Slashdot Mirror
A Brief Sony Password Analysis
troyhunt writes "With all this [Sony] customer data now unfortunately out there for public viewing, I thought it would be interesting to do some analysis on password practices. There are some rather alarming (although not entirely surprising) findings including: 36% of passwords appear in a common password dictionary. 50% of passwords are 7 characters or less. 67% of accounts on both Sony and Gawker use the same password. 82% of passwords are lowercase alphanumeric of 9 characters or less. 99% of passwords don't contain a single non-alphanumeric character."
Who cares? I don't waste good passwords on trivial online services.
Know what's important to protect and create passwords appropriately.
it's a pretty big PITA to enter a secure password, or any complex non-alphanumeric mix of characters using an on-screen keyboard.
My sony account only held the minimal information and some of that not correct. The PW I used was my public throw away password that I only use on sites that require me to register when I just need it to use a basic service and not enter anything not already public knowledge. So I'm not going to burn a good PW or spend my time trying to memorize a new one to use for something I really wouldn't care if they cracked and couldn't use the same PW on a site for which I care about it being cracked.
I don't think very long passwords are necessary.
My own practices:
No dictionary words, only a string of random letters
No change, memorize and keep the same password forever
I use the same password for all internet sites, slashdot, reddit, throwaway emails, etc. Another one for all my computers, at home and at work. A third one is for my bank account only.
It doesn't help when some sites don't even allow non-alphanumeric passwords. Besides... when Sony stores them in plain text, what does it matter what your password is?
Bite my shiny metal ass!
'82% of passwords are lowercase alphanumeric of 9 characters or less.'
So what about lowercase? As long as it's random-ish, it's fine. Good luck brute forcing a 9 character lowercase alphanumeric password... Capitals are overrated anyway, if asked to include an uppercase character, in my experience most people will use exactly 1 uppercase character. So, given a password with length 8, it's only 8 times as many possibilities you would check. However, it is still an extra keypress, so if you went for an extra character it would be a lot more effective. Then there is the point that on many phones it's a nuisance to type capital letters, then there is a problem of readability of for instance I (upper i), or l (lower L). Also, when speaking out a password it is annoying. Then, at least for me, it is hard to remember the location of the capital letters.
The whole point of a password is to have something you can memorize (without writing it down) as a security precaution. The problem is that different websites have different password requirements. For example, one website might require at least 8 characters in your password with at least one numeric and one non-alphanumeric character. But then another website might require at least 6 characters (alphanumeric), but DOES NOT ALLOW non-alphanumeric characters. So now you have two different passwords to remember. On top of that, it is recommended that you have a different password for each account. I don't know about you, but I have probably 100 accounts to various websites, games, etc - and there's no way I could memorize that many different passwords containing a mixture of alphanumeric and non-alphanumeric characters.
For my passwords I use the keys one-up-and-to-the-right of the "dictionary style" password I have. For example, for password this would come out as -wee305r, making it harder to brute force. Of course if the passwords are all stored plain text by some incompetents what's the point?!
'); DROP TABLE Password;
of having 100 alphanumeric+special character long passwords when websites just give up the password lists with the magical words 'sql injection'?
Unique passwords at least ensure that once a website you frequent is compromised you don't get further screwed over...
The problem with slashdot is that most of its users were bullied and stuffed into lockers as kids!
There must have been a few dozen.
"99% of passwords don't contain a single non-alphanumeric character." Many sites out there don't allow non-alphanumeric passwords. Most bank login pages I've seen are this way. It's really infuriating that a page whose security is of the utmost importance doesn't allow very secure passwords. Since a lot of people reuse passwords this statistic makes sense.
ah geez. it's like being back in school. my best mate's password was "123".
Ah, the memories. (The school's admin password was "access".)
67% of accounts on both Sony and Gawker use the same password.
Without a map of Sony accounts to Gawker accounts I don't know what this means... I take it to mean "The cardinalty of the set that is the union of password sets from Sony and Gawker is 67% of the cardinality of the set of Sony passwords."
Don't blame me, I voted for Baltar.
The issue is I have, at last count, 13 systems with separate passwords. There's a network account, elevated privileges account for server admin, HR systems, online learning systems, expenses system, which is not the same as the travel booking system, etc.
With the company's computer, I can't just install any software I want, so one of the password tracking programs is not an option. So I use the same password for all 13 systems.
So the next issue, not all those systems have the same password requirements. There is one system which does not allow the use of special characters. So while my password always has lower case, upper case, and numeric, I'm always going to be in that 99% with no non-alphanumeric characters. Oh, and I think the max characters limit is around 12.
Of course, writing down passwords is such a bad practice. But there's no way I can afford to burn the cycles to memorize 13 new passwords every 90 days, so I use the same password for all work systems. The same bad password.
Of course they're not salted. They're checking their sodium intake!
Stop screwing around.
Passwords short enough to memorise are now short enough to crack in many cases. See recent article about hash reversal with GPUs.
Use a password safe. Just search -- there are lots around. I use KeePassX (small, cross-platform -- Windows, GNU/Linux, Mac, Android, no install required on Windows). It'll make strong passwords for you and save them in a tiny encrypted file you can copy to all your devices, with a couple of clicks. The only passwords you'll need to remember are your local login password and the password to the safe.
Life is better without having my web accounts chain-hacked or having to clutter my brain remembering a bazillion passwords...
+1 insightful
Ask a dozen people on the street about the "Sony rootkit" and most will probably think it's an MP3 player for plants.
Here's how I look at it:
My PSN account is used purely for entertainment. It is not linked to a credit card. I have made one PSN purchase on my credit card. My credit card company offers fraud protection.
Why should I have a 26-character long UTF-8 password that I'm never going to remember? It's about as useful as having a strong password on the hotmail account I use to sign up to websites. Huge pain in the ass, negligible benefit.
My banking site, my PayPal account, my Canada Revenue Agency account - these are the places that I bother to use strong passwords. Elsewhere, I don't care that much.
It may look like I'm doing nothing, but I'm actively waiting for my problems to go away.
--Scott Adams
Knowing Sony's recent track record with system security, I wouldn't bother using one of my "good" passwords at one of their sites anyway. If there is a good chance that some hacker is going to get a hold of their password file and post it on the Internet, it might as well be "password" or "abc123". I sure as hell wouldn't use the same password that I use for my bank or my e-mail, anyway.
I would like to see a poll on how many accounts people have. The mid to upper level geek will use a password management software, but for 90% of the sheep out there.... I can think of 14 accounts of credentials I have now. I've resorted to putting in some random password that meets the requirements, then hitting the "forgot password" whenever the cookie expires...
Sit down and think of the number of sites/services/etc. that you access each week.
Pretend for a second your browser doesn't remember a single one of them.
I came up with 34 different sites. 34 different systems with their own rules, regulations and security questions. Some sites only allow alpha numeric, some require the alphabet to be limited to what shows up on a touch tone phone. Others require passwords to change every 30 days with no repeats for the last 5 passwords.
At 9 characters a piece, that would be a string of 306 characters. Hell I'm lucky if I remember my wife's birthday and our anniversary. And those are much more important to me than my slashdot password.
My point is, the current system is BS. Too many sites require logins so they can advertise to you. I don't want your ads, they go directly into the trash. I'd advocate for a single ID across these systems, but the issue is if that's violated everything goes to hell just as fast as if you had the same password for each site. So what to do? Reuse a password that is reasonably secure and risk it across multiple sites? Or do I follow perfect security and ensure no one can get in, including me?
And don't get me started on security questions. If I can't remember the damn password, what hope do I have to remember the question I used?
=================
Unix is very user friendly, it's just picky about who its friends are.
exactly. call it a PIN and you'll get 4 numbers. and most people will use their REAL bank pin on shadystealyourinfosite.biz just so they remember it
mod me funny
Any non retarded system will not allow more than a few login attempts. Any password longer than 3-4 character doesn't offer any real protection, only psihological comfort.
If someone got a hand of the password hash, its gameover - doesnt matter if its a week or 2 month to crack it.
We need to get our collective heads out of the sand and triage the REAL security values!
Mod parent up.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Lots of websites have different requirements, so you end up finding a password that fits most of them. Most websites can't agree on what a special character is, because each one will only support one or two. The reason, is because some website admins are afraid of a SQL injection attack through the password box. The last time I felt the need to change one of my passwords, I had to try out the different websites I was going to use that password for, and come up with one that they all agreed on. Personally I think that all passwords should have a space charater in them. That would result in users creating easy to remember phrases. I have yet to find a website which allows spaces in the passwords though.
Excuse my ignorance, but why not have a system that locks you out after three attempts and sends an email to your previously verified email account?
Why all this focus on "unguessable" passwords when it looks like if you have a powerful enough computer you can guess most in minutes?
Ok perhaps banks & public utilities need all the crypto stuff, but Joe-sixpack? Surely there's a more elegant solution than getting people to remember unmemorable passwords (which leads to post-it note on the monitor syndrome anyway)
I'll see your hokum and raise you a boondoggle.
I use a sort of "incremental" password. My base password is 10+ characters containing letters/numbers/symbols where no character is used more than once. Using part of the website's URL, based on a pattern I've devised for myself, I take letters/symbols out of the URL and prepend it to my password. So if my base password was E21jd78&@qPm and the site was slashdot.org, my password for slashdot dot might end up being SshoTE21jd78&@qPm. This way I only have to memorize the base password, and use the URL to prompt myself as to what the rest of it should be making every password for every website I use to be different. If the passwords are encrypted on each service no two hashes will ever be the same.
The first inclination we have is that all these users have really bad passwords. However, you're missing one key piece of data and that is what was the real hack rate? How many accounts were hacked/month, and was there any correlation between hacked accounts and password strength?
If the correlation is low, then what it really tells us is that our standard "best practices" may not really be the "best" because maybe they're unnecessarily complicated.
We don't have that data, so we really can't say much other than this is what people do.
Given the fact that the account info was stolen, I think it's justifiable that people understand the level of importance of this sort of account (ie not really important at all)
Since the Sony debacle I've switched to deciding my passwords algorithmically. I use a base password of six lower case digits that is the same for all websites. Then I use two capital letters that are related to the website in question (e.g. "SD" for slashdot) which I offset by a certain number of keys in a certain direction (e.g. SD might become "XC" if my offset is one key down, but it's not). Then I append a single number to the end (same in all cases). This gets me a nine digit password with mixed case alphanumerics that's easy to remember and is unique across the websites I use. Of course, if you know my algorithm and base it's easy to figure out my password for all sites. But my concern isn't really being singled out for my password specifically (if they want to do that I'm sure they can get it other ways), but rather being part of a large password theft like Sony's. I highly doubt a hacker who stole 75 million passwords is going to take the time to figure out that hipp5's passwords are algorithmically generated across websites.
I have seen no data here or elsewhere that suggests blackhats are brute forcing [my] accounts. Although outside of my area of knowledge I would have thought that blocking more than 5-10 attempts for a login in a [second, minute, hour, day, month] would dramatically impact the effectiveness of brute forcing. All the news coverage on password weakness seems to be sourced from the security failure of the vendor rather than individual user.
Typing text on the Playstation is a horror.
"Up, Up, Down, Down, Left, Right, Left, Right, B, A, Start"
THAT would be a password!
An issue is, however, hash security. But salts help with that.
Not really. If I know that your password is short, comprised of common english words (say 4,000 common words that are short enough), something like "football123" is going to be cracked in a matter of hours.
4000^2 x 1000 = about 4.4 hours at 1 million/sec
Worse, since "football" is itself probably in that list of the 4000 most common words, my search space is only 4000 x 1000, or 4 seconds.
And probably even faster then that since I would probably try "123" and "1234" as common suffix values to the word list.
Doesn't matter if you salt or not if I'm brute-forcing your password. Salt just means that I probably (assuming you were smart and used a 12-16 bit or larger salt) can't use a pre-calculated rainbow table against the password hash.
Wolde you bothe eate your cake, and have your cake?
Until black hats devote a great chunk of their time to cracking random joes videogame/email passwords to a point of it become a real threat, not only a potential one, i dont see any problem with that. usual slashdot bad analogy: theres always a strong real potential risk of us being hit by a comet, but until that become a clear short therm invevitable threat (like someone findind an object on a colision course), we humans wont take any real actions to defends ourselves if it. the very definition of a PARANOID is someone who takes measures to protectef oneself against a very unlikely scenario. hope noneone gains root access to machine and gets a hold of my porn stash just by this post :)
The real problem with passwords is that there's so damned many of them. It's a little exasperating to me that in the 21st century we're still managing security and authentication the same flawed, stupid way. All the idiot users in the world and the hapless tech support people reseting their passwords would cry tears of joy if we could just change to a standardized approach. What I'd really like is something like this:
1) Everybody pick a trusted authentication provider (the Google, Facebook, Verisign, your bank, etc.)
2) Have that trusted authenticator sell you a cheap USB dongle (a cell phone-based app might work too) with a shifting, unique code synced to their auth. server
3) Enter your master password then plug in the dongle (or enter a "code of the moment" displayed on an LCD display on the side of the dongle) and you're automagically authenticated to all participating sites using that federated security system.
Hell... I'd just be happy if all sites would let you have at least 20 characters, with no moronic restrictions on special characters.
Ask me about my sig!
yours had a password?
It pays to be obvious, especially if you have a reputation for being subtle.
It seems that standard username and password as authentication may be coming to an end. Anyone agree?
It's dire, but not as dire at that.
8 characters or less, with little to no complexity is truly dead (and has been for years).
Longer passwords (10-15 characters), with complexity checks and not reusing passwords across sites is still fine for 90% of use cases. In 90% of those cases, you're not protecting anything of much value and an accidental exposure does not lead to loss of life or massive theft.
Banks and financial institutions will have to either start enforcing minimum password lengths of 12-15 characters or add two-factor authentication soon. But even that is not perfect as many attackers simply do a MitM attack, capturing the credentials in transit and executing transactions that were not what the user wanted.
The reason why longer passwords are still going to be fine is that every character you add to the password increases complexity by 40x to 80x. Add four letters to the average password and search difficulty increases by anywhere from 2.6 to 41 million times.
The attacker will just shift more towards sniffing / spyware rather then brute-force.
Wolde you bothe eate your cake, and have your cake?
I wouldn't read too much into people's bad password habits to a site that didn't collect any sensitive personal data. Sharing passwords across sites would be more of a problem as it may lead to inadvertently revealig a password to another site that does have more importance; or losing access to a bunch of individually unimportant accounts may be more traumatic.
For my school's system, one of the superuser accounts was "a" with no password. Things ended badly.
Darn, my password must have been in the vanishingly small amount that used special characters, numbers, upper and lower case and was actually funny as well.
It was "1c@nCurt1t5" (and by WAS I mean several months ago: I am not going to give you my current password - however it is constructed the same way and is also funny)
I can't figure out why everyone can't manage to use good passwords. But, the bigger atrocity is why the hell Sony was storing plain text passwords anyway? Don't they know about things like salted hashes?
It doesn't matter if you password is a single letter or a giant randomized hex string, if the service stores their passwords in a plain text file people can get into, your password is lost either way.
What do I know, I'm just an idiot, right?
ah geez. it's like being back in school. my best mate's password was "123".
Ah, the memories. (The school's admin password was "access".)
When I was 12 I found out from an older student that the admin password was "changeme". I used it to increase my disc quota.
I then gave the password to a younger student, who changed it. IIRC he had a letter sent to his parents, but I was merely banned from using school computers at lunchtime "until the end of the year", which was about 2 weeks. I think talking to people outside for two weeks probably did me good.
Yes.
Some support circus administered the computers. A friend of mine looked over the guy's shoulder once, and I didn't believe him until he demonstrated that it works.
Of Course the passwords will be simple, Most people setup their accounts on the system with the controller. They just wanted to get past the screens to play with their new system so they wanted something really simple that they could forget. If they ever needed to actually get in they could just reset it in theory. They could of used a strong password but we know people dont do that.
Why would someone post a message containing just 7 asterisks? Weird.
how is babby formed?
Hehe, I have a friend of mine that wrote her PIN number on the ATM at her bank.
1 wr173 m¥ p4$$w0rÐ$ 1n p£41n 73x7 4nÐ 1 h4v3 n3v3r h4Ð 4n¥ pr0b£3m$!
that's pretty much a given considering the vast majority of password storing and retrieval systems out there barf when you give them a non-aphanumeric character...
Donald 'Duck' Dunn: We had a band powerful enough to turn goat piss into gasoline.
Just subtly change one character in your written passwords, and even someone who has your list wouldn't be able to use it.
Just write down part of the password. Personally, I have all passwords on a text file but just their "2nd half". The first half is the same for all, and I have it memorized. This way, I can do the "2nd half" as random as the site allows me, and if one password gets compromized, it only affects one site and they would have to get into my computer to get to my (disk encrypted) text file with the passwords. I can backup my "password file" online and it still cant be used without knowing my system.
It's interesting that all of these "onoes errybody using the same password errywhere" stories fail to point out that the junk logins required by almost every site for the purpose to collecting ad demo data essentially feed weak passwords to black hats. This has trained many people to use the same password everywhere, since no sane person will maintain and memorize separate passwords for dozens of sites, many of which they may just utilize for entertainment. Combined with the weak security even major players (c.f. Sony) have been shown to use, this is now a bottomless cornucopia of id theft data.
Since it's well known that a large proportion of user demo data entered along with these logins is also junk, the smart guys use bugs and IP tracking, and profiling of various kinds to collect this data now anyway, so it's not even useful to have local logins for that purpose. It's time for sites to Just Say NO To Junk Logins...
Our Network Administrators password was "ramses" back in those days....
Getting it was even more fun than using it :-)
bickerdyke
This is how you take a stolen hashed password and retrieve the real password from it.
It is the third step in the process.
1: steal the passwords.
2: If they are hashed, apply a rainbow table and you can crack the weakest and most common passwords.
3: If you want to put in the effort, you do a brute force attack against every possible password for each password you still want to crack.
I guess credit card data is not important to protect
For some people the credit card number that Sony has is not important. It is a temporary alias for the real card number. This alias issued by the bank's online services upon user request, has a user defined expiration, has a user defined limit, and it *locks* to the first company that makes a charge on it.
Try bank passwords. Of two banks I know, the passwords CANNOT have non-alphanumeric characters, and require passwords be 5-8 characters long...
What, it didn't accept the incomplete password and prompt you for additional letters, such as "II"?
The Quirkz Handbook of Self-Improvement for People Who Are Already Pretty Okay
You're 10 years or so behind.
These nice metrics that are still being thrown around by your so-called security consultants are bullshit. They are from times where brute-force and dictionary attacks were your problem. That's not half as much true today as it used to be. In fact, not only has technology changed, security has matured quite a bit as well.
The main password I use for many sites online is 8 characters, all lower-case letters. Why? Because not even a security expert seriously remembers kCw]^7qwKR+3 - whoever came up with the idea of telling non-tech people to use passwords like that should move out of the basement and meet the real world.
So-called "hard" passwords are mostly one thing: Hard to remember. And hard to remember means you need more password resets, which leads to these "security questions" that are a bigger risk than a weak password. I mean, finding out your mothers maiden name or your first car or the name of your dog is two hours of work tops for anyone who is actually interested in getting access to your account. And the mass-hacks of today don't go via brute-forcing anymore, they grab your password from some database, so it matters little if it's "12345" or something like the above.
But hard to remember also means written down more often. Either physically, which means one visit to your desk and I have your password(s) or electronically which means if I guess your master password (if you even set one) I have all of your access credentials.
I'm sorry to say it that harshly, but stuff like "x% of the passwords don't satisfy this totally arbitrary metric" is meaningless. If you want to do serious security instead of security theatre and consulting, get some actual studies done. Get the numbers on how many accounts with 6-letter passwords are being compromised compared to accounts with 8-characters-at-least-two-numbers-or-special-chars. Then we can talk. If you're still interested, because my 15 years of experience tell me you won't find that the weaker passwords are half as much a problem as you think they are. It's one of those "quick-wins" that consultants come up with when you pay them a lot of money to improve your security. You know, doesn't require much effort, sounds reasonable, is something the client can personally relate to because even the CTO/CIO/CEO uses passwords, etc.
Assorted stuff I do sometimes: Lemuria.org
By my estimation in >90% it will be the very first character which is caps, the rest lower and 12 numbers at the end. Pretty simple algorithm for a code cracker to implement. Thinking of it: forcing numbers actually make it easier to crack a password as they mostly added to the end.