Slashdot Mirror
A Brief Sony Password Analysis
troyhunt writes "With all this [Sony] customer data now unfortunately out there for public viewing, I thought it would be interesting to do some analysis on password practices. There are some rather alarming (although not entirely surprising) findings including: 36% of passwords appear in a common password dictionary. 50% of passwords are 7 characters or less. 67% of accounts on both Sony and Gawker use the same password. 82% of passwords are lowercase alphanumeric of 9 characters or less. 99% of passwords don't contain a single non-alphanumeric character."
Who cares? I don't waste good passwords on trivial online services.
Know what's important to protect and create passwords appropriately.
ah geez. it's like being back in school. my best mate's password was "123".
it's a pretty big PITA to enter a secure password, or any complex non-alphanumeric mix of characters using an on-screen keyboard.
Given the average joe have to remeber zillion of passwords what do you expect?
My sony account only held the minimal information and some of that not correct. The PW I used was my public throw away password that I only use on sites that require me to register when I just need it to use a basic service and not enter anything not already public knowledge. So I'm not going to burn a good PW or spend my time trying to memorize a new one to use for something I really wouldn't care if they cracked and couldn't use the same PW on a site for which I care about it being cracked.
I don't think very long passwords are necessary.
My own practices:
No dictionary words, only a string of random letters
No change, memorize and keep the same password forever
I use the same password for all internet sites, slashdot, reddit, throwaway emails, etc. Another one for all my computers, at home and at work. A third one is for my bank account only.
http://it.slashdot.org/story/11/06/05/2028256/Cheap-GPUs-Rendering-Strong-Passwords-Useless
I'm not in it.
It doesn't help when some sites don't even allow non-alphanumeric passwords. Besides... when Sony stores them in plain text, what does it matter what your password is?
Bite my shiny metal ass!
'82% of passwords are lowercase alphanumeric of 9 characters or less.'
So what about lowercase? As long as it's random-ish, it's fine. Good luck brute forcing a 9 character lowercase alphanumeric password... Capitals are overrated anyway, if asked to include an uppercase character, in my experience most people will use exactly 1 uppercase character. So, given a password with length 8, it's only 8 times as many possibilities you would check. However, it is still an extra keypress, so if you went for an extra character it would be a lot more effective. Then there is the point that on many phones it's a nuisance to type capital letters, then there is a problem of readability of for instance I (upper i), or l (lower L). Also, when speaking out a password it is annoying. Then, at least for me, it is hard to remember the location of the capital letters.
Like your password entropy makes any difference when it's stored in plaintext. Even if 80% of sites hash passwords, chances are it's the other 20% that'll be vulnerable to SQLi. Given the current state of security, minimising password re-use is the only useful thing you can do.
And 100% are not hashed and salted.
The whole point of a password is to have something you can memorize (without writing it down) as a security precaution. The problem is that different websites have different password requirements. For example, one website might require at least 8 characters in your password with at least one numeric and one non-alphanumeric character. But then another website might require at least 6 characters (alphanumeric), but DOES NOT ALLOW non-alphanumeric characters. So now you have two different passwords to remember. On top of that, it is recommended that you have a different password for each account. I don't know about you, but I have probably 100 accounts to various websites, games, etc - and there's no way I could memorize that many different passwords containing a mixture of alphanumeric and non-alphanumeric characters.
I strongly believe that very few words are bad passwords. Sure, using "password" is bad. As is "qwerty". But something like "football123" is fine. Or "soccerfan" - that'd be fine too. But *only* as long as there is decent bruteforce protection. 3 password attempts and a 5-15 minute lockout. Annoyingly, few websites use this policy.
An issue is, however, hash security. But salts help with that.
For my passwords I use the keys one-up-and-to-the-right of the "dictionary style" password I have. For example, for password this would come out as -wee305r, making it harder to brute force. Of course if the passwords are all stored plain text by some incompetents what's the point?!
'); DROP TABLE Password;
of having 100 alphanumeric+special character long passwords when websites just give up the password lists with the magical words 'sql injection'?
Unique passwords at least ensure that once a website you frequent is compromised you don't get further screwed over...
The problem with slashdot is that most of its users were bullied and stuffed into lockers as kids!
There must have been a few dozen.
"99% of passwords don't contain a single non-alphanumeric character." Many sites out there don't allow non-alphanumeric passwords. Most bank login pages I've seen are this way. It's really infuriating that a page whose security is of the utmost importance doesn't allow very secure passwords. Since a lot of people reuse passwords this statistic makes sense.
67% of accounts on both Sony and Gawker use the same password.
Without a map of Sony accounts to Gawker accounts I don't know what this means... I take it to mean "The cardinalty of the set that is the union of password sets from Sony and Gawker is 67% of the cardinality of the set of Sony passwords."
Don't blame me, I voted for Baltar.
The issue is I have, at last count, 13 systems with separate passwords. There's a network account, elevated privileges account for server admin, HR systems, online learning systems, expenses system, which is not the same as the travel booking system, etc.
With the company's computer, I can't just install any software I want, so one of the password tracking programs is not an option. So I use the same password for all 13 systems.
So the next issue, not all those systems have the same password requirements. There is one system which does not allow the use of special characters. So while my password always has lower case, upper case, and numeric, I'm always going to be in that 99% with no non-alphanumeric characters. Oh, and I think the max characters limit is around 12.
Of course, writing down passwords is such a bad practice. But there's no way I can afford to burn the cycles to memorize 13 new passwords every 90 days, so I use the same password for all work systems. The same bad password.
asking the user for or generating a passWORD is the beginning of the problem
call this authentication method something else in your application/gui and you might see a change in user behavior
...people who have to remember passwords for access to accounts at work, to pay their bills at home, to access their e-mail, to buy something online, to visit almost any service providing website... would rather make it something they can actually remember. In other news, smoking isn't healthy for you.
I find the writings of security professionals who imply that anyone who doesn't have secure passwords and change them frequently and not write it down but rather expect me to be able to remember all that for every site I go to are fools, quite offensive. I doubt if even THEY can do that! I had to create a way to do it that's not fully dependent on memory.
Sure, I could do one or two secure password but when every site you sign up for requiring a password for the most trivial things, it becomes impossible.
Can't write it down, oh no, can't use it more than a month, having to change it to something else? Forget it! Literally!
So then you have to do reset every time you visit the site now. What a PITA!!!
So how do you do this?
You make a password based on an algorithm that you crate where your password is based on some password you CAN remember, this is based on the month, something you do with the word of the month for this base password. Then you add some numbers or characters based on the name of the site or some other value that's site based you make up, so that its unique, and you can figure out, instead of having to remember the impossible.
That for me has been the ONLY way I can have a secure password that follows best security practices and isn't so hard to remember I can't use it.
Stop screwing around.
Passwords short enough to memorise are now short enough to crack in many cases. See recent article about hash reversal with GPUs.
Use a password safe. Just search -- there are lots around. I use KeePassX (small, cross-platform -- Windows, GNU/Linux, Mac, Android, no install required on Windows). It'll make strong passwords for you and save them in a tiny encrypted file you can copy to all your devices, with a couple of clicks. The only passwords you'll need to remember are your local login password and the password to the safe.
Life is better without having my web accounts chain-hacked or having to clutter my brain remembering a bazillion passwords...
wow i'm in the 1%, nice
Ask a dozen people on the street about the "Sony rootkit" and most will probably think it's an MP3 player for plants.
Here's how I look at it:
My PSN account is used purely for entertainment. It is not linked to a credit card. I have made one PSN purchase on my credit card. My credit card company offers fraud protection.
Why should I have a 26-character long UTF-8 password that I'm never going to remember? It's about as useful as having a strong password on the hotmail account I use to sign up to websites. Huge pain in the ass, negligible benefit.
My banking site, my PayPal account, my Canada Revenue Agency account - these are the places that I bother to use strong passwords. Elsewhere, I don't care that much.
It may look like I'm doing nothing, but I'm actively waiting for my problems to go away.
--Scott Adams
Knowing Sony's recent track record with system security, I wouldn't bother using one of my "good" passwords at one of their sites anyway. If there is a good chance that some hacker is going to get a hold of their password file and post it on the Internet, it might as well be "password" or "abc123". I sure as hell wouldn't use the same password that I use for my bank or my e-mail, anyway.
I used to include non-alphanumeric characters in my passwords until the following incident occurred.
I created a new account at some website. My randomly generated password consisted of alphanumeric and non-alphanumeric characters.
Some time later I returned to login to the website. It rejected my password. I tried several times but with the same result.
Then I looked at my password. One of the characters was a '#'. No, surely it can't be what I'm thinking. So I entered the password up to but not including the '#' character. Yes, password accepted; the stupid website had interpreted the '#' as the start of comment.
I would like to see a poll on how many accounts people have. The mid to upper level geek will use a password management software, but for 90% of the sheep out there.... I can think of 14 accounts of credentials I have now. I've resorted to putting in some random password that meets the requirements, then hitting the "forgot password" whenever the cookie expires...
With all these bad password practices obviously happing everywhere and the growing power of parallel processing (via GPU's), rainbow table lookups etc. It seems that standard username and password as authentication may be coming to an end. Anyone agree?
Sit down and think of the number of sites/services/etc. that you access each week.
Pretend for a second your browser doesn't remember a single one of them.
I came up with 34 different sites. 34 different systems with their own rules, regulations and security questions. Some sites only allow alpha numeric, some require the alphabet to be limited to what shows up on a touch tone phone. Others require passwords to change every 30 days with no repeats for the last 5 passwords.
At 9 characters a piece, that would be a string of 306 characters. Hell I'm lucky if I remember my wife's birthday and our anniversary. And those are much more important to me than my slashdot password.
My point is, the current system is BS. Too many sites require logins so they can advertise to you. I don't want your ads, they go directly into the trash. I'd advocate for a single ID across these systems, but the issue is if that's violated everything goes to hell just as fast as if you had the same password for each site. So what to do? Reuse a password that is reasonably secure and risk it across multiple sites? Or do I follow perfect security and ensure no one can get in, including me?
And don't get me started on security questions. If I can't remember the damn password, what hope do I have to remember the question I used?
=================
Unix is very user friendly, it's just picky about who its friends are.
Any non retarded system will not allow more than a few login attempts. Any password longer than 3-4 character doesn't offer any real protection, only psihological comfort.
If someone got a hand of the password hash, its gameover - doesnt matter if its a week or 2 month to crack it.
We need to get our collective heads out of the sand and triage the REAL security values!
Mod parent up.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Lots of websites have different requirements, so you end up finding a password that fits most of them. Most websites can't agree on what a special character is, because each one will only support one or two. The reason, is because some website admins are afraid of a SQL injection attack through the password box. The last time I felt the need to change one of my passwords, I had to try out the different websites I was going to use that password for, and come up with one that they all agreed on. Personally I think that all passwords should have a space charater in them. That would result in users creating easy to remember phrases. I have yet to find a website which allows spaces in the passwords though.
Excuse my ignorance, but why not have a system that locks you out after three attempts and sends an email to your previously verified email account?
Why all this focus on "unguessable" passwords when it looks like if you have a powerful enough computer you can guess most in minutes?
Ok perhaps banks & public utilities need all the crypto stuff, but Joe-sixpack? Surely there's a more elegant solution than getting people to remember unmemorable passwords (which leads to post-it note on the monitor syndrome anyway)
I'll see your hokum and raise you a boondoggle.
I use a sort of "incremental" password. My base password is 10+ characters containing letters/numbers/symbols where no character is used more than once. Using part of the website's URL, based on a pattern I've devised for myself, I take letters/symbols out of the URL and prepend it to my password. So if my base password was E21jd78&@qPm and the site was slashdot.org, my password for slashdot dot might end up being SshoTE21jd78&@qPm. This way I only have to memorize the base password, and use the URL to prompt myself as to what the rest of it should be making every password for every website I use to be different. If the passwords are encrypted on each service no two hashes will ever be the same.
First, of the millions of Sony accounts how many people read technical blogs or news sites? How many are technically inclined? Let's even go high and say 10%. That still leaves the vast majority of people who are not tech inclined. It is people like my wife, my parents, my sister, most of my friends, etc. They use passwords that they can remember, period. No amount of me saying anything will stop it. Why? Because it becomes way too difficult to manage. Sure I can create some complex cipher and all that nonsense, but ultimately it makes no difference. Why? Becuase corporations spend zero dollars on security for online stuff. It is no big deal to them, it is not their inconvenience. You know what Sony is crying about? Lost pofits from down time and having to give stuff away for free.
I am sorry, but one of two things needs to happen or both:
1. Allow victims of breaches to sue either individually or as a class action. If a corporation takes the data it is responsible for it. If it lost the data it is responsible for it. No more valet garbage where they are not responsible for personal property. If you do not want to be responsible for it, do not collect it. Contract with a 3rd party willing to take the risk and has proper insurance against threats.
2. Regulate the collection and storage of personal information online. Force companies to reveal any and all breaches of the system (currently they do not have to let you know anything, which is why the hackers announce it so much). Force companies to abide by certain procedures and have the systems used for collection and storage of the data certified by a 3rd party.
Either way, I think this would give rise to a more centralized personal infromation storage structure that overall has a higher level of security because it is forced to or suffer serious damages. Instead of your personal information being stored on hundreds of insecure sites, it is stored on a few more secured sites that are background to the front applications and if setup correctly far less accessible from simple URLs. Yes, this increases the cost of doing business in this space, but it is such a fail right now that it cannot be much worse. You can still have separate usernames and passwords for sites, but the name, phone, email, etc are stored separately.
Because I can guarantee you one thing. Anyone that I know that is not technical is not using something like Last Pass, KeePass, or a cipher for their passwords. And getting the whole list is not their fault anyway, that is the fault of piss poor security from the company. Because guess what. With most sites even if someone logs in as me they cannot see my credit card number or social secuirty number. So yeah, it can hurt me but I can cancel my card if it gets used to send goods to some strange place. When a database gets hacked, you are screwed. The difference is night and day.
The first inclination we have is that all these users have really bad passwords. However, you're missing one key piece of data and that is what was the real hack rate? How many accounts were hacked/month, and was there any correlation between hacked accounts and password strength?
If the correlation is low, then what it really tells us is that our standard "best practices" may not really be the "best" because maybe they're unnecessarily complicated.
We don't have that data, so we really can't say much other than this is what people do.
Given the fact that the account info was stolen, I think it's justifiable that people understand the level of importance of this sort of account (ie not really important at all)
I'll have to be fairly vague here for obvious reasons. I was trying to set up an online account with a credit union I just switched to and was getting weird errors. Turned out it did not like the non-alphanumeric characters in my password.
Like I'd use a secure password for something as critical as PSN? It's a throwaway account with a throwaway password.
Since the Sony debacle I've switched to deciding my passwords algorithmically. I use a base password of six lower case digits that is the same for all websites. Then I use two capital letters that are related to the website in question (e.g. "SD" for slashdot) which I offset by a certain number of keys in a certain direction (e.g. SD might become "XC" if my offset is one key down, but it's not). Then I append a single number to the end (same in all cases). This gets me a nine digit password with mixed case alphanumerics that's easy to remember and is unique across the websites I use. Of course, if you know my algorithm and base it's easy to figure out my password for all sites. But my concern isn't really being singled out for my password specifically (if they want to do that I'm sure they can get it other ways), but rather being part of a large password theft like Sony's. I highly doubt a hacker who stole 75 million passwords is going to take the time to figure out that hipp5's passwords are algorithmically generated across websites.
I have seen no data here or elsewhere that suggests blackhats are brute forcing [my] accounts. Although outside of my area of knowledge I would have thought that blocking more than 5-10 attempts for a login in a [second, minute, hour, day, month] would dramatically impact the effectiveness of brute forcing. All the news coverage on password weakness seems to be sourced from the security failure of the vendor rather than individual user.
Typing text on the Playstation is a horror.
"Up, Up, Down, Down, Left, Right, Left, Right, B, A, Start"
THAT would be a password!
Until black hats devote a great chunk of their time to cracking random joes videogame/email passwords to a point of it become a real threat, not only a potential one, i dont see any problem with that. usual slashdot bad analogy: theres always a strong real potential risk of us being hit by a comet, but until that become a clear short therm invevitable threat (like someone findind an object on a colision course), we humans wont take any real actions to defends ourselves if it. the very definition of a PARANOID is someone who takes measures to protectef oneself against a very unlikely scenario. hope noneone gains root access to machine and gets a hold of my porn stash just by this post :)
The real problem with passwords is that there's so damned many of them. It's a little exasperating to me that in the 21st century we're still managing security and authentication the same flawed, stupid way. All the idiot users in the world and the hapless tech support people reseting their passwords would cry tears of joy if we could just change to a standardized approach. What I'd really like is something like this:
1) Everybody pick a trusted authentication provider (the Google, Facebook, Verisign, your bank, etc.)
2) Have that trusted authenticator sell you a cheap USB dongle (a cell phone-based app might work too) with a shifting, unique code synced to their auth. server
3) Enter your master password then plug in the dongle (or enter a "code of the moment" displayed on an LCD display on the side of the dongle) and you're automagically authenticated to all participating sites using that federated security system.
Hell... I'd just be happy if all sites would let you have at least 20 characters, with no moronic restrictions on special characters.
Ask me about my sig!
I wouldn't read too much into people's bad password habits to a site that didn't collect any sensitive personal data. Sharing passwords across sites would be more of a problem as it may lead to inadvertently revealig a password to another site that does have more importance; or losing access to a bunch of individually unimportant accounts may be more traumatic.
It doesn't matter if you password is a single letter or a giant randomized hex string, if the service stores their passwords in a plain text file people can get into, your password is lost either way.
What do I know, I'm just an idiot, right?
Number of times my account has been compromised by someone brute forcing or social engineering my "simple" password: 0
Number of times my account has been compromised by someone stealing information from the company that holds the accounts: 4
Why put that work into one password when you can just take all of them instead?
I have around 80 passwords at websites where I would rather not have to use any password at all. For example, Gawker. I couldn't care less if the whole world knew all of these passwords, which protect the sites from spam, but serve no purpose for me.
I have only a few passwords that I do care about. They are strong and unique.
That means that based on the 3.3 billion passwords/second that was said in a previous article about password cracking (with the HD5770) you can crack 82% of this articles passwords in under ~8.6 hours. WTF?!? The math: ( (36 ^ 9) / (3.3 * 10^9) ) / (60*60) = 8,5488179013818181818181818181818 hours
Of Course the passwords will be simple, Most people setup their accounts on the system with the controller. They just wanted to get past the screens to play with their new system so they wanted something really simple that they could forget. If they ever needed to actually get in they could just reset it in theory. They could of used a strong password but we know people dont do that.
;SELECT * FROM USERS
Hehe, I have a friend of mine that wrote her PIN number on the ATM at her bank.
At one site the requirement was a 15 character password (no more and no less) - a mix up upper and lower, numbers and special characters with no 'real' words used in any part of the password. And you could not repeat the last 100 passwords and they had to significantly different than the previous ones (no similar sounding characters in the same spots). Finally updated at least every 30 days and Mandatory change if the account had not been used for two weeks. Account locks on the failed 2nd attempt. The password could not be written down in a visible area.
Lift up every ones key board and guess what you found.
1 wr173 m¥ p4$$w0rÐ$ 1n p£41n 73x7 4nÐ 1 h4v3 n3v3r h4Ð 4n¥ pr0b£3m$!
that's pretty much a given considering the vast majority of password storing and retrieval systems out there barf when you give them a non-aphanumeric character...
Donald 'Duck' Dunn: We had a band powerful enough to turn goat piss into gasoline.
Just subtly change one character in your written passwords, and even someone who has your list wouldn't be able to use it.
Just write down part of the password. Personally, I have all passwords on a text file but just their "2nd half". The first half is the same for all, and I have it memorized. This way, I can do the "2nd half" as random as the site allows me, and if one password gets compromized, it only affects one site and they would have to get into my computer to get to my (disk encrypted) text file with the passwords. I can backup my "password file" online and it still cant be used without knowing my system.
It's interesting that all of these "onoes errybody using the same password errywhere" stories fail to point out that the junk logins required by almost every site for the purpose to collecting ad demo data essentially feed weak passwords to black hats. This has trained many people to use the same password everywhere, since no sane person will maintain and memorize separate passwords for dozens of sites, many of which they may just utilize for entertainment. Combined with the weak security even major players (c.f. Sony) have been shown to use, this is now a bottomless cornucopia of id theft data.
Since it's well known that a large proportion of user demo data entered along with these logins is also junk, the smart guys use bugs and IP tracking, and profiling of various kinds to collect this data now anyway, so it's not even useful to have local logins for that purpose. It's time for sites to Just Say NO To Junk Logins...
Here's a more accurate description of the stats:
"36% of SonyPictures.com passwords appear in a common password dictionary. 50% of SonyPictures.com passwords are 7 characters or less. 67% of accounts on both Sony and Gawker use the same password. 82% of SonyPictures.com passwords are lowercase alphanumeric of 9 characters or less. 99% of SonyPictures.com passwords don't contain a single non-alphanumeric character"
So we have some statistics on password practices for worthless unimportant websites. That's mildly useful. What about for important ones, like their bank? Well, it's a bit of a paradox, because those important sites are likely to not have the shitty security required to get the password data.
I guess credit card data is not important to protect
For some people the credit card number that Sony has is not important. It is a temporary alias for the real card number. This alias issued by the bank's online services upon user request, has a user defined expiration, has a user defined limit, and it *locks* to the first company that makes a charge on it.
Just make your password something like this: D0g.....................
http://www.grc.com/haystack.htm
Try bank passwords. Of two banks I know, the passwords CANNOT have non-alphanumeric characters, and require passwords be 5-8 characters long...
You're 10 years or so behind.
These nice metrics that are still being thrown around by your so-called security consultants are bullshit. They are from times where brute-force and dictionary attacks were your problem. That's not half as much true today as it used to be. In fact, not only has technology changed, security has matured quite a bit as well.
The main password I use for many sites online is 8 characters, all lower-case letters. Why? Because not even a security expert seriously remembers kCw]^7qwKR+3 - whoever came up with the idea of telling non-tech people to use passwords like that should move out of the basement and meet the real world.
So-called "hard" passwords are mostly one thing: Hard to remember. And hard to remember means you need more password resets, which leads to these "security questions" that are a bigger risk than a weak password. I mean, finding out your mothers maiden name or your first car or the name of your dog is two hours of work tops for anyone who is actually interested in getting access to your account. And the mass-hacks of today don't go via brute-forcing anymore, they grab your password from some database, so it matters little if it's "12345" or something like the above.
But hard to remember also means written down more often. Either physically, which means one visit to your desk and I have your password(s) or electronically which means if I guess your master password (if you even set one) I have all of your access credentials.
I'm sorry to say it that harshly, but stuff like "x% of the passwords don't satisfy this totally arbitrary metric" is meaningless. If you want to do serious security instead of security theatre and consulting, get some actual studies done. Get the numbers on how many accounts with 6-letter passwords are being compromised compared to accounts with 8-characters-at-least-two-numbers-or-special-chars. Then we can talk. If you're still interested, because my 15 years of experience tell me you won't find that the weaker passwords are half as much a problem as you think they are. It's one of those "quick-wins" that consultants come up with when you pay them a lot of money to improve your security. You know, doesn't require much effort, sounds reasonable, is something the client can personally relate to because even the CTO/CIO/CEO uses passwords, etc.
Assorted stuff I do sometimes: Lemuria.org
By my estimation in >90% it will be the very first character which is caps, the rest lower and 12 numbers at the end. Pretty simple algorithm for a code cracker to implement. Thinking of it: forcing numbers actually make it easier to crack a password as they mostly added to the end.