Slashdot Log In
MS Employee Calls for No More Passwords
Posted by
Zonk
on Sat Feb 12, 2005 08:43 PM
from the wise-man-in-a-unique-position dept.
from the wise-man-in-a-unique-position dept.
BobPaul writes "On his blog, Robert Hensing of the Microsoft PSS Security Team makes a really convincing argument for the abolishment of complicated passwords. He argues that precomputed hash tables, network sniffing, and programs like LoftCrack make passwords obsolete and dangerous in the windows environment. What does he recommend in their place? Passphrases: sentences and quotes that are easy to remember but may be more than 30 or 40 characters in length. With many companies requiring frequent password changes, (and we know exactly where that leads) this is a simple idea I'm surprised more people haven't been doing this more often."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Biometrics (Score:5, Interesting)
converting to all passphrases. First, the person will probably use the same passphrase for everything because it's too difficult
to remember multiple passphrases. Second, it's difficult to remember passphrases! Phone numbers (In the US, at least) are limited to
10 digits because research shows the average person can only memorize 10 digits, as a result...we tend to write things down, or in the case of
data people are likely to store their passphrases in a central location that is still prone to theft/decryption.
Biometrics, on the other hand, requires that you only have your body present at the time! No special USB keys to lug around, no pieces of
paper with important passwords/phrases. This won't solve the problem of possible data interception when talking about remote
authentication--but every form of authentication is prone to such attacks when transmitted.
Re:Biometrics (Score:5, Insightful)
Parent
Re:Biometrics (Score:5, Funny)
Something I have... Smith and Wesson.
Something I know... How to freaking shoot.
Something I am... Bad MotherFucker.
Parent
Re:Biometrics (Score:5, Insightful)
This won't solve the problem of possible data interception when talking about remote
authentication--but every form of authentication is prone to such attacks when transmitted.
No it isn't, because if you use a salted hash (chosen by the server), you can't just replay the traffic.
Parent
Re:Biometrics (Score:4, Funny)
That's true
Parent
Re:Biometrics (Score:5, Funny)
Ooh...yea--that'll be the downfall of biometric authentication. Someone steals my retina and then all my accounts are 0wned for ever and ever...
Parent
Re:Biometrics (Score:5, Insightful)
Suppose you are just walking in the streets when someone suddenly shoves a camera to your face and takes a picture. The flashlight blinds you momentarily, so you can't pursue him. He disappears into the crowd with a picture of your retinas in his camera.
What are you going to do ? The picture contains all the data he needs to log into online services as you. You cannot change the password, since you don't have any. In theory, you might be able to burn a distinguishing pattern into your retina with a laser - but, of course, that will negatively impact your vision.
So yes, that's exactly what will happen. Someone will steal your retina (or rather, copy the biometric info that is used to authenticate you) and then all your accounts are 0wned for ever and ever.
Not to mention the privacy concerns - I wouldn't want every online service to be able to link my identity to my real one, would you ?
Biometric identification is an extremely bad idea that will hopefully die the silent death it deserves.
Parent
Re:Biometrics (Score:4, Funny)
Good point, but anyone who wants to go through all that trouble is welcome to my slashdot account.
Parent
Re:Biometrics (Score:5, Insightful)
Once someone gets a copy of your fingerprint or retina, your credit card is comprimised for life. You can't change you biometrics, which is why they are a total joke.
Parent
Re:Biometrics (Score:5, Interesting)
I agree that biometrics can't be changed, but will you ever need to?
Parent
Re:Biometrics (Score:5, Informative)
Not to mention that fingerprints are left EVERYWHERE.
Parent
Re:Biometrics (Score:5, Funny)
Gummy Bears! Bouncing here and there and everywhere! Foiling security beyond compare! They are the Gummy Bearrrrrrrrrrrs.
Parent
Re: It's no joke! (Score:5, Informative)
Parent
Re:Biometrics (Score:5, Informative)
Here's a link to a Norwegian article about one successful breach:
http://www.tu.no/nyheter/ikt/article30692.ece [www.tu.no]
The article links to this Swedish one on the same story:
http://www.nyteknik.se/pub/ipsart.asp?art_id=3739
and this concerning some Japanese experiments:
http://www.rootsecure.net/content/downloads/pdf_d
(mind the
Parent
Re:Biometrics (Score:5, Informative)
Even worse, some fingerprint-based biometric sensors that were being toted as secure were able to be broken by simply blowing warm breath on the reader, much like when you go up to a cold, glassy window and fog it with your breath. The biometric sensors, for one reason or another, read the previous fingerprint.
Again, it all depends on which system is in question, but my research found that most biometric systems were able to be broken, sans bloody, cut-off fingers or jelly replicas. Of course, they are toted as super-secure.
That is why the fundamental rule for using biometrics for authentication is as follows:
Biometrics aren't meant to replace passwords/passphrases. They are meant to be used as an added layer of security in addition to the password.
(As a side note, if you wanted to do more than just get the copy of fingerprints, invite someone out for beer and french fries at the local bar and bring some scotch tape with you. When they are done and leave, take their greasy, finger-print covered glass and apply the scotch tape to it. You will lift the oily fingerprint. Depending on how the system works, you can now use watery ink to get a negative of the fingerprint. Print this onto the old boards they used to hand-make printed circuit boards, etch the board with chemicals, and come out with a fairly 3-D version of the fingerprint. Now, make your standard flat, thin jelly mold and, when set, wrap it on your finger. Viola!)
Parent
Re:Biometrics (Score:5, Insightful)
There are two definite (and related) advantages to biometric systems.
One -- the bar to "unauthorized use of credentials" is raised to a higher level. Which, to a large degree, is what all security is about. If ${large organization of nefarious intent} wants my data, they have the means to get it. Biometrics helps weed out the less well-funded and well-motivated people. It's like me using one-time passwords for SSH access. No, it doesn't prevent someone from entering my house and installing a tiny hardware key-logger in my PC, but it does stop all of those clowns running dictionary attacks.
With biometrics, people can't just rummage around a desk looking for the password post-it. They (as in your case) have to arrange for greasy finger-print covered glasses and scotch tape. Not insurmountable, just a bit more difficult.
Two -- any kind of remotely plausible deniability in the event of a breach is gone. ("Uh, I don't know how it happened. I just happened to have a jelly mold of this guy's fingerprint..."). Unauthorized access to a biometrically controlled system is pretty solid primae faciae evidence that Evil Deeds[TM] are afoot.
Yes, there are problems with biometric authorization. Irrevocability being a very large one. Almost all of the people complaining about biometrics being ineffective -- and almost all of the people touting them as *the* solution to all security problems -- are forgetting one thing.
Security is about the whole organizational process. Total security is enhanced or diminished by the particular method of authentication that you use -- and poor authentication can undermine a lot of the rest of the system. Hackable authentication does not automatically invalidate the rest of the security process. 100% provable authentication does not automatically mean that your system is 100% secure.
Let's look at the example of an anonymous FTP server. There's no authentication. None. However, any sensible person would be running it read-only. It would be jailed or chrooted. IP addresses would be logged for auditing purposes. The partition that the ftp server is serving data from could be mounted noexec. Blah, blah, blah, etc, etc, etc. Here's a case where zero authentication does not mean zero security.
People often talk about biometrics in the context of some theoretical, non-existent system where there is no other security other than this one, initial biometric authentication...and the whole system is either "secure" or "insecure" based on the authentication. Which is just garbage.
Even in the simplest case -- biometric time-keeping -- there are other checks in the system.
Let's assume that worker A and worker B have colluded to provide each other with false handprints. We'll leave out such annoying real-world problems like, "Hey, Bob, why are you clocking in with that jelly-filled hand-on-a-stick ?" and assume that worker A and worker B can at any time just clock in and clock out as each other without anyone noticing.
OK, at the end of the week, Manager M gets a payroll report. Manager M gives it a cursory glance. Uber-manager N gets the same report, and gives it an even more cursory glance. Let's not even talk about Director O -- we know that it's just sitting in her in-box with all of the other reports.
HR Flunkie T runs the weekly "check for discrepancies between scheduled shifts and actual time worked" and sends those to Manager, Uber-Manager and Director. Manager M fires an email back saying, "Hey, no problem." Or perhaps the email says, "Hey, worker A is showing up as having no discrepancies -- I distinctly remember that he was thirty minutes late on Tuesday".
Every month, Auditor X takes a brief look at all of the discrepancies between last month and today and all of the explanations for them. Auditor X looks for any suspicious or unusual patterns -- and the absenc
Parent
Re:Biometrics (Score:3, Funny)
Or that someone else has your body present. Or just search google for jelly fingerprint to see how to duplicate other people's prints for fun and profit.
Biometrics is bound to stick around for a while, but the fad will hopefully fade before all my bank and credit card accounts get tied to my fingerprint and I have to have new prints carved into my fingers to replace the ones that some identity thief lifted off the s
One Question (Score:3, Insightful)
Becuase your fingerprints will be all over unless you wear gloves all the time.
Other body parts aren't quite this extreame but still have similar weaknesses.
Re:Biometrics (Score:5, Informative)
It's a lot easier to remember a series of words than a series of digits that have no obvious relationship to each other.
Parent
Re:Biometrics (Score:5, Interesting)
Parent
Re:Biometrics (Score:4, Informative)
Nonsense. I recall the phrase "Whan that April with his showres soote" from 20 years ago when I read it for the first and last time. 3 years before that I memorized pi to 21 decimal places --- I still know them. How about "Now is the winter of our discontent"? or "The lord is my shepherd. I shall not be in want"? or thousands of others?
Memorizing a phrase -- particularly a phrase that means something to you, is not as difficult as memorizing the first 3 entries in the phone book.
Parent
Re:Biometrics (Score:5, Insightful)
Great, now what happens when I need to log into a remote server? I currently live in Colorado and have access to machines in Wisconsin and Alberta, and the great security of fingerprint biometrics aside, my arms just aren't that long. And if that remote machine will accept data from a reader at my own machine, well, that reader is vulnerable to tampering and outside their control, and we're back where we started.
At some point, we HAVE to realize that we just can't have some type of perfect security. Like a real safe or vault, someone determined enough to get in WILL get in. However, the better the security, the more chance that you will catch them in the act and prevent it, or deter the would-be attacker in the first place. This is the true goal of security.
Biometric security measures, in my opinion, would be too intrusive and unwieldy for use at the desktop level. If I want to let my friend Bob use my machine, I can give him my password, but I cannot hand him my retina. Of course, for ultrasensitive applications (bank vaults, national security information, nuclear power facilities) it would be an excellent alternative to the current cards and such which can be stolen.
As to the passphrase idea, it's not -terribly- hard to remember multiple phrases. And you don't need a different one for each site you visit-four or five different ones are sufficient for most people. And it's a lot harder for a would-be cracker to guess that your passphrase is "My daughter threw cake at the dog on her second birthday" then it is to look up your kid's date of birth.
Parent
Offer Void on pre-2000 MS operating systems. (Score:5, Informative)
Therefore, if you have any legacy systems to support, these password tips don't apply to you, and that's got to be part of the reason there hasn't been much of a movement to suggest that users use longer passwords.
Re:Offer Void on pre-2000 MS operating systems. (Score:5, Informative)
Took a bloody age to authenticate though.
Parent
People are lazy (Score:4, Informative)
I have convinced a majority of my friends & family to at least stop using dictionary words and names of pets. Instead, I have them pick some favorite line from a movie or book and then use the first letter of each word. It's easy to remember, so they don't stick it on the bottom of their keyboard. It also is not a word in the dictionary so at least Crack & friends can't be used to guess it.
For example, if one of my friends is a Dead Head, he might use "stlasom.oticbs" If you're a Dead Head you'll probably be able to guess the lyric. But you *won't* be able to find it in a dictionary.
Re:People are lazy (Score:4, Insightful)
Parent
Re:People are lazy (Score:3, Insightful)
Let me give you an example of how excessive security requirements can do this. Quite a few years ago, I was doing some contract programming for a local university/teaching hospital. I was working with one of their mainframe programmers, and he told
Excellent! (Score:5, Funny)
Only a few thousand years behind... (Score:5, Funny)
My passphrase... (Score:5, Funny)
or
Make of that what you want, but:
Of course, I changed the password to something more politically correct before leaving the companies....
For generation of strong and easy to remember ... (Score:3, Informative)
good news, everybody (Score:3, Interesting)
*yeah, right*
this "idea" is described in every single tutorial/howto/paper/note about password security. it's a good idea, i've been doing it for years, it has most likely been mentioned on slashdot countless times, but here we go again.
at times i forget why i am such an avid reader; it provides me with "stuff that matters" and makes me feel like i know more than all the others, from time to time
jethr0
No one will ever break my password! (Score:5, Funny)
Re:No one will ever break my password! (Score:4, Funny)
Parent
Bible as the next crack dictionnary? (Score:3, Interesting)
IMHO, passphrase would make it easier for a hacker to successfully hack a system. For example, myself:
- Make a google search for my name
- See that The White Stripes is among my favourite groups
- Add The White Stripes lyrics to the crack dictionnary
- Attack, and probably succeed (password = "Why can't you be nicer to me?").
The list of all quotes in imdb mustn't be THAT big. Thus "I will have my vengeance, in this life or the next" would be a bad password. (not to mention "whoa"
Of course, IANASB (security blogger), I could be wrong.
two obvious problems with this idea (Score:5, Insightful)
2) if most people's passphrases are made of dictionary words take from their active vocabularies, dictionary attacks are still very possible. If we figure a typical vocabulary of 25000 words and a six-word phase, hmmm, some quick math indicates we're in the range of a 14-character random alphanumeric+punctunation password -- not too bad. (Especially if you grant people bigger vocabularies [worldwidewords.org]....) But, suddenly, we're open to language-based attacks -- there's probably thesis project in here for someone to come up with good algorithms to narrow down the required attack dictionary.
Thesis? I can do it right now, right here. (Score:5, Insightful)
subject - verb - object
(I like pizza).
Here's another:
adverb/adjective - object - verb
(Mean people suck).
The trick is finding the most common 3 word phrases (in English) and applying the basic grammatical rules you learned in school.
That guy didn't understand that passphrases/passwords are covered in cryptology under "authentication".
And any student of cryptology can tell you that PATTERNS are the problem.
With passphrases, there are too many GRAMMATICAL RULES and PATTERNS that make it simple to crack.
He focuses solely on the number of characters and never looks at how someone else would approach this to crack it.
Parent
It's not LoftCrack (Score:3, Informative)
passwords? passphrases? (Score:3, Interesting)
A password is a string you know, a passphrase is a string you know.
One is probably longer than the other, big deal.
2, or 3, or 4 factor authorisation schemes are the only way forward. Like those used by some banks in, erm, Sweden ?
how about public key authentication? (Score:5, Interesting)
Passphrases are just long passwords with (usually) low entropy. They still have the same problems... You have to have a separate passphrase for each account, and you have to trust the computer you're using not to log your keystrokes. I would much rather carry around a device that can authenticate me and never have to remember a password again.
Why don't we all just switch to USB tokens [rsasecurity.com] for authentication? You have one device that can authenticate you by generating an RSA signature without divulging any information that would allow someone else to pretend to be you. It amazes me that more people don't use these things. I've never used one, but have considered ordering one. Does anyone out there have experience with USB tokens? Is there a good model/brand to buy? Is it easy to get them to work with Linux and ssh? Do any brick-and-mortar stores sell them?
Passphrases are MUCH easier (Score:5, Informative)
1. Must contain at least 8 characters
2. Must contain at least 2 lowercase letters
3. Must contain at least 2 capital letters
4. Must contain at least 2 numbers
Since a lot of people cant grok this we start to see passwords like 34erdfCV. If you are using a QWERTY keyboard take a look at that password and tell me whats wrong with it.
Since I saw this article in a MS Security newsletter I've started using passphrases. Here is an example of my Windows Server 2003 administrator login (local only, not going to help you). "Rent is due on the 5th". Now I see many comments already talking about how that is so much harder to type than "34erdfCV" but I beg to differ. For me at least it is much easier to type a coherent sentense than a bunch of random letters and numbers.
This password is not only easy to type, but it is very secure. I'm sure some mathematician is going to come down on my with a bunch of stats about how I'm wrong and what not but just the fact that the LM hash is not stored when you use a password larger than 14 characters helps significantly. Sure you can tell windows not to store a LM hash by editing the registry but do you really expect all employees of a mid size company to follow directions that start out like "Click Start, then Run. Type 'regedit' and click OK"?
Now of course this isn't going to defend you against the ol' linux bootdisk trick, or that awesome "NT Password Recovery" bootdisk, which is basically linux which allows you to overwrite the password, but thats what NTFS and encryption is for. And if you've got physical access all bets are off anyway. At least you know they wont be able to run a rainbow table lookup on your LM hash and figure it out in a few seconds.
Also, passphrases are easier to remember, harder to guess, harder to figure out by watching someone type them, and if your really that dense you can just pick up a book off your shelf, turn to a page, type in the first sentense and remember the book and page number.
And there is an added bonus to having a passphrase over 14 characters that you are all completely missing here. When the hot chick in accounting sees you keying in some enormously long password she will think your smart and savy and will want to have hot sex with you right there in the server room.
Well, maybe not the hot chick and sex part.
Now, what would be a good long slashdot post without a question for you to ponder. If you havent figured yet I'm the sysadmin at this company and am trying my hardest to find a way to "sell" this passphrase idea. It seems that the easiest thing to do in IT is configure complex servers and firewalls and support ID10T's. The hard part is "selling" common sense stuff like SSL and passphrases.
"You mean we're going to have to add an 's' to the end of 'http', do you really expect 100 people to change their bookmarks! They've been using those bookmarks all year!"
Insight from other admins very welcome.
I've got a task for the security team... (Score:3, Insightful)
Passwords matter NOT AT ALL when you can just send a packet and get full admin access without any authentication step.
Who the hell else is better suited to innovate on security than Microsoft? We are to believe that they have 50,000 geniuses working there on groundbreaking amazing stuff... and the best thing they can come up with is a Java ripoff and a desktop search doodad? No. There are enough smart people there (or enough funds to create university research projects outside the softie-dome) to wow the world with some kickass new technology based on either genuinely new ideas, or old ideas that needed a lot of refinement to be usable on real code.
I suspect, though, that this is something they're unwilling to do because the design itself is inherently insecure, and securing it would mean breaking 99% of shipping apps. If that's true, it means that Bill's committment to security is just lip service. Please, Microsoft, break apps that use crappy backdoors. XP SP2 broke stuff to improve security, and that was the right decision. Apple had to do something similar with the Carbon transition (breaking old apps that correctly used well documented but ill-concieved APIs from the pre-OS X days). Microsoft could provide tools to help ISVs be compatible with a Longhorn "clean API" that doesn't let apps use deprecated, unsafe features from the bad old days of not caring about security.
Of course, they won't.
I can't type my 8 char passwords half the time (Score:5, Insightful)
Re:I can't type my 8 char passwords half the time (Score:4, Insightful)
This same jumble of characters I would think would do more to kill typing speed. Again, they're "fat fingering" it because they're not typing in natural letter combinations, so when the authenticator barfs, they slow down the next time and mash each letter slowly and methodically. I think it would be faster for most people that know how to touch type (hunt and peck management types are more or less boned) to type an 8 word phrase than an 8 character random mess.
You do have a point here, but "standard" grammar (not to mention spelling ;)) has a bad habit of widely varying over relatively narrow regions, particularly among languages like English that have very poorly defined grammatical rules. A locally-originating attack might have a chance of succeeding, but some hacker in Asia might have a harder time parsing a passphrase written by someone in the US Deep South.
Parent
Broken implementation, not broken technology (Score:4, Informative)
Everybody else mixes random salt bytes into passwords prior to hashing. Unix was doing this over 20 years ago. Modern systems use long (16+ character) salts that make precomputed hash tables infeasible for many years to come.
Some platforms use a better system [openbsd.org] still, that makes it more difficult for password guessers now and well into the future.
The only intrinsic problem with passwords is that people choose dumb ones, but again this can easily be fixed with a little technology [openwall.com]
One Time Passwords. (Score:4, Interesting)
I use s/key or opiekey (depending on OS) for ALL my remote logins. Both of these programs use a pass phrase but (even better) this pass phrase is never transmitted across the network... encrypted or not. What happens is the pass phrase is used to generate a one time pass phrase.
In practice it looks like this:
ssh localhost
otp-md5 498 la7365 ext
Password:
I then open another window: type in
opiekey 498 la7365 ext
Using the MD5 algorithm to compute response.
Reminder: Don't use opiekey from telnet or dial-in sessions.
Enter secret pass phrase:
type my passphrase at the prompt and it spits out:
GIG DIRE EGG HISS HUB COOK
I type that at the password prompt and go on my way (cut and paste between xterms is best here). Even if I was not using an encrypted protocol the password is useless once it is used. You can even hit enter once so the phrase will be echo'ed back to you on the screen so you don't mistype it. Doesn't matter if someone reads over your shoulder because GIG DIRE EGG HISS HUB COOK will never work again.
Next time my password might be:
KNEW LARD ARGO LARD BARE YOGA
Or whatever. The point is that it is a mixture of pass phrases with the ability to avoid sending your pass phrase over an untrusted connection. You can even print out a list of the next 10 pass phrases you will have so you can log in from a computer where you wouldn't trust it enough to run the opiekey program.
How exactly is this an insecure linux system, at least in regards to passwords?
lol, besides that... I think pass phrases are a good idea. Just a little anoying at first.
Passphrases are no silver bullet (Score:5, Insightful)
Users hate passwords, they hate typing them, and they hate having to remember things. They will always opt for whatever is easy. They will hate you if you set a lower limit of 30 characters, and their passphrase was 28.
Passwords or passphrases - same thing - will be chosen easy the more obstacles you place on the users: Requiring users to change password every three months will leave your systems less secure:
Users will choose easier passwords, and/or they will rotate just two different passwords. No security gained.
Further, in the race with a bruteforce attack, nothing is gained unless you change your password to one that has been tried.
In stead, as the administrator you have a head start in the race with the crackers. Go password cracking and require users to change their password when it has been cracked.
If password is cracked too quickly it should be followed by disiplinary actions as a compromise of security. Ofcourse the users must be informed beforehand of such proceedures.
Just my 5euro-cent contribution...
Re:Auto-completion (Score:3, Funny)
[] Check this box to remember password
Re:Auto-completion (Score:3, Insightful)
turning it off should be located in some obscure dialog box in some unrelated area
it should randomly set itself back to "remember password" without notifying you
the next upgrade will make it the default and change where it's stored
--
absolutely! (Score:5, Informative)
For more information on this, this [google.com] Google search produced some good sites explaining tihs.
Also, in just conducting that search, I learned that 2000 and XP is apparently immune from this particular problem, according to this site [securityfocus.com].
"With LM, password hashes were split into two separate 7-character hashes. This actually made passwords more vulnerable because a brute-force attack could be performed on each half of the password at the same time. So passwords that were 9 characters long were broken into one 7-character hash and one 2-character hash. Obviously, cracking a 2-character hash did not take long, and the 7-character portion could usually be cracked within hours. Often, the smaller portion could actually be used to assist in the cracking of the longer portion. Because of this, many security professionals determined that optimal password lengths were 7 or 14 characters, corresponding to the two 7-character hashes.
But things are different with newer versions of Windows. Windows 2000 and XP passwords can now be up to 127 characters in length and so 14 characters is no longer a limit. Furthermore, one little known fact discovered by Urity of SecurityFriday.com is that if a password is fifteen characters or longer, Windows does not even store the LanMan hash correctly. This actually protects you from brute-force attacks against the weak algorithm used in those hashes. If your password is 15 characters or longer, Windows stores the constant AAD3B435B51404EEAAD3B435B51404EE as your LM hash, which is equivalent to a null password. And since your password is obviously not null, attempts to crack that hash will fail.
With this in mind, going longer than 14 characters may be good advice. But if you want to enforce very long passwords using group policy or security templates, don't bother - neither will allow you to set a minimum password length greater than 14 characters."
Parent