We are constantly told to make our passwords more complex and harder to guess. And that is a good thing. But we should not imagine that merely making them longer or more obscure is sufficient.
Consider for example the password: Ph’nglui mglw’nafh Cthulhu R’lyeh wgah’nagl fhtagn1
That looks pretty formidable, right? But actually it took password cracking software just a few minutes to solve it. Why? Because, according to Dan Goodin, that is a phrase that occurs in an H. P. Lovecraft story that appeared in a Wikipedia article. Apparently password crackers have become increasingly sophisticated with the increasing power and speed of computers. As Goodin says, “Crackers have responded by expanding the dictionaries they maintain to include phrases and word combinations found in the Bible, common literature, and in online discussions.”
So you need to come up with a password that is both complex as well as (very likely) unique so that it would never appear in a dictionary and would require a brute force method to solve. It turns out that the stated password policies of companies often result in their users’ passwords having patterns that actually make them easier to hack.
Goodin’s article, including the comments and responses at the end, is a fascinating read for those interested in such things.
I anticipate a future in which every time you log in to your bank you have to itemize each transaction, identifying which ones are legit and which are identity thefts. Then, you have to change your login, create a new 56,000 character password, change your name, move to a new address, burn off your fingerprints with acid, and exterminate everyone who can identify you by sight.
Password crackers have become very good. But all methods only work if the attacker somehow gets a hold of the password hash. In a scenario where the attacker has zero knowledge it is very unlikely to even crack relatively weak passwords.
Unfortunately in many cases that is relatively easy to do. I am always astonished how little many software packages care about cryptography. If anyone is in doubt how little developers care about And even the password hashes could be much more secure if more programmers followed some simple techniques. Salting makes it much harder to break the password even if the attacker gets a hold of the hash.
But the best protection still is a crypto-smartcard but relatively few software packages support them although the new Windows versions have the option to use smartcards instead of passwords so any software that integrates with the Windows authentication module can use it as well.
Oops somehow my compute ate the second half of the sentence. I meant to say: If anyone is in doubt how little developers care about security you just need to watch some talks at hackers conferences.
Bruce Schneier has some good blog posts about password crackers and how to beat them. This one’s really good, and even explains how to choose good passwords:
http://www.schneier.com/blog/archives/2013/06/a_really_good_a.html
Part/model numbers on the back of computer equipment, boxes of staples, and other supplies around the office.
On the back of my keyboard I see “820-003327SY109UK”. That could be a good password. Assuming I usually access the relevant account from that location then I don’t need to write it down or remember it.
As well I use a program called Revelation, passwords in Revelation are protected by a master password and are stored in an AES-256 encrypted XML file. So now I only have to remember 1 pass phrase. Revelation will also generate passwords that hopefully do not suffer from the defects discussed above.
You should keep your money under your mattress like I do.
Passwords are an utterly stupid technology that security practitioners have been pointing out the flaws with, for decades. The problem is that people keep using them, which makes using something else (like a smart card) impossible. FFS, now with just about everything accepting USB, authenticator dongles ought to be common, along with some kind of federated ID through amazon, google, facebook, ebay, or whomever. The problem is, of course, that everyone who could do a federated ID knows that if they try they will be met by market-dividing tactics and competing standards from everyone else. This is a perfect example of how capitalism prevents itsef from offering customers solutions that would actually move the market forward.
And if you find any of my money under your mattress please return it ASAP.
I just keep all my passwords in a password vault. Heck, I don’t even know any of my passwords, except the one to unlock the vault.
Companies need to redo how they hash passwords- this will help a lot. Current hashes are very fast to calculate. You guess a password, hash it, compare it. This can be done billions of times a second.
With a deliberately slow hashing algorithm, each hashing step could take around half a second even on good hardware. This is fast enough for password validation for legitimate system entry, but it will slow password crackers down by several orders of magnitude. Go from getting a few thousand good passwords in an hour to being lucky if you get one or two. Vast security improvement at essentially no cost to usability.
Unfortunately, it costs money to make an upgrade like this. Money companies don’t want to spend even if they can easily afford to. It won’t fix everything with computer security, but it would help, they really should spend the money. At the very least, start doing this for new services.
And keep your password vault under steve oberski’s mattress, like I do.
There are already algorithms for this (bcrypt, PBKDF2). It’s a combination of ignorance (Unsalted MD5? Really? That’s been in some of the recent leaks, IIRC) plus the hardware costs. Security is given short shrift.
It’s getting pretty crowded under my mattress.
All the authenticators I’ve had use both a password and an authenticator.
Authenticators can be stolen. Passwords have to be social engineered or guessed. Biometrics are very difficult to change once compromised.
Nothing is going to be perfect.
Authenticators can be stolen
Nothing is perfect, but why pass up vastly better?
If your authenticator is stolen, you know about it fairly quickly. Furthermore, your attacker has to actually be physically nearby at some point during the attack -- which dramatically raises the cost of the attack and the risk to the attacker. Hint: there are a lot of malware artists in Eastern Europe who will never set foot in the US or UK or Canada because there’s a prison cell waiting for them.
xkcd says ‘correcthorsebatterystaple’ is a pretty good password.
https://xkcd.com/936/
Until people grasp that, for almost all purposes, a 25-character randomly generated password that you write down (or store on your computer) is more secure than a 7-character password that you can remember, password cracking will continue to be a problem. Think about it this way: If you keep your passwords in a filing cabinet at home, anyone who can get to that filing cabinet can just as easily install a keylogger on the computer sitting under the adjacent desk.
In addition, any organization that arbitrarily restricts the length of passwords and the characters that can appear in them, preventing the user from providing a secure password, should be subject to strict liability for any security breach. Actually, I wonder if my congresspeople would be interested in that idea….
An IT director once told me the number one thing he’s seen that makes passwords “breakable” is people making them so difficult to remember that they either write them down (meaning someone needs no computer knowledge to hack you) or keep forgetting them. If people keep forgetting them, the company, such as the massive medical organization he worked for, gets in the business of helping people access computers they don’t have passwords for.
I asked him his solution: Go live off the grid in a shack, because everyone gets hacked.
I’ve been using the sentence-generation scheme for my passwords for probably twelve years now. I use biographical information, particularly where such information is obscure and undocumented, like “The year I met Dave @ 37 Yonge Street”, (TyImD@37YS) or whatever. Take the first initials, and you’ve got a strongish password that you’ve got a shot at remembering, and is basically random to anyone else.
Obviously, this example is not an actual one. 🙂
Also, eschew most social networking sites.
My own password pet annoyance is when there’s no way to see what you’re typing. I get the point of default-invisible, absolutely, and I can see that this should be so. But put a wee tick-box in that allows me to make my typing visible to me, because I use my laptop in public about 0.0000001% of the time, and the rest of the time it’s just me. Thankfully, some big sites are starting to do this.
While using the initials of a string of words is a good idea, it is not a good idea if the original string is a phrase that exists in these massive hackig dictionaries because the code-cracking software also routinely tries the initials.
Yeah -- that’s why I specify biographical and undocumented things (to avoid “I was born in 1966”, a reasonably guessable password knowing the scheme), but there are really so many ways to say even a given datum in English that such an approach, knowing the use of a sentence, would have the sole advantage that they’d likely find that the first initial is upper-case. Else, it’s basically random. There might be a preferential in using the relative frequency of roman letters used in English, but at least three of my passwords are sentences that aren’t even in English, just written in roman letters, so that’s not going to get those easily either.
A friend of mine takes it further: she uses passwords of this style, written using her English keyboard while pretending it’s a keyboard configured for her language. As an example, using Russian, I could type the word “skoro”, using the English keys that are in the same places as the Russian letters: crjhj is the result. If I type what looks like crjhj on my keyboard when it’s configured as Russian, I get the word скоро (quick). But again, it’d be basically random to a guessing algorithm, and more so when using the initials or finals of a sentence of words.
Granted that passwords are a crap method, there are ways to maximize both their utility and strength for ordinary folks; that’s my only point. 🙂
The separation I learned was:
Something you know (password/PIN)
Something you have (authenticator/card/key)
Something you are (biometrics)
An authenticator may be better than a password, but both is even better than that. Passwords are the cheapest by far, so you might as well always use them. But yea, I agree that we should be moving to authenticators.
Or similar systems. One method of password generation I read (by Clifford Stoll, IIRC) is to use multiple short words that are unrelated (e.g. boxletdig), hard to guess but easy to remember. I use a modified form of that, two or three words with a number (3-5 digits) that is not relevant to anyone but me. For example, I have no interest in mountain climbing and don’t talk about it anywhere, so if I used 8848 (Mount Everest’s height), it’s easy to remember but unrelated to me as a person, unlike my birthdate which could be found by data mining.
Password crackers are dependent on laziness and similarity, which is why long random strings work best. One of the weakest parts of usernames and passwords is the fact that they’re limited to about 40-50 possible characters, alphanumerics and few others. And some systems won’t even allow spaces, underscores, dashes, or other characters. The larger the range of possibilities, the harder it is to guess a six character password. 50^6 is four times as many possiblities as 40^6, and a 15 character long password has fifteen times as many possibilities. At 10,000 guesses per second, even a password hacker with the encryption hash is going to take years to break it.
… and the way to get that kind of password is diceware.