Analysis of 32 Million Breached Passwords

An anonymous reader writes "Imperva released a study analyzing 32 million passwords exposed in the Rockyou.com breach. The data provides a unique glimpse into the way that users select passwords and an opportunity to evaluate the true strength of these as a security mechanism. In the past, password studies have focused mostly on surveys. Never before has there been such a high volume of real-world passwords to examine." Most interesting to me was that in the sample, less than 4% used any non alpha-numerics in their #$#%'ing passwords.

Comments

Password strength vs. how often you change it

[Anonymous Coward]

My company wants me to change my pass every 2 months. Guess what happens to the password strength over time.

Re:Password strength vs. how often you change it

[Rockoon]

My company (over 10,000 employees, not in the computer industry) does the same thing, but the really annoying part..

..it must be EXACTLY 2 letters, followed by EXACTLY 4 digits.

So even allowing for upper case (which I am not sure that it differentiates), the total password space is only 2704000000.

The size of this space can conveniently fit into a 32-bit value, which is probably what they are doing: storing passwords in an integer field.

Did I mention that they pay our IT department $11/hour?

Yeah, all my coworkers do the same thing: use the same 2 letters every time they need to change it, followed by "1111" then "2222" then "3333" and so forth...

Re:Password strength vs. how often you change it

[mrcaseyj]

For places that require password changes I'd suggest to take a very long base password with a month appended and hash it, then convert the hex hash into printable characters. Maybe something like this:
echo -n "LongUnchangingBasePasswordSiteNameJan2009" | sha512sum | xxd -r -p | tr -cd [:print:]
This has the advantage of being highly secure and easily memorable, but someone shoulder surfing your password wouldn't be able to figure out what your password is next month. People more familiar with windows could suggest a command available on that system. Be careful to do this on a computer where the command will not be stored in a command history.

I'm planning to go all lower case with my passwords though. I'll have to make my passwords 50% longer, but I think they'll be easier to type and almost as easy to remember as totally random ones. In fact my error rate with the totally random ones is an issue with shoulder surfing because I make mistakes and have to retype it so often, giving shoulder surfers repeated sightings, and because the numbers and symbols and shifts slow me down.

Re:Password strength vs. how often you change it

[Anonymous Coward]

At my work we are all required to logon with Smart Card and PIN. Nobody has these "passwords" of which people speak. Shoulder surfers don't have my Smart Card, so lots of luck if they think getting my PIN was very important.

Re:Password strength vs. how often you change it

[WuphonsReach]

My company wants me to change my pass every 2 months. Guess what happens to the password strength over time.

It's a leftover idea from a bygone decade.

The primary advantage of a required monthly or bi-monthly change is that if a password is compromised, it's only useful for about 1/2 of the expiration period. So it's a way of reducing risk in the case of accidental or nefarious disclosure.

But the big downside is that it requires users to be constantly learning new passwords every month or so. And unless these passwords are automatically assigned, users WILL pick weaker and weaker passwords over time or passwords that fit into an easily remembered sequence. So you really end up back where you started.

Forced password renewal is a valid strategy in a small number of cases. Such as a system which protects billions of dollars in assets or is super super critical to the business. But in those cases, there should be 2-factor authentication in play anyway and the passwords probably only need to be changed every 3-6 months and should be randomly assigned.

For end users? Limit their permissions, force complex passwords, but don't require them to change frequently (*maybe* once every 2 years). Tell them to go ahead and write the passwords down and store them in their wallet next to their credit cards. Which is at least a huge step up from putting it under the keyboard or stuck to the monitor.

Longer passwords are also easier to remember if they are used frequently (at least daily). But for some users, it may take as long as 2-3 weeks for them to remember it without looking.

Re:Password strength vs. how often you change it

[Ploum]

That's highly annoying. Even more if this is a web proxy password and that, each month, you have to change the proxy password for every f*** application that connect to the web (That Windows OS is really really bad).

I took another approach :

1) informing the computer dpt that it's a very bad idea. Here are some links:
http://www.cerias.purdue.edu/site/blog/post/password-change-myths/
http://ploum.frimouvy.org/images/dilbert.png
http://ploum.frimouvy.org/?177-le-gilet-de-sauvetage-et-le-tgv (in french)

2) of course, they won't change. So consider : what will you loose if you password is corrupted ? Nothing personal. Only stuffs from the company that didn't want to hear you. Should you have a more complicated life because they are too dumb ?

3) if the answer is no, simply change your password to :
yearmonth. That makes it : january2010. Easy to remember and will change all the time.

4) Share the tip with your collegues. Anyway, they should have access to my files, you are working together, isn't it ? Guess what ? Most thought it's a good idea and do the same.

Result : easier work for everybody.
Security ? You tried to improve it, you were not listened. That's their problem now.

PS: of course, be careful to analyse what you are sharing and what are the risk. I will never do that for my personal stuffs.

PPS: even better solution. Try to think about systems that cannot change their password, like the backup system. Usually, that login/password has access to everything in the company, doesn't change and is really easy to find if you know where to look. (and is, 99%, something like "permanent_pass" or "autologin"). That's make your life even more easier.

Re:Password strength vs. how often you change it

[Anonymous Coward]

.., followed by "1111" then "2222" then "3333" and so forth...

Dont you mean so 4444th.

Re:Password strength vs. how often you change it

[nine-times]

..it must be EXACTLY 2 letters, followed by EXACTLY 4 digits.

That's retarded.

I've thought about this sort of thing before, where password policies also have the effect of narrowing the number of possible passwords. For example, it's pretty standard for a company to have a policy like, "Your password must be at least 10 characters, contain at least one capital letter and one lower case letter, contain at least 1 number and one non-alpha-numeric character." And yes, it's true that keeping these policies has the effect of increasing the number of combinations, but it also is simultaneously narrowing the combinations.

If a hacker knows this policy and were to try a brute-force attack, they would be able to disregard any possible passwords made of 7 characters or less. They would be able to get rid of all combinations that were all lower-case, all upper-case, or even all alphanumeric. I haven't done the math and I'm sure that requiring some of these things are still a net gain, but it struck me as funny. Like if someone were to try a very clever brute-force attack that didn't bother trying all-alphanumeric passwords, then "password" would in that case be a safer password than "*pQQ\K6"XSiM". It might take him a million years to get to "*pQQ\K6"XSiM", but he'd never try "password".

Re:Password strength vs. how often you change it

[Opportunist]

Hey, I used to use a password that could be found on my coworker's monitor, in plain view. I had the idea when they required me to come up with a secure, 10-digit-or-more password containing alphanumeric characters and his monitor's serial number fit the bill.

Re:Password strength vs. how often you change it

[pastafazou]

That's nothing. At my job, the passwords are randomly generated, so nobody has any passwords OR smart cards/pins to steal. We have to use a password removal tool to reset the password to "12345" just so we can log on in the morning!

Re:Password strength vs. how often you change it

[clodney]

It may narrow the nominal keyspace, but it almost certainly increases the average keyspace that needs to be searched. Without the complexity requirements most people will use a dictionary word or something like that. And the company wants to keep all the accounts secure, so it has to care about the average password.

And think of it this way - in a keyspace that requires 10 numeric digits, what percentage of the total keyspace is consumed by anything containing less than 10 digits? seems to me you have only given up 10% of the space, and an even smaller percentage if you consider the full printable range of characters instead of just numerics.

Re:Password strength vs. how often you change it

[zorg50]

Hopefully he doesn't decide to get a new monitor any time soon.

Re:Password strength vs. how often you change it

[Anonymous Coward]

Luxury! At my job, every morning we have to beat a confession out of a captive Yorkshireman, and hash that with each employee's ID number.

Re:Password strength vs. how often you change it

[kalirion]

Given the above policy, a smart hacker would bruteforce the following template:

(1 capital letter)(7 lower case letters)(1 number)(1 special character). With a dictionary attack for the first 8 characters.

Password1!

Re:Password strength vs. how often you change it

[rickb928]

Funny.

People familiar with Windows won't be recommending a command available on Windows. Your example is several commands. Which one?

Seriously, strong passwords require some creativity and of course some investment by the user. If you've administered a fairly large (or even small) corporate network for any length of time, you know users generally are not overly concerned about security until they are personally inconvenienced. Then they blame everyone else.

This is a corporate issue, as important as financial controls and marketing. Some corporations, of course, suck at those functions too, so no surprise. But security is a core process nowadays. If you value your job, you will be diligent at your password management. If not, well, you take the change that you will be reading about the reasons for the demise of your employer while you search for your next I Hate Passwords job.

Where I work, I currently have 12 unique passwords, used on 27 differnet systems. My personal passwords are a different matter, when I use over 50 unique passwords for various online stuff.

I use combinations of

- variations on a theme; like password1, password2, password03, passwordH, passordT%
- reversed passwords; carrot, torrac, trouble, elbuort
- word-sounding passwords; c@rr0T, St!ck, b@g3!, myb!rtH@^, these are bad examples.

Since my eBay account was compromised about 2 years ago, I've gotten harder about passwords.

Now my wife, she seems to cling to passwords like lost children. I'm working on her.

Passwords are as necessary as rain.

Re:Password strength vs. how often you change it

[exploder]

I wish someone (ISO? NIST? DOHS?) would establish an honest-to-god STANDARD for what makes a strong password. For instance, >=8 characters, at least one each of upper, lower, numeric, other.

Why? Because I use a fantastic Firefox addon called Password Hasher (and there are other good ones for the same purpose), which uses a hashing algorithm to combine the site's domain name with my own personal master password to create a different, secure password for every account, while only forcing me to remember one nice, strong password.

The problem is, different sites require different kinds of passwords, to the point where NO combination of settings for length and content of the generated password can work for every site. PH does a good job of remembering the individual sites' settings on my own computer, but it gets a lot less convenient when I'm on someone else's.

Re:Password strength vs. how often you change it

[epine]

technically an all lowercase password is just as secure as any other password

You must have missed the bulletin which explains that security consists of becoming a less inviting target than the guy beside you. If the sheep tend to use all lower-case passwords (baaaaaa), then you're best off wearing a different cloak.

it is probably also better to start all of your passwords with a 'z' since they tend to check in alphabetical order [citation needed]

I thought script kiddies were all playing on the streets of the Facebook favela these days, and that unemployed Russian PhDs were out there flexing their combinatorics.

From that training set, it would be pretty easy to code up a Markov letter bigram or trigram model and enumerate from least entropy on up (a near approximation to this is plenty good enough). My guess is that that nine letter all-lowercase passwords would be on roughly the same tier as six letter passwords with multiple punctuation marks.

This study was a bit stupid in reporting password strength. A nine letter password from two symbol sets will be close in strength to an eight letter password from three symbol sets, as long as the nine letter password doesn't build upon trivial substrings.

I think this is why the recommendation demands three symbol sets: it gives users less scope to squander entropy that a longer, ordinary character password ought to have.

One time, as a joke, a very long time ago, a devious coworker put a keystroke logger on a paranoid coworker and the password revealed was 6uldv8. Apparently there's more than one reason to keep your passwords secret.

I generate all my own passwords starting from suggestions offered by OpenBSD's apg utility. For crap sites, I try to achieve an estimated entropy in the vicinity of 30 bits and scale up to about 60 bits at the paranoid end: 5*6 (a brief burst of line noise), 6*5, 7*4, 8*4, 9*3, 10*3 (baby talk).

For longer passwords, you can pair two words from a large dictionary (about 13 bits entropy each) and then add another four bits with a single symbol corruption. Routinely sticking an ! in between two obscure dictionary words is not a good idea if you're concerned about cross entropy, where the attacker already knows some of your passwords by other means. I avoid consistent corruption templates, because I don't want to lower the cross-entropy on a set of partially exposed passwords too severely.

For most purposes, even 20 bits of entropy is a good start, if the attack involves knocking on the front door. Not so good if the hashed password file is compromised behind the scenes. Even 30 bits is pathetic in the latter case, but this reasonably well mitigated by never sharing a password across multiple sites.

At 40 bits, the attacker begins to ask whether there's any money involved. A high-end video card, properly coded, would sneeze at 40 bits. However, properly coded still isn't free,

By the time you get to 50 bits, it's time to start asking whether you've seriously pissed off the wrong person. Quite doable, with a modicum of enmity, but not worth the bother if the game is shooting fish in a barrel at least expense. Armour piercing rounds are deployed sparingly.

I wouldn't be the least bit surprised that the NSA has accumulated a dictionary of the trillion most common passwords, sorted by descending order of frequency, covering all languages and source lexicons of the world (pets, pet names, Klingon, Thalassian, Qenya) permuted into all manner of imposed password template schema. I'd be shocked if they hadn't. For that matter, Google could build a good approximation to that dictionary just using their lexigram index, on roughly the terascale.

Shedding about 10 bits of protection per decade, we'll soon need to return to Beowulf era culture where reciting your ancestors back to the garden of Eden was the gold standard for accurate recall.

I wish every login box on every site had a

Re:Password strength vs. how often you change it

[Carnildo]

I wish someone (ISO? NIST? DOHS?) would establish an honest-to-god STANDARD for what makes a strong password.

That's impossible. A password's strength is related to its Kolmogorov complexity, and Kolmogorov complexity is incomputable.

Re:Password strength vs. how often you change it

[The Archon V2.0]

I hate it when systems specifically require odd crap though...requiring a mixed password (must have 2 of the 3 following features or something) is good but saying that my 8-character password must include at least two numbers is actually decreasing the keyspace fairly significantly since you can limit several parts of the password to 0,1,2,3,4,5,6,7,8,9 as opposed to every single letter/number/punctuation.

My personal favorite dumbass password requirement was an internal company one that checked your password for dictionary words and ruled any dictionary word in a password invalid. I thought that was stupid, and then I found out by accident that the dictionary contained "it". And then I realized it contained every two letter word I could think of. So "4!h8B^%iT2" was a weak password because iT is a dictionary word (?!?) and thus the password will be ZOMG dictionary hacked.

We also had like, six different internal systems, each with their own password requirements. One needed at least one number, another normalized mixed case to lowercase, one just didn't care about anything, etc. Passwords all had to be changed, but the dates on which they did was different. (Payroll password changes once a month. I only needed to access the payroll system once a month.)

Ultimately, even the dedicated never-write-it-down people like me had to give up and write their passwords down. I had my cheat sheet in my wallet, but a lot of people just had them at their desks. (Only monitor post-it-notes were caught by management. Paper under the keyboard? Never caught. In a desk drawer? Like the managers are gonna go around opening every drawer in the building!)

So, yay security?

Have they released the list anywhere?

[damn_registrars]

I think it would be interesting to search the passwords I use against the list. I like to think that my passwords are pretty good, but it would be interesting to see how similar they are to the passwords that were obtained and used in the study.

Re:Have they released the list anywhere?

[QuantumRiff]

Post it here, I'll check it for you.. Don't worry, Slashdot blanks your password.

My password is *******

See, blanked out!

Re:Have they released the list anywhere?

[bcmm]

hunter2

Re:Have they released the list anywhere?

[Anonymous Coward]

Wonderful, mine is also blanked out: hunter2 :)
See?

Obligatory bash.org reference: http://www.bash.org/?244321

The Top 10

[goldaryn]

1. 123456
2. 12345
3. 123456789
4. Password
5. iloveyou
6. princess
7. rockyou
8. 1234567
9. 12345678
10. abc123

By a massive coincidence, these happen to be the passwords for their respective /. userids!

Re:The Top 10

[Anonymous Coward]

Is there a reason to have a really strong password on "rockyou.com"?

Maybe since it integrates with facebook and the like?

I'm really annoyed when all I want to do listen to some online music (ie pandora, etc) and the web site gets pissy because I choose pandora as my password.

Why should I care?

Why does password strength matter?

[geekmux]

...Most interesting to me was that in the sample, less than 4% used any non alpha-numerics in their #$#%'ing passwords.

Er, does it REALLY matter anymore the strength of your password with the FBI using post-it notes as a search warrant? I mean I hate to say that, but seriously.

On a related note, what pisses me off even more is going to a website and trying to use a strong password and their system doesn't allow it.

Re:Why does password strength matter?

[AndersOSU]

Well it doesn't matter (and it never did) if you're selecting passwords so the FBI can't read your secret diary.

If, on the other hand, you're concerned about someone in Russia gaining access to your credit card it still matters.

Re:Why does password strength matter?

[Omegium]

Do you really think that the FBI is your greatest enemy online?
IT IS NOT.
It is nice to think that you are enemy of the state nr 1 and that everybody cares about your secrets, but that's not the case. You should worry about phishers and other criminals, not about law enforcement. And they don't use search warrants. They need to crack passwords

Re:Why does password strength matter?

[marcobat]

Someone in Russia can just hack into a fbi account using some IE or PDF hole, then send a false subpoena to gain access to my account. The subpoena will never be looked on twice or reviewed by anyone and my provider will promptly comply. There is no escape :-)

actual list of passwords?

[naz404]

Does anyone have the list of passwords itself?

It would be fun to perform one's own statistical analysis of the list :)
Here's the top 20 most common passwords used according to the report:
Rank Password # of Users
1 123456 290731
2 12345 79078
3 123456789 76790
4 Password 61958
5 iloveyou 51622
6 princess 35231
7 rockyou 22588
8 1234567 21726
9 12345678 20553
10 abc123 17542
11 Nicole 17168
12 Daniel 16409
13 babygirl 16094
14 monkey 15294
15 Jessica 15162
16 Lovely 14950
17 michael 14898
18 Ashley 14329
19 654321 13984
20 Qwerty 13856

Re:actual list of passwords?

[enbody]

http://thepiratebay.org/torrent/5232943/RockYou.com_UserAccount-passwords

Re:Limited in Password size and chars

[Scutter]

The report makes it painfully obvious that passwords are an ineffective way to secure information because too many people find strong passwords cumbersome. Maybe we need to come up with something better.

Look at the user base for RockYou...

[adosch]

RockYou is a MySpace photo/video sharing site (from what I could gather from googling, never used it myself) and it's certainly no excuse that people implement bone-head password choices such as the 10 shame shame list FTFA. However, I didn't really see the article address or even consider that their target users on the RockYou site aren't generally what geek, wanna-be security folks on /. are security conscious. I'm glad the analysis and study was done, but I'm really not surprised. If people are picking '123456' as the #1 password, as much as we have a PEBKAC situation on our hands, fault RockYou for not implementing some sort of semi-secure password standard.

Keep in mind, this is RockYou.com

[tunabomber]

Is it even worth the effort of coming up with a secure password for that site? If I had for some reason found it necessary to register with such a vapid site I would have just re-used one of my low-security passwords (which many other sites have access to). It isn't too surprising that nobody cares whether someone else is using their account to steal their noisy, eye-burning flash videos. What is far worse is if people are re-using passwords from much more important sites. In this case, it doesn't matter if your password is a random string of letters, numbers and special characters.

Why Is That Interesting?

[Dun Malg]

Most interesting to me was that in the sample, less than 4% used any non alpha-numerics in their #$#%'ing passwords.

Why is it any surprise that people tend to approach passwords as a pass-WORD? It has to be something they can remember, and remembering a string of characters they can't pronounce is far more difficult than remembering (say) their favorite basketball team and the year they graduated high school.

Re:Why Is That Interesting?

[Megane]

There's no reason something can't be both pronounceable and secure. Start with two nonsense syllables, and add a special character between them. Not quite as "secure" as a completely random password, but much less likely to be written down, plus some of the letters can be l33t3d for variant forms. Make three base words for various levels of usage (one for regular web stuff, one for login passwords, and another rarely used for important stuff), and you can even keep around hints for rarely used passwords with one letter and a bunch of ## or @@ symbols for the parts that change.

A good way to make something pronounceable is with the old "D&D character name generator" type of program, making a CVCCVC name. So you get, for instance, DORLOT (FWIW, I cheated just now and used an alpha D20), and don't tell me you can't pronounce that. Then some variant passwords from that would be "dor%lot", "d0r##lOt", and "D0r:*!o+". They're still "dorlot", but the result is a lot more secure than picking a dictionary word and puts you into that tiny wedge on TFA's pie chart. And while they're all similar, they're different enough that a compromise in one place won't let someone get into every account you have anywhere.

Re:Given the sample set, is it a surprise?

[Blade]

Until they break into your facebook account and use that to socially engineer access to something else and escalate their way into something beyond that. Or they access your facebook account and start taking guesses are the answers to the security questions you're forced to use (what school did you go to, what was your first pet called, etc., etc.)

There are so many links between so much of what we do online that you would do well to treat it all as worth securing equally.

Not really suprising

[jmauro]

Since most sites have a bunch of silly restrictions (no special characters, no more than 8, etc) most systems if the don't enforce strength, randomness, etc will degrade down to the lowest level where the password will work on all the systems.

Security should not depend on strong passwords

[AbbeyRoad]

The article says that in 20 years users have not gotten better at creating good passwords.

Logically then the solution is NOT to get users to take "password security seriously". This is like trying to stop VD by convincing teens to abstain from sex - it's in the never-going-to-happen catagory.

The solution is to mitigate the damage of a brute force attack - when bots make password guess attempts, you need counter-"bots" to detect patterns of access and then block IPs, warn users, or disable accounts. This is a form of intrusion
detection.

This is not to mention that for most web accounts, a break in doesn't matter - what damage can the hacker really do? Like post things-you-didn't-say and trash your reputation on www.social-site-for-people-who-spend-to-much-time-online.com? Heck, that's major dude.

Just a wild guess here, but let's ask: Are there web site owners who think the logins they host are way more important to their customers than they actually are?

Hmmm

-paul

Why surprising?

[argStyopa]

"Most interesting to me was that in the sample, less than 4% used any non alpha-numerics in their #$#%'ing passwords."

Not surprising at all, because the rules for what you CAN use as passwords are so inconsistent. Some places REQUIRE non alphanumerics, but have a limited choice of what you can use. Some don't accept ANY non alphanumerics, some will accept them but again it's different from site to site.

I don't know about you, but I've probably got 100 different passwords rattling around in my brain. I'd guess most people are like me in that they see passwords as a necessary evil but otherwise a giant pain in the ass, and so accept the slight increase in security risk by using a system that changes predictably (at least for me) from site to site. So I'm not going to use a base-password or base-concept that includes any characters that might be disallowed on some other site.

Re:Why surprising?

[DrinkDr.Pepper]

Southwest.com allows you to create a password with non alpha-numeric characters, but then you can't log in with your password!

Too often is bad too.

[suso]

I dealt with a bank once that expected its customers to change its passwords every 2 weeks. So obviously what happened is every time a customer needed to check their bank account, probably once a month, they were locked out. Now this isn't necessarily the problem here. The problem is that with people having to call in every time to reset their password, it becomes such a norm that it probably drastically increases the potential for social engineering.

12345?

[selven]

That sounds like a combination that an idiot would put on his luggage.

repost from my comment on nyt:

[circletimessquare]

intelligent password management:

pick something you will always remember say "frankie45"

lets say the website you are visiting is facebook.com

so your password there will be "frankie45face"

and your password at twitter.com would be "frankie45twit"

in other words, you want to use what's called an algorithm

make your ALGORITHM unique, not your password. so maybe your algorithm would be "'twenty23' plus the second through fifth letters in the website's name plus my daughter's birthday" or whatever

the point is: having one password across all websites is a vulnerability, and having simple passwords is a vulnerability. so instead, don't remember a password, remember an ALGORITHM that you can use to recreate your password for any site on the fly

by the way, i got this idea from a slashdot thread, and it was an eureka moment for me, and i went about resetting all my passwords

i forget the thread or the user id of whoever made the comment, but it was a password related subject matter and i think it was in the last 6 months or so

whoever you are, and i hope you read this: thank you!

Re:repost from my comment on nyt:

[Culture20]

pick something you will always remember say "frankie45" lets say the website you are visiting is facebook.com so your password there will be "frankie45face" and your password at twitter.com would be "frankie45twit"

And if you use the same username on all of the sites, all it takes is one unscrupulous (or incompetent) site manager to quickly have your other accounts accessed.

Obligatory Spaceballs Reference

[Pollux]

Roland: One.
Dark Helmet: One.
Colonel Sandurz: One.
Roland: Two.
Dark Helmet: Two.
Colonel Sandurz: Two.
Roland: Three.
Dark Helmet: Three.
Colonel Sandurz: Three.
Roland: Four.
Dark Helmet: Four.
Colonel Sandurz: Four.
Roland: Five.
Dark Helmet: Five.
Colonel Sandurz: Five.
Dark Helmet: So the combination is... one, two, three, four, five? That's the stupidest combination I've ever heard in my life! The kind of thing an idiot would have on his luggage!

-----

President Skroob: What's the combination?
Colonel Sandurz: 1 - 2 - 3 - 4 - 5.
President Skroob: 1 - 2 - 3 - 4 - 5?
Colonel Sandurz: Yes.
President Skroob: That's amazing! I've got the same combination on my luggage!

One had to dig deep for this gem...

[pongo000]

I don't know if anyone bothered to read the full report, but I found this recommendation tucked in at the end of the report:
ast character in the password. (pg. 3)

Allow and encourage passphrases instead of passwords. (pg. 5)

And I say amen, amen to that. I've done quite a bit of personal research in this area, and have found passphrase systems to be far superior in terms of security and ease of use/recall over random combinations of characters. For years I've used the list provided at Diceware to generate my passphrases, and I have no problem still recalling little-used 5- or 6-phrase passphrases years later.

The idea that random sequences of characters is somehow superior to a passphrase of equal entropy is a myth borne of ignorance and a resistance to change. So long as companies that know better keep forcing their minions to adhere to a strict range of letter/number combinations, we'll continue to be saddled with the problem presented by the Rockyou.com crack.

Re:Same problem as 20 years ago

[CaroKann]

The article concludes that after 20 years of dealing with this problem, "It’s time for everyone to take password security seriously". That is the wrong conclusion. If things have not improved after 20 years, then they are not going to improve ever.

The password concept needs to be replaced with a better concept. I think the password idea has been proven to be a bad concept due to human nature.

Re:Password strength vs. Validation Rules

[wwwillem]

It is not just the mandatory password changes that increases the mess. It is also that each and every site has different validation rules. If I could use one-and-only strong password for many sites, then I could remember that. However, some sites _require_ special characters, while others _forbid_ it, etc, etc. So each time you end up inventing something on the spot, and then two months down the road you've forgotten it.

I guess that I've 50 passwords to remember, so if I can't do that with just a few (I don't use the same password for my online banking as for my slashdot login :-) then it quickly becomes Post-it time again. Or worse, that little file on the PC desktop with a list of userid/passwd combo's.

A couple questions about passwords

[JSBiff]

I have a couple questions for some more security minded folks here on slashdot, about the 'conclusions' of the analysis in the linked article. . .

* "The shortness and simplicity of passwords means many users select credentials that will make them susceptible to basic forms of cyber attacks known as 'brute force attacks.'"

      Is this really true? Here's why I ask - most websites (though unfortunately not all), seem to lock your account if you don't get the right password in 3-5 attempts. Then, it may stay locked for 15 minutes, or 24 hours, or until you go through a process of some sort to verify the account (such as an automated email to the address on record, with a link you have to click in the email).

      If the website takes such measures, doesn't that shut down brute force attacks pretty fast, even with fairly simple passwords? If the website is doing that, and it shuts down brute force attacks, doesn't that mean that even a somewhat weak password can provide 'good enough' protection?

* While I'm sure that adding special symbols does make the password harder to brute force, isn't even an alpha-num password pretty strong if it's about 10-12 characters long and mixes both upper and lower as well as some numbers? Personally, if I was guiding someone about a password, and I know they have a hard time remembering complex passwords, I would urge them to a longer password instead of a more complex one, because the length makes the complexity grow exponentially, right?

* Sort of touching on the parent's point - appropriateness. We can't remember lots of complex long passwords, so I would think that we should get people to concentrate on remembering complex passwords for the things that most need them - particularly things which can be attacked 'offline'? By 'offline', I'm thinking of something like, say, an encrypted file (like a zip file or TrueCrypt volume file), and online passwords which protect truly important stuff like access to your network account at work, your bank account, Tax-site password, etc.

Of course, there are always 'password safe' type applications, but I've never really liked the idea of a password safe, simply because I don't necessarily have access to it whenever I need a password. Take, for example, going to a library, FedexKinkos, or college computer lab, and needing to access a password protected site. Even if you *do* have your password safe file, on a USB key (for example; or maybe you can download your 'safe' from a site online), you may not be able to run the password safe software to decrypt it. Even if you *can* run the password safe file from the USB key, on the public computer, do you really trust that public computer to decrypt all your passwords? I just don't like the concept of password safes, for these reasons.

Re:Password strength vs. Validation Rules

[Synn]

Or worse, that little file on the PC desktop with a list of userid/passwd combo's.

Just use a password store utility instead of a text file. They encrypt a file that stores the passwords.

security now had a show about this

[jollyreaper]

I understand why you don't want to use dictionary words for passwords, too easy to brute-force. Though how likely is it that servers these days would sit still while a single account fails login ten thousand times? I know once the hacker is in, he can then run the hash file against the dictionary and back into the passwords of other accounts. But wouldn't even a dictionary word with a number or two after it be fine? duck1234 should be just as secure as duck!@#$, right?

I'm running through the ways you can get hacked and what a secure password would mean.

1. Guessing by a person sitting at your computer, brute force hacker from outside, running the dictionary against the hash -- strong is good.
2. Your PC gets rooted, your keystrokes are captured -- strength doesn't matter a bit, you typed it in for the hacker and he won't even have to touch the keyboard when his scripts hit your account and drain it.
3. Data breach and your password is stolen -- Why was it stored in plaintext? Regardless, they have it and can copy and paste if they use it.

The consensus on security now was that draconian policies on the part of IT without any seeming rhyme or reason to the employee will simply foster non-compliance and animosity towards IT.

Design your own coding system

[aussersterne]

so that you don't need to be sitting in from of your own Linux command line to remember your passwords. I use a base of two nonsense pairs (things like AkB and jzQ) and then use positions 4 and 5 in the password as a code for the type of site and "rank" in terms of frequency of use, for example (these aren't mine but you get the idea):

! (shift-1) = social networking
@ (shift-2) = banking
# (shift-3) = utilities / bill payments

1 = site in this category I use most
2 = second most used site
3 = third most used site

and so on. So the base for something like Facebook using a system like this might be A@B!1jzQ, for Twitter maybe AkB!2jzQ, and for my primary bank account AkB@1jzQ (invariant components AkB and jzQ, with @ [for banking] and 1 [for most used] sandwiched in between them).

Then, I postfix the password with the number of the instance of the password.

A = first use
B = first mandated change
C = second mandated change
D = third mandated change

and so on. So after the third change, my primary banking password at a bank might be:

AkB@1jzQD

After they ask me to change it again, it will increment to:

AkB@1jzQE

and so on.

This way, there is always a base of predictability to my passwords (usually enough to get it within three tries) and the variable information is context-based in a way that is only meaningful to me and no two sites will ever share the same password.

The only place this falls down is when sites mandate their own password structure (max or min length, etc.) but it usually works (includes uppercase, lowercase, symbols, and numbers, which is enough to make most of them happy) and the few sites that don't allow such passwords are far enough between to stand out in my memory, meaning that I don't forget the specially-formed exceptions that I created for those sites.

A system like this won't work for everyone, but for most people with a reasonable IQ, it's good enough, once you can get them to buy into the need for password security and for them to design their own system.

Wow

[Quiet_Desperation]

No "swordfish", huh?

Re:Password strength vs. Validation Rules

[nickyj]

KeePass is an excellent utility, available for Windows, Linux, and other platforms. It's simple, quick to use, and configured correctly, you will only have to learn one password the one to unlock the encryption file.

Passwords

[Stooshie]

I worked for a company that ran a birth/death/marriage certificate site. People were having problems logging in, so we kept a log of passwords that did not result in a successful login.

We found that one of the most commonly typed passwords that was denied was "case-sensitive".

Needless to say, we soon took off the "Your password is case-sensitive" text from the login page.

Faulty Data in Report Linked in Summary

[mnslinky]

I've been playing around with the password file, and there are some gross errors in the report.

First, their top 20 list has many passwords with capital letters, where none actually exist in the 'real' top 20. Also, their numbers are off. I am guess they used a case-insensitive match, which for most passwords will not work. The 'real' top 20, which case respected is:

290729 123456
79076 12345
76789 123456789
59462 password
49952 iloveyou
33291 princess
21725 1234567
20901 rockyou
20553 12345678
16648 abc123
16227 nicole
15308 daniel
15163 babygirl
14726 monkey
14331 lovely
14103 jessica
13984 654321
13981 michael
13488 ashley
13456 qwerty

You can download my list of all common passwords used by more than 1000 people at http://www.secure-computing.net/files/count_gt_1k.txt (1KB file) which maintains case. A file without the counts is at http://www.secure-computing.net/files/gt_1k.txt for use with john, etc.

Stupid

[Kral_Blbec]

There is a very simple way to prevent 100% of brute force attacks. Permenant/temporary lockout after 3 failed attempts. Its a lot harder to make 100 million guesses when you can only make 3 per day.