Slashdot Mirror

← Back to Stories (view on slashdot.org)

Multiword Passwords Secure Or Not?

Posted by Unknown on from the never-ending-passphrase dept.

Gaygirlie writes "An article over at Gizmag says: 'It's a meme that's been doing the rounds on the internet in recent years: multi-word pass-phrases are as secure as long strings of gibberish but with the added benefit of being easy to remember. But research from Cambridge University suggests that this may not be the case. Pass-phrases comprised of dictionary words may not be as vulnerable as individual passwords, but they may still succumb to dictionary attacks, the research finds.' I find this to be twisting of words and general consensus; of course any password whatsoever is going to be insecure against offline attack, and using common, popular words is going to make guessing the password much easier. But is this really an issue in a world where most attacks are done online? Should general populace still be coaxed into using randomly generated passwords?"

16 of 372 comments (clear)

  1. Obligatory xkcd by kc9jud · · Score: 5, Insightful

    http://xkcd.com/936/

    1. Re:Obligatory xkcd by medv4380 · · Score: 5, Insightful

      Come on. All he did was post a link to a related xkcd comic. He didn't say anything about it being right or wrong. It's related, and funny. Would you rather have had someone do a standard first post troll instead?

    2. Re:Obligatory xkcd by Anonymous Coward · · Score: 5, Insightful

      No, you RTFA. They mention xkcd, but then ignore it and go on to test 2-word passwords that are not randomly chosen or unrelated words. Of course 2-word passphrases, where the words are related ("Chicago Bulls") or are a verb-noun pair ("Speedy Gonzalez" "Soft Kitty" "Oneiric Ocelot"), are weak against dictionary attacks. The xkcd approach is not.

    3. Re:Obligatory xkcd by gstoddart · · Score: 5, Informative

      There is something that always bothered me, how in the hell does the attacker knows if I am using words for my password or not?

      They don't, but if they have the resources for a brute-force search, it's moot since in theory they'll just keep trying until they find it.

      Second consider the following password where at one point was on my laptop: "A happy worker is mindless worker, so shut up and do your job!" I fail to see how this password is not safe just because I used actual words, wouldn't it take million of years(even with dictionary attack) to gess it ?

      Well, possibly not. Think about a document with a password.

      If someone really wants to get into it, and is willing to invest the time and hardware, having a computer try millions and millions of permutations isn't as expensive as you might think, and it gets cheaper every year.

      Many forms of crypto have fallen over the years as the speed of computers has allowed what used to be an impossible task to be something which can be done in relatively short time. Even a couple of days or weeks of compute time would represent an absolutely vast amount of attempts.

      It's a damned find pass-phrase, but a computer is really good at doing an endless set of boring things. So, eventually even if it's a massive brute force attack, it could still arrive at the one that worked.

      However, this is the most telling part:

      The researchers found that film and book titles were effective in identifying pass-phrases in use - information readily available in list-form online suitable for dictionary-style attacks. The researchers used Wikipedia and IMDB lists, as well as slang phrases from Urban Dictionary. Researchers found users tended to favor simple two-word phrases common in natural language, though there is evidence that some users seek out seemingly-random pairings. The researchers also claim that there are "rapidly diminishing returns" for longer pass-phrases containing three or four words.

      So, if movie names and slang is what many people are using as their pass-phrases, a dictionary attack is a little easier.

      But, something like "cotillion squirrel hammer bollocks gouda inkwell" might be random enough that the sources people might use to try a dictionary attack won't be of any help. Whereas "The Dark Knight" or "Star Wars" might fall pretty quickly.

      --
      Lost at C:>. Found at C.
    4. Re:Obligatory xkcd by Geoffrey.landis · · Score: 5, Informative

      So you didn't bother to RTFA before posting that. They're trying to show that the easier to remember password may be easier to crack with a dictionary attack.

      And you didn't bother to read the xkcd before posting that. It showed with calculations that the commonly used "hard to remember" password has lower entropy than a much easier to remember multiword phrase. For reference, "higher entropy" means "harder to crack with a tailored brute force attack."

      In any case, though, the actual first thing you need to do is to make sure you never reuse a password on two different systems. And the xkcd for that is http://xkcd.com/792/

      --
      http://www.geoffreylandis.com
    5. Re:Obligatory xkcd by Anonymous Coward · · Score: 5, Informative

      > Say you have a 4 word password and you publish your 2048 word dictionary on the internet, entitled "come at me". Is that more or less secure than a random 8 character password(upper, lower, numbers, 40 symbols)

      > 4^2048 vs 8^102

      You mean 2048^4 vs 102^8.

      2048^4 = 1.7592186 * 10^13
      102^8 = 1.17165938 * 10^16

      With only a 2048 word dictionary to choose from this is less secure than a random 8 character password.

    6. Re:Obligatory xkcd by tigre · · Score: 5, Insightful

      Aren't those exponents reversed?

      2048^4 vs 102^8?
      1.7 * 10^13 vs 1.1 * 10^16?

      So completely random is still better in this sense. Just hard to remember and maybe hard to input. xkcd compared "uncommon word + common substitutions + a couple random characters".

    7. Re:Obligatory xkcd by micheas · · Score: 5, Interesting

      Pulling one example, I was asked to see if I could recover the password on pdf to allow editing. IIRC, the cypher was 256 bit AES. When trying to find the password to edit a pdf, my really ancient dual core athlon64 took under 2 minutes to try every unique word in the OED.

      The password of the pdf (which was sanfrancisco2) took me about 15 minutes to find using standard password dictionaries. Theoretically, a 13 character password with a number in it should take an insanely long time to crack, reality was well under an hour.

      --
      Work bio at MMWD
    8. Re:Obligatory xkcd by realityimpaired · · Score: 5, Informative

      People are under the mistaken impression that would-be hackers waste their time trying to brute force passwords. They don't. They either exploit design vulnerabilities (in which case your password doesn't matter), or they try a little social engineering to get your password. The one thing the movie Hackers got right was the scene when Dade called up the night security desk at one of the places he was trying to hack, pretending to be an employee in a panic, and got him to read the phone number off the modem so he could dial in. That's how it really does work... you come up with a ruse, and convince somebody who doesn't know better to give up sensitive information that you can use to gain access to the system.

      And that's where passphrases have a huge advantage: they are easy enough to remember that they don't need to be written down.

    9. Re:Obligatory xkcd by 93+Escort+Wagon · · Score: 5, Funny

      IA typical English speaker uses 2,000 different words over the course of any given week and knows about 20,000.

      Verily and forsooth! Thou dost assume what thou shouldst not. Amend thy ways, miscreant, lest thou find thyself at the receiving end of my bludgeon!

      --
      #DeleteChrome
  2. Of course they are secure by Bender+Unit+22 · · Score: 5, Funny

    I find that passwords like "Linuxrox4ever" are very secure. havn't had a problem with that one yet.

  3. [Nelson] HAHA! by Bender+Unit+22 · · Score: 5, Funny

    lol omg. it worked.

  4. Very specific conditions by Dixie_Flatline · · Score: 5, Insightful

    The passphrase system they studied wouldn't allow duplicate passphrases. So if you picked one that was already in use, it would tell you so.

    The problem isn't that the passphrase is insecure, the problem is that the system itself is giving you information about what's inside it. Doesn't it seem obvious that any security system that relies on secret data that gives up information about the secret data is insecure?

    Then they did an analysis on passphrases that use english words with the same frequency as in standard English. So the word 'betwixt' was probably pretty low down on the list, and 'material' was probably higher. That also seems unreasonable. Just because you want a memorable password/passphrase, it doesn't mean that you have to use small, ultra-common words.

    This study has little merit in declaring that passphrases are insecure. (It does have merit in letting us know that obvious security problems are, in fact, obvious security problems.)

  5. Take into account human nature by MetalliQaZ · · Score: 5, Insightful

    As mentioned, a lot of stock is put into secure passwords, when the reality of computer usage makes all the effort meaningless.

    Lets look at a normal user, Joe. Joe has many corporate logins at his job. His company has a password strength policy, so Joe has ended up with this password: Jason5 (Jason is his youngest son). The last password was Jason4, then Jason3, etc. Some system require more powerful passwords, so he uses _Jason$5. I have met dozens of Joe's IRL.

    Lets look at Lucy. Lucy knows that a good password only has to be easy to remember and hard to brute force. "Simple Man" is one of her favorite songs. Especially these lyrics:

    "Boy, don't you worry you'll find yourself
    Follow your heart and nothing else
    And you can do this, oh baby, if you try
    All that I want for you my son is to be satisfied"

    She selects this password: allthatiwantforyoumysonistobesatisfied
    She'll never forget it, and I won't be cracked by ANYONE. Governments who want her password could crack it, but they would probably just put her in jail until she gave it up.

    Then, Lucy reads the article linked above and starts to doubt the security of her password. She is wrong, her password is WAY better than Joe's.

    Both accounts end up getting compromised. The company had been storing passwords in plain text and was hacked via a 2-year old SQL injection vuln. So much for all that bullcrap.

    -d

    --
    "Here Lies Philip J. Fry, named for his uncle, to carry on his spirit"
  6. My method by Anonymous Coward · · Score: 5, Funny

    Fuck it I say. I just always use letmein for all my passwords. Easy to remember and so easy to hack into nobody's going to waste time thinking there's anything valuable protected by it.

    I call it security through insecurity.

  7. Re:Poetry by HCase · · Score: 5, Funny

    There was a ship that tried using Vogon poetry for their password locks once. Unfortunately, after valiantly functioning for 3 weeks, the login daemon it decided it could no longer take it and convinced the ship's navigation system to fly into a nearby star. Further use of password verification system was banned several years later, after an intergalatic agreement was reach that said requiring people to remember Vogon poetry was cruel and inhumane.