DARPA Wants To Get Rid of Password Protection 205
coondoggie writes "Researchers from the Defense Advanced Research Projects Agency will next week detail a new program it hopes will develop technology to dramatically change computer system security authorization. The program, called Active Authentication, looks to develop technology that goes way beyond today's use of hard to remember password protection and determine identity through 'use of software applications that can determine identity through the activities the user normally performs,' DARPA said."
Re:Obligatory XKCD (Score:3, Informative)
Even assuming you only use the 3000 most common words in the English language, 4 words gives you close the the same number of possibilities as an alphanumeric password of 9 characters.
Re:Obligatory XKCD (Score:3, Informative)
Re:Obligatory XKCD (Score:5, Informative)
now, as to why i don't disagree, let me first define a premise. the password is being attacked via a brute force attack. there are no rainbow tables in use or exploiting of the encryption algorithm. a dictionary can and will (as you'll see later on) be used. now, let me recalculate the passwords in terms of possible password permutations. i don't know how to calculate it with bits of entropy and even if i did, it'd be really confusing to understand.
with a 24 character length password from a set of 26 characters, the number of possible passwords is 26^24 or 9.1 x 10^33. for a password that is 11 characters in length from a 96 character set, its 96^11 or 6.4 x 10^21. again, the plaintext password is stronger.
now here's where my criticism comes in... when you reduce the password to using only english words, you exclude from the set of possible passwords words like "sdfjae" or "fjwioxe". in other words, its no longer completely random. in fact, i believe you so significantly reduce the entropy space that it is now much weaker than the random character password.
lets take for instance a 5 character length password. given all available password combinations, that would yield us the set of possible passwords that is 26^5 or 11, 881, 376. now using the dictionary at http://www.wordbyletter.com/words_by_length.php [wordbyletter.com], i used a script to pull all the 5 letter words and count how many there were. that yielded us 9755 words. of course, its possible the word list at that site isn't complete and once you start increasing the character length, the number of word combinations will increase.
i'm not going to try to calculate the possible number of permutations of a 24 character english word password but its definitely significantly less than the 112 bits of entropy we calculated earlier. is it less than the 72 bits for the ascii character set? i don't know. but maybe someone smarter than me can go tell us that one.
therefore, this allows us to use a brute force attack that doesn't attempt every character but rather, every possible word in the english dictionary. it should also be noted that most of the words in the english dictionary are extremely rare and usually unheard of. my point in this wasn't conclusively disprove the artists rendition. rather, i just wanted to draw doubt and show that there might afterall be a reason why we don't use extremely long passwords of words we commonly use.
Re:Obligatory XKCD (Score:5, Informative)
That's the whole point. Using "correct horse battery staple" is stronger in the real world because people can pick random common words, have a decently high level of entropy, but still remember the passphrase. As opposed to using "Pa$$word1" to meet the complexity requirements with something they can remember and then seeing it get cracked in fifteen seconds.
Plus, if you need more entropy, you can obviously just use more words. If you use something like "frozen biology department literally conducts every experiment after august but before march" then you have something with more entropy than you can crack in any practical amount of time even with offline methods (and even including the fact that it has grammatical ordering which reduces entropy some), but any idiot can memorize it in short order.
Re:Obligatory XKCD (Score:5, Informative)
i'm not sure i completely agree with that. for one thing, he calculates entropy wrong. according to wikipedia, the set of all ascci characters has an entropy of 6.5446 bits per character. given an 11 character password, thats ~72 bits. a 26 letter character set has an entropy of 4.7004 bits per character with 24 letters, that gives the password 112 bits. that doesn't make my case for why i disagree, just showing that he calculated entropy wrong. i actually don't even know how he came up with those numbers.
People understanding things in this way is exactly why everyone chooses bad passwords. His point is that if everyone has passwords like Tr0ub4dor&3, password guessers won't guess random printable ASCII characters, they'll guess a word and then try some substitutions on it.
So 'Troubador' can be guessed with a dictionary attack, which is why the word only gets about 16 bits of entropy (that puts it in the top 64000 most common words in English). There is additional entropy added by the substitutions but substituting '0' for 'o' is much easier to guess than changing the 'o' to a random character.
i'm not going to try to calculate the possible number of permutations of a 24 character english word password but its definitely significantly less than the 112 bits of entropy we calculated earlier. is it less than the 72 bits for the ascii character set? i don't know. but maybe someone smarter than me can go tell us that one.
And again, since an attacker would be using a dictionary attack, the correct way to calculate entropy is per word, not per character. The xkcd calculates 11 bits of entropy per common word which suggests these words are in the top 2^11=2048 most common words which seems reasonable (a quick glance at wikipedia suggests around 80% of the words in written texts are built from the most common 2000 words). So we get 44 bits of entropy. Obviously less than 72 bits but how many people are really going to create a completely random alpha-numeric-punctutation string of 11 characters (not built from a word or pattern)?
Re:Obligatory XKCD (Score:5, Informative)
now here's where my criticism comes in... when you reduce the password to using only english words, you exclude from the set of possible passwords words like "sdfjae" or "fjwioxe". in other words, its no longer completely random. in fact, i believe you so significantly reduce the entropy space that it is now much weaker than the random character password.
Of course you reduce the amount of entropy, per character. The point is to use more characters in order to make the password have the same level of security while being easier to remember.
The example four English word password "correct horse battery staple" has 28 characters. It has about the same amount of entropy as a 7 character password that randomly uses any of the slightly less than 100 characters you can type on a keyboard. A 28 character random password has preposterously more entropy. But it looks like this: "#1-:';Gqz_UR]l~g607PM_/v@/e6". That's utterly useless because the user will never remember it so it ends up on a sticky note on the user's monitor. Even the 7 character random password ends up on the sticky note. The four English word password gets memorized and not written on anything.