It looks like garbage if anybody watches over your shoulder while you type it, but you think "To be or not to be, That is the question!". You remember it. They don't.

No, I have never used this as a password on any system.

...laura

....password

[Anonymous Coward]

that is the one i always try first....

Re:....password

[Creepy]

password and Password were popular 20+ years ago - amazing people still use them. I miss the days when almost all passwords could be hacked with god, password, or admin (or anything else that stroked an admin's ego if I had to go beyond that).

I feel lied to

[swilde23]

I thought 'god' was the most common password. Stupid Angelina Jolie...

Faulty Data in Report Linked in Summary

[mnslinky]

I've been playing around with the password file, and there are some gross errors in the report.

First, their top 20 list has many passwords with capital letters, where none actually exist in the 'real' top 20. Also, their numbers are off. I am guess they used a case-insensitive match, which for most passwords will not work. The 'real' top 20, which case respected is:

290729 123456
79076 12345
76789 123456789
59462 password
49952 iloveyou
33291 princess
21725 1234567
20901 rockyou
20553 12345678
16648 abc123
16227 nicole
15308 daniel
15163 babygirl
14726 monkey
14331 lovely
14103 jessica
13984 654321
13981 michael
13488 ashley
13456 qwerty

You can download my list of all common passwords used by more than 1000 people at http://www.secure-computing.net/files/count_gt_1k.txt (1KB file) which maintains case. A file without the counts is at http://www.secure-computing.net/files/gt_1k.txt for use with john, etc.

Re:Faulty Data in Report Linked in Summary

[Athaulf]

Where the hell'd you find that? I was looking all over for them, but the original rapidshare appears to have been taken down. Any way you could post a list of the full password data without the email addresses? This would rock my professor's statistics world.

Re:Faulty Data in Report Linked in Summary

[mnslinky]

You can download via bittorrent. The .torrent is on The Pirate Bay: http://www.thepiratebay.com/torrent/5232943/RockYou.com_UserAccount-passwords for your edification. :)

Re:Password strength vs. Validation Rules

[StuartHankins]

PC Magazine had a utility called "Password Prompter" that offered this feature; it also has a random password generator, a place to store notes and several other fields. They also included the C++ source. A quick Google search finds it. It doesn't have to be installed, just run it from the folder.

I haven't been interested enough to check the security of it -- it's inside a VM which is only open when I'm at work so I'm not too worried about it. If you don't like that one there are probably hundreds or thousands more, or build your own.

Re:Password strength vs. Validation Rules

[Anonymous Coward]

What's wrong with:

gpg -d mypassfile.txt.asc

and

gpg -seao mypassfile.txt.asc -rme -ume mypassfile.txt; shred -uvz mypassfile.txt

provided you don't have ~/.gnupg on an SSD or flashdisk?

I'm not trying to be snarky here. I'm really curious why you'd go to the extra trouble of using something -else-

Re:Password strength vs. Validation Rules

[networkBoy]

I use "low security" passwords at multiple sites.
I have 4, to satisfy the most common requirements of pwd utilities. I use these at sites like /. where in the grand scheme of things it doesn't matter if I'm compromised.
Then I have unique passwords for all financial sites like amazon.
Finally I have hard passwords. I only can remember one, and it is to a TC volume on a USB key. I keep the key with me (and have several backups). This is for domain pwds, bank pwds, google account, etc. where there would be real harm possible.

More Password Analysis

[lakiw]

I managed to obtain a copy of the list, and have been doing some analysis on my blog http://reusablesec.blogspot.com/ with more to come. You can find a list of the top 100 passwords from the RockYou disclosure here: http://reusablesec.blogspot.com/2009/12/rockyou-32-million-password-list-top.html I've also been analyzing more lists such as the 10k Hotmail list that was released a couple of months ago. As for the recommendations that Imperva made, I think they are too tough on the users. Let's be honest, someone could have had a 28 character passpharse and it wouldn't have helped them since Rockyou stored all the passwords in plain text. For most people, online password cracking isn't the main problem. Phishing/keystroke loggers are much more prevalent, (due to their low cost to attackers). What this shows though is you really need to have different classes of passwords. You don't have to remember a different password for every site, (which is almost impossible without using some keyvault program), but you should use a different password for your webmail/bank accounts compared to all of the other sites.

uhhh

[kel-tor]

I think Shulman is missing his own point.

"The problem has changed very little over the past 20 years, explained Shulman, referring to a 1990 Unix password study that showed a password selection pattern similar to what consumers select today. Its time for everyone to take password security seriously; its an important first step in data security.

So 20 years later we still have all of exact same problem? The lesson here is _not_ that "it's time for _everyone_ to take pw security seriously". The lesson is that the basic mechanic's of passwords doesn't work. I'm sure they tried to take pw security seriously 20 years ago. The average user doesn't understand the math behind making a complex password. Password requirements add to the confusion: one pw changes every 3 months, another 4, some must use mixed case, ohters 2 numbers and a special character, and don't write it down, etc, then throw in some passwords fields that cannot use special characters, my bank pw cannot start with a number, can't reuse a pw for 12 uses and the result is simplified easier to remember passwords. Same as the last but add a '1' at the end, incriment to '2' in 3 months.

Old Dakota wisdom says that if you are riding a dead horse, get off. Shulman seems to think that if we just get serious and dig in our heals we can suddenly get the dead horse to trot. Meanwhile management will ignore Shulman and instead decide to double the horsepower-- by buying another dead horse.

devolpment of passwords

[delvsional]

If I told you how I make my passwords, I'd have to kill you.

some of my favorite passwords

[peter303]

Former zipcodes and telephone numbers. Pretty easy to remember 15 digits this way. Some systems wont accept all digits.
Words in obscure languages. They mean something to me, but not to standard dictionary attacks.

non keyboard characters

[Anonymous Coward]

I do tech support, the best PW idea I ever heard was from a customer who used ALT key and numeric keypad to get non keyboard characters in his PW.

Stop using passwords, use pass phrases

[MobyDisk]

Pass phrases: Stronger. More easily remembered. Just stop using the word "password" all together. It gives people the wrong idea.

passwords and language?

[cenc]

I have asked this a couple times before, but I still have not been able to find a good answer.

What happens with passwords in other languages, and more specifically forcing the use of UTF-8 double bit characters? What about using passwords in multiple languages?

Most brute force password cracking at least uses a dictionary to get at the low hanging fruit, why not increase the size of the dictionary? What are there like million words or something like that in the English language (guess) vs millions Chinese?

It would seem just branching out to Spanish, German, or whatever combinations would greatly decrease the success of brute force attacks.

Re:passwords and language?

[lakiw]

What happens with passwords in other languages, and more specifically forcing the use of UTF-8 double bit characters? What about using passwords in multiple languages?

Most brute force password cracking at least uses a dictionary to get at the low hanging fruit, why not increase the size of the dictionary? What are there like million words or something like that in the English language (guess) vs millions Chinese?

It would seem just branching out to Spanish, German, or whatever combinations would greatly decrease the success of brute force attacks.

I've analyzed password lists in several languages, and it depends on how the hashing algorithm encodes the password, or more specifically how the program sends the password to the hashing algorithm. Aka the MD5 of an UTF-8 encoded password is different vs. the MD5 of a codepage encoded password. That gets really interesting when someone switches between languages mid-password, (aka half of a password in a right to left language such as Arabic, and the other half in a left to right language such as English). Oh, and yes, increasing the keyspace due to multiple alphabets certainly can hurt a brute-force attack, but not as much as you would expect if the password set is mostly from the same group. There are other patterns as well. For example non-English native speakers tend to use more number replacements, (aka 1 for a 'l', 3 for an 'e', etc), while English speakers favor symbol replacements, (@ for 'a'). Also, in a Spanish set, numbers at the front of the password, such as '123password', were much more frequent then I've seen in other datasets, (most people put the numbers at the end). Like all things though, these are just averages, so it's really hard to nail down the origin of a user based on their password unless they use a non-English word in it.

Re:passwords and language?

[cenc]

Great. So all we need to do is force computer systems to only accept passwords with at least one word in a language like Ojibawa

Miin-aan baash kimini-sij-i-gan bitooyin sij-i-gan-i bukwayszhiigan = blueberry pie

Re:Password strength vs. Validation Rules

[Binestar]

However, some sites _require_ special characters, while others _forbid_ it, etc, etc.

Indeed. Oddly enough, my WoW account allows for a stronger password than my bank account.

I no longer play WoW, but I still have an authenticator hanging above my monitor. Wish my bank supported tokens.

Alphanumeric--so what?

[Anonymous Coward]

One of my passwords is 8 characters, all alphanumeric, but completely random (no mnemonic, no word). There's no dictionary to give it to you. Brute force on ~2e14 (26+26+10=62, 62^8) possible passwords? Be my guest.

Even if there were no repeats (and the attacker *knew* there were no repeats), that's still 62!/54! possibilities, ~1e14. If the attacker could guess a *million* every second, that's like three years to search exhaustively (so, given a uniform distribution, the expected time is about a year and a half).

Stupid

[Kral_Blbec]

There is a very simple way to prevent 100% of brute force attacks. Permenant/temporary lockout after 3 failed attempts. Its a lot harder to make 100 million guesses when you can only make 3 per day.

Re:Stupid

[ddt]

Exactly. Moreover, the "use alpha-numerics" nonsense doesn't help much. A purely case-sensitive password 8 characters long with no alphanumerics can have 53,459,728,531,456 permutations. That's way more than enough when coupled with this simple permanent/temporary lockout technique Kral mentions above.

even if you are 100% correct

[circletimessquare]

"remember only this algorithm except for site xyz and site abc" is still a lot easier than "for 46 different sites, here is what i have remember uniquely for each one..."

Re:Password strength vs. Validation Rules

[Physics Dude]

As long as you keep it encrypted with a sufficiently strong key, is it really any different from using "one-and-only strong password for many sites"?

Yes.

When using one-strong-password for many sites you can't verify the security measures used to protect that password at any given site. They could be storing your password in plain text for all you know. Once one is compromised and linked to your personal information, that could potentially be used by an attacker to access other sites you use.

By using a keyring where only you have access to its password and how it's being treated (ie. not on some remote website), you avoid that problem.

low quality passwords for low quality sites

[danlip]

This doesn't tell us anything about how people use passwords in important situations. I use crap passwords for crap sites like rockyou.com. For any site I actually care about (banks, gmail) I use really good passwords (well, as good as they will let me use, some banks still don't allow non-alphanumeric characters). So all this study really tells us is what password people use when they don't give a crap.

Re:low quality passwords for low quality sites

[cycle003]

ITA. That's just what I was about to write.

put your PO Box address on your driver's license

[KWTm]

Address? Any long term ticket you might have for your subway or bus system will probably contain that. A student ID card will too. Library card? Of course, a drivers license would be the jackpot.

That's why I set my driver's license address to a PO Box. It was actually my hemi-geek wife who convinced me to do it; she had been doing it for ages.

When people ask, I say, "Why, yes, I do live in a tiny Post Office box."

I suspect, though, that many jurisdictions will not allow you to have a PO Box as the address on the driver's license.

Re:Password strength vs. Validation Rules

[DougInKY]

I agree about using KeePass. The data file is encrypted, it works on Windows, Linux, OSX (you have to install X) and they are working on a version for the iPhone and some other smart phones. I have been moving to strong passwords on any and all sites I use knowing that I have them all available in KeePass. A reallly great program.

There's nothing wrong with alpha-only passwords

[davidwr]

If your password looks like this sentence, then you should be okay even if you do not include the punctuation.

^^-- do not use this example as your password.

The key to good alpha-only passwords is they have to be long and hard to guess.

Re:There's nothing wrong with alpha-only passwords

[RockDoctor]

If your password looks like this sentence, then you should be okay even if you do not include the punctuation.

However, even a modicum of (correctly-applied) punctuation can make things *much* harder for the attacker! And as for ASCII art!

Re:Password strength vs. Validation Rules

[Cro Magnon]

I don't play WoW, but my most recent account that forbids special characters is, surprise, a bank account. :-P

Re:put your PO Box address on your driver's licens

[BobMcD]

I suspect, though, that many jurisdictions will not allow you to have a PO Box as the address on the driver's license.

If they did before, they probably stopped some time in the last decade.

Re:Password strength vs. Validation Rules

[AthanasiusKircher]

It is not just the mandatory password changes that increases the mess. It is also that each and every site has different validation rules.

Yes, and some get incredibly arcane and frankly, idiotic. A few years back, I needed to get the password reset on a school email account. I don't know why my old password wouldn't work, and the tech couldn't explain it to me. I went in to reset it manually.

I started entering in one of my rather long (15+ character) passwords that I often use, along with non-alphanumeric characters. (I have variations for generating alphanumerics when I need them for websites, etc.)

But it didn't complain about the non-alphanumerics or the length. It complained that I had some string of three letters in a row that was a "word," and thus was vulnerable to a dictionary attack. Okay, so I tried another long password that I knew didn't have a three-letter actual "word" in it. Again, it complained about this three-letter "word," even though it isn't actually a word... it's simply a three-character string.

While I agree that having a long string of alphabetic characters in the midst of a short password is insecure, it surely doesn't matter within a 15+ character password that includes a bunch of numbers, capitals and lowercase, and non-alphanumerics.

Yet the system wouldn't accept any of my passwords or their variants, even though any password-strength meter would say that they are extremely secure.

So eventually I entered an 8-character alphanumeric password composed of only lowercase letters and numbers that I knew I could remember on the spot, and it said okay, because I didn't have three letters in a row.

Later that evening, I changed my password to something better. But when I looked the online guide to selecting a password for this institution, ALL of the passwords it gave as examples wouldn't actually be accepted by the system.

And this is at one of the best universities in the US....

Re:Password strength vs. Validation Rules

[BobMcD]

If this is the case, isn't that sort of similar to the "Chuck Norris" password that Facebook used, only less secure?

And All Were From Wifi

[Anonymous Coward]

wifi is not secure people.

Re:And All Were From Wifi

[Anonymous Coward]

Neither anything on wire :b

Don't get over excited by your analysis guys...

[pev]

So... Like may people with half a brain I sent different passwords for different things. For my on-line banking I have a solid proper password you *can't* guess or brute-force. For myspace, random sites, occasional web-mail I use different easy to remember passwords because I care less about being compromised and more about being memorable. Unless your baseline assumption is that people use the same passwords for meaningless services as for critical services, this kind of analysis is very hard to draw conclusions from. Now, if this had been an analysis of the same number of passwords from an on-line banking service I'd be *much* more interested...

Re:Password strength vs. Validation Rules

[Jesus_666]

The problem is compounded by the fact that many sites will force you to use fairly short passwords. Yes, !qAyXsW2 is immune to a naive dictionary attack but so is please turn on your magic beam*. The latter has the advantage of being easy to remember but won't work on many sites with policies that restrict passwords to eight to eleven characters because apparently they don't want to pay for the extra storage space they'll need to store the hash of a longer password.



* Why yes, I do have Mr. Sandman stuck in my head right now.

Re:Password strength vs. Validation Rules

[Anonymous Coward]

What do you do if you are at a friend's house and need to check your bank statement?

Re:Password strength vs. Validation Rules

[nEJC76]

Do you do your banking at friends house regularly? If you do, having a weak password is the least of your worry ...

Re:Password strength vs. Validation Rules

[nEJC76]

I use GPass on ubuntu ( http://projects.netlab.jp/gpass/ ) - I love the way its simple password generator works. Plus its only 1 file I have to keep synced between different computers ...

Most password requirements are equally garbage

[bgspence]

Less than 4% of my passwords protect anything I care about. Most are to protect sites from spam users or to elicit demographic data from me. They don't protect me. It is no loss to me if someone uses my registration to their system.

Even my ATM card pin, a very uncommon 4 digit number, is of no real need of protection. I've had my accounts hacked in some of the big security leaks and the bank absorbs the loss.

Insecurities

[Geckomayhem]

Correctly, that should read "fewer" than 4%. But grammar aside, that's unbelievable. I guess 96% of people just don't care whether they have a secure login or not. My most secure password belongs to my World of Warcraft account. Oh shoot, I'd better go change it. >.>

Re:put your PO Box address on your driver's licens

[Opportunist]

Not possible here because it's a legal document and such documents require a real address.

Before you ask, yes, in my country you have to register with the government when you're moving and deposit your new permanent address, not doing it violates the law. It didn't occur to me that this is kinda invasive 'til a friend in the US asked how I could live in such a fascist country...

Re:Password strength vs. Validation Rules

[gmr2048]

I carry a portable version of KeepPass on a USB drive. Of course, I keep the encrypted KeepPass.

Hmmm

[BrokenHalo]

Studying users' passwords isn't new, but it might be argued that your password (no matter how strong) is totally useless if a server can just hand it out with 31,000,999 others at the same time to anyone who asks.

Why not remember a pattern?

[Anonymous Coward]

I find it easiest to remember a keyboard pattern. Something like every third character on a row of the keyboard. So your password could be something like:

cn,3^9dDHLeyo]

When you need a new password, just shift your pattern over a key.

Re:Password strength vs. Validation Rules

[exploder]

Barely, remotely similar, yes, but not at all less secure. To begin with, that was a master password into other people's stuff, whereas in this case I have full control over my own password management. And I don't know if they come right out and say it in the instructions, but the idea is that you don't use the name of a celebrity and/or recent internet meme as your "strong master password".

It's no less secure than using OpenID or similar to access many different sites.