Slashdot Mirror
An Algorithm For Better Password Checking (technologyreview.com)
New submitter della writes: Password checkers — those things that tell you whether your password is strong or not — are good: various studies have found that they make users choose better passwords. Unfortunately, nowadays attackers use probabilistic strategies based on natural language processing to guess passwords earlier, and most checkers consist of heuristic rules that don't reflect well probabilistic attacks. To do better you could in theory simulate the attack, but if your password is not that bad, that would be very expensive or just unfeasible.
In a paper I wrote with Maurizio Filippone and presented at ACM's CCS conference, we show how you can take an attack model and a password, and through a simple formula come up quickly with a reliable estimation of how many guesses that attack would need to guess the password. You can use this to roll a better password checker, or — as we've also done in the paper — to compare different attacks.
In a paper I wrote with Maurizio Filippone and presented at ACM's CCS conference, we show how you can take an attack model and a password, and through a simple formula come up quickly with a reliable estimation of how many guesses that attack would need to guess the password. You can use this to roll a better password checker, or — as we've also done in the paper — to compare different attacks.
Stop saying my password is bad. If I make it more complicated, I won't remember it. So it would be even worse.
And making me change it every now and then is even more stupid.
I don't even care if they're secure or guessable or lexographic or written down or whatever other bullshit I'm supposed to care about.
I am sick of these bullshit passwords and signins fucking everywhere. Every single site, every single service, every single day, input this, email that, account name, please re-enter, confirm, mandatory, change must contain a two numbers, must contain capital letters, cannot contain special characters, forgotton your password?
I've given up. Fuck it. I'll just lurk, post anonymously while I still can. I must have over 200 accounts out there and I just don't care anymore. It's too much effort to remember all this bullshit anymore.
Lots of things really don't need highly secure passwords but insist on having ridiculous password requirements.
Case in point Xbox one must login to microsoft account to setup for the first time password must have at least one capital, at least one number, at least one symbol and at least 8 characters Password1~ is an acceptable password. Pita to type on xbox controller.
Netflix is a model for reasonable requirement's especially since it likes to log itself out at random. So less to type on wii remote is a definite plus. 4 letters minimum 0000 is an acceptable password.
Minimum threshold fixed. Thanks!
various studies have found that they make users choose better passwords.
By better do you mean harder for computers to guess or easier for users to remember and not have to write down?
>> Symbols appear to be less predictable and placed in different locations of the password
I disagree with the paper's conclusion based on the passwords I've seen, which FREQUENTLY just end in a "!" or other common character. Here's a different paper that goes into symbol frequency; I pulled out the relevant bit.
In almost all cases (90%), only a single special character was used. The most popular special character sequences were all single characters: exclamation point (“!” – 29%), period (“.” – 19%), “at” symbol (“@” – 15%) and hash (“#” – 14%). These were followed by the single dash (“-“), dollar sign (“$”), space (” “), asterisk (“*”), and plus sign (“+”), each making up between 3% and 6% of the single-character special character population. Passwords containing multiple special characters mainly (68%) just repeated the same special character, such as “##” or “???.” - http://resources.infosecinstit...
Stop making us change them every 3 months and we could come up with stronger passwords.
The only thing necessary for evil to triumph is for it to be pitted against a slightly greater evil
I use randomly generated passwords of lowercase letters and numbers. Most "password checkers" tell me they are insecure. This just shows how bad they are. Bit it is good that somebody did a systematic evaluation of the problem. Maybe now the stupidity will decrease.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
What's easier, teaching somebody who isn't tech savvy: A) how to use KeePass X or some other offline password manager; or B) to manually compose a bundle of strong, memorable passwords, to change them at least once a year, but not to re-use them, not to use them on any computer that could keylog them, and not to write them down or save them in plaintext?
The answer seems pretty obvious to me.
Let's stop caring about password complexity! It is a losing game. Let's stick with simple passwords that are super easy to remember and type.
Security shouldn't be limited to a single factor. Two factor authentication is what we SHOULD be using. Something you know (the password), and something you have (some physical device). U2F is a damn perfect example of this. You can use your phone as an authenticator. You can add the authentication codes on multiple devices in case you lose the primary. These codes generate a time based sequence of numbers, so even if some MitM attach steals the entire login session details, it'll only be valid for at best ~1 minute.
https://en.wikipedia.org/wiki/...
I haven't seen zxcvbn mentioned before, a similar look at password strength from 3 years ago.
https://blogs.dropbox.com/tech...
Demo is here: https://dl.dropboxusercontent....
Personally I like the output of http://www.kurtm.net/wpa-pskge... for passwords:
o|IRcWY;g_V]C}9'.@]@,]!YF.[Yj{K@QmuFCo%%!=~+ab,e2(pU97{V-)Qm*T
Do you have any better hostages?
Sure. I can remember one of those. But seriously the (r) and (c) symbols ... pray you never need type that in on someone elses laptop computer with an international keyboard and no numeric pad or a smartphone keyboard... etc.
But more importantly I can't remember dozens of those.
And password re-use is a bigger issue than using a good password.
I use a mix of a password safe for most passwords, and subset of passwords i need to use commonly are 'algorithmic' based on what i need them for / the sites name / etc.
However, I try to keep the algorithmic ones to a minimum because if you ever have to change an algorithm generated password, it really sucks... because the algorithm you normally use can't be used... because that would result in the password you have now, that you can't use.
And as that starts to accumulate the benefit of algorithmic passwords rapidly declines.
Services should not care about whether or not my password is easy to guess (easy to remember). They should only care about making sure nobody can hack into their data center and steal EVERYONE'S passwords.