MySpace Users Have Stronger Passwords Than Corporate Employees

Ant writes "A Wired News column reports on Bruce Schneier's analysis of data from a successful phishing attack on MySpace, and compares the captured user-passwords to an earlier data-set from a corporation. He concludes that MySpace users are better at coming up with good passwords than corporate drones." From the article: "We used to quip that 'password' is the most common password. Now it's 'password1.' Who said users haven't learned anything about security? But seriously, passwords are getting better. I'm impressed that less than 4 percent were dictionary words and that the great majority were at least alphanumeric. Writing in 1989, Daniel Klein was able to crack (.gz) 24 percent of his sample passwords with a small dictionary of just 63,000 words, and found that the average password was 6.4 characters long."

Okay...

So MySpace users are smart enough to pick somewhat secure passwords, but still dumb enough to fall for basic phishing attacks.

It doesn't matter how strong their password is if they are still giving it to whoever asks for it.

Re:Okay...

Hello, this is http://slashdot.org./ [slashdot.org.] We're undergoing a routine security check and your account has been flagged as it is being accessed by computers in other countries. Please click "reply" to this post and enter your userid, password, shoe size, and iq so that your account can be unlocked. Failure to do so indicates that you are a non-compliant individual and appropriate steps will be taken.

Re:Okay...

You're going to have trouble typing my password, as it's 6.4 characters long. The first six characters are 'passwo' The .4 consists of 'r' and 'd' type in such a way as to only use 0.2 of each. :-)

Re:Okay...

From a link in the article:

"The attacker had registered a MySpace account named login_home_index_html, meaning that the MySpace page hosting the fake login, looked like a legitimate place where users would sign on to the service."

So it was just a user page but it DID have myspace.com in the URL. The URL was:

http://www.myspace.com/login_home_index_html [myspace.com]

Duh!

Those corporate users that were dumb enough to fall for phishing had bad passwords. No suprises there. People prone to fishing are probably less securtity concious.

Are myspace users really more security consious? Or are the typical demographics those people who tend to use oddball non-English words and text phrases that end up being "good passwords". yourmom69

Re:Duh!

Just shows that MySpace users value their virtual presence more than corporate users value their jobs.

Re:Duh!

Just shows that MySpace users value their virtual presence more than corporate users value their jobs.

Au contraire! It shows that MySpace users value their virtual presence more than corporate users value data security on the corporate network. Not the same thing. Most people don't get fired for choosing a shit password and getting the company hacked up.

Re:Duh!

How is a password from sample A more secure than sample B when BOTH sample A and B's passwords were compromised?

They were both compromised by social engineering. Which allows us to see the passwords people are choosing and find that corporate passwords are more venerable to brute force attacks.

Re:Okay...

Wow. We MySpace usrz hav BetA security. hu wouldve thunk it. It's not lIk Im doin NEthing dfrnt. Im not lIk tinkN security 24-7.

Re:MOD PARENT INSIGHTFUL

Not really. Most cracking software knows that a letter k might be k, K, |<, et cetera. It makes things take a little longer but most check for such substitutions by default now.

Re:MOD PARENT INSIGHTFUL

I never worry about passwords. I would not worry if someone else knew my password for slashdot. What would they do with it? The only thing they could do it make comments in my name. Even with my bank accounts the only thing they can do it to see how much money I have and transfer money between two of my accounts. If someone wanted to be super mean they could transfer all my checking account money into my savings account and thus cause any checks I write to bounce. They still would not get any personal gain from it. If passwords are such a problem let me suggest a hardware fix. Let there be two passwords. A local password that the user would remember and a password that would be sent out. There would be a table on either the hard drive or a usb flash memory card for the lookup of the secondary password. Since no one would have to memorize or even know the secondary password it could be a 100 randomly generated characters and could be changed every time the user access the account. If one uses the usb flash memory than one could take it with them for use on another computer and by removing it from the computer prevent any other user on that computer from accessing their account. If it is that big a problem than a fix like that would have been used a long time ago.

Re:Okay...

Or maybe it's just the fact that Myspace requires new users to have a number in the password!

Re:Okay...

Maybe MySpace users just can't spell....

The Lesson?

This may not mean that "passwords are getting better." It may just prove once again that people care more about their personal things than other people's stuff.

Re:The Lesson?

I tend to think people come up with a really good password, then they have to come up with 12 others in a row after each expires and disallows reusing an old one.

Re:The Lesson?

Yeah I agree. The time limits on passwords cause most people to just come up with something easier to remember. Why should I have to change my password every 30 days if it's something like Mxo2s0LLn234aAZSQ If I can't even get it right I'm sure no one else is going to guess it. There shouldn't be a need to change it.

The three most commonly used passwords are...

"Love, Sexxxx, and...GOD. So, would her royal highness care to change her password?"

Security through obscurity?

...found that the average password was 6.4 characters long.

What kind of newfangled keyboard do you need to type one of those in?!

Re:Security through obscurity?

You need to use an average keyboard because an average keyboard has 101.4 keys.

nobody can guess mine

I use this password ;#E4][££2&9a for everything.. Oops?

Re:nobody can guess mine

Don't worry... all we saw was:

I use this password ************ for everything.. Oops?

Slashcode is pretty advanced like that... it has filters that automatically hide your personal information in case you accidentally post it. Try posting your ATM PIN or social security code and see how advanced those filters are.

Re:nobody can guess mine

Don't worry... all we saw was:

I use this password ************ for everything.. Oops?

Slashcode is pretty advanced like that... it has filters that automatically hide your personal information in case you accidentally post it. Try posting your ATM PIN or social security code and see how advanced those filters are.

"you can go hunter2 my hunter2-ing hunter2"

*Cough* [bash.org]

i'm not suprised

a 14 year old cares far more about their social life than most adults care about their jobs.

More to lose

It's because the MySpace users have more to lose. They don't want someone defacing their website. Employees on the other hand probably don't care if someone logs into their computer.

Which do you care more about?

This shouldn't be groundbreaking news. Myspace accounts deal with personal part of people's lives and they don't want it interfered with. Which individuals have a vested interested in corporate security?

Stronger Passwords

It easy to have Strong Passwords when you don't need to change them all the time and can't reuse parts of the old password in the new password.

Passwords Expire

    The corporate drones have to deal with passwords that expire every 30/60/90 days, and once expired those passwords can never be reused. So creating a hard password and then remembering it is not so trivial. The myspace users can come up with one hard password and keep it forever.

Re:Passwords Expire

That's one of the two points I was going to make; the other being that a comparison to corporate passwords from 1989 is only slightly more informative than one to passwords from 1889.

Awesome statistic

The best quote is from the article linked within the article:

"I was surprised about how many Christian-sounding -- for example, "Ilovejesus" -- log-on names were associated with the worst cuss words."

Draw your own conclusions, but I think there might be something to this.

(and yes I did RTFA+LFA, do I lose my subscription?)

fear and netspeak

I figure there's two main reasons for this:

1) They're terrified of their peers breaking in and sabotaging their profiles. (I once got assaulted by a drunk girl I knew who thought I hacked her LiveJournal... which I didn't.)

2) They can't spell worth shit, due to netspeak, so typical dictionary approaches aren't going to work.

Also, you have to take into account the basic fact that younger people have grown up around computers, and understand the concept of passwords a bit better than your average middle-aged office worker.

This is all wrong...

MySpace passwords would fail more often if a l33t dictionary was used instead. Do kids even know words from a plain old dictionary?

Dictionary words?

I'm impressed that less than 4 percent were dictionary words

Considering only 10 percent of the words on myspace are dictionary words to begin with, this isn't very surprising.

Maybe the users just used their usernames as passwords - that would probably be the best way to generate a random sequence of characters.

Don't be impressed.

I'm impressed that less than 4 percent were dictionary words and that the great majority were at least alphanumeric.

I'm not. MySpace users have good passwords because MySpace requires them to, not because they're savvy. "Your password must contain at least one number and one punctuation mark," etc.

It's obvious!

Of course dictionary attacks won't work - have you seen the spelling on MySpace?!? It's not that they are trying to be more secure, it's that the users can't spell well enough to get a dictionary match.

Getoffamylawn!

Statistics from phishing attacks are wrong!

You can't compare the passwords from two different phishing attacks. You only get the passwords from people who fall for the scam. If one scam is easier to detect than the other one, then one sample will contain passwords from dumber people than the other sample.

The quality of passwords has nothing to do with the type of people that where scammed, but with the difficulty of detecting the spam.

MySpace requires strong passwords

The only reason MySpace users have stronger passwords is because they're required to. Try signing up to MySpace with a weak password (i.e. without numeric characters) and see what I mean. I signed up for MySpace for a throwaway account with an easy-to-remember password, but couldn't.

learning at age 6

Computer security is something that kids are learning at younger ages these days. Case in point: My 6-year-old daughter plays a flash game called clubpenguin.com, which is basically a MUD where you're a penguin and you go around playing video games, socializing with other penguins, taking care of your pet, etc. Yesterday at school, her friend asked her for her login info, and she gave it to her. Yesterday evening, my daughter finished her homework, tried to log on, and got a message saying she'd been banned for 24 hours for cussing, and the time when her penguin was cussing was a time when she hadn't been on the computer. No big deal, but at age 6, she's now had a concrete experience that shows her how it's not a good idea to give your password to someone else, even someone you think you can trust.

Re:why alphanumeric?

It depends on length and the character set.  Many cracking programs, brute force cracks, will iterate through all possible combinations of a character set up to a certain length.  This lets the program find simpler passwords faster.

With just alphabetic characters and a 6 character length you have about 26^6 or about 308 million possibilities

With alphanumeric characters and a 6 character length you have about 36^6 or about 2.1 billion possibilities

Extending to common non-alphanumeric characters (using shift+#) adds another 10, 46^6 or 9.4 billion possibilities

By comparison, changing the length of the previous examples:

Alpha: 26^7 = 8 billion
Alphanumeric: 36^7 = 78 billion
Extended with non-alphanumeric: 435 billion

So "crackability" as you dub it, is influenced heavily by the length of the password, but it is also greatly influenced by the character set used.

As for whether "adklfjsldfjsdf" is harder to crack than "adklf123dfjsdf".

"adklfjsldfjsdf" is 15 in length and alpha characters only (26^15)
"adklf123dfjsdf" is 15 in length and alphanumeric (36^15)

1,677,259,342,285,725,925,376 is less than 221,073,919,720,733,357,899,776

So the alphanumeric one is definitely more secure.