Slashdot Mirror

← Back to Stories (view on slashdot.org)

Analysis of 32 Million Breached Passwords

Posted by CmdrTaco on from the trust-no-1 dept.

An anonymous reader writes "Imperva released a study analyzing 32 million passwords exposed in the Rockyou.com breach. The data provides a unique glimpse into the way that users select passwords and an opportunity to evaluate the true strength of these as a security mechanism. In the past, password studies have focused mostly on surveys. Never before has there been such a high volume of real-world passwords to examine." Most interesting to me was that in the sample, less than 4% used any non alpha-numerics in their #$#%'ing passwords.

25 of 499 comments (clear)

  1. Password strength vs. how often you change it by Anonymous Coward · · Score: 5, Insightful

    My company wants me to change my pass every 2 months. Guess what happens to the password strength over time.

    1. Re:Password strength vs. how often you change it by Rockoon · · Score: 4, Informative

      My company (over 10,000 employees, not in the computer industry) does the same thing, but the really annoying part..

      ..it must be EXACTLY 2 letters, followed by EXACTLY 4 digits.

      So even allowing for upper case (which I am not sure that it differentiates), the total password space is only 2704000000.

      The size of this space can conveniently fit into a 32-bit value, which is probably what they are doing: storing passwords in an integer field.

      Did I mention that they pay our IT department $11/hour?

      Yeah, all my coworkers do the same thing: use the same 2 letters every time they need to change it, followed by "1111" then "2222" then "3333" and so forth...

      --
      "His name was James Damore."
    2. Re:Password strength vs. how often you change it by mrcaseyj · · Score: 4, Funny

      For places that require password changes I'd suggest to take a very long base password with a month appended and hash it, then convert the hex hash into printable characters. Maybe something like this:
      echo -n "LongUnchangingBasePasswordSiteNameJan2009" | sha512sum | xxd -r -p | tr -cd [:print:]
      This has the advantage of being highly secure and easily memorable, but someone shoulder surfing your password wouldn't be able to figure out what your password is next month. People more familiar with windows could suggest a command available on that system. Be careful to do this on a computer where the command will not be stored in a command history.

      I'm planning to go all lower case with my passwords though. I'll have to make my passwords 50% longer, but I think they'll be easier to type and almost as easy to remember as totally random ones. In fact my error rate with the totally random ones is an issue with shoulder surfing because I make mistakes and have to retype it so often, giving shoulder surfers repeated sightings, and because the numbers and symbols and shifts slow me down.

    3. Re:Password strength vs. how often you change it by WuphonsReach · · Score: 5, Insightful

      My company wants me to change my pass every 2 months. Guess what happens to the password strength over time.

      It's a leftover idea from a bygone decade.

      The primary advantage of a required monthly or bi-monthly change is that if a password is compromised, it's only useful for about 1/2 of the expiration period. So it's a way of reducing risk in the case of accidental or nefarious disclosure.

      But the big downside is that it requires users to be constantly learning new passwords every month or so. And unless these passwords are automatically assigned, users WILL pick weaker and weaker passwords over time or passwords that fit into an easily remembered sequence. So you really end up back where you started.

      Forced password renewal is a valid strategy in a small number of cases. Such as a system which protects billions of dollars in assets or is super super critical to the business. But in those cases, there should be 2-factor authentication in play anyway and the passwords probably only need to be changed every 3-6 months and should be randomly assigned.

      For end users? Limit their permissions, force complex passwords, but don't require them to change frequently (*maybe* once every 2 years). Tell them to go ahead and write the passwords down and store them in their wallet next to their credit cards. Which is at least a huge step up from putting it under the keyboard or stuck to the monitor.

      Longer passwords are also easier to remember if they are used frequently (at least daily). But for some users, it may take as long as 2-3 weeks for them to remember it without looking.

      --
      Wolde you bothe eate your cake, and have your cake?
    4. Re:Password strength vs. how often you change it by Ploum · · Score: 5, Insightful

      That's highly annoying. Even more if this is a web proxy password and that, each month, you have to change the proxy password for every f*** application that connect to the web (That Windows OS is really really bad).

      I took another approach :

      1) informing the computer dpt that it's a very bad idea. Here are some links:
      http://www.cerias.purdue.edu/site/blog/post/password-change-myths/
      http://ploum.frimouvy.org/images/dilbert.png
      http://ploum.frimouvy.org/?177-le-gilet-de-sauvetage-et-le-tgv (in french)

      2) of course, they won't change. So consider : what will you loose if you password is corrupted ? Nothing personal. Only stuffs from the company that didn't want to hear you. Should you have a more complicated life because they are too dumb ?

      3) if the answer is no, simply change your password to :
      yearmonth. That makes it : january2010. Easy to remember and will change all the time.

      4) Share the tip with your collegues. Anyway, they should have access to my files, you are working together, isn't it ? Guess what ? Most thought it's a good idea and do the same.

      Result : easier work for everybody.
      Security ? You tried to improve it, you were not listened. That's their problem now.

      PS: of course, be careful to analyse what you are sharing and what are the risk. I will never do that for my personal stuffs.

      PPS: even better solution. Try to think about systems that cannot change their password, like the backup system. Usually, that login/password has access to everything in the company, doesn't change and is really easy to find if you know where to look. (and is, 99%, something like "permanent_pass" or "autologin"). That's make your life even more easier.

      --
      Ploum.net.
    5. Re:Password strength vs. how often you change it by Anonymous Coward · · Score: 5, Funny

      .., followed by "1111" then "2222" then "3333" and so forth...

      Dont you mean so 4444th.

    6. Re:Password strength vs. how often you change it by Opportunist · · Score: 5, Funny

      Hey, I used to use a password that could be found on my coworker's monitor, in plain view. I had the idea when they required me to come up with a secure, 10-digit-or-more password containing alphanumeric characters and his monitor's serial number fit the bill.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    7. Re:Password strength vs. how often you change it by clodney · · Score: 4, Informative

      It may narrow the nominal keyspace, but it almost certainly increases the average keyspace that needs to be searched. Without the complexity requirements most people will use a dictionary word or something like that. And the company wants to keep all the accounts secure, so it has to care about the average password.

      And think of it this way - in a keyspace that requires 10 numeric digits, what percentage of the total keyspace is consumed by anything containing less than 10 digits? seems to me you have only given up 10% of the space, and an even smaller percentage if you consider the full printable range of characters instead of just numerics.

    8. Re:Password strength vs. how often you change it by epine · · Score: 4, Interesting

      technically an all lowercase password is just as secure as any other password

      You must have missed the bulletin which explains that security consists of becoming a less inviting target than the guy beside you. If the sheep tend to use all lower-case passwords (baaaaaa), then you're best off wearing a different cloak.

      it is probably also better to start all of your passwords with a 'z' since they tend to check in alphabetical order [citation needed]

      I thought script kiddies were all playing on the streets of the Facebook favela these days, and that unemployed Russian PhDs were out there flexing their combinatorics.

      From that training set, it would be pretty easy to code up a Markov letter bigram or trigram model and enumerate from least entropy on up (a near approximation to this is plenty good enough). My guess is that that nine letter all-lowercase passwords would be on roughly the same tier as six letter passwords with multiple punctuation marks.

      This study was a bit stupid in reporting password strength. A nine letter password from two symbol sets will be close in strength to an eight letter password from three symbol sets, as long as the nine letter password doesn't build upon trivial substrings.

      I think this is why the recommendation demands three symbol sets: it gives users less scope to squander entropy that a longer, ordinary character password ought to have.

      One time, as a joke, a very long time ago, a devious coworker put a keystroke logger on a paranoid coworker and the password revealed was 6uldv8. Apparently there's more than one reason to keep your passwords secret.

      I generate all my own passwords starting from suggestions offered by OpenBSD's apg utility. For crap sites, I try to achieve an estimated entropy in the vicinity of 30 bits and scale up to about 60 bits at the paranoid end: 5*6 (a brief burst of line noise), 6*5, 7*4, 8*4, 9*3, 10*3 (baby talk).

      For longer passwords, you can pair two words from a large dictionary (about 13 bits entropy each) and then add another four bits with a single symbol corruption. Routinely sticking an ! in between two obscure dictionary words is not a good idea if you're concerned about cross entropy, where the attacker already knows some of your passwords by other means. I avoid consistent corruption templates, because I don't want to lower the cross-entropy on a set of partially exposed passwords too severely.

      For most purposes, even 20 bits of entropy is a good start, if the attack involves knocking on the front door. Not so good if the hashed password file is compromised behind the scenes. Even 30 bits is pathetic in the latter case, but this reasonably well mitigated by never sharing a password across multiple sites.

      At 40 bits, the attacker begins to ask whether there's any money involved. A high-end video card, properly coded, would sneeze at 40 bits. However, properly coded still isn't free,

      By the time you get to 50 bits, it's time to start asking whether you've seriously pissed off the wrong person. Quite doable, with a modicum of enmity, but not worth the bother if the game is shooting fish in a barrel at least expense. Armour piercing rounds are deployed sparingly.

      I wouldn't be the least bit surprised that the NSA has accumulated a dictionary of the trillion most common passwords, sorted by descending order of frequency, covering all languages and source lexicons of the world (pets, pet names, Klingon, Thalassian, Qenya) permuted into all manner of imposed password template schema. I'd be shocked if they hadn't. For that matter, Google could build a good approximation to that dictionary just using their lexigram index, on roughly the terascale.

      Shedding about 10 bits of protection per decade, we'll soon need to return to Beowulf era culture where reciting your ancestors back to the garden of Eden was the gold standard for accurate recall.

      I wish every login box on every site had a

  2. The Top 10 by goldaryn · · Score: 4, Informative

    1. 123456
    2. 12345
    3. 123456789
    4. Password
    5. iloveyou
    6. princess
    7. rockyou
    8. 1234567
    9. 12345678
    10. abc123

    By a massive coincidence, these happen to be the passwords for their respective /. userids!

  3. Why does password strength matter? by geekmux · · Score: 5, Insightful

    ...Most interesting to me was that in the sample, less than 4% used any non alpha-numerics in their #$#%'ing passwords.

    Er, does it REALLY matter anymore the strength of your password with the FBI using post-it notes as a search warrant? I mean I hate to say that, but seriously.

    On a related note, what pisses me off even more is going to a website and trying to use a strong password and their system doesn't allow it.

    1. Re:Why does password strength matter? by AndersOSU · · Score: 4, Insightful

      Well it doesn't matter (and it never did) if you're selecting passwords so the FBI can't read your secret diary.

      If, on the other hand, you're concerned about someone in Russia gaining access to your credit card it still matters.

  4. actual list of passwords? by naz404 · · Score: 4, Informative

    Does anyone have the list of passwords itself?

    It would be fun to perform one's own statistical analysis of the list :)
    Here's the top 20 most common passwords used according to the report:
    Rank Password # of Users
    1 123456 290731
    2 12345 79078
    3 123456789 76790
    4 Password 61958
    5 iloveyou 51622
    6 princess 35231
    7 rockyou 22588
    8 1234567 21726
    9 12345678 20553
    10 abc123 17542
    11 Nicole 17168
    12 Daniel 16409
    13 babygirl 16094
    14 monkey 15294
    15 Jessica 15162
    16 Lovely 14950
    17 michael 14898
    18 Ashley 14329
    19 654321 13984
    20 Qwerty 13856

    --
    http://www.object404.com
  5. Re:Limited in Password size and chars by Scutter · · Score: 4, Insightful

    The report makes it painfully obvious that passwords are an ineffective way to secure information because too many people find strong passwords cumbersome. Maybe we need to come up with something better.

    --

    "Tell me doctor, with all of your defenses, are there any provisions for an attack by killer bees?"
  6. Keep in mind, this is RockYou.com by tunabomber · · Score: 4, Insightful

    Is it even worth the effort of coming up with a secure password for that site? If I had for some reason found it necessary to register with such a vapid site I would have just re-used one of my low-security passwords (which many other sites have access to). It isn't too surprising that nobody cares whether someone else is using their account to steal their noisy, eye-burning flash videos. What is far worse is if people are re-using passwords from much more important sites. In this case, it doesn't matter if your password is a random string of letters, numbers and special characters.

    --

    pi = 3.141592653589793helpimtrappedinauniversefactory71 ...
  7. Why Is That Interesting? by Dun+Malg · · Score: 4, Informative

    Most interesting to me was that in the sample, less than 4% used any non alpha-numerics in their #$#%'ing passwords.

    Why is it any surprise that people tend to approach passwords as a pass-WORD? It has to be something they can remember, and remembering a string of characters they can't pronounce is far more difficult than remembering (say) their favorite basketball team and the year they graduated high school.

    --
    If a job's not worth doing, it's not worth doing right.
  8. Re:Given the sample set, is it a surprise? by Blade · · Score: 4, Interesting

    Until they break into your facebook account and use that to socially engineer access to something else and escalate their way into something beyond that. Or they access your facebook account and start taking guesses are the answers to the security questions you're forced to use (what school did you go to, what was your first pet called, etc., etc.)

    There are so many links between so much of what we do online that you would do well to treat it all as worth securing equally.

  9. Why surprising? by argStyopa · · Score: 5, Insightful

    "Most interesting to me was that in the sample, less than 4% used any non alpha-numerics in their #$#%'ing passwords."

    Not surprising at all, because the rules for what you CAN use as passwords are so inconsistent. Some places REQUIRE non alphanumerics, but have a limited choice of what you can use. Some don't accept ANY non alphanumerics, some will accept them but again it's different from site to site.

    I don't know about you, but I've probably got 100 different passwords rattling around in my brain. I'd guess most people are like me in that they see passwords as a necessary evil but otherwise a giant pain in the ass, and so accept the slight increase in security risk by using a system that changes predictably (at least for me) from site to site. So I'm not going to use a base-password or base-concept that includes any characters that might be disallowed on some other site.

    --
    -Styopa
  10. Too often is bad too. by suso · · Score: 5, Insightful

    I dealt with a bank once that expected its customers to change its passwords every 2 weeks. So obviously what happened is every time a customer needed to check their bank account, probably once a month, they were locked out. Now this isn't necessarily the problem here. The problem is that with people having to call in every time to reset their password, it becomes such a norm that it probably drastically increases the potential for social engineering.

  11. Obligatory Spaceballs Reference by Pollux · · Score: 5, Funny

    Roland: One.
    Dark Helmet: One.
    Colonel Sandurz: One.
    Roland: Two.
    Dark Helmet: Two.
    Colonel Sandurz: Two.
    Roland: Three.
    Dark Helmet: Three.
    Colonel Sandurz: Three.
    Roland: Four.
    Dark Helmet: Four.
    Colonel Sandurz: Four.
    Roland: Five.
    Dark Helmet: Five.
    Colonel Sandurz: Five.
    Dark Helmet: So the combination is... one, two, three, four, five? That's the stupidest combination I've ever heard in my life! The kind of thing an idiot would have on his luggage!

    -----

    President Skroob: What's the combination?
    Colonel Sandurz: 1 - 2 - 3 - 4 - 5.
    President Skroob: 1 - 2 - 3 - 4 - 5?
    Colonel Sandurz: Yes.
    President Skroob: That's amazing! I've got the same combination on my luggage!

  12. Re:Have they released the list anywhere? by QuantumRiff · · Score: 5, Funny

    Post it here, I'll check it for you.. Don't worry, Slashdot blanks your password.

    My password is *******

    See, blanked out!

    --

    What are we going to do tonight Brain?
  13. Re:Password strength vs. Validation Rules by wwwillem · · Score: 5, Insightful

    It is not just the mandatory password changes that increases the mess. It is also that each and every site has different validation rules. If I could use one-and-only strong password for many sites, then I could remember that. However, some sites _require_ special characters, while others _forbid_ it, etc, etc. So each time you end up inventing something on the spot, and then two months down the road you've forgotten it.

    I guess that I've 50 passwords to remember, so if I can't do that with just a few (I don't use the same password for my online banking as for my slashdot login :-) then it quickly becomes Post-it time again. Or worse, that little file on the PC desktop with a list of userid/passwd combo's.

    --
    Browsers shouldn't have a back button!! It's all about going forward...
  14. Re:Password strength vs. Validation Rules by nickyj · · Score: 4, Informative

    KeePass is an excellent utility, available for Windows, Linux, and other platforms. It's simple, quick to use, and configured correctly, you will only have to learn one password the one to unlock the encryption file.

    --
    Causing Chaos Everywhere,
    Nik J.
    The strange world of a loner, in a populous city, drowning in society
  15. Passwords by Stooshie · · Score: 4, Informative

    I worked for a company that ran a birth/death/marriage certificate site. People were having problems logging in, so we kept a log of passwords that did not result in a successful login.

    We found that one of the most commonly typed passwords that was denied was "case-sensitive".

    Needless to say, we soon took off the "Your password is case-sensitive" text from the login page.

    --
    America, Home of the Brave. ... .and the Squaw.
  16. Re:Have they released the list anywhere? by bcmm · · Score: 4, Funny

    hunter2

    --
    # cat /dev/mem | strings | grep -i llama
    Damn, my RAM is full of llamas.