Selectively Reusing Bad Passwords Is Not a Bad Idea, Researchers Say

An anonymous reader tipped us to news that Microsoft researchers have determined that reuse of the same password for low security services is safer than generating a unique password for each service. Quoting El Reg: Redmond researchers Dinei Florencio and Cormac Herley, together with Paul C. van Oorschot of Carleton University, Canada ... argue that password reuse on low risk websites is necessary in order for users to be able to remember unique and high entropy codes chosen for important sites. Users should therefore slap the same simple passwords across free websites that don't hold important information and save the tough and unique ones for banking websites and other repositories of high-value information. "The rapid decline of [password complexity as recall difficulty] increases suggests that, far from being unallowable, password re-use is a necessary and sensible tool in managing a portfolio," the trio wrote. "Re-use appears unavoidable if [complexity] must remain above some minimum and effort below some maximum." Not only do they recommend reusing passwords, but reusing bad passwords for low risks sites to minimize recall difficulty.

Comments

This makes sense.

[Anonymous Coward]

My intuition says that most people do this. Though, I could be wrong.

Re:This makes sense.

[Anonymous Coward]

The point of password reuse is to use an algorithm that you can remember but not someone can guess.

This is not my password but it's an example of how I create one:
If I visit a site and it's name is GoogleSucks.com, I will use my "easy" word + the first syllable of the site + a padding word that I use on all sites, Depending on how asinine the password requirements are, the beginning or end of the password will be padded with numbers and symbols, but always the same ones.
So Googlesucks.com might be turkeyGootrucking8
and another site like a bank site that I want higher entrophy on will use a different algorithm, so BOA might end up a hard non-englisht word + the passing word, then the company's initials + needed password entrophy, so BOA would end up with namastetruckingBOA8

So when I use sites that want to remember my shipping address or credit card (I never save my credit card number, I don't care how "safe" your site is) I use the harder credentials. I just want to post a comment on the many HuffPo type of sites, easy password all the time. So while each password for each site is unique, effectively the easy password is reused but padded with something unique to the site so that even if the password was stolen it's unusable for any other site.

Re:This makes sense.

[vtcodger]

My intuition says that most people do this. Though, I could be wrong.

Well, some of us try to do it. We are, regrettably, impeded by whacked out sysadmins who insist we must use THEIR idea of a strong password -- which always seems to be different from anyone else's idea of a strong password, and/or that we need to change passwords periodically, and/or that we can't reuse passwords.

I sometimes seems that there is an inverse relationship between the actual need for security and the system administrator's perception of the need for security.

But other than the fact that users often have to contend with the idosyncracies of sociopaths who feel that anything that is easy to use is clearly flawed, this seems a pretty good idea. If it gets the attention it deserves, perhaps it might be one small first step toward straightening out the incredible mess that is computer security.

Re:This makes sense.

[SQLGuru]

Yep. This has been my strategy for many years. I rank sites by how much I care whether they are compromised. For low ranked sites, they get one of several easy passwords (depending on how important THEY think their passwords are). For critical sites (i.e. banking info) they get a unique strong password conforming to the password rules.

Re:This makes sense.

[knarfling]

I see that someone has had problems with a sysadmin.

Try to remember that not all sysadmins are BOFH. Some actually agree with you on the need for complex passwords and how often they should be changed. Many of them, however, have to follow outdated and impractical guides forced upon them by government standards in order to comply with HIPA, SOX, or PCI.

There are a couple of things that bother me, though. The first is pattern re-use. P@$$word521 does meet the complexity requirements of many systems. But when you use P@$$word125, P@$$word251, P@$$word215 and then tell everyone that you use P@$$word with the same three numbers and just rotate the numbers, it is not much better than a post-it under the keyboard. Complex passwords do not have to be difficult to remember. Just because someone has difficulty coming up with good passwords does not mean that a hard-to-remember password is actually complex.

The second thing that bothers me is when a sysadmin will force a password policy on you, but won't use it himself. I know one admin that forced a password change every 90 days for all accounts except his. When he left the company, his password history was completely blank. He had used the same password for years. While I think passwords could live longer than 90 days and twice a year would be sufficient for many passwords, if a change is required, it should be required for all users including the sysadmin.

Just my little rant.

Re:This makes sense.

[gman003]

We are, regrettably, impeded by whacked out sysadmins who insist we must use THEIR idea of a strong password -- which always seems to be different from anyone else's idea of a strong password, and/or that we need to change passwords periodically, and/or that we can't reuse passwords.

I sometimes seems that there is an inverse relationship between the actual need for security and the system administrator's perception of the need for security.

This.

I tried to do something basically like this - I have three password strengths, one for low-security throwaway stuff, another for regular stuff (with suffixing so one compromised site won't affect others unless I am specifically targeted), and a max-security one.

Guess which one I use for banking. It's the mid-tier one, MINUS the special characters and suffix. They have an upper length limit that keeps my max-security password from being used for the one thing it really should have been used for.

The only thing that max-security password secures now is root access to my BSD box (and I have sudo set up with nopw, so I never even use that). Everything else is secured by something that really isn't secure enough.

Re:This makes sense.

[Anonymous Coward]

Sadly most people pick the same low-entropy password and use it on ALL sites, facebook and their bank acct and their retirement acct and their student loan account etc etc etc. Usually the only time a user will pick a different password on their own free will is when the password rules of a site (length/complexity) dictate deviating. And that is when trivial security questions get rolled out (Since the user is sure to forget what different pwd they picked.)

Re:This makes sense.

[knarfling]

We are, regrettably, impeded by whacked out sysadmins who insist we must use THEIR idea of a strong password -- which always seems to be different from anyone else's idea of a strong password, and/or that we need to change passwords periodically, and/or that we can't reuse passwords.

I sometimes seems that there is an inverse relationship between the actual need for security and the system administrator's perception of the need for security.

This.

I tried to do something basically like this - I have three password strengths, one for low-security throwaway stuff, another for regular stuff (with suffixing so one compromised site won't affect others unless I am specifically targeted), and a max-security one.

Guess which one I use for banking. It's the mid-tier one, MINUS the special characters and suffix. They have an upper length limit that keeps my max-security password from being used for the one thing it really should have been used for.

The only thing that max-security password secures now is root access to my BSD box (and I have sudo set up with nopw, so I never even use that). Everything else is secured by something that really isn't secure enough.

So in other words, nothing has your max security. if you left your screen open and unattended for a moment, a person wouldn't even need your password to crack your BSD box. I hope your BSD box doesn't have anything important on it. The nopw option of sudo should NEVER be used. It is like putting a huge un-pickable lock on your door and then never locking it because it is too inconvenient to pull your keys out. If you use sudo (which I do use often and I believe it is useful, convenient and CAN be secure), you should make sure your password is complex and you need to type it in when you use sudo. Otherwise, you are reducing your security. Yes, sudo can be restricted by host, but most people do not do that, and what happens when that host dies?

I understand that good passwords can be difficult, but they don't have to be. Once I learned how to create good passwords, it became very easy. Even my low security passwords are fairly complex and will pass most complexity requirements. My work password, which has to be changed every 90 days, is usually between 14-20 characters long, has multiple complex characters, and is easy to remember. Although work allows rotation after 6 passwords, I have not re-used a password in six years. My biggest issue is not remembering the password, it is fat-fingering such a long password. The longer it is, the more likely there will be a fat-finger at some point.

Re:This makes sense.

[Anonymous Coward]

Why would forcing reoccurring password changes help security at all?
If the system already is compromised it could be a good idea to do a company wide password change, but you probably need to clean/reinstall a bunch of servers too and send out info to you customers that their information has been compromised.
If the system haven't been compromised, what good is enforcing a password change?
Perhaps it would help against an ongoing brute-force attack but then again, why not request the password change when you detect an unusual amount of incorrect login attempts?

Can someone enlighten my to why changing passwords would be good for security unless you do it company wide at the same time? As far as I can tell it only encourages the users to write down their passwords on post-its.
Not that I necessarily consider that a big problem, anyone who has access to the post-it already has access to the entire office and can easily steal/clone the disks or whatever other papers that haven't been sent through the shredder yet.

Re:This makes sense.

[fivepan]

As a sysadmin, it is much more than just my perception that I need to have secure access into the network. There are different levels of security within the network, but that initial entry has to be highly secure. I'm going to require my users to change their passwords every 90 days and it must consist of 9+ characters using lower/upper chars and symbols. That's really the only serious password I'm asking my users to create and remember. Once they're inside the network, they can do whatever they want in regards to passwords (or rather, it's someone else's rules on the databases themselves). But it is a lot more than just some sociopathic need on my part.

Re:This makes sense.

[knarfling]

The 90 day password change is a fixture of compliance regulations. If you deal with PCI, SOX or HIPA, you probably have to force password changes every 90 days. With PCI, you can lose your ability to take credit cards if you can't show that you force password changes at least every 90 days. (There are ways around it, the most common is lying to the auditor, but that is a different story.)

I have my own theory as to why the 90 days became standard, but was told that my theory was all wrong without any explanation as to why it was wrong. Suffice it to say that 90 days is a standard and if anyone really knows why it became a standard, they aren't talking.

If you ask an auditor, they will tell you that if someone does find your password, either through a key logger, finding your post-it or cracking your password database, they will only have a limited time before that password is changed. You don't even have to know that someone got your password if you change your password on a schedule. Of course, it might not take long before they learn the new password, but that concern is usually dismissed.

Re:This makes sense.

[Talderas]

Having helped ease my company from using very generic user accounts and passwords that everyone in the company knew to user unique logins and passwords I can provide some insight as to some of the reasons beyond security.

Part of the problem I've had with trying to break users of the habit of sharing their username/password with others (managers are the ones telling them to do this) is convincing them that 1. applications are available regardless of the logged in account and 2. if there are files or documents that legitimately need to be shared among the workgroup then they should be housed on the network drives and not on the personal network drive or local machine. Having a password policy to require password changes every 90 days is one of the ways to help encourage them to discontinue this practice. I've attempted to be diplomatic and explain why they don't need to do it, but it hasn't sunk in yet. I've talked numerous times and finally I had them just log in as themselves on another machine to prove to them that what I was saying was true. Now that group talks about the sharing of accounts and passwords more sarcastically, when the manager is not around, so there's at least some improvement.

We're starting to come under more strict auditing these days so a lot of these password and user account related changes are in order to comply with things the audit might turn up and flag as a problem (there are negative consequences if there's too many flags from the audit). Additionally, the changing of password and not sharing user accounts is not just a company security issues but an individual user security issue as well. Since we do all our logging based on user account, that's who usually gets slapped with disciplinary action if something bad happens. Regardless of that, if passwords are used on websites that are externally accessible to their home computer, they could get compromised and the data available to the Internet is available at large. A periodic password reset limits the scope of when a compromised account is a danger since if the account was compromised and they have a valid username/password it won't flag bad attempts (unless you do some sort of IP tracking). The same thing occurs internally. If a user shared their credential information with another user, because say they were on vacation, then the periodic password resets ensure that other user doesn't have valid credentials for the first user after a period of time.

I've actually gotten a lot better response from users regarding passwords when I use that latter arguement about accountability. It shifts the focus from what's good for the company to what's best for the user. It gives them a stake and enfranchises them with security and consequently they tend to be more receptive towards it as a whole. When you leave them with the impression that security is about the company, they don't care as much and will do whatever they can to make their lives easier.

Re:This makes sense.

[ultranova]

This is not my password but it's an example of how I create one:

And this is why the algorithm method won't work: people can't keep their mouths shut. Letting everyone know how clever you are is a drive that's almost impossible to resist, because it simultaneously helps your group and demonstrates your value to it, so it's selected for double strength. Consequently, the only way to have secure passwords is to generate them randomly and just write them down. Heck, just generate them for the user and tell them to use "save password" option on the browser - it's safe unless the machine gets infected, in which case it's gonna leak anyway.

and another site like a bank site that I want higher entrophy on will use a different algorithm

If a bank lets its customers pick their own passwords, that should be your cue that the bank thinks it won't be on the hook for any online thefts. After all, a lot of those passwords will be "password".

Re:This makes sense.

[Vellmont]

Many of them, however, have to follow outdated and impractical guides forced upon them by government standards in order to comply with HIPA, SOX, or PCI.

Don't blame the goverment for that. SOX doesn't specify passwords, it's an accounting standard that leaves that to the accounting industry. PCI is a credit card processing standard, and isn't set by the goverment.

Your instincts are simply incorrect. You think bad standards==government. Pure BS. Bad standards are bad standards and they're set all the time by large organizations. Much of what you're complaining about are bad standards set by accountants who really have no business setting these standards. It's the IT industry that needs to push on these people to change.

Re:This makes sense.

[Anonymous Coward]

> it is not much better than a post-it under the keyboard.

Hey, you're right! There is a Post-It under my keyboard!

Re:This makes sense.

[knarfling]

True. I should have said major corporate standards when I said government. But because of the way the payment card industry works, if FEELS like government. Complete with not following its own rules and having rules for the sake of rules.

Re:This makes sense.

[weszz]

Recently read through a penetration test we had done, and some of the things in there I didn't know... thankfully they couldn't get into our servers from the outside, but from inside the network wasn't too difficult from a system having some outdated software letting them in...

Anyway the whole deal about LANMan, kerberos and other things storing passwords in memory in a way that is very easy to decrypt was surprising... I also thought that if I told PCs to not store the LM password locally and don't use it, then it would be okay. Nope. have to do that AND have a 15 character or longer password. LM makes the hash of the password regardless of if it will ever use it, so the only defense is a password long enough to break it.

Kerberos... well there is no getting around that one. it's there and if they get admin access on the server they have the plaintext password of anyone logged in interactively. end of game.

Was surprising never being in part of a mitigation team for a test like that.

Re:This makes sense.

[Anonymous Coward]

I thought there was no difference anymore between major corporations and government... Isn't there a big buyout around every election?

Re:This makes sense.

[DMUTPeregrine]

I have an algorithm. I open Keepass, type my master password, and use the generator to make a password for that site!

Re:This makes sense.

[Anonymous Coward]

I use something similar, but my bank is stuck in the dark ages of the information age, requiring passwords to be at max 5 characters. MY BANK!!!

Re:This makes sense.

[swillden]

So, all I have to do is observe a small selection of your passwords and I know most of them, and even have strong clues as to the structure to facilitate what little guessing I need to do for your "hard" passwords.

Brilliant!

Re:This makes sense.

[I'm New Around Here]

Hmmm, let me think about this. Which is safer?

A. Have a system similar to what an anonymous person online described, and never have to write down or save a password for sensitive sites; or

B. Have my computer remember all my passwords, and still have to write them all down for when I am out of the house.

I know what I consider to be more secure. How about others?

Re:This makes sense.

[h4ck7h3p14n37]

Years ago I went through a SOX compliance process for a B2B website I worked on. I can't recall the name of the auditor, but it was one of the giant companies in Chicago. They sent us a clearly green auditor who had apparently taken some internal courses in how to perform an audit of computer systems (and billed a ridiculous hourly rate). One of the controls they insisted on was routine password expiration. When I challenged the auditor as to explain how it improved our security posture, they were unable to come up with any response other than that's what they were told was necessary. I suspect 90 days became the standard because the biggest auditors said so.

Re:This makes sense.

[I'm New Around Here]

Do you walk around your users' office space looking for the paper they write successive passwords down on?

If I walked into the office, would i be able to find at least five passwords this way?

I don't think your "secure network" is that secure. I visit many offices in my work, and I see how people survive your system.

Re:This makes sense.

[I'm New Around Here]

Is this a bank in the US?

Not asking the name, just curious where in the world banks are that way.

Re:This makes sense.

[Anonymous Coward]

And how are you going to observe a small selection of my passwords, when you don't even know who I am?

Re:This makes sense.

[Anonymous Coward]

Yep, as opposed to the morons that use password keepers and safes where all you have to observe is One password and then you have everything.

Re:This makes sense.

[Anonymous Coward]

But the algorithm above isn't his actual algorithm. It's just an example. Cracking an algorithm password is very difficult if you don't know the person involved, and if you know the person well enough to crack the algorithm; you probably are able to get physical access to a device with a saved password. Algorithms (depending on what you use) can generate very hard to machine crack passwords very quickly with no insecure external tools.

Re:This makes sense.

[swillden]

Yep, as opposed to the morons that use password keepers and safes where all you have to observe is One password and then you have everything.

One password which is never sent anywhere from their device, plus you also have to get their device.

I don't think that word "moron" means what you think it means.

Re:This makes sense.

[Neil Boekend]

If a bank lets you use ONLY a password to access your accounts it is clear that they do not care much about theft. The rest of their security will be similarly crappy. I would trust them with my mortgage. Not my savings or payment accounts.

My bank requires me to log in with a unique single use code. That code is generated by a "random reader". To generate a code I need to put my PIN card in that reader and enter the PIN.
After I have logged in I still need to sign my transactions. Also with a single use code generated by my random reader. This signing code requires me to enter a single use code that is generated by the bank and displayed on the signing page. Each signing event needs a different code, each code generates a different signing code to enter on the signing page (to prevent some man in the middle attacks.). Next I need to enter the total amount on my random reader (to prevent large problems in other man in the middle attacks).
For large amounts I also need to enter the bank account number in my random reader (to prevent large problems in other man in the middle attacks).

The app is slightly less secure once activated, but you need to sign (with the process described above) to activate your account number on that phone. If you never do that there are no phones that can access your account via the app. You can only pay to known bank accounts with the app. Only those you have already paid to (with the extensive signing procedure).

I like my bank. They have actually spend time to secure transactions. They have found ways to secure it without much hassle (the random reader is easy).
Maybe that is because they are on the hook if they can not prove that I authorized the transaction myself.

Re:This makes sense.

[HappyPsycho]

And this is why the algorithm method won't work: people can't keep their mouths shut.

I can think of a simple counter to this statement, RSA (or any other major encryption scheme) are published algorithms whose security is decided by the strength of the keys used.

Given the GP's algorithm I see numerous points where I can choose my own keys / base passwords / padding words. These are defenses to stuff like rainbow tables and word lists and should deny an attacker any benefit over raw brute-forcing of the password (from say a hash).

For those sites which require frequent password changes and don't allow repeating passwords something as simple as tacking on a series of digits in order like "012" then "345", "678", "901", "234", etc. will make brute-forcing a password significantly more difficult (if you notice the sequence doesn't repeat immediately when you loop back around, there are 10 combinations so it has increased the difficulty by an order of magnitude). You can easily change this to other keys on the keyboard or leters of the alphabet etc to increase security without altering the algorithm itself (just like RSA the size of the keyspace dictates the security).

Re:This makes sense.

[ultranova]

I can think of a simple counter to this statement, RSA (or any other major encryption scheme) are published algorithms whose security is decided by the strength of the keys used.

Can you do RSA in your head? Because once you're willing to use a computer for password management, you can as well simply use a keyring app with password generation and not worry about any of this.

Also, I think you meant a hashing scheme, not encryption, since making the algorithm one-way would seem to be a very desirable property.

Re:This makes sense.

[ultranova]

Have my computer remember all my passwords, and still have to write them all down for when I am out of the house.

If you don't worry about a random computer having a keylogger, why would you worry about writing your passwords down? At least you have a chance of noticing a pickpocket.

The chain is only as strong as its weakest link. There's no point in closing the barn door after the horses have ran away. Etc. etc.

Re: This makes sense.

[Anonymous Coward]

I'd tell you how I work my passwords over various sites but then I'd have to kill you.

Re: This makes sense.

[Anonymous Coward]

Concur. I don't have any idea how anyone in this day and age can NOT use a password safe. I have over 300 entries in mine and I clean out the junk regularly. I know it's a SPOF but seriously my life is too full of crap to try to be super vigilent about this subject. I'll take my chances and keep my sanity, thank you.

Re:This makes sense.

[lsatenstein]

The point of password reuse is to use an algorithm that you can remember but not someone can guess.

This is not my password but it's an example of how I create one:
If I visit a site and it's name is GoogleSucks.com, I will use my "easy" word + the first syllable of the site + a padding word that I use on all sites, Depending on how asinine the password requirements are, the beginning or end of the password will be padded with numbers and symbols, but always the same ones.
So Googlesucks.com might be turkeyGootrucking8
and another site like a bank site that I want higher entrophy on will use a different algorithm, so BOA might end up a hard non-englisht word + the passing word, then the company's initials + needed password entrophy, so BOA would end up with namastetruckingBOA8

So when I use sites that want to remember my shipping address or credit card (I never save my credit card number, I don't care how "safe" your site is) I use the harder credentials. I just want to post a comment on the many HuffPo type of sites, easy password all the time. So while each password for each site is unique, effectively the easy password is reused but padded with something unique to the site so that even if the password was stolen it's unusable for any other site.

When a bank's or other stupid organization calls on using a password with a Capital letter, an integer and a minimum of 8 characters, and two adjacent characters not the same, it is recipe for easy hacking. Mathematically, easy.

I protect my passwords by including the wonderful €, and symbols which are on my standard keyboard.

yours
  sekalf nroc

(read backwords)

Re: This makes sense.

[Anonymous Coward]

Watch out for key loggers. It is pretty easy for the bad guys to get your info. They do it all the time ...

Re: This makes sense.

[swillden]

Watch out for key loggers. It is pretty easy for the bad guys to get your info. They do it all the time ...

If the bad guys are installing system-level software, or -- even worse -- plugging hardware into your box, you're sunk. There's basically no defense against that. Two-factor auth helps, but only for sites that support it, and even then a real-time attack can get in.

Re:This makes sense.

[Anonymous Coward]

Simple remote access trojan with keylogger will take care of that.

Re:This makes sense.

[swillden]

Simple remote access trojan with keylogger will take care of that.

If the attacker has sufficient access to install system-level software, you're already completely screwed. Game over. Go home.

Dumb dumb dumb advice...

[dskoll]

That is just so stupid. Use a password-keeper and use strong passwords everywhere. Then you only need (1) physical access to your password keeper and (2) to remember one strong passphrase.

Re:Dumb dumb dumb advice...

[dskoll]

Following up on myself: That research paper is awesome! Never before have I seen the use of partial differential equations to justify unequivocal bullshit. Amazing! They must've really worked hard on that.

Re:Dumb dumb dumb advice...

[cdrudge]

So what is this ideal password keeper? And how to do you access it whenever and wherever you're located?

Re:Dumb dumb dumb advice...

[dskoll]

I use something called TkPasman, which runs on my Linux desktop. I don't use a mobile device much to surf the web, and never to log into any sites I care about because it's just too painful.

I could access it in a pinch by tunneling X over SSH back to my main computer, and I have done so in the past. Another thing I do is sync the password database to the handful of Linux desktops I use on a regular basis.

The password manager keepassx is available for Mac OS, Windows and Linux and you can sync the databases. I'm not aware of one that also works on Android or IOS, though. :(

Re:Dumb dumb dumb advice...

[Russ1642]

I've used one for years. I primarily use it on my phone but it's backed up and synchronized across all my devices. I use a VERY long password but I can type it very quickly. I can quickly log into anything, even if it has been a year since I've logged in. I can also store important personal items such as insurance and health information.

Re:Dumb dumb dumb advice...

[retchdog]

Never before have I seen the use of partial differential equations to justify unequivocal bullshit.

Haven't read many research papers, have you? ;-)

Re:Dumb dumb dumb advice...

[Bacon Bits]

And what if you have a house fire, break in, or accident?

Re:Dumb dumb dumb advice...

[CrimsonAvenger]

I doubt it's ideal, but I use PasswordSafe and carry it on a USB stick.

And in the end, there are only about three computers I ever access it from.

Re:Dumb dumb dumb advice...

[sideslash]

That is just so stupid. Use a password-keeper and use strong passwords everywhere. Then you only need (1) physical access to your password keeper and (2) to remember one strong passphrase.

I didn't RTA, but when you say it's stupid not to always use a strong password, aren't you making an unwarranted assumption? There are some sites where it truly doesn't matter. On such sites I will never send any sensitive data, and all I want is to get past the annoying login to get to something I care about. You know, like the bugmenot cases. If you take the time to create such accounts for yourself with an insecure(!) and memorable password, there's nothing wrong with that.

Re:Dumb dumb dumb advice...

[reanjr]

Yeah, because single point of failure is exactly how you want to perform security.

Re:Dumb dumb dumb advice...

[Anonymous Coward]

I don't think it is safe to assume that he is so stupid that he doesn't understand the concept of back ups. He MAY be, but I don't think it is a safe enough assumption.

Re:Dumb dumb dumb advice...

[jbmartin6]

This isn't stupid at all, it is something missing from a lot of security advice: a hint of reality. The amount of effort any person will put towards security, or any other goal, is finite. Therefore it is useful to put at least some thought into how that limited effort can be used for the maximum benefit. For the most part, I don't care what my gawker password is or all the other silly little logons. I use the same simple password for all of them because there is zero risk to me if they are compromised, other than someone else can now post with the screen name I picked (and don't care about) To suggest that I should lug around a password safe and log into it every time I need to use one of these zero risk logons is to suggest that I squander my limited security effort. It is far better to conserve that effort for things that are actually important.

Re:Dumb dumb dumb advice...

[93 Escort Wagon]

That is just so stupid. Use a password-keeper and use strong passwords everywhere. Then you only need (1) physical access to your password keeper and (2) to remember one strong passphrase.

Well, in the Microsoft Universe it was good advice. The rest of us are ten years past that point, though, and are using password managers.

I only have to remember one password - the rather long one I've used to protect my OS X login keychain. Well, and my login password... so I guess that's two.

Re:Dumb dumb dumb advice...

[Anonymous Coward]

Well, depending on context, being able to reduce the points of failure in a plan or project or mission to only one potential-in-question is quite impressive. But yes, house of cards, keystone in the arch, etc.

Re:Dumb dumb dumb advice...

[93 Escort Wagon]

Intelligent people regularly back up their data - including their password key stores.

Re:Dumb dumb dumb advice...

[Anonymous Coward]

mSecure. Syncs between your phone, tablet, 'top, destop. Encrypted key file, self destructs on 'x' number of open attempts. Very nice app. The problem is having to whip it out every time you need to look up a high-ent password.

Re:Dumb dumb dumb advice...

[Anonymous Coward]

So... how is this supposed to be useful when you don't have internet access, or only insecure web-access is available (which is what most airport/rail/mcdonalds have)

The problem with these "password keeper" programs is the fact that you are storing them. That means they are both weak to being cracked/tampered with, and should your device be stolen, you are without all your passwords.

The safest password remains in your head. Two things you should never do:
a) click the "save my password on this site" , because that saves the password on your computer in a state that can be retrieved.
b) save your credit card to any site that you do not have a recurring financial relationship with (eg your electricity bill is OK, your clothes/computer parts/steam is not)

The last point is especially annoying since you can't use paypal or Apple's iTunes without one. I don't want my card number saved and then have my device lost/stolen and used to buy stuff. Yes I lock my device, that is absolutely meaningless when that data can be retrieved through other means. It's somewhat ironic that the "cloud" passwords of Apple's products is actually more secure than "save my password on this device" because you can then lose the device and still get into your sites provided you buy another Apple product, or borrow one in a pinch. I would certainly not trust cloud storage with any high value financial accounts, but if I'm sick of re-entering passwords on sites just to leave a damn comment, that's fine.

Re:Dumb dumb dumb advice...

[Anonymous Coward]

Dumb Dumb Dumb - don't use a password keeper - unless it's your brain.

Strong passwords aren't strong - they're weak.

Cutting down the number of characters that can be chosen for each position reduces the entropy pool related to the password.
This makes brute forcing the password much easier.

Given a password rule of 8 characters with 1 Numeric, 1 Symbol, 1 Upper Case, 1 Lower Case, and 5
10 * 32 * 13 * 13 * 26 * 23 * 22 * 21 - gives us 14,941,006,080 combinations of characters (assuming US 104 Key keyboard). That's only 14.941 billion possibilities.

With using the full set for each position
68 * 68 * 68 * 68 * 68 * 68 * 68 * 68 - gives us 457,163,239,653,376 (assuming same US 104 key keyboard).

That's 457.163 trillion possibilities - that's 30,597 times more characters - over a 30k increase in entropy - making it 30 thousand times harder to brute force.

Re:Dumb dumb dumb advice...

[Anonymous Coward]

So what is this ideal password keeper?

https://clipperz.is/

Re:Dumb dumb dumb advice...

[Geeky]

I use KeePass and synchronise the file so I have access to it on all my devices including my phone. There are clients for just about every platform.

Re:Dumb dumb dumb advice...

[Anonymous Coward]

See, the problem the tech literate seem to over look is that most people aren't even making an effort on this type of thing. The paper's argument isn't that two tiers of passwords (secure vs insecure) is BEST. Like the dentist begging you to PLEASE you to floss once a day (never mind proper gum brushing, flossing after every meal, mouth wash, fluoride, etc), it's saying that two tiers is better than: 123qwe, b00b13s, password, Aaaaaaaa at all points of authentication.

Sure, it would be nice if everyone chose unique, paragraph long high entropy passwords/phrases for every point of authentication. But: A, that's not practical; B, it's cumbersome; C, it's more ideal to use nominal passwords with 2-factor authentication; F, you're a gimp.

Don't forget that the info-sec has to walk the line formed by usability and security.

Re:Dumb dumb dumb advice...

[Anonymous Coward]

and 5 = and 5 characters that are not repeats of a character already used.

Sorry, my math was off as I didn't take the full keyboard character set into account for the remaining 4 characters

10 * 32 * 13 * 13 * 64 * 63 * 62 * 61 - gives us 824,667,217,920 combinations of characters...

Only 554 times more entropy for full character set, still 554 times harder to brute force than restricted (weaker) rule-sets.

Re:Dumb dumb dumb advice...

[Anonymous Coward]

In other words, you have a very poor solution, that doesn't work as well for normal people as the procedure proposed in the article, but you're just another derpster that pretends they're smart by criticizing actual smart people. At least you titled the post with your dumb advice well.

Re:Dumb dumb dumb advice...

[AudioEfex]

You trust one of those absurd "password keepers" and think that making a risk assessment on low-danger websites where no harm could come even if someone did by remote chance try to break into your account is stupid?

If you are one of the password zealots, using one of those "hey stuff all your passwords into one convenient app!" programs is simply the dumbest thing you can do. It's akin to taking every object you own with any value, including all your cash, important papers, SS card, etc. out of your safe or safety deposit and just leaving them in a cardboard box, putting it in one storage shed outside your home, and "securing" it with an off-brand padlock on it you got 2 for 1 at the dollar store. If someone does break into it, by breaking just one lock, you've just given them everything you own of any value.

Now THAT is stupid.

Particularly the phone app based ones - most of which backup to "the cloud" - please, seriously. They are all written by unknown companies that I'm sorry, I'm not willing to trust the most essential data I have to, much less allow them to back up. But even if you disable that (then when you drop your phone and it busts you are fucked), or use a desktop version (lot of good that does on the go), they still make no sense whatsoever. Even if it's a "known" brand - still absolutely frigging retarded. It's amazing how many folks see the promise of encryption and think it's safe - unless you are decompiling the source code, you have no idea you can even trust that. But even if it is truly encrypted - have you never heard of the very time-tested wisdom against putting all your eggs in one basket?

It makes perfect sense to reuse the same password, or very close, for stupid sites where there really is little risk to begin with. Every fucking thing you do on the Internet requires a login these days - "Oh noes! Someone hacked into my Pollstar.com account, that doesn't even have my real name attached, and signed me up for concert date notifications for Taylor Swift to my dummy email account!"

You need your strongest password for your email (which is the key to many site password resets), and hopefully you are smart enough to have multiple throw-away email addresses for low-priority stuff (which you can conveniently forward, or, as I do, just have multiple accounts on your phone or tablet device). Next you need to have decently strong passwords for your financial sites, depending on what they are. But beyond that - even for things like your cable company - not much someone can do, even if they break into it, that can't be undone, aside from pay my bill for me (and if anyone wants to do that, shoot me a message, I'll send you the damn password). My payment info is saved, but it's ********** out, someone can't glean the number from logging in as you. Someone can play a trick and upgrade your service I guess? I'm sure the world's foremost hackers are right on that one.

Like everything, there is a middle ground. You just need to make a reasonable risk assessment by site. I basically have three tiers - one, strongest for email/financial, two, semi-reused for things like paying my cable bill or light subscription maintenance, etc., and three, reused for stupid sites that shouldn't require a login anyway, or where the data is completely inconsequential (the aforementioned Pollstar, etc).

But I sure as fuck am not going to put ALL of them into ANY app or single program - there are backdoors built into routers these days, you expect some start-up (or even established) "password keeper" doesn't have that possibility? I am concerned for your common sense.

Re:Dumb dumb dumb advice...

[bluefoxlucid]

I use a password manager for the bad practice of high password complexity. Passwords like 'mj%9F!17' that should have never been created because they're crap, and impossible to remember.

For my important stuff--like my password safe password--I use passwords like "crazy_dutch_flying_candybar". It really doesn't make a difference if you use underscores, spaces, or concatenation; just use the same always so you never have to remember how you formatted it. Most systems accept underscores, and concatenation is confounding due to the mental impulse to add a space.

You can also make up numerics and memorize them with Dominic's System, but this greatly reduces entropy. For example, if you used 1477 and came up with "jesus_christ_chasing_girls" (because 14--AD, Anno Domino, The Year of our Lord, Jesus Christ--and 77--GG, Girls Girls, Yakko Warner, chasing girls all the damn time), anyone who has your Dominic's matrix can come up with a few thousand likely passwords. Even with some interpretation, there are 100 names and 100 activities describable in a handful of sensible ways, so maybe 100 x 500, give or take.

Re:Dumb dumb dumb advice...

[Charliemopps]

That is just so stupid. Use a password-keeper and use strong passwords everywhere. Then you only need (1) physical access to your password keeper and (2) to remember one strong passphrase.

Whats dumb is giving the same advice over and over, building your security policy around those people following that advice all despite 30yrs of evidence that proves they wont follow the advice

Security is as much about psycology as procedure. I worked at AT&T a little over 10yrs ago and one day they announced that the password requirements to one of their systems would be changed to now require a 29 letter phrase, including at least 3 spaces, capitals, lower case, numbers and special characters. The end result? A utopia of highly secure, un-crackable system to be proud of? No... the whole company had their passwords written on post-it notes stuck to their monitor within a week.

Re:Dumb dumb dumb advice...

[bluefoxlucid]

Why does anyone run 8 character minimum anymore? 20 character, all lower case, with the space or underscore.

Re:Dumb dumb dumb advice...

[dskoll]

I have two off-site backups: One to an encfs partition in my office and one to an encfs partition in a colocated server 200km away. Next question?

Re:Dumb dumb dumb advice...

[Anonymous Coward]

Not that.
A single point of failure as in the strong passwort that locks all your other password/login info.
If your password locker gets hacked, you're boned.

Re:Dumb dumb dumb advice...

[dskoll]

If you don't have Internet access, then remembering your password for a web site is moot.

If you have only insecure Internet access, then you don't do anything important unless you can use HTTPS and make sure you validate the certificates.

That means they are both weak to being cracked/tampered with, and should your device be stolen, you are without all your passwords.

To defend against the first attack, you choose a strong master passphrase and you make sure your password manager uses a properly-implemented and secure encryption algorithm such as AES. To defend against the second attack, you regularly back up your password database. It's not rocket science.

Re:Dumb dumb dumb advice...

[dskoll]

But I sure as fuck am not going to put ALL of them into ANY app or single program - there are backdoors built into routers these days, you expect some start-up (or even established) "password keeper" doesn't have that possibility? I am concerned for your common sense.

Woah, woah, woah, chill out!

I have the complete source code for my password manager. And guess what... I've even read the source code!

It uses "openssl bf" to encrypt (that's the Blowfish cipher). In spite of all the warnings about OpenSSL holes, I don't believe anyone's yet found a problem with its Blowfish implementation, and though Blowfish is old and there may be weak keys, I don't believe it has serious vulnerabilities especially when only used to encrypt small files.

Re:Dumb dumb dumb advice...

[sexconker]

So what is this ideal password keeper? And how to do you access it whenever and wherever you're located?

KeePass. It has strong encryption options, it isn't tied to any site or service, the (encrypted) database can be synced however you want (such as with Dropbox) and used on any devices you want (including phones), it's got all sorts of options for generating passwords, automatically typing them, automatically expiring them, etc., and it's fairly light weight.

Re:Dumb dumb dumb advice...

[dskoll]

There are some sites where it truly doesn't matter.

I don't believe that. You may think it doesn't matter, but when it comes to identity theft, any little crumb of information may be useful to an attacker. And if you use the same weak password across a whole slew of supposedly "unimportant" sites, an attacker may be able to piece together a lot of information about you... enough to surprise you with cell phone bills you didn't sign up for, credit cards in your name, etc.

Re:Dumb dumb dumb advice...

[TonyJohn]

Hmm. 29 letters you say? How's about: "AT&T have 0 secret passwords."

Re:Dumb dumb dumb advice...

[dskoll]

Actually, writing down your password is a good idea as long as you keep it in your wallet. People understand how to protect their wallets. Posting it in a public place is probably not such a good idea.

Re:Dumb dumb dumb advice...

[steak]

and once that one strong password has been obtained by neerdowells they have access to everything.

Re:Dumb dumb dumb advice...

[Anonymous Coward]

I think he was meaning if someone decided to break into your password key store and steal your passwords either on your main system or your backup.

Re:Dumb dumb dumb advice...

[AudioEfex]

As I said above... But even if it is truly encrypted - have you never heard of the very time-tested wisdom against putting all your eggs in one basket? To paraphrase a movie quote many around here are surely familiar with, "One password to screw them all..."

Re:Dumb dumb dumb advice...

[Dynedain]

I love KeePass, but the community needs some help...

There's a myriad of client apps for it, but the 1.7 vs 2.X database formats fragments the market.

2.X requires Mono if you want to run it on Linux or OSX.

I wish they had a central dev team with first-class OSX, Windows, and Linux versions like VLC or Transmission.

Re:Dumb dumb dumb advice...

[Anonymous Coward]

Ideal situations are not practical or not generally accepted as worth while. Most people don't use password managers, and if they do, they need to be 100% transparent and require no setup and work on all platforms.

Choose 2

1) Strong passwords
2) Many passwords
3) Weak passwords

Re:Dumb dumb dumb advice...

[bmo]

have you never heard of the very time-tested wisdom against putting all your eggs in one basket?

Have you ever heard of backups? For someone supposedly technically astute, you seem to have dropped that idea on the floor. I'll pick it up for you.

--
BMO

Re:Dumb dumb dumb advice...

[Rob the Bold]

That is just so stupid. Use a password-keeper and use strong passwords everywhere. Then you only need (1) physical access to your password keeper and (2) to remember one strong passphrase.

Why? Not everything requires that much security. And not everything needs so much security as to require you to bring your password list -- locked in a password keeper though it may be -- with you at all times and subject to possible loss or theft. Not to mention the hassle of carrying it around and tying a lengthy passphrase to do low-risk things.

At my bank, I've noticed that things are locked up with different degrees of security based (I assume) on the perceived risks vs. usability. The paper towels in the bathroom are locked up with a "key" that anyone could grab off the janitor's cart if they really wanted to. Or pick the lock easily. Or just physically bust open the plastic dispenser to get to the sweet, sweet wipes inside. The tellers all have cash drawers that they lock with a key that they keep with them. The vault is locked with a multi-layered security system far more secure than the tellers' drawers. Now why might that be? Why not put the paper towels in the vault and bring two officers with you to the vault/restroom so you can be issued a single towel to dry your hands after washing them? It would greatly reduce towel waste and theft, right? Why not give each janitor a unique key, so you know who has filled the dispenser at audit time like with the cash drawers?

Similarly with low-risk logins, convenience can outweigh security. I don't necessarily need to protect a login to paywalled New York Times articles with the same diligence that I guard my bank login. Why would I create a strong password for that, keep it in keepass (or whatever), enter a passphrase in my phone or tablet or notebook to retrieve it when I could just sit down and enter my relatively weak default password with much less hassle? I guess if the Gray Lady was hacked, she might reveal a password/username combination that would allow ne'er-do-wells to also access my high-quality streaming on the PBS website. Oh well. It's not really a risk to me on the order of giving away the money in my bank account.

Re:Dumb dumb dumb advice...

[Anonymous Coward]

As I said above...

But even if it is truly encrypted - have you never heard of the very time-tested wisdom against putting all your eggs in one basket?

To paraphrase a movie quote many around here are surely familiar with, "One password to screw them all..."

Statistically one basket has the least odds of failure (1/x where x is the odds of a failure leading to loss of confidentiality). Remember, if you have half your passwords in one place and half in another, you just doubled the odds (assuming a random distribution) that half of your passwords will get cracked/hijacked/whatever. Sure you can fall back on having one password manager for low importance stuff and having one brain for high importance stuff, but most of us dont want to pick favorites between our retirement account and our kids college fund account.

Re:Dumb dumb dumb advice...

[Anonymous Coward]

Backup doesn't help with this single point of failure, since that point is your passphrase. If you forget your main password, you are now locked out of every account you have. No more "forgot your password? we'll email you a password reset link" because you can't access your email either.

Re:Dumb dumb dumb advice...

[NeutronCowboy]

There is paranoia, and then there is you. Here's the deal: if you're worried about backdoors in your routers, it doesn't matter what you use - your security is hosed. Same if you're worried about backdoors in password managers - what makes you think that your browser doesn't have one? Your OS? The instant you type in your password, even if it is a 50 random character one that you keep on a steel plate in a vault, it is gone.

You think you're being secure, but you're just being lazy. Specifically, you're being lazy about your security analysis, and actually have no idea what the ramifications are of something being insecure. To extend your analogy to your approach, you think that a padlock is bad, so you put all of your stuff into three separate bins that you then keep in storage locker that is protected not by a padlock, but by door and lock system. Congratulations, you're still making the same mistake all the password manager users are doing. Except you're not aware of it, and therefore much more open to getting exploited.

Re:Dumb dumb dumb advice...

[sexconker]

Not that.
A single point of failure as in the strong passwort that locks all your other password/login info.
If your password locker gets hacked, you're boned.

My KeePass database won't be cracked unless someone breaks AES.
If my PC gets hacked and I use KeePass, I'm boned for every password I have. Without KeePass, I'm boned for every password I use while hacked.
If my shit is hacked and I'm typing in passwords, that means I don't know my shit is hacked, so I'll be typing in passwords with reckless abandon.
With KeePass, I at least have a list of all passwords I need to change once I figure out I've been hacked.

Re:Dumb dumb dumb advice...

[Anonymous Coward]

Clearly, your "solution" is massively inferior, and more vulnerable, than the clearly-mandated 300 character password, with upper, lower, number, punctuation, and embedded Unicode character required. We don't accept professionally substandard solutions here at Slippery Slope Inc., mister.

Oh wait, it fact the upper/lower/number requirement makes absolutely no difference in the search space for a brute-force attack, so long as these characters are -allowed-, -requiring- them being irrelevant to that question. Yes, making your password "x" would be found quickly, -depending on the attempted brute force algorithm-, and reasonable length is an entirely different question to mandating "special" characters. And, we're making the rather large assumption that the target system/site has no anti-brute force mechanisms at all, like a simple 1-second delay between attempts, or an x-try lockout.

So, an entirely academic question, with your entirely academic solution.

So, moving on to the real world, here's a simple solution to both the TFA constraints of memorability and complexity. Pick some attribute that is unique to each site you go to. Say, the first five characters of the site's name. Then, say, change the first letter to the next one. Then append another set of characters that you use for every site.

So, for Slashdot for example, we would have:

Tashdawesome

With "awesome" as the sample "universal personal password," it becomes trivially easy to remember your password for any given site, and having your password to one site does not particularly aid in accessing another site (provided your "personal mental algorithm" has at least mild difficulty in guessing). Nor is it vulnerable to a dictionary attack. Nor it is vulnerable to having your master password on a password manager compromised thus compromising all your passwords.

Oh wait, I think somebody might pay me to write a paper on this...

Re:Dumb dumb dumb advice...

[nahpets77]

I use KeePassX and MiniKeePass on my iPhone. I sync the password db using dropbox. This works well for me because I can generate strong passwords for ALL sites and I have access to them when I'm on the go.

Re:Dumb dumb dumb advice...

[bswarm]

Keepass http://keepass.info/ versions for all OS's and database can be securely put on a flashdrive

Re:Dumb dumb dumb advice...

[Anonymous Coward]

Why are you sharing identifiable information with all those sites? Too many sites now require you to login just to read content. Those sites not only get my simple password, but also get bogus profile info as well. The real problem is far too many sites think they're too important and think they should require people login.

Re:Dumb dumb dumb advice...

[Anonymous Coward]

Why is a backup relevant? If I have a backup of my password repository, and someone is able to decrypt another copy of it and access the info stored within, what good is my backup? At a minimum I still have to change all my passwords and probably much more if I ever put any sensitive info into a "secure notes" section like LastPass..

I'm of the opinion that any service that requires authenticating you as a real person (sensitive info, etc.) should be required to provide 2-factor authentication. Use a weak password if you want, at least an attacker has to work a little harder to get access.

Re:Dumb dumb dumb advice...

[Agent0013]

The password manager keepassx is available for Mac OS, Windows and Linux and you can sync the databases. I'm not aware of one that also works on Android or IOS, though. :(

Yep, Keypass is available for Android. It uses the same password database, so is compatible with the others. It is called KeePassDroid. I like the fact that it is not on the web so there is no server that can be hacked into or spied upon. I use the password and keyfile so if someone were to get the password database file they would not also have the keyfile that I use. And since it runs on my phone, I pretty much always have it on me when I might need it. I even upload the file into Google Drive on occasion in case my SD card got corrupted or something.

I have also been doing what the article says, simple passwords that are reused for something like slashdot, more secure ones for sites that I buy things from, and very secure ones for banking sites and GMail. I include GMail as an extra secure site because any other site could have their password reset if someone got into my GMail account.

Re: Dumb dumb dumb advice...

[macinnisrr]

I'm confused. You don't want to save your credit card information or browser passwords on a single device or site because they can be retrieved, but you like the idea of apple storing credentials that can be retrieved from any device on the planet. Also, good for locking your phone, but if you're also using encrypted storage you don't have much to worry about with PayPal having your credit card info., at least notnif you're using their app as its also pin or password secured and doesn't save your password - and that's on top of your general phone security.

Re:Dumb dumb dumb advice...

[sideslash]

There are two things you aren't grasping here:

1. I don't care about any data I'm sharing with the site. So if my password was posted on Twitter, that would not cause a major problem for me.

2. I may not even trust such a site to handle my private data. So I would typically not even use my personal email address, but rather something like mailinator.com. (Credit: The AC who also replied makes this excellent point. Healthy online distrust should be extended to hosts and sites as well as to other internet users.)

Re:Dumb dumb dumb advice...

[bmo]

>two factor

Fat lotta fucking good that does you when hardly any place on the web uses it.

You just went full retard. Never go full retard.

--
BMO

Re:Dumb dumb dumb advice...

[Anonymous Coward]

There's an Android version of keepass, not sure about IOS though

Re:Dumb dumb dumb advice...

[dotancohen]

KeePass. It has strong encryption options, it isn't tied to any site or service, the (encrypted) database can be synced however you want (such as with Dropbox) and used on any devices you want (including phones), it's got all sorts of options for generating passwords, automatically typing them, automatically expiring them, etc., and it's fairly light weight.

Or Lastpass, which doesn't have to be tied to the Lastpass site or service, but if you do opt to use the site or service then you get automatic syncing of the (encrypted) database on any decices you want (including phones).

Re:Dumb dumb dumb advice...

[Anonymous Coward]

How's that supposed to work for the unwashed masses? The ones that need an app to figure out where they parked their car?

Re:Dumb dumb dumb advice...

[Anonymous Coward]

Dashlane has proven to be a great password manager for me.

https://www.dashlane.com/en/cs... - (for free premium trial of 6 months vs 1 month)

Have the client on my home computer and phone so i can get to passwords there, and at work i use the website (so I don't get written up for unapproved software...)

It has password generators built in and alerts you when sites report they were hacked so you can change passwords before it hits the major news. Really made password management easy for me. I tried it on a Clark Howard suggestion initially.

Re:Dumb dumb dumb advice...

[weszz]

I use Dashlane https://www.dashlane.com/en/cs... (for 6 month free trial)

I have it on my computer at home, my phone and the website at work.

It's pass phrase encrypted so they claim they can't decrypt the passwords without your passphrase.

Really works well for me.

Re:Dumb dumb dumb advice...

[just_common_sense]

2.X requires Mono if you want to run it on Linux or OSX.

KeePassX 2.0 (only alpha releases so far) uses the 2.X database format and has a native Linux/OS X version. I'm using it myself and don't have mono installed. It does have some nuisances, though... The big one for me is that when you save the database, it changes the file's user/group. Also, I don't think there's browser support yet.

Re:Dumb dumb dumb advice...

[Dutch Gun]

Yeah, because single point of failure is exactly how you want to perform security.

Just make that point of failure a modern, well-vetted encryption algorithm. Those algorithms are, despite serious effort by every cryptologist on the planet, still completely unbreakable. The math is solid. Properly implemented, the only chink in the armor is then the password, and that's something in my control.

So, yes, I'm fine with a single point of failure, so long as it's intelligently chosen. A mathematical model will not suddenly break or stop working like a hard drive or router, barring some revolutionary crypto breakthrough. It's sort of like worrying that an airplane's wings or fuselage are "single points of failure". Technically true, but those components are built robustly enough that it's not really worth worrying about, and the realities of trying to mitigate that would be horrendously impractical.

Re:Dumb dumb dumb advice...

[Chalnoth]

Except password managers are far, far easier to use than remembering the passwords for a bajillion sites. The answer to the problem of password reuse is to lower the bar to make use of a password manager at the browser level. That means having encrypted cloud storage of passwords combined with an extremely easy-to-use password generator.

I do think that Lastpass gets about 90% there, but still has some hurdles for casual users (you have to install a plugin, and some of the password generator options can be a little confusing for casual users).

Re:Dumb dumb dumb advice...

[JazzXP]

I paid the $10 (or whatever it was) for KyPass on OSX. I use KeePass everywhere else. Works well for me.

Re:Dumb dumb dumb advice...

[Dynedain]

Yeah, I have KeePassX 2.0 as well. The UI is kinda flakey (hence why it's been in Alpha status for several years now)

Re:Dumb dumb dumb advice...

[Anonymous Coward]

There is an Android version of KeePass, but I've never found a mobile password manager that I like. The Auto-Type feature on KeePass for Windows (and KeePassX for Linux) based on window title matching is the number one feature for me and there's just no way to do this on mobile devices.

For people interested in using KeePassX on OSX, yes it works but if you want the Auto-Type feature you have to build it yourself. It's not hard, just Google around for it. (I have no idea why it's not included in the default OSX build.)

Re:Dumb dumb dumb advice...

[goddidit]

Except that you really cannot use a password manager for the critical accounts. Unless, it's a local one, and then its suddenly not that portable anymore. There is some promise in mobile phone based password managers, though.

With online password managers there is only your master password holding your passwords from the operator of said service, and that is in the best case when the service is implemented with client side decryption. How much entropy you can expect from a master password anyway? I would say that for most users it's around 30 bits maximum (under some near optimal password cracking entropy model). This translates to around 12 character pronounceable autogenerated password (one can only give upper limit for entropy for human generated ones). How long it takes to brute force it depends on the key derivation function, which is limited in strength by the maximum login delay.

However, you could use a password manager for the shit-tier accounts...

Re:Dumb dumb dumb advice...

[goddidit]

Bugmenot is rather interesting example, since it kind of shows that the cost of leaking a password can actually be negative (for the society).

Re:Dumb dumb dumb advice...

[goddidit]

How strong is the key to your encfs? Where do you store the key, if not in your memory? Who has access to the encrypted blob? Does your threat model involve those people, or is it special in that sense? How generalizable do you think your solution is from the point of view of implementation difficulty and threat model uniqueness (scale 1-5)?

Enough questions?

Re:Dumb dumb dumb advice...

[Chalnoth]

At some level, security boils down to trust. At least, it does today. You have to ensure that your password manager is controlled by an organization that you trust: one that has very strict security safeguards. I do think that LastPass meets this requirement, though you're welcome to investigate yourself.

That said, in a few years we might not be so concerned about this sort of thing. We might be using secure keys instead of passwords, such as the keys that Google is working on.

Re:Dumb dumb dumb advice...

[david_thornley]

Reminds me of people complaining that the fingerprint sensor on the iPhone 5s wasn't secure. No, it isn't. It is, however, a whole lot more secure than what a whole lot of people were doing, which was no security whatsoever. The fingerprint sensor meant the 5s could default to having some security.

(I bought one a few months after it came out, and the thing has recognized my fingerprint exactly once. Something about my fingers, no doubt.)

Re:Dumb dumb dumb advice...

[david_thornley]

Wallets get stolen now and then, and you probably don't want identifiable passwords in it. You may want to obfuscate them, by having some scheme other than the obvious to link accounts and passwords, or having extra characters tacked on to beginning and/or end of passwords. A pickpocket is unlikely to do anything fancy for password cracking, but you don't want to make it too obvious. Of course, if my wallet is stolen by the FBI and they have the NSA look at the contents, this isn't going to work, but I'm not sure anything will work then.

Re:Dumb dumb dumb advice...

[Samizdata]

I have been using LastPass also and it seems to work a treat, as well as keeping things sync'd between my Windows and Linux sessions. I also like the fact it automatically checks for and flags when you repeat the same password between multiple sites. It is also pretty smart about determining non-password based logins (I have one that uses a combination of SSN/DOB/and a PIN.)

Bah

[Nimey]

Using a password manager with one strong master password + randomly-generated passwords unique to each website is better.

That said, the linked paper is long and math-heavy, so I rate it likely the submitter (and the "editor") misunderstood something.

Re:Bah

[dskoll]

The linked paper did mention password managers in passing, but dismissed them as being vulnerable to client-side malware which could compromise all your passwords. That assumption is true if you're running your password manager on a Windows system, I suppose, which is likely the only thing the "Redmond researchers" are even aware of. But if you keep your password manager on a separate device or run it under a secure sandbox in a secure OS, you're much better off than the paper implies.

Re:Bah

[Anonymous Coward]

If you have a secure, separate device, why not authenticate using client-side SSL certificates instead?

Re:Bah

[Anonymous Coward]

If you're using a secure sandbox to run a secure OS to store your secure passwords, you're so far, far, far removed from the average user that you don't matter.

Re:Bah

[Anonymous Coward]

But if you keep your password manager on a separate device or run it under a secure sandbox in a secure OS, you're much better off than the paper implies.

There is no secure OS. There are fairly secure systems, they have no direct interaction with any other system. You might do well having a synced pair of a no-wifi tablet and a cheap little un-networked PC that both have your password manager so you can type in "af#$Asdfasd0fas-122341å09nsd±fasd9823eÜnjfaa" whenever you want to log into Slashdot.

Re:Bah

[Anonymous Coward]

Perhaps you're forgetting this from 2011:

LastPass Password Service Hacked

Re:Bah

[Nimey]

Pfft. You seem to think Slashdot stories have any credibility, or that a vulnerability from three years ago still matters.

You're adorable.

Re:Bah

[Anonymous Coward]

I use a password manager for everything not important (like slashdot). I memorize anything important. You still only have to remember a few things but no one has to get a crappy password.

Re:Bah

[Nimey]

Further, your non-story is about anomalous traffic they couldn't explain, so out of an abundance of caution they forced everyone to change their master passwords. Hardly a smoking gun.

You are probably an idiot.

Re:Bah

[TheCarp]

I have to say, I REALLY like password manager someone was working on that was based on, I think, a rasberry pi, where it would actually act as a USB HID to enter the password, and keeps your encrypted passwords on its physical hardware device.

Still susceptable to keyloggers and other malware but...1) they can only get the passwords as you use them and 2) they will NEVER see your master password since it never even gets entered into the machine, but only to the password keeper device.

Now THAT is how to do passwords right.

Re:Bah

[Anonymous Coward]

Now all I need to do is crack one password, then I have them all.

Re:Bah

[Anonymous Coward]

Have a link to that?

Re:Bah

[Sqr(twg)]

Using a password manager with one strong master password + randomly-generated passwords unique to each website is better.

...if, and only if, the password manager is completely secure in itself.

If the terminal used to access the password manager is compromised, then the attacker gets the master password and thus access to all keys - not just the one that was requested.

In other words, you might have used an insecure computer to log on to slashdot, and the attacker now has your bank login credentials.

Re:Bah

[tlhIngan]

The linked paper did mention password managers in passing, but dismissed them as being vulnerable to client-side malware which could compromise all your passwords. That assumption is true if you're running your password manager on a Windows system, I suppose, which is likely the only thing the "Redmond researchers" are even aware of. But if you keep your password manager on a separate device or run it under a secure sandbox in a secure OS, you're much better off than the paper implies.

Yeah, if you keep your passwords on an isolated system, great. But most people don't do that - they use client side systems, cloud syncing, etc., so that the password manager will auto-fill in the password for them.

Isolating your passwords to a secure device is fine and all, but it also removes a lot of the convenience of it because now you have this gadget you have to carry around, access, copy the password manually, etc.

Whereas a client side password manager you just visit the website, go to the manager, click a couple of times and it's autofilled. And many have the ability to grab passwords from the web form and save it so it's a lot less risk.

And people love to put it on a Dropbox or other cloud service so they can use their password manager anywhere and have it up to date.

So no, it's just moving the vulnerability to that one point. And it doesn't matter if you run Windows, Linux, OS X, BSD, whatever. They're all vulnerable.

Hell, iOS and Android are seeing copycat clones of popular password managers like 1Password and the like (nevermind the SEO creeps who make it so finding the official site harder by forcing their way up the Google ranks and sponsored ads hoping that you'd mistakenly click on the fake trojaned version they offer instead of the original).

Re:Bah

[nine-times]

Meh, then you still need to have access to that password manager on any computer you want to visit that site with.

Re:Bah

[bluefoxlucid]

Client-side malware is easy. Just write dancing pigs for Linux, and package it for Listaller.

Re:Bah

[hendrikboom]

One Password to rule them all, One Password to find them,
One Password to bring them all and in the darkness bind them

Re:Bah

[PhrostyMcByte]

You can buy a YubiKey to do this today without any finicking with a Raspberry Pi. There are a few modes depending on the devices you buy. First is what you say -- it can emulate a keyboard, and input a password for you whenever you press a button on the device. It can also perform HOTP/TOTP authentication, and some of them can act as a legitimate security token that integrates with your platform's crypto.

Re:Bah

[devman]

Yes people will go back and fourth on password managers. They are not idiot proof, and take skill to use, but for those of us who use them properly they are very convenient. No security system is going to be perfect so one just has to do a risk management analysis for themselves.

Personally, if I was forced to use an unsecured computer (a public terminal) to log in to a website I would look up the password on my cellphone and physically type it in. I would not log in to my password service on an unsecured computer, ever.

Re:Bah

[Anonymous Coward]

You're assuming there's such as thing as both a secure OS and a secure sandbox.

Re:Bah

[sudon't]

If your password manager lives on your own computer, and you don't access it remotely, you have little to worry about. That is, unless you're the kind of person that has to worry about someone willing to break into your home and install a key-logger. This is not a problem for the vast majority of users. Regardless, it's a much better solution than using the same simple password for everything.

Mac OS has come with a very good password manager since at least 2002, (that's how far back my passwords go, anyway), and it's trivial to use it to generate unique passwords, which is what I do for every account I sign up for. I've never had an account compromised in all that time, yet almost everyone else I know has.

Re:Bah

[drinkypoo]

You can buy a YubiKey to do this today without any finicking with a Raspberry Pi.

On the other hand, it actually costs as much as a Raspberry Pi. Seriously?

Re:Bah

[TheCarp]

Nope. Yubikey looks cool but it is a OTP solution that requires an OTP compliant service that works with it.

What I am talking about is a small device with not a button, but a mini-keypad on which you can enter your unlocking password. Once you do this, you select which password to send and send it....all from the device itself, with no PC interaction.

ALL it requires is an HID interface, no extra components. I can't find the original project (maybe it was arduino based? no pi based?) but it was a portable password vault not an OTP solution.

Very cool of course, but, not the same and not as universal.

Or Just Use a Password Manager

[CritterNYC]

Or just use a password manager and you can have unique high entropy passwords for every single site and service without taxing your brain.

Re:Or Just Use a Password Manager

[Anonymous Coward]

Or just use a password manager and you can have unique high entropy passwords for every single site and service without taxing your brain.

And how does this password manager help you when you're on a computer that you don't manage? Don't say "just never log into anything if you're not at home."

Re:Or Just Use a Password Manager

[Russ1642]

You pull out your phone, look up the password, and type it in! It's REALLY hard.

Re:Or Just Use a Password Manager

[retchdog]

You can use one on your smartphone. For android, you can even get an open source one and build it yourself if you want. (i forget the name of the one i used.)

Or just print out the ones you might need and put them in your wallet. (waits for shocked disbelief to pass) Seriously, why not? You're not being hunted by the NSA here; if your wallet gets stolen, it'll be by some street thug, not a master haxx0r. They're going to take your money and maybe your credit cards, then throw out the rest of the crap. If you're really worried, print out the first (N-3) characters of your passwords, and then just memorize the three characters. This way, you get high entropy against skilled attackers (good), and low entropy against street trash (good enough) who won't bother more than a few attempts at most.

It's all about having good enough security for the circumstance at hand, and compromising against convenience for you.

Re:Or Just Use a Password Manager

[93 Escort Wagon]

And on iOS 7, if you're using iCloud Keychain you can look them up in Settings -> Safari -> Saved Passwords (assuming you know your own device's password).

Re:Or Just Use a Password Manager

[Lehk228]

if that is how we are going to do things, why not use actual certificates instead of a password/certificate halfbreed?

Re:Or Just Use a Password Manager

[geekoid]

ou don't even need a smart phone. Is there a cell p[hone on he planet that does have some sort of 'notepad' feature?

Re:Or Just Use a Password Manager

[s0nicfreak]

The main reason I ever need to use a computer when away from home is that my phone is dead or lost...

Re:Or Just Use a Password Manager

[MrLogic17]

Can I borrow your phone for a second? I need to E-Mail myself some copy & pasted data real quick...

A single point of failure is a single point of failure, be it desktop, phone, or cloud. I trust no one to hold onto my passwords for me.

Re:Or Just Use a Password Manager

[retchdog]

What is your point? If your hyper-intelligent, single-minded adversary asks to borrow your phone, just don't let him.

If some poor schmo needs to borrow your phone to call the hospital because his friend just had a heart attack, well, just tell him to get fucked, there isn't anyone who's going to trick you out of your slashdot password.

KeePassSafe on desktop and mobile

[Anonymous Coward]

Nothing more needs to be said.

No duh

[gurps_npc]

When some site, like say slashdot, uses passwords not for real security, but instead to identify it's users, then only an idiot wastes their memory creating a 'good password' for it.

Better to use the same crappy password for web sites that do involve real financial risk.

Of course, if you use that same password for a bank account, or anything that knows a credit card number, SS#, or similar information, you need to have your head examined.

Re:No duh

[Nethead]

I'm using the same crappy password on slashdot that I got the account with.

Re:No duh

[bluefoxlucid]

But what if someone steals your Slashdot account, then you get a job interview and one of the interview questions is, "You called me a faggot on Slashdot back in 2002. How has this affected your career?"

Re:No duh

[retchdog]

"you probably deserved it. also, it helps me avoid working for easily-offended faggots. later."

Re:No duh

[Anonymous Coward]

Is this based on a true story?

Re:No duh

[Anonymous Coward]

What sort of moron uses their real name on an internet forum? If you do the reason for not getting the job is you can't be trusted to protect information, not because someone posted as you and called him a faggot. weak reuse passwords you combine with weak information, anywhere that requires real identity information about me would never get a weak reuse password. I use 3 levels of passwords, my Slashdot equivalent which is a reuse password for forums and sites that do not have any identity information. Then formula based unique passwords for sites that contain some information about me, and 3rdly complex passwords for financial information or highly sensitive information.

Re:No duh

[Anonymous Coward]

"You're lying. Nobody reads the articles, summaries, or comments on slashdot"

Everyone smart has already been doing this

[Anonymous Coward]

I have a password, six letters, all lowercase, available in the dictionary, that I use for websites that I care just enough to register my distinct presence on. It matters little to me if this password gets compromised as I use far more secure passwords for the accounts that actually matter, but the password is just secure enough so that I can get where I want to go without having to crack open a password manager.

Say what?

[djupedal]

In other news, researchers in Europe have discovered there is more risk to your data when taking password advice from MS than ever before.

Re:Say what?

[pr0fessor]

Really? The way I read it is there is a group of free websites that don't require any personal information so don't volunteer any, keep an extra spam catching email account to sign up with, and don't sweat the small stuff.

Passwords are bad

[cyclomedia]

Just bad, every site has different rules, at least one I use restricts the length to something daft like 10 chars. The should at minimum print the requirements (must have uppercase, digits etc) next to the password box, because as soon as I get into the reset-password screen for the umpteenth time and read those requirements I remember which password I used on that site.

Doesn't change the fact that requiring users to somehow remember or securely store a bunch of random gibberish to do anything on any website is just a bad system. Don't blame the users for using post it notes or things like password123 when the SYSTEM is dumb.

Re:Passwords are bad

[Anonymous Coward]

Doesn't change the fact that requiring users to somehow remember or securely store a bunch of random gibberish to do anything on any website is just a bad system. Don't blame the users for using post it notes or things like password123 when the SYSTEM is dumb.

What do you want to replace it with?

Re:Passwords are bad

[ChadL]

Not the OP, but I'd like to see passwords replaced with SSL client certificates. The GUI for them in most modern browsers is horrific and the error messages shown when something goes wrong even worse; but both issues could be fixed.
If additional verification of identity is required then a password would be much safer behind a certificate (as an attacker trying passwords would need the users certificate and could easily be rate limited by account).

Re:Passwords are bad

[CronoCloud]

Not the OP, but I'd like to see passwords replaced with SSL client certificates.

That would be nice.

The GUI for them in most modern browsers is horrific and the error messages shown when something goes wrong even worse; but both issues could be fixed.

That is true. Don't some of the Linux "Password & Keys" utilities handle SSL client certs too? I'm not sure on that.

Hmmph, Comodo doesn't e-mail you when your freecert is about to expire.

Good since OpenID failed to take over

[medv4380]

The advocacy for Password Managers and Password Keepers is just utter BS. If some nothing website insists that I have to make an account just to post one little comment, and I might come back 5 years later to post again then they're getting generic username plus generic password. I'm not waisting my time making some uber powerful password, and utilizing something just to remember it. Even then the OpenID solution would have been great but every once in a while I'm presented with the option of logging in with my Google ID and giving some organization full access to my contact list, or full access to my google drive. Screw them, and I'll just create generic account just for their site though their old interface just so they can't read my contacts or documents. If they're so worried that people are using BS passwords on their site that spammers keep hacking to post then maybe they should accept better business practices.

Re:Good since OpenID failed to take over

[Average]

The thing is, I'm already having to use a password manager to keep track of my valuable passwords. With what, easily a dozen banking-ish relationships (cards, mortgage, retirement, etc) alone. That battle on complexity was lost long ago (ymmv).

Thus, if I've already resorted to a password manager for my valuable life, adding an entry to that vault for even the most trivial sites (and creating a random password) is easier than remembering a throwaway name/pass for even 30 seconds.

It's not that "you need a password manager to post to your local newspaper blog". You don't. It's that, if you're already using a password manager (and I can't imagine living without one now), using it for trivia is trivial.

Re:Good since OpenID failed to take over

[medv4380]

I don't actually have to remember hundreds of different throwaway usernames and passwords. It's One username/password combo for hundreds of websites. Makes it easy when 5 years later you forget you made an account for the site and it says sorry that username already exists. Which since it's a stupid nonsense username that only I would use I just go login and put it with the password that it should be. Any spammer that hacks that one account has access to hundreds of sites to post as me, and you know what. I don't care. There is very little harm to me in someone hacking that account and posting spam, or trollish nonsense as me. A bit irritating, but a waist of my time to even fight it, and I'm pretty sure it's a waist of their time too.

Re:Good since OpenID failed to take over

[93 Escort Wagon]

I'm not waisting my time making some uber powerful password, and utilizing something just to remember it.

There are tools that make this trivially easy, you know.

Re:Good since OpenID failed to take over

[Ardyvee]

What about the remember your password function on your browser? Do you, would you use that?

Note: I consider this to be on a different category than password managers since (by my experience) anybody capable of logging-in on the machine has access to the account.

Re:Good since OpenID failed to take over

[bmo]

Lastpass fills in both the "new password" and "confirm new password" automagically after you've generated a secure password. This makes passwords for trivial sites even more trivial to use.

I cannot even imagine what I would have had to do when I had to re-set all my passwords one night and /didn't/ have a password manager to type all that shit in for me, including the "new password" and "confirm new password" fields. It would have taken half a day, but instead it only took one hour. And all that stuff is backed up offsite in a csv file in multiple locations.

Life is easier with a password manager. It literally is.

--
BMO

Re:Good since OpenID failed to take over

[wvmarle]

I have three bank accounts, two PayPal accounts and a credit card account. That's six highly sensitive logins.

Then I have my local computer (remote ssh login) and a remote cloud server (remote ssh login). Also requiring decent passwords. That's eight already. Plus one generic password for slashdot and all the other forums.

So that's nine passwords to remember. Well, I may be able to manage that.

Now the second part: remember which password belongs to which service, without making your passwords something like (still have to remember the first part separately), which in turn would compromise your password's security.

For added difficulty: I don't use all the above accounts actively. It is quite OK to remember a rather complex password you use on a daily basis, it gets harder if you check your bank maybe once a week, let alone that dormant account that is accessed maybe once or twice a year.

That just doesn't work. As a result, the banks that don't allow me to use my password manager have a relative weak password, something that at least I can remember easily and link to the correct account, for actual security relying on the second factor in the authentication chain there. The alternative would be the good old post-it note, or having them written down (or stored in a plain text file) somewhere.

People are not computers. Memories falter and fail, and are inaccurate. We'll have to live with that.

Re:Good since OpenID failed to take over

[Anonymous Coward]

Scottrade recently changed their login screen to disable autocomplete. For the password field, this wasn't a big deal since I actually don't have a problem creating a memorable long passphrase and not saving it in the browser where any dick could get it. No, they also disabled autocomplete on the account number field which was something like a 10 digit number I had never bothered to learn or write down since it was in the autocomplete database. I ended up having to open the chrome database (sqlite) and retrieve my account number.

So complex

[Impy the Impiuos Imp]

So re-use low complexity passwords for unimportant sites and use high-complexity unique passwords for important sites.

Got it. Low for my bank account, high for World of Warcraft.

Re:So complex

[fibonacci8]

You could even refer to something low-complexity as a "PIN", and something of high complexity as a "password". I imagine you're already doing that for your bank and game respectively.

Re:So complex

[david_thornley]

I recently looked at my list of strong passwords. Frighteningly enough, the one that looked strongest was for my Facebook account.

Nice to know

[Marginal Coward]

That's nice. Now, I no longer need to remember "12345" for Slashdot - I can go back to just using "pass".

I got a fool proof method

[140Mandak262Jamuna]

I apply ROT-13 encryption on my passwords TWICE, and write down the resulting string in a post it note and paste it to the *underside* of the key board. Ha, ha, I am really safe. I can use this technique on all the sites, high value... low value... no value... INBD.

Re:I got a fool proof method

[Anonymous Coward]

I know a lot of people who do that subconsciously ;-)

Re:I got a fool proof method

[tapspace]

ONLY TWICE!? I apply ROT-13 no less than 20 times, 30 for e-banking passwords.

Absolutely

[swillden]

I've always done this. I have one short, low-entropy password which I use on ALL low-risk web sites. For example, it's the one I use on slashdot. I don't really care if anyone gets in and starts posting stuff as me. In fact it might be a good thing, since it would give me some plausible deniability for the stupid things I sometimes say :-)

For important sites (e.g. financial), I use long, randomly-generated passwords and manage them in a password manager, which itself is protected with a very strong password. But for everything else, that's too much effort and serves no purpose. And for my "crown jewels" account -- my e-mail account, which if hacked would provide the intruder with the ability to reset most all of my other passwords -- I use a strong password and have two-factor authentication enabled.

Re:Absolutely

[The Phantom Mensch]

I do this and add the wrinkle that the password for really important financial sites in my password manager is not entered as is, I have another layer of obfuscation on what I store in there.

High entropy rules on low importance sites

[erice]

This is why it is infrurriating when low importance sites require high complexity passwords. They create unnecessary exposure for the limited pool of high complexity passwords I can remember. Meanwhile, the bank will take anything.

Re:High entropy rules on low importance sites

[Anonymous Coward]

Agreed, but it is worse when high importance sites require low entropy passwords. I think fidelity.com requires 12 characters, only alpha-numeric. F**k you!

Re:High entropy rules on low importance sites

[Anonymous Coward]

Worse still: my bank does not allow punctuation (and maybe even numbers) in my passwords.

Re:High entropy rules on low importance sites

[scamper_22]

Yeah, this one is the worst. These low-complexity sites started to have more rules. Things like minimum 8 chars, mix of case, at least one number and one letter...

Now, for all these low priority sites, I have to remember permutations of my password.

Re:High entropy rules on low importance sites

[Anonymous Coward]

Password PassWord password passw0rd pa55word pa55w0rd password pas5word

Re:High entropy rules on low importance sites

[wvmarle]

At least one of my banks complained of a too long password when I used an 8-character password. I had to shorten it to no more than 6 characters.

Some forums don't even accept that short passwords.

Re:High entropy rules on low importance sites

[Anonymous Coward]

If the sites are of low importance, then it shouldn't be a problem to just write the passwords down on paper, in plain text. Maybe store them in a text document somewhere too.

Of course, this solution is not at all appropriate for the passwords to high-importance sites.

Re:High entropy rules on low importance sites

[PhrostyMcByte]

Meanwhile, the bank will take anything.

Really? I'm so used to "6-8 characters, no symbols, etc.". You'd think these things would be regulated.

Re:High entropy rules on low importance sites

[FhnuZoag]

Let me tell you my secret trick for those sites:

Use a filename.

Re:High entropy rules on low importance sites

[Anonymous Coward]

"6-8 characters, no symbols, etc." amounts to pretty well accepting anything. For sites that do care about security often 12 characters and at least 1 symbol is the minimum. Even if the site requirements are less than that, most (non-bank) sites will take passwords that are substantially longer.

Re:High entropy rules on low importance sites

[Chizinksyahoo.com]

It's also infuriating that most banks (at least in the US), don't have the ability to add 2FA to the login process, but almost every cypto-currency exchange has that ability and HIGHLY recommends implementing / enabling it.

NSA approves of this!

[MindPrison]

Selectively Reusing Bad Passwords Is Not a Bad Idea, Researchers Say

This article has been approved by the NSA!

Re:NSA approves of this!

[Anonymous Coward]

Or they work for the NSA.

HAHA WUT?

[bmo]

Microsoft researchers have determined that reuse of the same password for low security services is safer than generating a unique password for each service.

This has to be a fucking joke. It has to be. bmo looks at calendar. Huh, it's not April 1.

And what, exactly, is a "low security service?" The only "low security service" I can possibly think of is stuff like Mailinator where you don't even use a password.

Remember when the entire Youporn chat login credentials file was leaked? You know, the one with real names, aliases, emails, and passwords in cleartext? Remember? Nearly every single password was usable on Facebook and the same password was reused in email.

People had fun with that. I was in /g/ when it happened. I laughed at the results.

Yahoo lost control of my fucking credentials twice showing logins from Romania and Sweden. I no longer use Yahoo Mail as a result, except as a throw-away, and the last time pushed me over the edge into using a password manager that holds -unique to every site- passwords that I can't even remember myself at 25 characters of complete ASCII gibberish. And you know what? It's easier on top of being more secure.

Lose control over your login credentials at one place, and the rest is vulnerable if you recycle them elsewhere. Password re-use over multiple sites is fucking bad. Anecdotes aren't data but I don't care about your calculations because my reality trumps your poorly researched paper.

--
BMO

Re:HAHA WUT?

[Lazere]

My slashdot password does not need to be high entropy. I can probably use the same password for a soylentnews account. While it's true that if one gets compromised, they both do, guess what? I don't care. Nope. Not one bit. Facebook's different, email's different, my bank is different. What do I care if my pointless accounts get compromised? If you're using these types of accounts on computers you don't control, it makes sense to have easy to remember passwords and keep the high-entropy passwords for the actually important stuff.

Re:HAHA WUT?

[bmo]

Using a password manager makes it just as easy to have secure passwords as it is to have easy to remember passwords that you recycle everywhere.

And it fills them in for you, automagically, when you have to do the "new password" and "confirm new password" fields on a new site.

People complaining that password managers are complex never used one.

--
BMO

Re:HAHA WUT?

[simplypeachy]

But my method of creating passwords myself only takes three screens-worth of text to describe and has a mere three caveats! Wait, no I got that step wrong. Oh that site doesn't work with the method because I skipped a section.

Oh those early sites used my old method of simply creating passwords which wasn't as good. Here I can explain it all to you, it's simple!

Or I just type Win R->password->enter.

Re:HAHA WUT?

[simplypeachy]

It's a password. It must be unique and secure. With the right procedure in place, this is simple, fast and usable. Anything else is just an excuse.

Re:HAHA WUT?

[simplypeachy]

"into using a password manager that holds -unique to every site- passwords that I can't even remember myself at 25 characters of complete ASCII gibberish. And you know what? It's easier on top of being more secure."

Bingo. Why would anyone want to remember all of their passwords? I wouldn't even recognise 99% of mine if you showed them to me.

Re:HAHA WUT?

[Agent0013]

Using a password manager makes it just as easy to have secure passwords as it is to have easy to remember passwords that you recycle everywhere.

This is just plain wrong! There is no nicer way to say it. Typing in a 6 letter word that I remember is much quicker than opening a program, typing in my master password, finding the account that I want to log in to, clicking on the log-in button, then switching back to the browser. Even describing what you need to do is too long and complicated.

And it fills them in for you, automagically, when you have to do the "new password" and "confirm new password" fields on a new site.

And this does not work from my password manager on my phone when I am using a PC at work on home. The automagic part seems to fail on many sites also due to the way the structure their login screen.

Re:HAHA WUT?

[bmo]

Typing in a 6 letter word that I remember is much quicker than opening a program, typing in my master password, finding the account that I want to log in to, clicking on the log-in button, then switching back to the browser. Even describing what you need to do is too long and complicated.

You know how I know you've never even /tried/ using a password manager?

Argument from complete ignorance is bad form, man.

--
BMO

Re:HAHA WUT?

[Agent0013]

What kind of a stupid fuck are you that you can take a very legit complaint of using a password manager and then say I have never used one. I use one all the time. As you can see from my post, if you actually have the intelligence to read "SENTENCES", I use one on my phone. I also have the same one that runs on my PC at home. And whether I use one or not, it doesn't take a rocket scientist to realize that typing a memorized word is easier than looking something up in a database. It only takes someone smarter than BMO I guess!!!
God! What a douche!!!

Re:HAHA WUT?

[bmo]

I use one all the time.

No you don't and you're a liar, and not only that, you have rage issues. Go away.

--
BMO

Re:HAHA WUT?

[Anonymous Coward]

What is your point? The quote you used clearly says to use the same password for "low security services" but then you use the youporn exposure as a argument against it when clearly the youporn users didnt follow the advise and also used the same credentials for high security services like Facebook. So what are you actually trying to say here? Surely you must be agreeing with the MS advise then?

Re:HAHA WUT?

[Agent0013]

Is it any wonder that I might get angry when some stupid fuck tells me that I am lying. I use KeePassDroid. What do you use, you stupid dumb-ass!

seems like effort

[Anonymous Coward]

Just forget the username and passwords to most sites and have it reset so often it becomes par for the course.

I forgot the slashdot password and can't be bothered to log in.. Forgetting loads of shit is the brains old age way of dealing with crap.
- ciderbrew.

Non-Uniform Password Requirements

[timrod]

One major issue I can see with this is the sheer number of websites that have arbitrary password restrictions: capitals, special characters, numbers, etc. The worst ones are those that require multiples of each, so that there is no way you can make something easy to remember - and then expect you to come up with another password in two weeks.

Until website operators realize that putting arbitrary restrictions on passwords doesn't help them to be any more memorable (and likely not any more secure), I can't see this method working.

Necessity

[fibonacci8]

Using weak passwords for cases when a password at all is unnecessary should be the norm as a defense against phishing, even by a company you presently trust. Mandatory complexity increases are probably being used already to undermine password variety. When a password has to be one thing different each time (another capital letter, another numeral, another punctuation mark) a service of dubious character could very quickly spot patterns that could be used improperly.

That's exactly what I do.

[91degrees]

For most websites, I really don't care. Here I use a dictionary word. If someone logs into my /. account the limit to the damage they can do is to pretend to be me. Hell, with this one they don't even get a valid email address.

My bank accounts and email address each have their own password based on out of date information that inexplicably stays in my memory.

I actually use a different password for facebook, nit because I'm particularly concerned about someone haking into that. More because I don't trust facebook with the password Iuse for everything else.

Re:That's exactly what I do.

[geekoid]

I've had some get into my account twice here on /.
So now I have a hard password. One time I found out when /. blocked me.

Simpler approach...

[flajann3290]

A simpler approach is to have a few high-entropy passwords and append a value at the end that is unique to each website using some self-created rule for it that is easy for you to remember. I would speak on how I do this but I won't for obvious reasons. :p

A great way to remember your passwords is to use them often. The more the better.

What kills me is that different sites have different password restrictions that infuriates me. Some force you to use "special characters", others forbid it. Some force you to use a combination of letters and numbers, and many force you to use at least one uppercase letter and one lowercase letter. Some even restrict how long your password can be!!!!

This wrecks havoc with my high-entropy passwords that now becomes useless or needing to be altered, as in capitalizing a letter that I totally forget about later...

Re:Simpler approach...

[CronoCloud]

What kills me is that different sites have different password restrictions that infuriates me.

Yeah, that. Though I basically do what the article says and have "weak" passwords for things like Slashdot, and stronger ones for things involving money. I'd like to be able to use my strongest password everywhere, but many places don't support that many characters. yes it's longer than "correct horse battery staple"

Obligatory XKCD:

http://xkcd.com/936/

Re:Simpler approach...

[Anonymous Coward]

I just realized my passphrase is shorter than correct horse battery staple by a few letters. Time to rekey all the things!

Re: Simpler approach...

[Anonymous Coward]

Incorrect pony AC outlet paperclip?

Re:Simpler approach...

[jfengel]

I find that in effect my password-keeper for sites with onerous restrictions, but used only rarely, is my email. I end up using the password-recovery feature which usually ends up as "we'll email you a link; if you have access to the original email address you signed in with, we'll treat that as proof that you are who you say you are."

Losing access to my email account would be pretty disastrous. That can happen not just by forgetting the password, but with any kind of administrative failure, or even simply being out of range (though fortunately, trying to access a web site usually implies access to my email.)

It's very much an eggs-in-one-basket situation, though fortunately those rarely-used web sites are usually of limited importance to me.

Re: Simpler approach...

[macinnisrr]

Which is why my primary email address' password is unique and stronger thany banking password (my bank requires a six digit pin number because they use the same password for internet and phone banking. It's stupid). Other than that, I use 3 different passwords of low, medium, and high entropy for almost every site unless it has some ludicrous password rule. A couple if the sites I've signed up for have required a mixture of capital and lowercase, no characters, and 11 characters or less, a pattern which matches exactly zero of my standard passwords. Why would one enforce mixing case (higher entropy) only to limit length (lower entropy)? And that's why email recovery is awesome.

Re:Simpler approach...

[Anonymous Coward]

The really scary part is how many sites store unencrypted or reversible encrypted passwords. It's a safe bet that any site that doesn't allow special characters in your password is storing it unencrypted. I've never seen a bank website yet that allows special characters in the password, though I've seen a few that have no character limit at all.

Re:Simpler approach...

[thoromyr]

you wouldn't be so infuriated with their stupid requirements (and, I agree, most are stupid) if you just used a password manager. Then the only thing that is annoying is figuring how what parameters of the random generator you have to weaken to get an acceptable password. Instead, you have to remember how you had to adapt your generation rules to their site.

Humans are terrible at selecting passwords, and it isn't just the obvious 123456 or password. If you think you have a clever password method, it isn't. If you think you are randomly selecting characters, you aren't. The bad guys know all of this and exploit it. It may not have fancy equations, but there's some practical information at Ars Technica (e.g., http://arstechnica.com/securit... and http://arstechnica.com/securit...)

Personally, I use a lot of rather weak passwords. You know, for the site that insists I create an account to read it. Whatever, they get the "stupid" password. (And I mean "stupid".) Those are throwaway "accounts" that I couldn't care less if they were hacked. I know the password, because its "stupid", just like all the rest (or "stupid123" if they require numbers). OTOH, if it is a password for access to something I *do* care about it gets a computer generated password that is stored in a password safe. I don't care how hard it is to type, because I don't have to. I don't care how hard it is to remember, because I don't have to.

The only middle ground are login passwords (e.g., to a computer, or something I have to type into a mobile device, ugh!). There the ability to actually input the password can become a consideration, and for a desktop login it has to be memorable -- but when you don't have to remember a laundry list of passwords, the two or three you *do* have to remember aren't that bad (home system, work login, mobile phone -- you *do* lock your mobile devices, right?)

Re:Simpler approach...

[Chalnoth]

If you use a password generator, it doesn't have the weaknesses you mention. It really is 5000^4 entropy. Which is about as good as an 8-character randomized password from a generator that uses 64 characters. And if you're going to consider longer passwords or using more special characters, then you should compare that against simply adding more words.

You can obviously vary the number of common words used to increase or decrease the strength of the password. The point is that random word combinations are likely going to be easier to remember.

That said, a potentially even better method is supported by LastPass's generator: generate a pronounceable password of arbitrary length. I like to use this generator for passwords that I have to enter manually.

Re:Simpler approach...

[goddidit]

A simpler approach is to have a few high-entropy passwords and append a value at the end that is unique to each website using some self-created rule for it that is easy for you to remember.

I would speak on how I do this but I won't for obvious reasons. :p

Easy for you to remember translates into easy for an attacker to guess. Whether you're adding random chars to the password string (entropy), or using your mangling rules (Kolmogorov complexity), the attacker effort to guess and your effort to remember will be the same in both cases. The other only being harder to estimate. Complex looking transformations may still have low Kolmogorov complexity, in the worst case your mangling rules can be approximated or short cutted with much simpler rules.

Re:Simpler approach...

[david_thornley]

The other problem with that is that I don't trust high-security institutions not to store my password in the clear, or in easily broken form. I see enough problems with their websites to make me trust anything. This means that I want to have significantly different passwords on my high-value sites. I mean, if you find my brokerage account password is passwerd456, you've got a very limited search space for my banking passwords.

Re: Simpler approach...

[david_thornley]

The thing that scares me about character limitations on passwords is that they should have no use: you just feed a string into the password hasher, you get the fixed-length value you store, what's hard about that? A character limit suggests to me that they've got a fixed-length field (VARCHAR2(11)) that they store the actual password in.

Similar to what I do

[GameboyRMH]

My weak passwords aren't actually weak but they're relatively simple, I use them for forums etc, my email has a STRONG password because it's the keys to the kingdom of all my accounts, and if I used online banking that would have a strong password as well.

Something that helps to make a simple password unique and stronger yet memorable is to come up with a way to mix in something from each site. For example you could postfix them with the dominant color on the site, for Slashdot that would be green.

Social hacking?

[EmperorOfCanada]

The problem is that once you allow a hacker to penetrate a low value service it could give a hacker the threads needed to start unravelling through social hacking.

If I were some kind of hacker (don't have the time) it would be through the least secure systems and social hacking that I would start. I personally would think that attacking a core server that is most likely locked down solidly and is sat on by an army of paranoid administrators. I would much prefer if someone simply gave me the keys to the system.

Basically the two main hacks that I read about are either the above, or poorly maintained/secured systems with things liked default passwords etc.

For instance I have seen security checks where the admins will send a crude Phishing message to users that even include a warning about phishing attacks and the users proceed to send the data that the admins were phishing for.

So the above Microsoft advice might look good on a spreadsheet but in reality it is plaintext stupid.

Re:Social hacking?

[Anonymous Coward]

Oh hey Emperor! It's me, Bob, from accounting.

I've forgotten my password for $MEGABUX_083_CC-TRANSACTION-SRVR, I need you to reset it and text it to me ASAP at 555-555-1234. I can prove it's me, because of this posting using my Slashdot account, and my identical update on Instagram, which also conveniently includes a color-filtered goatse I made just for you!

Thanks!

- Bob Wilson

I would likje to point out

[geekoid]

that it's trivially easy to create an easy to remember hard password.

Example:
First girlfriend was Sally Mendoza
You lived on 123 Main st

naiM321azodneM_yllaS_A

the A is for rotation.

There are may patterns you could use.
Use the first line of a poem and the birth year of your mom.
In_Xanadu_did_Kubla_Khan_44
or do it backwards.
even
P4ssw0rds_wh0s3_g0t_t1me_f0r_that

Re:I would likje to point out

[simplypeachy]

Create passwords? Remember them? That's what pseudo-random number generators and encryption are for. I haven't got time nor a lax enough attitude towards password management to think I'm better than encryption.

Think outside the ivory tower

[Falos]

A throwaway password tier is something that legitimately increases the casual's security against the obvious (http://xkcd.com/792/) and might actually catch on. Something like "grandma1!" is perfectly fine if she leaves it down at the facetweets and socnets while using something different (hopefully stronger) for her bank account.

But hey, if you think soccer moms and surfers are just as likely to indulge a "Sandbox-contained PW manager in a secure virtual OS" tutorial as the five seconds it takes to tell them "Hey, use a special password for those super important sites, 'kay?" then knock yourself out.

Good luck fitting it on a billboard, though.

bank accts strong, all else who cares?

[Anonymous Coward]

Social whatever: I get in, I don't get in; I don't give a shit. My bank accounts? whole different story.

Too secure == insecure

[spaceyhackerlady]

The problem with crazily-complex passwords is that if you can't remember them you write them down, and, at a stroke, have compromised security. One of the worst I've encountered is the U.S. Customs eAPIS web site, for sending advance information when you want to fly a private plane or sail a private boat to the U.S.

The other issue is that you risk locking out legitimate access.

My bank does the password plus security question thing. My security questions (you can make up your own) are more than a little interesting. :-)

...laura

Or just combine things

[Anonymous Coward]

You don't want the same password across multiple sites in case one of them turns into a not-so-low-risk site later.

But you can "mix and match."

Your "throwaway" password can be your 1st nephew's name and the "variable part" could be the first 3 letters of the web site's name.

So if you have "throwaway" MySpace, Google, and Yahoo accounts and your 1st nephew's name is George, the passwords could be MySGeorge, GooGeorge, and YahGeorge respectively.

Apologies in advance to George's uncle - he'll have to pick a different throwaway password now.

Slashdot is a low security service. Yelp also

[raymorris]

> And what, exactly, is a "low security service?"

Slashdot gets my low-security password. If someone gets my Slashdot password and posts as me, I don't much care. I REUSE the same low-security password on Yelp, so if you hack Slashdot, you can post a restaurant review with my name. Whoop-tee-doo.

Re:Slashdot is a low security service. Yelp also

[bmo]

So then tell me what your slashdot password is if it's that trivial.

I can be trusted. I have a 5 digit UID!

--
BMO

mnemonics

[Karmashock]

Its very easy.

I use lines of poetry or songs.

An example of something I might do would be to take this line:

To be or not to be, that is the question.

And I turn that into this:
2bon2btitQ

Anything that could be phonetically interpreted as a number is written as a number. All words are lower case except nouns.

Therefore, all I have to do to remember that password, is to remember "to be or not to be, that is the question" and I remember that password.

Another one might be

"Mary had a little lamb who's fleece was white as snow"

which is:
MhalLwFwwaS

The rules you use are half the password. And they're very easy to remember and you don't have to change them... ever. You can make them up once and then use the same rules your whole life.

Then you just remember different quotes, song lyrics, etc and you have your password.

If you need special characters in your password then you just come up with rules such as & = and etc.

You can even write these rules down.

Lets say a thief gets your rules cheat sheet.

And it says stuff like "every first letter, nouns capitalized, any word that could be phonetically interpreted as a number is written as a number, etc"... what is he going to do with that?

Its useless without knowing the text string its based on.

Mnemonics are awesome. Use them. You can make really nasty passwords that you can change all the time and never forget.

Re:mnemonics

[Falos]

Strong passwords are healthy, and acronyms (which I strongly advocate) deliver extremely high defensive complexity with little increase (now passphrase) in user's complexity; so little they might actually do it.

However, password reuse kills a user whether it's strong or not. If I hack into some photosharing socnet crap and get your password, chances are I now have access to a lot of your services. Even if I don't use the loot directly, I'll sell off the credentials or data (SSN) to others.

Re:mnemonics

[Karmashock]

I'm not advocating password reuse. I'm advocating mnemonic rule reuse.

For example...

Marry had a little lamb who's fleece was white as snow

MhalLwFwwaS

The rain in spain falls mainly on the plane

tRiSfmotP

Both passwords are generated using the exact same mnemonic rules.

All I have to remember is the rules and the text string.

Human beings are really good at remembering lyrics, quotations of poetry, famous aphorisms... etc. We can hear those in our childhood and remember then flawlessly until we're old men.

Therefore, all you have to remember is which one is the right one and your rules for converting that into the password.

I use these devices for passwords all the time. I have a book of famous quotations that I keep in my desk. And I literally write in the book noting which line applies to which password. I have this backed up in a few other locations for important passwords. But the point is that I don't have to store the actual password anywhere.

I also can provide password hints literally at login any any machine and its totally secure. You're not going to be able to turn that hint into the password unless you know my rules.

I could take the second letter of every word. The last letter. I could do the whole thing in reverse. I could do all sorts of fun substitutions. And if I use the same rules consistently then I can do that conversion effortlessly. Like a second language. Potato patato.

Just Add Salt

[Anonymous Coward]

I just reuse the same password for all free sites, but add a site specific salt tahts teh first few letters of the site.

For example, here the password would be sla45%tq!, and on dice it'd be dic45%tq!

So it's a unique password, and I just need to remember one complex bit (%tq!). If I need to change the password then the 45 becomes a 46, etc.

No Shit Sherlock...

[Sir_Eptishous]

What's the next clue?

password reuse on low risk websites is necessary in order for users to be able to remember unique and high entropy codes

Really? Wow, you had to do a study to "prove" what any dingbat(including myself) has known for years, using that rarefied skill called "Common Sense".

I like my way

[Anonymous Coward]

I have a few different passwords that meet the various complexity requirements often set out which i use on most low value sites, then for the higher value sites i combine many of my passwords into one very long password with the addition of one special bit i only put in the high value locations.

it may not be for everyone its probably will get flamed here i'm sure but it allows me to keep track of only a few simpler and memorizing the much more complex passwords is simplified

big issue

[Anonymous Coward]

I have performed this strategy, and it is a seemingly good strategy if you don't have a password manager. The real issue is you can use a service that you use that is not deemed to have sensitive data. Later, if you should store sensitive data on that service, you have to change the password to be stronger. People are lazy. They don't do that, and they end up potentially exposing data due to their previously chosen weak password.

Re:I would like to point out

[cmdrxizor]

Cue the endless prompts I have seen from various web sites telling me to "Please enter a new password". Here are some examples:

Your password must be between eight and sixteen characters.
Your password must contain at least one lower case letter, one upper case letter, one number, and one special character (#, @, or $).
Your password cannot start or end with a number.
Your password contains an invalid character.
You cannot reuse any of your last 24 passwords.

This becomes an even more entertaining game when the web site only tells you the first rule that you have broken.

It very quickly becomes non-trivially difficult to create an easy to remember hard password.

we need a dedicated token for sensitive sites

[Anonymous Coward]

It amazes me to no end that banking sites and similar don't require a dedicated token device that is synced with the server to gain access to the sensitive information. The same goes (and particularly so) for credit card numbers. There is no good reason merchants should be liable for unauthorized chargebacks when it would be simple enough to re-design the system to be bullet proof (or near so). A token device which requires a password would make it so (short of a camera and theft of the device). We should all be getting single purpose numbers that are only useful for one charge at a particular round-about amount. That is if I want to purchase a $432 item online the credit card should make me pre-authorize the transaction via a token for the given amount AND ask 'is the merchant allowed to excede this amount' along with 'if yes, by how much''. Add in wifi and a response to confirm the specific merchant and there isn't even any room for 'i authorized $432, but to merchant x, not merchant y' (this would thwart live interception attacks from spyware/malware). Now- if a merchants site gets hacked and the design of the system is proper the attacker wouldn't get anything of value short of some insanely sophisticated attack, but even that can be easily thwarted. All it would take is a single merchant or customer calling up about missing funds (in the case another person setup an account with the name of another merchant to recieve credit cards and then hacked the site). That type of senario would be easy to guard against as your most likely going to have some sort of evaluation of merchants (it's already mandated by law).

"Remember"?

[simplypeachy]

Why would anyone need to "remember" anything other than a handful of passphrases? Let computers remember the 99%. That's the point of them.

..and of course

[JustNiz]

..and of course It is completely not in any way in Microsoft's (a.k.a. the sock-puppet of the NSA) actual interest for people to read this then use the same password for everything.

Re:..and of course

[Bill, Shooter of Bul]

Never attribute to malice that which is adequately explained by stupidity.

Dumb dumb dumb advice...

[Anonymous Coward]

I think you're being quite harsh here; this paper is one of a series on the theme of password usability that Cormac has performed over the years. If I had to summarize his research in a sentence, it would be 'Your IT security policies are dumb.'

Previous research from this group looked at password composition policies, came up with a method of modelling entropy, and pointed out that the groups requiring the most entropy from their users were governments and universities, which were stronger on average than bank accounts. The same paper found that advertising was a strong predictor of entropy requirements: firms with ambitious recruitment goals appear to have relaxed their password strength requirements. The paper suggests that there are other methods of assuring security than simply passwords; if you've used a bank online you may well know them: registering computer IP addresses, using pictures and phrases to authenticate the website, scanning for probable fraudulent transactions, etc.

This paper then, is an investigation of a common IT security policy ('Never reuse passwords') and it's implications. The differential equations you mention in a later comment may prove useful in quantifying other alternatives (and extending the model to model their unique downsides). Alternatives like password managers. The paper in question is already sixteen pages long, but perhaps you can offer your help on a followup analyzing the benefits and pitfalls of password managers.

1111111

[Bohnanza]

or maybe PASSWORD

Impossible

[jgotts]

I have passwords for hundreds of services.

You must be joking about memorization. I have three memorized.

That's what I do

[orgelspieler]

Basically if there's no personal or financial information I'll use a low security password. Hasn't caused any problems yet, and I find it easy to remember passwords for forums this way.

Re:That's what I do

[orgelspieler]

Man that guy is a complete idiot. Pa$$w0rd! is like the stupidest password ever.

Obviously!

[wonkey_monkey]

Selectively Reusing Bad Passwords Is Not a Bad Idea, Researchers Say

It's the last thing hackers will expect!

Passwords are ripe for disruption.

[dagarath]

The basic problem is that passwords are obsolete. The average person's ability to remember a password has been exceeded by the computational capacity of modern computers / gpu's. It's time to move on to some new authentication technology.

The smartest idea

[slashmydots]

I personally use tiered passwords. Some forum or random website gets my low level password. Something vaguely important like a prominent tech support forum account gets a higher level password. Web servers and those sorts of logins get unique passwords each to avoid mass hacking. Banking passwords get my top tier password. Encrypted archives get my even more top tier and excessively long password. That last one doesn't even have to be good, it just has to be long. Llamasllamasllamas!123 is actually a very good password.

alittlebitofspinach

[raymorris]

I just checked, it turns out that Slashdot and Yelp have different password requirements. My yelp password is alittlebitofspinach. Have fun reviewing places! Good thing I don't live in France.

Re:alittlebitofspinach

[bmo]

Ask for "inconsequential" slashdot password
Raymorris dodges it
Tells me "yelp password"
Go to yelp
Yelp requires email address as login
Look up raymorris' email on slashdot
(email not shown publicly)
Try various raymorris@$MAILPROVIDER via "lost password"
None exist, not the top 5 anyway.
Google search site:yelp.com "ray morris" or "raymorris"
Nothing.

Whatever, man.

--
BMO

Agreed really bad idea, but why and what to do?

[ramriot]

Agreed what this paper says is a really bad idea, but the bigger question is why do you need to protect your low value digital assets with equivalent security to your high value ones with strong unique passwords.

The reason is, as is mentioned you will have many more low value assets with apparently insignificant information stores than the few that store critical information. So that if say you reuse a week password on all these low value sites a single break in any of them will potentially give an attacker access to all of the rest as it is known that once an attacker gets a username/email and a password (reversed from a week hash) say they will try that username/email and password everywhere they can. It thus will be not a single tiny piece of information you risk with this policy but every piece of information on all the sites you risk and that may well add up to something very saleable to an attacker.

So what do we do?

0/ We cannot go around with many unique strong passwords in our head for fear of leakage and loss of retention.
1/ We could use a password safe, provided we trust the vendors or our skill to write it and not later make what is now a strong keeper weak by software patch.
2/ We could use a high entropy deterministic password generator e.g: https://www.grc.com/offthegrid... if we have the time to work the manual algorithm each time we want a password.
3/ We could do away with almost all passwords by use of Oauth / SiteID etc. Provided we trust a third party in all logins to not track our use.
4/ We could do away with All but one single pass-phrase that would potentially allow us to pseudonymously identify everywhere like SQRL, but that is early days and will need time to be supported.

What I am saying is there is no single solution but many, but for certain the one suggested in the paper is not one of them...

Obligatory XKCD

[Anonymous Coward]

http://xkcd.com/936

trouble finding Obama's email address too?

[raymorris]

I'm reasonably well known, in the computer security field anyway. If you can't find my email address ... well I suppose you're not particularly interested in computer security.

We need standardization

[Fredde87]

Seriously, as many people here have already pointed out, there is nothing worse than finding that a website won't take your usual password because of some obscure reason. Usually its either some extremely low risk site where you will only log in once a year which requires your password to be 12 characters long with upper and lower cases, numbers and symbols all in one. Or it will be your bank which requires a 6 letter password but won't take any special characters. We need some sort of ISO or RFC standard which promotes companies to follow a standard requirement/restraint on passwords. As many people have already said in the comments, a sensible system would have your average joe only needing to remember four "levels" of passwords, one for email, one for financial websites, one for sites with personal information and one for throw away/unsafe/log in once websites.

Good luck

[Cute Fuzzy Bunny]

I have about 25 accounts on sites that have things like payment information. About 25% of them have odd password restrictions to the extent where I have no choice but to write them down. Some require a special symbol, some won't allow that, and one requires a 12 character password and nothing else I use will allow that many.

So while I do use the same password for all sites that haven't got any monetary or important personal information (and I've used the same one for 30 years), I have to have 5 other passwords. Since most of the sites also require a unique username and not an email or other username that I could re-use, I also have about 40 user names. So again, have to write it all down.

At some point, I'd like to see the security level of a piece of paper with usernames and passwords written down all over the front and back sitting in a drawer next to the computer vs just being able to use the same username/password on every system without ever changing it. I actually get ticked off when I'm asked for a password without any listed qualifiers, and its only after I put one in that the site tells me what they will and won't allow. And its *MY* password. I'd like to pick whatever the hell I want, how long I want, whether I want upper/lower/numbers/special characters in it, etc.

The greatest concern I have is that the company holding the password will lose it. I've had my account info hacked/lost about 100 times over the years. Number of times someone has gotten into an account I own without the password being simply lost by the holder? Zero over 35+ years.

Just f'in allow passwords longer than 16 chars!

[Anonymous Coward]

So sick of all these places. "Please enter your password between 8-12." or 8 - 16. F off. We build the most memory inefficient stuff in the world now but can't spare a few more bytes for passwords? Just make 8-64 the default size everywhere. That way we can easily fit sentence passwords that can actually be remembered.

Well it WAS a good idea

[Stan92057]

Well it WAS a good idea but now since you've made it public not so much anymore....lol

Password keepers.

[Ilarih]

It debends from needs, Keepass 1 and KeepassX are very popular ones, and good because they use same database. Also Lastpass. Lastpass is good if you need to use your passwords in different computers.

I used to write passwords to paper, but now I have lost that paper, so not a lot about it. And by the way, on most sites you can recover acces with e-mail so there is no real need to keep copies, just ask for new ones.

Re:Password keepers.

[Samizdata]

Or as I mentioned above, multiple OSs on the same machine.

Common Sense

[Anonymous Coward]

It seems pretty obvious. If you don't care about people getting into the account, don't waste time remembering a strong password. And then it also doesn't matter if you share that password across other accounts you don't care much about.

On the other hand, most people probably care about most accounts at least a little bit. So don't go overboard with it...

Security Levels

[Anonymous Coward]

Any site that requires registration to view content, but always keeps registrations free and open to everyone and never prunes dormant users is run by a moron who is careless of the glut in their user database. I don't even see the point in requiring registrations in those cases, other that trying to pad the membership numbers or, maybe, collect user/pass combos to try on other sites.

In these cases, why wouldn't you reuse the same bad credentials? If I have to waste my time creating an account on some forum to download a zip, why wouldn't I spam the fields? I'm partial to usernames like 'asdf' and 'aaaaaaaaaaaaaaaaaaaaa' and passwords like 'password' and 'stupid'. The email associated is also garbage. It's all garbage. But it's still less retarded than -_-XxX_kEwLSnIpErDuDe_QUICKscopEsXx-42-_-

If only I could throw garbage at people in real life to get what I want...

Tumblr - Just Today

[essbase_nerd]

What a coincidense, Tumblr is forcing me to reset my password due to suspicious activity, and I want to use my generic low security password, which len = 9, and includes both numbers and lower case letters,. It's not strong enough for them though, "Please choose a stronger password." Give me a break.

uh... yes?

[Tom]

A lot of security experts (myself included) have been saying this for years. It's nice to have an actual paper out on it, but it is quite trivial and obvious.

Password systems and the core elements of even most modern password policies were developed at a time when you had 3 or 4 different systems you needed to access. And when almost everyone doing it was a geek and could actually remember 65**L;)Y\BLe-A (an actual "secure password" I just generated on a password generator website).

Once you add normal people and 50 or so additional systems to the mix, you would have to be a total idiot to believe that users actually use 50 different 65**L;)Y\BLe-A style passwords, or that it is even within the capacity of the typical human mind to remember those.

In the real world, if your password policy is crazy, people will either break or circumvent it, most commonly by writing their passwords down. Which, of course, does not exactly make you more safe.

your basic password of abc123

[kyoko21]

your basic password of "abc123" could be just AlphaBetaCharlieOneTwoThree.

Easy to remember, hard to type, and pretty hard to brute force your way through.

Re:5 characters

[TaoPhoenix]

"requiring passwords to be at max 5 characters. MY BANK!!!"

I hope not. Even the worst services I have seen want 8 characters. I'll leave it to my betters how fast a cracker program can bust 5!

Re:Banking

[TaoPhoenix]

I'm old school here.

What is all this "banking info"!? I only do about five things with my bank, and 3.8 of them I can do on my phone just *dialing the automated number*.

Check my balance, pay something to my credit card, look to see if a check has been cashed that shouldn't have been (I've hired a bit of house help), and a couple other things.

When it gets a little weird I hit 0 or say "Representative" to do a couple of fancy things.

What I spend is in my head, I don't need a huge online report to tell me. My five bills are on my desk (including last month's late one!)

I have resisted BOA's attempt to get me to go all online-automated. I theoretically set up a couple of accounts to be online to save money, but not because I need a fancy account. When you wanna know what you can spend, you make a 1.7 min phone call - what else do you need to do?

Re:Govt vs Corporate

[TaoPhoenix]

"True. I should have said major corporate standards when I said government. But because of the way the payment card industry works, if FEELS like government. Complete with not following its own rules and having rules for the sake of rules."

Sorry, but I find this a bit of a big error to make.

I'm really torn on who I dislike more, but to *confuse* corporate policies and govt policies feels like a big step backwards!

(Your choice of which) one punches me in the gut and one holds me by the throat, but to *confuse* them doesn't feel right!

Re:Losing an email account

[TaoPhoenix]

Years ago in a weak variant of this whole thread, I designed a system of using some nine passwords for the entire net, and for whatever reasons I am to senile to recall, one email account got a weird password that changed a couple of times until I couldn't get in. (Including one suspicious moment but that's another post.)

But fortunately I made my "security questions" sufficiently strange yet unforgettable that after two hours on hold, I got into Yahoo Customer service and fixed it. (For now.)

But you have a point that, that was a "backup account". If the primary ones ever got hacked, people would have access to tons of stuff.

I'm def of the school of "use your passwords every time so you know them" and haven't looked into password managers that sorta bother me. It's one reason why last quarter's Heartbleed story made me grumpy - is every site in existence gonna make me flip my password system now? I don't have a new one yet.

Re: 11 characters

[TaoPhoenix]

Quick uninformed guess, sounds like someone's sloppy programming problem.

I'll defer to my betters here but it sounds like when someone slammed out the system they just picked some number like 11 for the password length and then someone else did the best they could by making it require lots of stuff.

Re:8 character min

[TaoPhoenix]

Again a guess, but I bet this is about "how much it costs us to upgrade our system".

Underscore I can see, but Space used to be a character that messed up a lot of systems. And I frankly don't have any 20 character passwords, so maybe people lowered it so that users would have any hope of ever remembering their password, however bad it may be.

Re: Real Name

[TaoPhoenix]

"What sort of moron uses their real name on an internet forum?"

Welcome to Facebook and Google's push!

Reversing 20 years of your type of common sense!

I know, I grew up with too, then it changed about 2007.

Security Rankings

[AndyCanfield]

High security = online banking
Medium security = Linux logins
Low security = everything else, everywhere else

My low security password has no digits in it. If your web site insists on a digit, I just don't sign up for your web site. My security level is MY choice, not yours. Why should I memorize a special password just to get your daily news feed?

My online newspaper passwords are abc123

[Anonymous Coward]

Sites with actual value or that I would be annoyed if they get hijacked get real passwords, unique per site. HuffPo and the New York Times get abc123; if somebody hijacks them then they can start posting letters to the editor as "Anonymous Coward", or whatever name I'm using there.

Remember?

[lonecrow]

Remembering passwords is a bad idea. Use a vault.

Re:5 characters

[david_thornley]

6-8 alphanumeric characters, no spaces or special characters, must begin with a letter. No, I'm not telling you which institution, just that I have at some points in time had fairly valuable assets with them. That's the worst I've had recently. Significantly less than a quadrillion possibilities, and doesn't allow any high-value scheme I've got.

Re:8 character min

[bluefoxlucid]

random_clown_jetski_explosion_wave