Slashdot Mirror
Many Password Strength Meters Are Downright Weak, Researchers Say
alphadogg writes "Website password strength meters often tell you only what you want to hear rather than what you need to hear. That's the finding from researchers at Concordia University in Montreal, who examined the usefulness of those ubiquitous red-yellow-green password strength testers on websites run by big names such as Google, Yahoo, Twitter and Microsoft/Skype. The researchers used algorithms to send millions of 'not-so-good' passwords through these meters, as well as through the meters of password management services such as LastPass and 1Password, and were largely underwhelmed by what they termed wildly inconsistent results.
Inconsistent can go both directions: I've seen password-strength meters that balked at absolutely everything (accepting weak passwords as good, after calling wildly long and random ones poor).
123Password is very strong because it uses numbers and upper and lower case letters.
Those meters are stupid.
The plain simple truth is that complexity of a password is barely relevant at all when compared to the threat of an outright data breach at a provider. Who cares if your password is 'veronica' (your daughters name) or `myL1ttleBr0ny%` since an attacker isn't going to bother with brute forcing anything but '123456' and 'password' because they will get tarpitted by any reputable provider before they can guess anything out of a dictionary more than 5 entries long.
What we need is a meter on a web site describing how much effort they put into server security, how big their target profile is (how many entry points they have) and a sign that says "??? days since a total data breach!", and then the user can decide if they want an account there at all. How's that coming?
So we need a meter for meters now.
Table-ized A.I.
I know that my password - hunter2 - is very strong
Doesn't look strong to me.
I run a GPU cracker on my user's password hashes to preemptively weed out weak passwords. Several times I have seen them try to change it from (for example) "password" to P@ssw0rd99", which in a certain sense is significantly more complex, but OCLHashCat has rules for capitalization, leet-speak, appending/prepending numbers. You've only changed the time it takes to crack that hash from fractions of a second to a few minutes.
The only highly secure password requires long, random characters. Given a choice, users will always prefer an easy-to-remember password because it makes their life easier. Unfortunately, it also makes the bad guy's life easier, and the sysadmin's life harder.
Websites should be required to disclose the hash format they are storing user's passwords in, to hopefully prevent another Linkedin plain-md5 type debacle.
entropy is, and how to measure it. Then we will solve the problem. Oh my God there is nothing worse than what passes for good passwords. People are good at remembering sentences and those have lots of entropy. People are terrible at remembering what we call passwords and those have very little.
We're just doing this wrong from beginning to end.
Most of those web sites are not one's I'm likely to return to anyway. Like a corporate web site for some company I clicked on a job posting for. And now it's asking me to create an account with my E-Mail address and a password. The only information in the account that the password is protecting is an E-Mail address, and I'm not likely to ever return to that site. At this point I'm already pretty sure I don't want to work for that company. If they bitch at me about the strength of the password I chose, that's really just going to make up my mind for me at that point. If I ever DO return to the site, I'm not even likely to remember that I ever created an account there, much less what the password was, so I'm just going to have to click on the "forgot password" link, anyway. I've had sites like this send me the original password in plain text, too.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
We should launch a massive research effort, figure out the strongest possible password, and make everyone use that.
A reminder about their password requirements.
I cannot begin to count the number of times I've had to hit "Forgot my password" simply because they do not remind me up fron that my password must have special character in it. For websites that do not have my personal information and especially not financial (blog sites, sport sites) I tend to use a common password so I don't have to remember different passwords. Again, completely different from any important password and used only for essentially throwaway sites.
But some sites require at least digit, others at least one Capital letter (or at least one lowercase), others at least one special character, others some combination.
The throwaway password usually meets these by virtue of the way it is constructed, but not always. Sometimes it has to be doubled to meet a length requirement, for example. But while they tell you this when you create the password, they never seem to remind you when you later have to enter your password.
There are also often (not told to the user!) length limits on passwords
I like making my passwords a sentence. Whether it is more secure or not, it is easier for me to remember and I like to pretend I believe it is super secure.
However, I have had several places where I make a user, make a password (which it thinks is super strong because it is like 50 characters), copy-paste it somewhere, and it says I have a user. I then try to login using the copy-pasted password, and it tells me I have a bad password. going through the password-reset process, it invariably works if I reset it to a much shorter password.
This is a bug that really annoys me, especially with xkcd encouraging people who might not know about this popular bug to make long passwords.