Slashdot Mirror
A Brief Sony Password Analysis
troyhunt writes "With all this [Sony] customer data now unfortunately out there for public viewing, I thought it would be interesting to do some analysis on password practices. There are some rather alarming (although not entirely surprising) findings including: 36% of passwords appear in a common password dictionary. 50% of passwords are 7 characters or less. 67% of accounts on both Sony and Gawker use the same password. 82% of passwords are lowercase alphanumeric of 9 characters or less. 99% of passwords don't contain a single non-alphanumeric character."
I guess credit card data is not important to protect
it's a pretty big PITA to enter a secure password, or any complex non-alphanumeric mix of characters using an on-screen keyboard.
My sony account only held the minimal information and some of that not correct. The PW I used was my public throw away password that I only use on sites that require me to register when I just need it to use a basic service and not enter anything not already public knowledge. So I'm not going to burn a good PW or spend my time trying to memorize a new one to use for something I really wouldn't care if they cracked and couldn't use the same PW on a site for which I care about it being cracked.
I don't think very long passwords are necessary.
My own practices:
No dictionary words, only a string of random letters
No change, memorize and keep the same password forever
I use the same password for all internet sites, slashdot, reddit, throwaway emails, etc. Another one for all my computers, at home and at work. A third one is for my bank account only.
Bah! I don't waste good passwords on trivial things like money!
which is totally what she said
'82% of passwords are lowercase alphanumeric of 9 characters or less.'
So what about lowercase? As long as it's random-ish, it's fine. Good luck brute forcing a 9 character lowercase alphanumeric password... Capitals are overrated anyway, if asked to include an uppercase character, in my experience most people will use exactly 1 uppercase character. So, given a password with length 8, it's only 8 times as many possibilities you would check. However, it is still an extra keypress, so if you went for an extra character it would be a lot more effective. Then there is the point that on many phones it's a nuisance to type capital letters, then there is a problem of readability of for instance I (upper i), or l (lower L). Also, when speaking out a password it is annoying. Then, at least for me, it is hard to remember the location of the capital letters.
This case underlines the futility of long passwords. Everyone's data was exposed no matter how strong they were.
It does however underline the importance of compartmentalisation. Don't reuse passwords between sites.
The whole point of a password is to have something you can memorize (without writing it down) as a security precaution. The problem is that different websites have different password requirements. For example, one website might require at least 8 characters in your password with at least one numeric and one non-alphanumeric character. But then another website might require at least 6 characters (alphanumeric), but DOES NOT ALLOW non-alphanumeric characters. So now you have two different passwords to remember. On top of that, it is recommended that you have a different password for each account. I don't know about you, but I have probably 100 accounts to various websites, games, etc - and there's no way I could memorize that many different passwords containing a mixture of alphanumeric and non-alphanumeric characters.
For my passwords I use the keys one-up-and-to-the-right of the "dictionary style" password I have. For example, for password this would come out as -wee305r, making it harder to brute force. Of course if the passwords are all stored plain text by some incompetents what's the point?!
'); DROP TABLE Password;
of having 100 alphanumeric+special character long passwords when websites just give up the password lists with the magical words 'sql injection'?
Unique passwords at least ensure that once a website you frequent is compromised you don't get further screwed over...
The problem with slashdot is that most of its users were bullied and stuffed into lockers as kids!
There must have been a few dozen.
The issue is I have, at last count, 13 systems with separate passwords. There's a network account, elevated privileges account for server admin, HR systems, online learning systems, expenses system, which is not the same as the travel booking system, etc.
With the company's computer, I can't just install any software I want, so one of the password tracking programs is not an option. So I use the same password for all 13 systems.
So the next issue, not all those systems have the same password requirements. There is one system which does not allow the use of special characters. So while my password always has lower case, upper case, and numeric, I'm always going to be in that 99% with no non-alphanumeric characters. Oh, and I think the max characters limit is around 12.
Of course, writing down passwords is such a bad practice. But there's no way I can afford to burn the cycles to memorize 13 new passwords every 90 days, so I use the same password for all work systems. The same bad password.
That's the same as I have for my luggage.
rewriting history since 2109
Of course they're not salted. They're checking their sodium intake!
Stop screwing around.
67% of accounts on both Sony and Gawker use the same password.
Without a map of Sony accounts to Gawker accounts I don't know what this means... I take it to mean "The cardinalty of the set that is the union of password sets from Sony and Gawker is 67% of the cardinality of the set of Sony passwords."
IIRC, Gawker had their username/password database stolen a year or so ago? I read the "67%" as: for accounts on both Gawker and Sony, where the email address matched up, 67% of the passwords were also the same.
That is, 2/3 of the people who had accounts on both Gawker and Sony were using the same password, not a different one.
Here's how I look at it:
My PSN account is used purely for entertainment. It is not linked to a credit card. I have made one PSN purchase on my credit card. My credit card company offers fraud protection.
Why should I have a 26-character long UTF-8 password that I'm never going to remember? It's about as useful as having a strong password on the hotmail account I use to sign up to websites. Huge pain in the ass, negligible benefit.
My banking site, my PayPal account, my Canada Revenue Agency account - these are the places that I bother to use strong passwords. Elsewhere, I don't care that much.
It may look like I'm doing nothing, but I'm actively waiting for my problems to go away.
--Scott Adams
Only a fool gives their credit card to everything.
MY Xbox live account is a simple password. and I'm not dumb enough to give them my credit card. I use their prepaid cards to keep their fingers out of my finances.
Do not look at laser with remaining good eye.
Sit down and think of the number of sites/services/etc. that you access each week.
Pretend for a second your browser doesn't remember a single one of them.
I came up with 34 different sites. 34 different systems with their own rules, regulations and security questions. Some sites only allow alpha numeric, some require the alphabet to be limited to what shows up on a touch tone phone. Others require passwords to change every 30 days with no repeats for the last 5 passwords.
At 9 characters a piece, that would be a string of 306 characters. Hell I'm lucky if I remember my wife's birthday and our anniversary. And those are much more important to me than my slashdot password.
My point is, the current system is BS. Too many sites require logins so they can advertise to you. I don't want your ads, they go directly into the trash. I'd advocate for a single ID across these systems, but the issue is if that's violated everything goes to hell just as fast as if you had the same password for each site. So what to do? Reuse a password that is reasonably secure and risk it across multiple sites? Or do I follow perfect security and ensure no one can get in, including me?
And don't get me started on security questions. If I can't remember the damn password, what hope do I have to remember the question I used?
=================
Unix is very user friendly, it's just picky about who its friends are.
Exactly. I use 1Password to generate and store all of my passwords, and apparently I fell into the 1% that used a non-alphanumeric character in their password. Mine was a 16-character password that mixed caps, numbers, and symbols, and it was unique to PSN, so I've had pretty decent peace of mind when it comes to my password.
Unfortunately, I lacked the forethought to not keep my credit card information on file with them. :/
It doesn't help when some sites don't even allow non-alphanumeric passwords.
Indeed, and by far the worst culprits I have found for such asinine limitations are banks. I have come across many that impose arbitrarily small password lengths and refuse all non-alphanumeric characters.
Exactly! You'd think a bank would want the most-secure passwords a user can come up with. Why would you ever disallow special characters? And, unlike the other poster who replied, these aren't French banks. They're local American banks. I don't get it...
Bite my shiny metal ass!
I've found that using non-alphanumeric characters in password fields to be problematic. The main reason being that a lot of sites won't let you use them and that it gets to be a real pain in the ass to fill them in at times. On top of which a lot of companies fail miserably at validating the password fields when they're being entered initially.
In other words, if companies weren't so incompetent when it comes to passwords then we could insist that users enter stronger passwords, as it stands now, if you go for really strong passwords, you're just asking for trouble.