Slashdot Mirror
An Algorithm For Better Password Checking (technologyreview.com)
New submitter della writes: Password checkers — those things that tell you whether your password is strong or not — are good: various studies have found that they make users choose better passwords. Unfortunately, nowadays attackers use probabilistic strategies based on natural language processing to guess passwords earlier, and most checkers consist of heuristic rules that don't reflect well probabilistic attacks. To do better you could in theory simulate the attack, but if your password is not that bad, that would be very expensive or just unfeasible.
In a paper I wrote with Maurizio Filippone and presented at ACM's CCS conference, we show how you can take an attack model and a password, and through a simple formula come up quickly with a reliable estimation of how many guesses that attack would need to guess the password. You can use this to roll a better password checker, or — as we've also done in the paper — to compare different attacks.
In a paper I wrote with Maurizio Filippone and presented at ACM's CCS conference, we show how you can take an attack model and a password, and through a simple formula come up quickly with a reliable estimation of how many guesses that attack would need to guess the password. You can use this to roll a better password checker, or — as we've also done in the paper — to compare different attacks.
Stop saying my password is bad. If I make it more complicated, I won't remember it. So it would be even worse.
And making me change it every now and then is even more stupid.
I don't even care if they're secure or guessable or lexographic or written down or whatever other bullshit I'm supposed to care about.
I am sick of these bullshit passwords and signins fucking everywhere. Every single site, every single service, every single day, input this, email that, account name, please re-enter, confirm, mandatory, change must contain a two numbers, must contain capital letters, cannot contain special characters, forgotton your password?
I've given up. Fuck it. I'll just lurk, post anonymously while I still can. I must have over 200 accounts out there and I just don't care anymore. It's too much effort to remember all this bullshit anymore.
Lots of things really don't need highly secure passwords but insist on having ridiculous password requirements.
Case in point Xbox one must login to microsoft account to setup for the first time password must have at least one capital, at least one number, at least one symbol and at least 8 characters Password1~ is an acceptable password. Pita to type on xbox controller.
Netflix is a model for reasonable requirement's especially since it likes to log itself out at random. So less to type on wii remote is a definite plus. 4 letters minimum 0000 is an acceptable password.
Minimum threshold fixed. Thanks!
heuristic rules that don't reflect well probabilistic attacks
In English, the direct object ("probabilistic attacks") immediately follows the verb ("reflect"), as in "heuristic rules that don't reflect probabilistic attacks well". The adverb ("well") is placed either immediately before the verb or after the direct object.
See this page for more explanation. Please don't consider this an attack on your grammar, but rather a gentle nudge in the right direction. What you wrote may sound good in a Latin language like Spanish, but to a native English speaker, it's butchered.
various studies have found that they make users choose better passwords.
By better do you mean harder for computers to guess or easier for users to remember and not have to write down?
>> Symbols appear to be less predictable and placed in different locations of the password
I disagree with the paper's conclusion based on the passwords I've seen, which FREQUENTLY just end in a "!" or other common character. Here's a different paper that goes into symbol frequency; I pulled out the relevant bit.
In almost all cases (90%), only a single special character was used. The most popular special character sequences were all single characters: exclamation point (“!” – 29%), period (“.” – 19%), “at” symbol (“@” – 15%) and hash (“#” – 14%). These were followed by the single dash (“-“), dollar sign (“$”), space (” “), asterisk (“*”), and plus sign (“+”), each making up between 3% and 6% of the single-character special character population. Passwords containing multiple special characters mainly (68%) just repeated the same special character, such as “##” or “???.” - http://resources.infosecinstit...
I still think it should be up to the person to choose a good password. Besides, it seems like most major breaches we hear about involve social engineering rather than actual password cracking anyway.
Stop making us change them every 3 months and we could come up with stronger passwords.
The only thing necessary for evil to triumph is for it to be pitted against a slightly greater evil
because they don't want us to use strong passwords. Use strong passwords.
I use randomly generated passwords of lowercase letters and numbers. Most "password checkers" tell me they are insecure. This just shows how bad they are. Bit it is good that somebody did a systematic evaluation of the problem. Maybe now the stupidity will decrease.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Some sites have a horrible password schemas:
* Want to put in 16 characters for a password (think passphrase)? Nope, not allowed because some idiot thought you shouldn't be able to enter more then 8 chars.
* Enter in a password only to have it rejected? Tell us _which_ characters are allowed and which ones aren't !
i search in this article for the word "dictionary" and didn't find it, so my article-checker heuristic algorithm determined that this was not a good article. please enter another article.
What's easier, teaching somebody who isn't tech savvy: A) how to use KeePass X or some other offline password manager; or B) to manually compose a bundle of strong, memorable passwords, to change them at least once a year, but not to re-use them, not to use them on any computer that could keylog them, and not to write them down or save them in plaintext?
The answer seems pretty obvious to me.
I'm a big fan of random phonetic passwords. The work well for my brain. Even a short base64 random letter password is harder for me to recall than a long phonetic password. Look at that co-author's butter tasting name " Maurizio Filippone". It's totally awesome to say that out loud. And do that 7 times right now and this evening you will still be able to say it. But you won't be able to recall 5(F{!X45*~d tonight. It's pretty easy to generate these where each phonem or di-phonem component has a very large library. I once wrote such a generator as a test and would just give people ten at a time to choose a password from. One person said it was a good way to choose baby names too.
A way I've experimented with password recovery is to generate a very long sentence I can remember and hash this to a random number seed. Then generate rememberable phonetic passwords in order starting from that seed, then pick one of the first hundred you are offered. If you need to recover your password later you just have it recreate the password list again from that sentence. Your brain can easily spot the password you picked the first time.
This latter test convinced me that phonetic passwords are easy to remember. If I had tried the same seeded passwrod generator on base64 passwords it less likely i'd spot my favorite in the mix.
Some drink at the fountain of knowledge. Others just gargle.
Let's stop caring about password complexity! It is a losing game. Let's stick with simple passwords that are super easy to remember and type.
Security shouldn't be limited to a single factor. Two factor authentication is what we SHOULD be using. Something you know (the password), and something you have (some physical device). U2F is a damn perfect example of this. You can use your phone as an authenticator. You can add the authentication codes on multiple devices in case you lose the primary. These codes generate a time based sequence of numbers, so even if some MitM attach steals the entire login session details, it'll only be valid for at best ~1 minute.
https://en.wikipedia.org/wiki/...
From the article:
Making a password longer or including symbols was much more effective.
Yet so many systems limit password lengths and forbid special characters. Example: My bank is one of the top 20 largest banks in the US, and they do not allow special characters in their web banking.
Everyone has too many password to remember. I have it down to just 3 with ZERO online accounts memorized.
Explained password manager to a sister and showed her KeePassX on Linux, KeePass v1 on Windows and DroidPass on android all using the same DB. Suggested she try it for a week a few years ago at Thanksgiving. By Xmas, she'd become hooked and was teaching the other members of the family how as well.
Hearing it was easy from a non-nerd helped the others accept it.
A few tricks are needed:
a) think of all the different platforms/devices as read-only, except 1. That is the only place where edits should be made. This keeps confusion to a minimum.
b) Having the latest copy of the DB on each device "now" isn't really that important unless an important password/account change just happened. If you never use the lifehacker.com account on your phone, having a new password on the phone isn't really important.
c) The rest are good password strategies.
** use a different email/contact for important/financial accounts than for all the social stuff
** always different passwords
** always random passwords
** always as long as allowed by the online service
** 22-55 characters - they will never type them anyway.
** use any character the keyboard can enter. Not just alphabetic characters-this stuff is automatic if using the keekassX generator.
Since Mom died, we've also started sharing half/3rd of our KeePassX DB credentials with different family members. This way if there is an emergency, then family can work together to access the accounts. At death, this isn't important, but if you are in a coma-wouldn't it be nice if family could let your friends know via social media?
Think I'll be giving YubiKeys to everyone for Xmas this year.
Funny video about password management: https://www.youtube.com/watch?...
I don't understand why brute force attacks can't be stopped by limiting the number of failed attempts on any given account name and password. After x failures on either, don't accept another attempt for y minutes. It can't just be stupidity, so what am I missing?
Fifty posts, didn't spot acronyms.
rrrybgdts
ttlshiwwya
ratrpfop
Nursery rhymes.
def IsPasswordHackable(password): return True
They make you choose passwords like JaNjwMownpJu81% which is pure crap, hard to remember, easy to bruteforce. Most sites won't let you use pass phrases, which are much more secure that those cryptic bullshit.
I haven't seen zxcvbn mentioned before, a similar look at password strength from 3 years ago.
https://blogs.dropbox.com/tech...
Demo is here: https://dl.dropboxusercontent....
Personally I like the output of http://www.kurtm.net/wpa-pskge... for passwords:
o|IRcWY;g_V]C}9'.@]@,]!YF.[Yj{K@QmuFCo%%!=~+ab,e2(pU97{V-)Qm*T
Do you have any better hostages?
Services should not care about whether or not my password is easy to guess (easy to remember). They should only care about making sure nobody can hack into their data center and steal EVERYONE'S passwords.
Can't Browse Comments Without Javascript
Subject says it all.
Let's see if I can "post" this...
I have memorized a couple passphrases with 10 diceware words for ~128 bits of entropy. Protect a password safe with a cryptographically secure passphrase and let it generate random passwords for you.
If you have to remember passwords for websites then diceware passphrases are faster to type, don't have special characters, are too long for rainbow tables or other brute force cracking, and most sites don't have ridiculous length limits any more.
dammit. now I have to change my password.
Sleep your way to a whiter smile...date a dentist!
In the real world hardly anyone bothers to try and crack passwords. And when they do they usually only try one or two very common passwords, mostly in the context of authenticated mail logins (because common MTAs such as sendmail don't even bother to log such attempts).
In the real world you can have a fairly simple password and it is perfectly safe. But there is a very large industry which wants you to believe that weak passwords are an enormous problem and that one needs to go to extraordinary lengths to protect one's passwords. They also want everyone to divulge additional private information in the guise of enhanced security, but that is not the true motivation.
This is exactly what we need. An approach that tells users who strong their passwords actually are in real-life scenarios, and not how well they conform to some arbitrary policy.
The alternative, that's been used by some for more than a decade, is to run your own password cracker at night, and everyone whose password it cracks by morning is sent a mail telling them to change it.
We desperately need to get away from these awful policies that try to make passwords as random as possible for two reasons. One, they are a total failure, people are very inventice when it comes to finding a password that will satisfy the stupid computer but still be easy to remember (and guess). Two, if you make it complicated enough, people will just re-use and write down passwords more. Congratulations, one step forward, two steps back.
Assorted stuff I do sometimes: Lemuria.org
By eliminating certain bit-permutations by classifying them as 'weak', you are effective shrinking the entire key-space that a brute-force checker has to search through, and thereby weakening the security of the entire system.
And that is without taking into account the fact that most people can't remember a 'random' 10-digit password; especially when they have to change it every 6 to 8 weeks.
If you have no issue 'trusting' a big multinational with your digital security, I would argue that a free(!) solution like Google Authenticator (or anything similar) will offer better long-term security then messing around with incomprehensible passwords.
I think its cheaper to plug in a biometric scanner these days . Passwords are like the time when Stallman was at MIT.