Slashdot Mirror
Multiword Passwords Secure Or Not?
Gaygirlie writes "An article over at Gizmag says: 'It's a meme that's been doing the rounds on the internet in recent years: multi-word pass-phrases are as secure as long strings of gibberish but with the added benefit of being easy to remember. But research from Cambridge University suggests that this may not be the case. Pass-phrases comprised of dictionary words may not be as vulnerable as individual passwords, but they may still succumb to dictionary attacks, the research finds.' I find this to be twisting of words and general consensus; of course any password whatsoever is going to be insecure against offline attack, and using common, popular words is going to make guessing the password much easier. But is this really an issue in a world where most attacks are done online? Should general populace still be coaxed into using randomly generated passwords?"
http://xkcd.com/936/
I find that passwords like "Linuxrox4ever" are very secure. havn't had a problem with that one yet.
lol omg. it worked.
Getting joe public to use something other than "password" is hard, but its easier to persuade Joe to use a phrase like "HomerLovesDonuts" than some random string of letters - we all know the random string will just get written down.
How many attempts are these supposed sites allowing? If someone has a one in a million chance to determine my password how much of a threat is that to me if the site that requires the password only allows a few attempts before it locks the account?
I work on a system with ten character passwords, not case sensitive but numbers can be used, yet I don't worry about someone cracking the system. Its not like they are going to have unrestricted access to try and multiple failures lock accounts.
I do like multiple word passwords as it tends to not lead to people using little yellow stickies near their desk to record their passwords or keep them as reminders in their email.
* Winners compare their achievements to their goals, losers compare theirs to that of others.
Is Vogon poetry available in common attack-dictionaries?
bickerdyke
The passphrase system they studied wouldn't allow duplicate passphrases. So if you picked one that was already in use, it would tell you so.
The problem isn't that the passphrase is insecure, the problem is that the system itself is giving you information about what's inside it. Doesn't it seem obvious that any security system that relies on secret data that gives up information about the secret data is insecure?
Then they did an analysis on passphrases that use english words with the same frequency as in standard English. So the word 'betwixt' was probably pretty low down on the list, and 'material' was probably higher. That also seems unreasonable. Just because you want a memorable password/passphrase, it doesn't mean that you have to use small, ultra-common words.
This study has little merit in declaring that passphrases are insecure. (It does have merit in letting us know that obvious security problems are, in fact, obvious security problems.)
I use and love LastPass. It has a really great password generator that I use for all sites. I always use the maximum number of characters and the largest character set (letters, numbers, symbols) the site will let me.
My actual LastPass password (the single point of failure) is 32 characters long. It is a phrase in "leet" speak with symbols padding the start, middle, and end.
I feel pretty safe with this.
Just my 2c
K Man
As mentioned, a lot of stock is put into secure passwords, when the reality of computer usage makes all the effort meaningless.
Lets look at a normal user, Joe. Joe has many corporate logins at his job. His company has a password strength policy, so Joe has ended up with this password: Jason5 (Jason is his youngest son). The last password was Jason4, then Jason3, etc. Some system require more powerful passwords, so he uses _Jason$5. I have met dozens of Joe's IRL.
Lets look at Lucy. Lucy knows that a good password only has to be easy to remember and hard to brute force. "Simple Man" is one of her favorite songs. Especially these lyrics:
"Boy, don't you worry you'll find yourself
Follow your heart and nothing else
And you can do this, oh baby, if you try
All that I want for you my son is to be satisfied"
She selects this password: allthatiwantforyoumysonistobesatisfied
She'll never forget it, and I won't be cracked by ANYONE. Governments who want her password could crack it, but they would probably just put her in jail until she gave it up.
Then, Lucy reads the article linked above and starts to doubt the security of her password. She is wrong, her password is WAY better than Joe's.
Both accounts end up getting compromised. The company had been storing passwords in plain text and was hacked via a 2-year old SQL injection vuln. So much for all that bullcrap.
-d
"Here Lies Philip J. Fry, named for his uncle, to carry on his spirit"
My granddaughter thinks it's too hard to defrost a frozen bagel before eating it. You want the youth of America to practice typing passwords? Ha!
Sorry, but gray text on gray background is making my eyes bleed.
Even if you have a very small set of words (about 1.000) to choose from, with four words you reach about 40 bits entropy. No chance to crack this brute force.
If you take only two words, you would have about 20 bits of entropy which is about as good/bad as cryptic password.
The system is broken if people can't use it. People aren't broken because they can't use the system right.
If your method of controlling access is nice and easy for computers but hard for people, it's broken and you need to find a new method.
Business/App ideas are like arseholes: everyone's got one, they're mostly shit, but very rarely they contain a diamond
They assume they get ideal circumstances, ie as many attempts as they want. As such their research is basically fucking worthless. The only time such a situation applies is if you have, say, encrypted data and an adversary has gotten that data. They can then try to decrypt it until the end of time and you can't change the password.
That doesn't do shit for remote login. No system is so accommodating to let you just try and try. Even if they don't do permanent lockouts, they'll lock you out for awhile. Like our domain, you get 5 attempts and then it locks the account for 30 minutes. So you can get a whopping 240 attempts per day (presuming we don't notice and shut it down). Gonna take a LONG time to cover the password spaces they are talking about, LONG time.
This also assumes that you know that someone is using a multi-word phrase, and that you know they aren't playing games with number substitution, caps, and so on. This is useful maybe in an intelligence agency type situation, where you can survey your target and you can learn about the kind of password they use, even if you can't find out the password itself, and restrict the search space. However in terms of randomly hacking things remotely, nope, not useful. There are too many possibilities for what the person could use and multi-word phrase is only one of them. You could try every single one of to 10 words, only to then discover your target doesn't use that, and has a simple password like password123 that wasn't in your search space.
Fuck it I say. I just always use letmein for all my passwords. Easy to remember and so easy to hack into nobody's going to waste time thinking there's anything valuable protected by it.
I call it security through insecurity.
Based on my read of the article, I conclude it as saying that pass phrases really are good, just not a panacea. We already knew that people pick stupid passwords. It turns out that people pick stupid passphrases too. That's too bad, but it is really unsurprising.
One thing I can say from personal experience: smart people still pick stupid passwords. I think most people just aren't paranoid about it, and don't care until something bad happens to them as a result. This might be something that parents need to teach their children: Don't talk to strangers, brush your teeth everyday, and don't pick obvious passwords. Maybe once a generation is imbued with this as obvious then the problem will diminish.
I have started using regex's as the basis for my passwords. Love to see some one crack ^[A-Z0-9]+\([a-z!]+\)$
The trouble is that now I have regex's ..
I am Slashdot. Are you Slashdot as well?
Not likely, seeing as the math is sound. TFA used a minimum case of 20,000 phrases generated from natural language, so of course it will be less secure.
It even says at the end that passphrases generated like in the XKCD comic are sufficiently secure to offline brute force.
... Amazon's PayPhrase registration page. Because the page prohibits the use of any pass-phrase that has been used by another user, it's possible to identify which pass-phrases are in use.
This is a well known, bad idea. Unless you also lock out the original user of an obvious passphrase, you give an attacker information.
Better is to just start with a dictionary of "bad" phrases, that no-one can use. Then, when an existing phrase is no longer in use, you mark it "bad" and unusable in the future. Of course, someone might start using that phrase berfore the rest stop using it. If it's an especially bad case, you might have to lock all those users, and make them reset their password through a different, secure, channel.
Throw some uncommon names and foreign words into your phrase, and it essentially becomes unguessable.
All ideas^H^H^H^H^Hprocesses in this post are Patent Pending. (as well as the process of patenting all postings)
If you have a decent vocabulary, ...
Most people don't choose their passwords from a decent vocabulary. I've seen too many instances of P@ssw0rd, that people think is secure.
Throw some uncommon names and foreign words into your phrase, and it essentially becomes unguessable. But, many people don't know any foreign words.
All ideas^H^H^H^H^Hprocesses in this post are Patent Pending. (as well as the process of patenting all postings)
My system guesses "deserve access to my accounts".
Just hold down shift and type in your 10 digit phone number.
(@)%%%!@#$
"If any question why we died, Tell them because our fathers lied."
I've been saying for a long time now if companies would just implement lockout policies we wouldn't have any of these issues.
It would help some (less annoying than a lockout policy is just to implement a delay that increases with number of failed attempts). However, the dictionary attacks that are worrisome come from a hacker stealing the password hash tables, and are done offline, trying to decrypt the hash, not simply repeated attempts to log in. These won't be prevented by lockout policies (although they will be prevented by making sure that the hash tables don't get stolen)
http://www.geoffreylandis.com
For myself, I have three phrase+number complex passwords which I use, one for financial sites, (online banking, amazon, anywhere I shop & my plastic is stored) one for places I expect to use regularly (such as slashdot) and one for trash sites where I gotta register for whatever it is I want, but don't likely expect to be back. The variant thing is, I have my own domain with a catchall address (similar to gmails + system) and for all domains I use the domain name plus my @domain.com
assuming the method show in the cartoon was automated checking of the password email + combo-- it'll fail because I wouldn't use the same email address at ANY website.
every day http://en.wikipedia.org/wiki/Special:Random
@lw@y$ U$3 Ch@r@ct3r R3pl@c3m3nt 1f Y0u U$3 R3@l W0rd$ 1n Y0ur P@$$phr@$3$ !!!
I have passwords that look like that (minus the spaces). Break that with a dictionary! :p
Seriously folks, if you use real words in a password in this day and age, you're a little bit more than naive or completely out of touch with what computers of the current generation are capable of. IMHO, you CANNOT use straight dictionary words (regardless of language, and yes, I do mean Klingon and Sindarin!) in your passwords without some sort of numeric or symbolic character replacement pattern. Then you can use easy to remember song lyrics, movie quotes, and other colloquial sayings as pass phrases. Use them "au naturelle" and you will get pwnd!
P.S. I don't always use the same replacement pattern or characters, either. The above is just an example. I wouldn't use that one as someone has it in their dictionary by now, btw.
Just lift up the keyboard and read it off the post-it note you stuck to the bottom of it!
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
... after all- when the Welsh were coming up with names for their villages they used random letter generating apps on their iDruids.
"That's the way to do it" - Punch
My recommendation for a really secure pass phrase:
1. Pick a phrase like "maryhadalittlelamb"
2. Add (or replace) with one capital letter, one number, one special character. Don't use l33t-speak, just at random.
3. Remember your three weird words like "maVry" "li6ttle" and "lam!b", it's much easier than when it's all just a hopeless mess.
4. Your password is now "maVryhadali6ttlelam!b", there not a password cracker in the world that'll find this.
It's way, way too long and uses from all the character sets for a brute force attack. As for a dictionary attack, there's way, way too many permutations. It could just as easily be "mar#yha1dalittlelRamb" or "m%aryhadalitOtlela9mb" or a million other combinations based on "maryhadalittlelamb", even if you knew that was the basis. Of course the biggest risk is the computer you're typing it into, for example I feel my mail is now much safer now that I can log into it from my smartphone rather from any random webcafe/desktop/laptop I happen to have available. It's a lot more difficult to get a spy app installed or bug my hardware than if I type it in on machines I don't control.
If I remember correctly, this is how our university got breached once, they bugged a desktop in the computer lab, trashed the software a bit then waited for an admin to come and try cleaning things up with the admin password. Boom, they got admin rights to every desktop on the network. Against that it doesn't matter if your password is a kilometer long, if you can't trust the console it doesn't matter. It only matters if your data is stolen and they never got the password, which is of course one important vector with stolen laptops and all, but it doesn't protect against other threats. All in all I consider my password complexity as being a very low-risk threat. No point in a bullet proof blast door if a burglar would use the window.
Live today, because you never know what tomorrow brings
This line from the summary was written by someone who doesn't understand the slightest thing about modern encryption and password security:
Look up the concept of key stretching. In a nutshell, you basically take a plaintext password and then apply many thousands of rounds of encryption or hashing to it and then store the end result in the password database. The idea is that you incur a few seconds of computation time every time the password is set or retrieved, which is a very minor inconvenience in normal use but is a humongous amount of overhead to brute forcing even a single account.
With this technique, a dictionary attack on one account can take days to work through the whole set of words. So if you're using a dictionary word for your password, you're screwed no matter what. But a halfway-strong password that doesn't appear in any dictionary can be completely immune to an offline attack if the hashes were computed securely. The only way for an attacker to get around it would be to find some fatal flaw in the encryption or hashing algorithm. (In which case, the NSA would probably like to speak with him.)