Strong Passwords Not As Good As You Think 553
Jamie noticed that Bruce Schneier wrote a piece on a paper on strong passwords that tells us that the old 'strong password' advice that many of us (myself included) regard as gospel might not be as true as we had hoped. They make things hard on users, but are useless against phishing and keyloggers. Everyone can change their password back to 'trustno1' now.
News at 11 (Score:5, Insightful)
If your computer is hacked than you're boned.
Seems to me that the solution is to have a strong password and keep your computer free of malware.
Is that really so hard?
And this is news how? (Score:5, Insightful)
Simple solution (Score:4, Insightful)
No problems there! [bbc.co.uk]
Throwing the baby out with the bathingwater? (Score:3, Insightful)
So because something that's good against brute-force attacks, but isn't against phishing and keyloggers, we should stop doing that? Phishing and keylogging are a result of strong passwords. So you need to implement adequate measures against those instead of saying strong passwords are useless.
If users have a hard time remembering their passwords, train them in it. Using phrases from which you take letters of which some are substituted with letters are very easy to remember for a user, yet very hard to bruteforce because you can make them quite long easily.
Re:News at 11 (Score:5, Insightful)
Yeah, this.
"Security" people who don't know anything about non-IT users like to make password rules that are so obtuse that normal users simply can't deal with them. The result is sticky noted passwords.
Users have to be able to remember their passwords in order for this security to be of any use. Push them beyond that ability, and you're actively making the situation worse.
Re:Throwing the baby out with the bathingwater? (Score:5, Insightful)
Exactly.
the old 'strong password' advice that many of us (myself included) regard as gospel might not be as true as we had hoped. They make things hard on users, but are useless against phishing and keyloggers.
It's like saying that the locks on our doors aren't good enough anymore because people are breaking into our windows -- so we should stop locking our doors? Doesn't make sense either.
Sounds dumb to me (Score:3, Insightful)
But maybe it's just the summary? I'll go RTFA right after this, or at least skim it. But since phishing and keyloggers are only two threats, and people can still guess passwords (or brute-force them) I think I'll keep using randomly generated passwords.
"Wrote a piece" apparently means "wrote a sentence" because all Bruce said about the paper is that it was "Interesting", then he C&P'd the abstract. Why not link directly?
Okay, I read the first page of the paper and they say you only need about 20 bits of password so long as there is a three strikes policy in place. However, this ignores the type of attack where a remote hole allows retrieval of a file, and that hole is used to retrieve the password list. There are also other attacks which would allow one to get ahold of your encrypted password, not least by sniffing, which can then be brute-forced without having to worry about three-strikes policies.
In other words, keep your complicated passwords, they are still necessary to defeat dictionary attacks. Security is not something you can buy in the store, it is a mindset that you must adopt. The more factors of security, the better. If you can't memorize a complex password after using it twenty or thirty times, you should start playing memory games or something. Even I can do that and my memory is poor enough to be a liability (and always has been since childhood.) We're all different and excel in different ways, but you owe it to yourself to sharpen certain skills.
I guess the bottom line is that I'd be concerned about employing someone who can't remember a password. You write it down until you memorize it, you treat that piece of paper as precious and secret, you burn it and scatter the ashes (or eat it, or whatever) when you no longer need it. It shouldn't be that difficult for a modern human who can understand how to operate a computer.
limited application (Score:4, Insightful)
In particular many *NIX environments still don't natively allow spaces in passwords, so that approach would fail there.
Re:News at 11 (Score:5, Insightful)
So write it down and put it in your wallet with your credit card.
Unless - of course - you routinely tack your credit card to your cubicle wall. No? Didn't think so.
Now if only people would take this into account... (Score:5, Insightful)
I signed up for a forum a couple of weeks ago. I used the same generic password that I use for every other throw-away site out there, so it's easy to remember the damn thing. When I clicked submit, I got an error message telling me that my password needs a number in it. So I append a '1' on the end to satisfy the filter, and click submit again. I get *another* error message telling me that it needs to be mixed case, so I capitalized the first letter. Now I'll forget the password and never be able to guess the damn thing again, so the next time I want to log in to whatever forum this was, I'll need it to send me an email with a reminder.
It would be really nice if they'd just turn those damn filters off. This forum site isn't a bank. I couldn't give two shits if someone hacks my account there, not that my regular password is particularly guessable anyway. Seriously, I my password to your dipshit forum shouldn't have to contain mixed case, three numbers, nine punctuation marks, Egyptian fucking hieroglyphs, and that goddamn symbol the artist formerly known as Prince uses. Failing that, it would be nice if they at least provided some instructions with the password box that say something to the point of "Capitalize the first letter of your generic password and append a 1."
[/rant]
Re:News at 11 (Score:4, Insightful)
This gets especially problematic when the janitorial staff comes through one night and decides all those pesky post-its (and, indeed, most every paper/seeming clutter on every desk) needs to get cleaned up and thrown out.
Really happened where I worked, once.
But just once.
Re:Throwing the baby out with the bathingwater? (Score:4, Insightful)
It's more like pointing out that a $25 lock is probably sufficient for a house with 25 glass windows (as opposed to a $100 lock).
Re:News at 11 (Score:5, Insightful)
Do you have to enter your credit card number every time you want to access your computer? No? Well that's why it's in your wallet and not more easily accessible.
Best Practices (Score:5, Insightful)
According to the article (cited by the citation):"Users are frequently reminded of the risks: the popular press often reports on the dangers of ïnancial fraud and identity theft, and most ïnancial institutions have security sections on their web-sites which oïer advice on detecting fraud and good password practices. As to password practices traditionally users have been advised to . . . "
-Choose strong passwords
-Change their passwords frequently
-Never write their passwords down
I would suggest that this is a case for the popular quip: "Pick two".
Re:News at 11 (Score:5, Insightful)
Another problem with password rules that rotate too fast and have too many rules is that you end up with many users who are locked out of their accounts. I imagine if the helpless desk gets 100 requests a day to reset account passwords then after a while they become less careful to ensure that the person requesting a password reset is actually the person that owns the account. Personally the more stupid password rules I encounter the more likely I am to try to come up with a password that is easy to guess (since I will be the one guessing the password in a little while.)
Re:News at 11 (Score:5, Insightful)
Agreed, but what I find even more mind numbing is the places that require you to have a password that is between 6 to 10 characters in length (6 for a "strong" password and 10 because their system can't handle passwords any bigger) and must have at least two numbers in them as well as one upper case or some such. If the person/group trying to crack your system know about these requirements (which isn't hard to find out if you plaster it on the logon screen) it greatly reduces the number of permutations they even have to try. You have basically handed them a filter and said Don't bother looking for anything that doesn't contain the following.....
Re:Simple solution (Score:4, Insightful)
We should have biometrics, passwords, and proximity smartcards.
Re:News at 11 (Score:4, Insightful)
Re:News at 11 (Score:3, Insightful)
Do you remember your mother's birthday? Your anniversary? Who won the last 5 World Series? The name of the first girl you had a crush on? What I'd mean if I were to say "Ni!" to an old woman? While you might not know all of them (I have no clue who won the most recent World Series, nor do I care), I'm sure you know all sorts of similarly esoteric information.
People can remember all sorts of information, if it is important enough to them. People look at passwords as inconveniences at best.
If you can't manage to remember one new chunk of information every 6 months, seems to me you're woefully over-employed. Perhaps you'd remember better if your boss would walk around and fire everyone with passwords on sticky notes.
Having said that, I did read the paper, and I agree with the conclusion the author makes: long, complex passwords only work to deter offline brute-force attacks and, to some extent, shoulder surfing. Both of these attacks are not likely these days. It is time for those of us in the computer security field (and yes, I am one of them) to take a hard look at our treasured "standards" and make sure that they still apply. I've already started discussions with my management with an eye towards implementing some of the recommendations. To be honest, I doubt management will agree to lower the password complexity rules since a) they haven't read the paper, and b) neither have the auditors, but I want to get the conversation started so we can do the other things (improve analysis of the log files).
Multiple Systems (Score:3, Insightful)
Re:News at 11 (Score:2, Insightful)
Re:News at 11 (Score:4, Insightful)
Strawmen. Those data points don't change every six months to something relatively arbitrary. Even the last world series question (the only one of your questions which EVER changes) has a very finite set of possible correct answers. Even more problematic, the many different systems with passwords usually have different schedules on which passwords need to be changed, and different ways of defining "strong" passwords, so you can't use the same "strong" password across multiple systems. I don't have post-its for my passwords, but the only way I've been able to escape that is by coming up with a system for my passwords which allows me to make minor, memorable variations each time I have to change one of my passwords. If it were just one password, well, okay, but voicemail and multiple system logins each with different password requirements and change-schedules? Some of which I only use intermittently? I'm sorry, but at some point these requirements become completely counterproductive.
Re:News at 11 (Score:5, Insightful)
If one assumes that the users are lazy and will only do the bare minimum that would mean (in order): 1 upper case letter, 3 lower case letters and 2 numbers. This would translate to 26 ^ 4 * 10 ^ 2 = 45697600 permutations. That wouldn't be very hard to crack. And that is without using dictionaries!
Anonymous Coward (Score:2, Insightful)
There's a bigger problem that I've yet to see written about and that's the shared username/password issue. I have at least 2 dozen different accounts, if you include Amazon, EBay, credit cards, bank account, youtube, blog/forums, etc.There's no way that I'm going to use different user names for each of them.
And of course, I'm going going to use the same passwords for the accounts as well. While I'm not too worried about using the same username + password for both Amazon and Ebay, what if I have the same password for MyFavoriteBlog.com. A single nefarious employee at a large blogging/forum site has access to many username/password combinations. What's to stop that user from trying those username/password combinations through eBay, every major bank, every major credit card, etc?
In truth, I user different user names for more "secure" sites like Amazon and banks than I do for ones that I don't trust, but I'll bet that most people don't bother.
Re:News at 11 (Score:3, Insightful)
Directly related item [thedailywtf.com] on The Daily WTF [thedailywtf.com].
The more fine-grained the requirements you can punch into your brute forcer, the faster the hash goes down...
--- Mr. DOS
threat model (Score:4, Insightful)
As all things in security, it's not black and white.
What exactly does "strong" mean? That's the important password.
In most circumstances, your threat model why you need a "strong" password is password guessing. It is rarely an actual brute-force attack, because most systems these days prevent a brute-force attack (e.g. they lock you out or reset your password to a random one that they send you per mail if you try it more than X times).
If your threat model does not include brute-force attacks, what you need is a "difficult to guess" password. That means you don't use "password" or "secret" and you don't use your own name, the name of your significant other or dog, your birthday and so on.
And that's all there is to it, really. All the bullshit about using numbers, special characters, etc. is just that - bullshit. It's defense against a threat that's not important anymore.
IANAL, but I am a security professional. Most of my passwords contain no numbers, and where the systems enforce them, there's usually a single number at the end or beginning. But I can type all my passwords in about a second on a standard keyboard. That makes shoulder-surfing a lot more difficult. In fact, I can make fairly good guesses at most "hunt and peck" people's passwords when I watch them type it in from across a small room. And the more difficult it is, the longer it takes them to type it in, and the easier it is for me to spot it.
So it all depends on your threat model, as always. Know what you need to defend against, and you'll have a pretty good idea of how you need to defend.
Re:News at 11 (Score:3, Insightful)
This month's password is: July2009. It has numbers and capitals. Great!
Next month's password will be: August2009. It has numbers and capitals. Great!
Don't be scared of the rules man. They are there to help you
Re:HEY! (Score:3, Insightful)
Keepass only works so well if you have a keylogger AND configure it properly. If you have a trojan + keylogger where they can log the entry and download the file, the whole concept is moot.
figure out your password + copy your credential + copy your keepass file? It's not like keepass originated yesterday.
There is no perfect solution. There are "best practices" and thats about the best an average person can hope for.
Re:Throwing the baby out with the bathingwater? (Score:4, Insightful)
It's like saying that the locks on our doors aren't good enough anymore because people are breaking into our windows -- so we should stop locking our doors?
More along the lines of: there ain't no sense in fitting a steel door if you live in a tent.
The main purpose of most door locks is not to stop determined people getting in at all, but to ensure that they have to break something in order to do so and can't claim some innocent excuse.
Its probably better to regard most user-level, non-banking passwords in much the same way, and concentrate on protecting the really sensitive stuff.
Also, apart from the "long passwords encourage writing down" issue, long passwords + frequent forced changes = more forgotten passwords = more demands on support staff to reset passwords = less scrutiny of reset requests.
Some things to note (Score:1, Insightful)
1. "But the worst possible password constraint I can think of is limiting the maximum number of allowed characters." There is a maximum because some backend systems can't handle a password longer than that.
2. Always set the maximum number of attempts allowed: 3 or 5, depending on how smart/dumb your user base is.
3. Use Self Service Tools. Have a user answer security questions (At least 3 different ones). So when they forget their password, they can log into a system themselves to change their password (Using a secure kiosk or guest account, with access only to the self service tool).
4. Leverage single sign on technologies. Having 10 different applications with potentially 10 different passwords causes people to write the password own on sticky notes (Or on a excel spreadsheet). Using SSO mitigates that.
5. Force password changes frequently. Every 3 months, I would suggest.
6. Not allow users to use their previous 6 passwords at least and make sure that at least 2 characters are different between passwords. So they can't just go from Password1 to Password2.
It's not a fool proof solution, but that combination of rules I have seen work the best at corporations.
Re:News at 11 (Score:5, Insightful)
There are just some things that we all have to do, even if they are "hard." So may I suggest that instead of complaining that passwords are too hard to remember, perhaps you could try using a couple of tools. 1. Use something like password safe for all those "useless" passwords. You know, the ones for Yahoo, Google, Slashdot, etc
Spoken like an ivory-tower admin with people skills worse than an angry badger. Some problems with that attitude:
1. While you think your system is special, it's not to us. Yours is one of many systems for which we have to remember passwords.
2. Systems that require such moronically complex passwords also require them to be changed. They also use slightly different rules so that passwords can't be exactly re-used. End result is that I've got about 40 passwords or their variants in recent use. No way I'm remembering that, and I'm smart. You can forget about the secretary.
3. Admins that set up such systems generally forbid the use of password keychains.
End result? At work, I have to remember passwords for about 8-10 systems, all with different rules and password expiration schedules. Naturally, each will lock you out after 3 tries. So what I generally have to do is, each time I've gone more than a week without using a particular system, I get the IT guy to reset the password. Only because I'm one of the good guys, I don't write them down. But I've been sorely tempted.
You can either learn to work with people, or you can keep making unusable edicts that make it impossible for people to follow them. Just know that once you cross the "sticky note" threshold - and you appear to be well over it - your system is far more easily compromised than if you had implemented a sensible security policy in the first place.
What admins usually forget is that security is inherently practical, not theoretical. Hackers will always focus on the weakest part of any secure system, not the strongest. Making it take 100 days instead of 10 to crack a password file doesn't accomplish anything, because they'll move on to another exploit. All you'll do is piss off your users and make it a lot more likely that passwords get written down. As Mitnick showed, the weakest link is usually human, and your approach makes that link far weaker.
you know (Score:3, Insightful)
My bank password? Yes, that should be strong. The forum where I go for auto repair advice? No, I shouldn't have to memorize an 8 character password with at least one upper case, one number, and one symbol character.
Re:Dict' attack is sooooo 2000 (Score:3, Insightful)
Re:Throwing the baby out with the bathingwater? (Score:3, Insightful)
If you have to break your own windows to get in about once a month - because your ridiculously complicated lock keeps locking you out - and it takes a week to replace those windows - then you probably need a simpler/less 'secure' lock. You might even be better off without a lock....
T
Re:Now if only people would take this into account (Score:3, Insightful)
T
Re:News at 11 (Score:3, Insightful)
For one, changing passwords do not improve security. At best, they limit the time when a system is compromised, but almost never improve the security (the only exception is if someone managed to get a hold of an encrypted password file and it takes 7 months to crack a 6 month rotation, but that takes an already compromised system to get that, so you've already been hacked). So, aside from the uselessness of that policy, it is a problem to learn a new word every 6 months. For one, people rarely have just one password, so it isn't just one. For another, as people age, they will have memories of passwords past. They will either do as I do password1 followed by password2 with a post-it up with just a number on it to remind me which version I'm on, or they will end up with "blocking" happening. That's where you can't remember which password you recall when you think about your password is the current one, and which is the time before, or for that other system, or such. There is no fix to that, it's the way the brain works. When people code systems with no thought to how the users themselves work, you will end up with a crap system. And that's what you are defending, a useless policy that results in a crap system and compromised passwords.
Re:News at 11 (Score:1, Insightful)
Ever time you use your card online you have to punch it in.
Every time you want to unlock your front door, you take your keys out of your pocket.
Every time you go into your car, you take your keys out of your pocket.
Do you notice a theme yet? Most people, at home, generally secure items that are important to them, so someone from the general public will not be able to just walk off with your stuff.
Your employer is PAYING you to secure what is valuable to them. A cubicle, is more or less a public area.
Re:News at 11 (Score:3, Insightful)
The Security Analyst can care less if you can remember your passwords or not. The real issue is whose fault it's going to be when the system does get compromised. I can tell you right now, it's not going to be the SA. Its all you, the end user! You can fight the good fight for admins and end users, but in the end, SA can care less if you have you password on a sticky note on your monitor. They have covered their ass, and when all your business gets owned. They are going to point their finger right at you. They will keep their job... You wont.
That's all fun and games until the person who wrote the password on the sticky note outranks the admin. And believe me, executives are the worst about that sort of thing.
Re:HEY! (Score:3, Insightful)
Keepass will work fine and dandy until enough people are using it where it's worth exploiting. The targets of most of this stuff aren't individual users. They're the broad audience, which a percentage will do a compromising activity.
I'll admit, I once worked for a company who sent spam. This was before the days of it's evilness, and laws, and ... well, what it's become.
The general thought at the time was, for every 100 emails sent out, there would be approximately 3 paying customers. Those were targeted towards previous account holders, which still is in the gray areas of legal. Even though the customer base continued to grow through this method, but more of affiliate marketing, the returns on sending the notices dwindled as spam became a bigger problem. 3% became 1%. We never sent any more mailings after the conversion rate dropped to something like 0.02%. I spoke with someone later (probably about 7 years ago) who was still in that business. He said no matter what the product was, the conversion rate was down to 0.0003%. That business folded from ISP pressures, and they went into the business of handling mailing list transfers. They acted as the neutral intermediary, to ensure both parties would be satisfied with the transaction. That dried up as the conversion rates dropped down below 0.0001%. Who wants to send 1 million emails, to make a single $29.95 sale? Well, they still try, or our spam boxes would be empty.
The same will happen with this market. As users become smarter or have better technology protecting them, the market will dry up. But in our current state, key loggers grabbing passwords, bank info, etc, is a lucrative business. I am very happy to say that I have never, nor ever will, be involved in that line of work. It's one thing to market and sell something. It's another to blatantly steal from an oblivious user.
How will this market dry up? It won't be better antivirus/antispyware applications. Those are just chasing the problem. How was a big dent put into the spam industry? Innovation and education. You can ask even the barely computer literate "Should you buy something from an email that someone you don't know sent you?". The majority of answers will be "No".
Such malware isn't quite as in your face, and masquerades itself quite gracefully. If it's a well written piece, you'd never know it was there. Fortunately, most of them aren't as well written as they should be.
Re:News at 11 (Score:3, Insightful)
For companies that don't allow simple incrementing of the password at each change, but rather require almost every character to be changed, I would suggest using a hash function to create a seemingly random but easily regenerated password. For example on Ubuntu the following command will give an easily reproducible password:
echo -n "LongUnchangingBasePasswordSiteNameJan2009" | sha512sum | xxd -r -p | tr -cd [:print:]
Just changing the month will give an entirely different password. Such a password will be dictionary and brute force proof unless the hacker knows this little generator scheme. And even if the hacker knows this scheme, using an easy to remember but long enough base password, will keep it dictionary and brute force proof. Even if someone knows that your little generator scheme increments the date, they still won't be able to predict next month's password by shoulder surfing this month's password. Unfortunately this may leave an unencrypted record of your password in your command or standard output log, which may also get copied to backup machines. Under windows these command line tools may not be available, so it may be necessary to create a small javascript program or something with similar functionality. That might also keep this input and output out of your logs. This might also be good for creating a completely different but easily reproducible password for every web site you log into, and prevent a hacker who obtains the web site's password file from brute forcing the site's hash of your password and getting your password to use on other sites.