Forgot your password?
typodupeerror
Security IT

Multiword Passwords Secure Or Not? 372

Posted by Unknown Lamer
from the never-ending-passphrase dept.
Gaygirlie writes "An article over at Gizmag says: 'It's a meme that's been doing the rounds on the internet in recent years: multi-word pass-phrases are as secure as long strings of gibberish but with the added benefit of being easy to remember. But research from Cambridge University suggests that this may not be the case. Pass-phrases comprised of dictionary words may not be as vulnerable as individual passwords, but they may still succumb to dictionary attacks, the research finds.' I find this to be twisting of words and general consensus; of course any password whatsoever is going to be insecure against offline attack, and using common, popular words is going to make guessing the password much easier. But is this really an issue in a world where most attacks are done online? Should general populace still be coaxed into using randomly generated passwords?"
This discussion has been archived. No new comments can be posted.

Multiword Passwords Secure Or Not?

Comments Filter:
  • Obligatory xkcd (Score:5, Insightful)

    by kc9jud (1863822) on Wednesday March 14, 2012 @10:18AM (#39352067)
    • Re:Obligatory xkcd (Score:4, Interesting)

      by zero.kalvin (1231372) on Wednesday March 14, 2012 @10:23AM (#39352113)
      There is something that always bothered me, how in the hell does the attacker knows if I am using words for my password or not? Second consider the following password where at one point was on my laptop: "A happy worker is mindless worker, so shut up and do your job!" I fail to see how this password is not safe just because I used actual words, wouldn't it take million of years(even with dictionary attack) to gess it ?
      • by Anonymous Coward on Wednesday March 14, 2012 @10:28AM (#39352177)

        That's no match for my million monkeys with million type writers.

        We're upgrading to windows 3.11 later this year. You'll see. HAHAHAHAHAHAH

      • Re:Obligatory xkcd (Score:5, Informative)

        by Culture20 (968837) on Wednesday March 14, 2012 @10:39AM (#39352341)

        There is something that always bothered me, how in the hell does the attacker knows if I am using words for my password or not? Second consider the following password where at one point was on my laptop: "A happy worker is mindless worker, so shut up and do your job!" I fail to see how this password is not safe just because I used actual words, wouldn't it take million of years(even with dictionary attack) to gess it ?

        It's more secure than 5#f^x902 in almost every way, except that it's easier to shoulder-surf in one try because it's a proper sentence. As long as they catch enough parts, they can guess the rest. Try adding purposefully misspelled words or bad grammar and it makes shoulder surfing hu23 sekane in the despondingly overstitch. Side effects of using passphrases like that include speaking random gibberish on occasion.

        • Re:Obligatory xkcd (Score:5, Insightful)

          by isorox (205688) on Wednesday March 14, 2012 @12:03PM (#39353551) Homepage Journal

          It's more secure than 5#f^x902 in almost every way, except that it's easier to shoulder-surf in one try because it's a proper sentence.

          Chances are "5#f^x902" will be on a postit on the monitor

        • Re:Obligatory xkcd (Score:4, Interesting)

          by ArundelCastle (1581543) on Wednesday March 14, 2012 @12:20PM (#39353781)

          Try adding purposefully misspelled words or bad grammar and it makes shoulder surfing hu23 sekane in the despondingly overstitch. Side effects of using passphrases like that include speaking random gibberish on occasion.

          I think this is always the key point. Other than the usual 1337 to text substitutions, which are easily predictable, I have never seen or heard of a "typo dictionary" attack. At that point it diminishes to raw permutations unless you start scripting likely pairs of consonant and vowels, which would differ between languages no matter their character set (ie. Hawaiian vs. French). Even lolcat is a language of randomness, ackshuilly. ;)

      • Re:Obligatory xkcd (Score:5, Informative)

        by gstoddart (321705) on Wednesday March 14, 2012 @10:40AM (#39352353) Homepage

        There is something that always bothered me, how in the hell does the attacker knows if I am using words for my password or not?

        They don't, but if they have the resources for a brute-force search, it's moot since in theory they'll just keep trying until they find it.

        Second consider the following password where at one point was on my laptop: "A happy worker is mindless worker, so shut up and do your job!" I fail to see how this password is not safe just because I used actual words, wouldn't it take million of years(even with dictionary attack) to gess it ?

        Well, possibly not. Think about a document with a password.

        If someone really wants to get into it, and is willing to invest the time and hardware, having a computer try millions and millions of permutations isn't as expensive as you might think, and it gets cheaper every year.

        Many forms of crypto have fallen over the years as the speed of computers has allowed what used to be an impossible task to be something which can be done in relatively short time. Even a couple of days or weeks of compute time would represent an absolutely vast amount of attempts.

        It's a damned find pass-phrase, but a computer is really good at doing an endless set of boring things. So, eventually even if it's a massive brute force attack, it could still arrive at the one that worked.

        However, this is the most telling part:

        The researchers found that film and book titles were effective in identifying pass-phrases in use - information readily available in list-form online suitable for dictionary-style attacks. The researchers used Wikipedia and IMDB lists, as well as slang phrases from Urban Dictionary. Researchers found users tended to favor simple two-word phrases common in natural language, though there is evidence that some users seek out seemingly-random pairings. The researchers also claim that there are "rapidly diminishing returns" for longer pass-phrases containing three or four words.

        So, if movie names and slang is what many people are using as their pass-phrases, a dictionary attack is a little easier.

        But, something like "cotillion squirrel hammer bollocks gouda inkwell" might be random enough that the sources people might use to try a dictionary attack won't be of any help. Whereas "The Dark Knight" or "Star Wars" might fall pretty quickly.

        • by Ihmhi (1206036)

          Couldn't you fix this by adding an additional layer of password creation on your end?

          Say you have a simple encryption algorithm. Your password is "shpadoinkle". You type "shpadoinkle" into your crypto program, and it churns out a consistant phrase every time, say "g55yg546+6^4g5fjjk#6Y~t6SDg". Now you copy/paste that and use it as your password for a service.

          Thus you only have to remember a simpler password and the program used to encode it. Then you chuck that password into whatever you're trying to protec

          • by gstoddart (321705)

            Couldn't you fix this by adding an additional layer of password creation on your end?

            The more random your password, the less vulnerable it is to a dictionary attack, so yes.

            In this case, they're identifying that many people use multi-word pass phrases which might be more susceptible to a dictionary attack because they end up being fairly common.

            So, a truly random set of characters is likely to be impossible to remember, but really secure. But "Harry Potter and the philosopher's stone" might be fairly weak

            • Re:Obligatory xkcd (Score:4, Interesting)

              by Ihmhi (1206036) <i_have_mental_health_issues@yahoo.com> on Wednesday March 14, 2012 @02:41PM (#39355883)

              I had a customer who was in the military who was really concerned about his privacy. He had an ex-wife who was really vindictive and trying to get into his e-mail, Facebook, anything just to fuck with him. So he asked me for some advice on how to make a secure password that will stop casual attempts.

              ME: "Okay, you were a soldier, so you know NATO phonetics right? [wikipedia.org]"

              HIM: "Yeah..."

              ME: "What year were you born?"

              HIM: "1982."

              ME: "Give me the individual letters of 'apple' in NATO phonetics."

              HIM: "Alpha Papa Papa Lima Echo."

              ME: -writes down- "alpha1papa9papa8lima2echo". Here's your password. We're not going to use this, but when I finish unfucking your Windows registry I'll ask you again.

              ~1 hour later~

              ME: "So what was that password?"

              HIM: "Alpha one papa niner (lol) papa eig- holy shit, I remember it!"

              ME: "Right. Now do something similar, but create something I don't know about. I don't like to know my customer's passwords."

              Teach someone to use mnemonics and patterns and you can create something interesting and easy to remember. There's no reason the "random letters, numbers, etc." and "leetspeak" methodologies need to be mutually exclusive.

              I use a similar logic of patterns and the like for myself. My bank's website only allows letters and numbers for the password (and only up to 20 characters, lame) so I use a pattern on the keypad to remember it via muscle memory. (I "draw" a particular shape using the number keys in my head., and then some letters, and then some more numbers. My e-mail password is 30+ characters long. I have half a dozen pretty strong passwords floating around in my head and I'm not going to forget them anytime soon because I created a pattern that is personally easy for me to remember but cryptographically difficult to discern or break.

        • @lw@y$ U$3 Ch@r@ct3r R3pl@c3m3nt 1f Y0u U$3 R3@l W0rd$ 1n Y0ur P@$$phr@$3$ !!!

          I have passwords that look like that (minus the spaces). Break that with a dictionary! :p

          Seriously folks, if you use real words in a password in this day and age, you're a little bit more than naive or completely out of touch with what computers of the current generation are capable of. IMHO, you CANNOT use straight dictionary words (regardless of language, and yes, I do mean Klingon and Sindarin!) in your passwords without some s

          • Re:UGH! (Score:4, Insightful)

            by olliM (1239308) on Wednesday March 14, 2012 @11:59AM (#39353493)

            I'm not sure if you are being sarcastic or not... That's a terrible way to create passwords: the character replacements are easy to guess and the method is so common that they are going to be included in the dictionary.

            The point of using dictionary words in pass phrases is to think of them as letters of a password. A password with 8 random letters is much more secure than a random 8 letter word. Similarly 8 random words are much more secure than a random phrase with 8 words.

            • by AmiMoJo (196126)

              It works if you use completely random words, but phrases are little better than using single dictionary words. Rather than trying every word in the dictionary you just try every phrase in Google's corpus. The usual variation rules apply: capitals, letter/number substitution, first letters only, spaces or no spaces etc.

              Unless what you are protecting is worth throwing a large amount of energy into cracking your password a longish passphrase is probably fine. Any time there are a large number of other users th

          • >IMHO, you CANNOT use straight dictionary words (regardless of language, and yes, I do mean Klingon and Sindarin!) in your passwords without some sort of numeric or symbolic character replacement pattern.

            Of course you can. If they're selected randomly, an attacker has to use the complete source space for the random selection in a brute force attack.

            http://www.diceware.com/ [diceware.com] gives you 12.9 bits of entropy per word. Brute forcing that is already more trouble than it's worth at three words, and five would r

        • by afidel (530433)
          They don't, but if they have the resources for a brute-force search, it's moot since in theory they'll just keep trying until they find it.

          Except you can make a cipher practically impossible. AES256 is one such cipher, unless there is a significant breakthrough in cryptography a correct implementation of AES256 would require a perfect computer consuming all of the suns output longer to crack than the sun has life left.
          • by omglolbah (731566)

            Why would you use AES256 to generate a one-way-hash?.....

            Using AES256 for storing passwords means that if you have a breach and the hacker gets hold of the database and has access to the login code you have given the attacker all user passwords in plain text....... Not a good thing.

      • Re: (Score:2, Insightful)

        by Anonymous Coward

        Exactly. Even if they knew it was a string of words, there are 13 words there. So think of it like a 13 "character" password (generally pretty secure), except that instead of each "character" being picked from one of a set of (26+26+10+~20), each "character" is picked from a list of thousands of words. Even if you were to try applying linguistic details (like one particular word is likely to followed by a smaller set of words), it's still going to be more complex than a 13 character random password. And the

      • Re:Obligatory xkcd (Score:4, Informative)

        by second_coming (2014346) on Wednesday March 14, 2012 @10:56AM (#39352585)
        according to https://www.grc.com/haystack.htm [grc.com] that's one hell of a password :)
      • Re:Obligatory xkcd (Score:5, Interesting)

        by micheas (231635) on Wednesday March 14, 2012 @11:01AM (#39352667) Homepage Journal

        Pulling one example, I was asked to see if I could recover the password on pdf to allow editing. IIRC, the cypher was 256 bit AES. When trying to find the password to edit a pdf, my really ancient dual core athlon64 took under 2 minutes to try every unique word in the OED.

        The password of the pdf (which was sanfrancisco2) took me about 15 minutes to find using standard password dictionaries. Theoretically, a 13 character password with a number in it should take an insanely long time to crack, reality was well under an hour.

      • The proper way to mount a dictionary attack is to start with an example database of stolen/cracked passwords to generate a good statistical model for most passwords and then write a generator that will enumerate all possible passwords but in an order such that the password spaces containing the majority of passwords are enumerated first. This may mean running a pure dictionary attack in parallel with a grammar for generating short English-looking passphrases, and once that's complete shift to going back ov
    • Re:Obligatory xkcd (Score:4, Informative)

      by Jake73 (306340) on Wednesday March 14, 2012 @10:30AM (#39352219) Homepage

      Well, not exactly applicable but interesting to the discussion.

      I think the point is that consideration must be made for the "location" of the access portal. That is, if anyone with an internet connection can try their key in your lock, you probably want a pretty good lock.

      But for access to things that have additional security, the lock quality may be reduced in favor of a key that is easy to remember.

      1. Keep a good, long, easy-to-remember passphrase for access to your TrueCrypt partition that sits on a private computer inside your house.

      2. Store passwords inside this partition in something like KeePass. The KeePass password doesn't need to be industrial. It should be easy to remember, but non-obvious. You type this password a lot.

      3. Keep all internet passwords at maximum strength for the site and make them random from your password generator.

      • by Baloroth (2370816)

        The only problem with that system is it makes all of those sites unaccessible from literally any other computer in the world, unless you carry the KeePass file around with you.

        While probably not quite as secure, LastPass offers two-factor authentication using Google Authenticator, so even if someone keylogs my pass-phrase they still won't be able to get my passwords without also getting access to my Android device (which isn't a phone, so hacking it would be tricky too). Keep in mind unless you have enemies

        • by Jake73 (306340)

          The only problem with that system is it makes all of those sites unaccessible from literally any other computer in the world, unless you carry the KeePass file around with you.

          To a great extent, that's the point. My feeling is that my stuff should be inaccessible from any other computer in the world unless I trust that computer. And representative of my trust of that computer is that my TrueCrypt (and KeePass) files are on it.

    • Re:Obligatory xkcd (Score:5, Insightful)

      by thsths (31372) on Wednesday March 14, 2012 @10:54AM (#39352553)

      I agree - and I especially hate draconian password rules, especially when they are different for every site. Some need at least 8 letters, but then some limit you to 8 or 10 at most. Some want upper case and letters, other's don't. Some don't allow special characters such as '.

      And the worst part: if you have a system to generate cryptographically strong passwords, quite a few sites still reject them. The worst site that I would allowed only 12 characters, but required at least 2 digits, 2 special characters, and 2 upper case letters.

      I still think that words are the way to go. You just have to make sure that they are reasonably random and not too common. "honeyiamhome" is not going to be difficult to guess if you have billions of attempts. The problem of entropy still stands.

  • by Bender Unit 22 (216955) on Wednesday March 14, 2012 @10:21AM (#39352101) Journal

    I find that passwords like "Linuxrox4ever" are very secure. havn't had a problem with that one yet.

  • Its a Trade-Off (Score:3, Interesting)

    by Anonymous Coward on Wednesday March 14, 2012 @10:24AM (#39352125)

    Getting joe public to use something other than "password" is hard, but its easier to persuade Joe to use a phrase like "HomerLovesDonuts" than some random string of letters - we all know the random string will just get written down.

    • by trdrstv (986999)

      Getting joe public to use something other than "password" is hard, but its easier to persuade Joe to use a phrase like "HomerLovesDonuts" than some random string of letters - we all know the random string will just get written down.

      Yes, but you CAN make them simple to remember and VASTLY more difficult to crack if you put different emphasis on specific characters. HomerLOVESDonuts! - is a lot harder to crack as is encouraging them to swap out numbers for vowels even if it's just one. H0merL0vesD0nuts! - is a lot better.

  • by Shivetya (243324) on Wednesday March 14, 2012 @10:25AM (#39352141) Homepage Journal

    How many attempts are these supposed sites allowing? If someone has a one in a million chance to determine my password how much of a threat is that to me if the site that requires the password only allows a few attempts before it locks the account?

    I work on a system with ten character passwords, not case sensitive but numbers can be used, yet I don't worry about someone cracking the system. Its not like they are going to have unrestricted access to try and multiple failures lock accounts.

    I do like multiple word passwords as it tends to not lead to people using little yellow stickies near their desk to record their passwords or keep them as reminders in their email.

    • by Crasoose (1621969)
      I've been saying for a long time now if companies would just implement lockout policies we wouldn't have any of these issues.
      • by Culture20 (968837)
        If companies would implement lockout policies, they would have to pay a group of four-five people to answer phones and unlock accounts all day. And woe betide the company which gets its username list posted somewhere ("everyone's locked out, and an admin has to walk down to the server room to log into the console as root to unlock us all. We've blocked the offending IP addresses, but this might happen several more times from new IPs").
        • Can't you make the lock out temporarily?

          The goal should be to make brute force attacks too inefficient to be effective, not to annoy your users.

      • I've been saying for a long time now if companies would just implement lockout policies we wouldn't have any of these issues.

        It would help some (less annoying than a lockout policy is just to implement a delay that increases with number of failed attempts). However, the dictionary attacks that are worrisome come from a hacker stealing the password hash tables, and are done offline, trying to decrypt the hash, not simply repeated attempts to log in. These won't be prevented by lockout policies (although they will be prevented by making sure that the hash tables don't get stolen)

    • by Sycraft-fu (314770) on Wednesday March 14, 2012 @10:34AM (#39352283)

      They assume they get ideal circumstances, ie as many attempts as they want. As such their research is basically fucking worthless. The only time such a situation applies is if you have, say, encrypted data and an adversary has gotten that data. They can then try to decrypt it until the end of time and you can't change the password.

      That doesn't do shit for remote login. No system is so accommodating to let you just try and try. Even if they don't do permanent lockouts, they'll lock you out for awhile. Like our domain, you get 5 attempts and then it locks the account for 30 minutes. So you can get a whopping 240 attempts per day (presuming we don't notice and shut it down). Gonna take a LONG time to cover the password spaces they are talking about, LONG time.

      This also assumes that you know that someone is using a multi-word phrase, and that you know they aren't playing games with number substitution, caps, and so on. This is useful maybe in an intelligence agency type situation, where you can survey your target and you can learn about the kind of password they use, even if you can't find out the password itself, and restrict the search space. However in terms of randomly hacking things remotely, nope, not useful. There are too many possibilities for what the person could use and multi-word phrase is only one of them. You could try every single one of to 10 words, only to then discover your target doesn't use that, and has a simple password like password123 that wasn't in your search space.

      • You didn't read the FA. This research is testing the often-repeated claim that passphrases provide more security than passwords by looking at real data from a passphrase system. No one is claiming that this has anything to do with remote login, so you can forget that strawman. Your criticism about knowing whether someone uses a passphrase or not makes no sense either. The whole point of the research was to look at a database which was *already known* to consist of passphrases, and evaluate how much secur

      • by mlts (1038732) *

        What is bad is if password hashes are grabbed from a database, and in a number of cases, it becomes hard to tell if this happens, and if/when it does, there will be break-ins to accounts that are hard to trace, usually only when the legit account owner finds themselves locked out.

        Of course, there is a way to mitigate that... use database triggers/procedures to have the RDBMS do the password validating, and to start having timeouts/lockouts on too many wrong entries.

        As for remote login, one would be surpris

    • Re: (Score:3, Interesting)

      If someone has a one in a million chance to determine my password how much of a threat is that to me if the site that requires the password only allows a few attempts before it locks the account?

      When I see this implemented, it's usually like 3 attempts until lockout. Make it a few hundred. That's enough that a forgetful human has plenty of tries but a brute force attack will fail.

  • Poetry (Score:4, Funny)

    by bickerdyke (670000) on Wednesday March 14, 2012 @10:27AM (#39352163)

    Is Vogon poetry available in common attack-dictionaries?

    • by medv4380 (1604309)
      No, but Klingon is.
    • by drinkypoo (153816)

      While building your dictionary for passphrase analysis you have to be a pretty big asshole not to include the complete works of Douglas Adams. I would dump a big ebook collection through a filter which sorted, uniq'd, compiled, sorted, uniq'd until it was left with not just all the dictionary words that people actually use but also all the proper names and alien words that appear in all the typical universes with which people are familiar and entranced... Culture, Merchanter, Empire, etc etc. A wikipedia du

    • Re:Poetry (Score:5, Funny)

      by HCase (533294) on Wednesday March 14, 2012 @10:57AM (#39352617)

      There was a ship that tried using Vogon poetry for their password locks once. Unfortunately, after valiantly functioning for 3 weeks, the login daemon it decided it could no longer take it and convinced the ship's navigation system to fly into a nearby star. Further use of password verification system was banned several years later, after an intergalatic agreement was reach that said requiring people to remember Vogon poetry was cruel and inhumane.

  • by Dixie_Flatline (5077) <vincent.jan.goh@gmTIGERail.com minus cat> on Wednesday March 14, 2012 @10:28AM (#39352185) Homepage

    The passphrase system they studied wouldn't allow duplicate passphrases. So if you picked one that was already in use, it would tell you so.

    The problem isn't that the passphrase is insecure, the problem is that the system itself is giving you information about what's inside it. Doesn't it seem obvious that any security system that relies on secret data that gives up information about the secret data is insecure?

    Then they did an analysis on passphrases that use english words with the same frequency as in standard English. So the word 'betwixt' was probably pretty low down on the list, and 'material' was probably higher. That also seems unreasonable. Just because you want a memorable password/passphrase, it doesn't mean that you have to use small, ultra-common words.

    This study has little merit in declaring that passphrases are insecure. (It does have merit in letting us know that obvious security problems are, in fact, obvious security problems.)

    • by MaerD (954222)

      It's also worth pointing out that they suggest that common phrases like "Manchester United" or "Harry Potter" would be used quite a bit. Just because it's a passphrase doesn't mean you shouldn't still use a "common dictionary" (or in this case "Common Phrasebook") to prevent people from choosing things like the above, possibly with a length check of some sort involved as well, to prevent cases like "fee fai foh fum", which may not be caught by the common phrase check, but has all words of the same length.

      F

  • LastPass (Score:3, Informative)

    by alphax45 (675119) <(kyle.alfred) (at) (gmail.com)> on Wednesday March 14, 2012 @10:29AM (#39352199)
    I use and love LastPass. It has a really great password generator that I use for all sites. I always use the maximum number of characters and the largest character set (letters, numbers, symbols) the site will let me.

    My actual LastPass password (the single point of failure) is 32 characters long. It is a phrase in "leet" speak with symbols padding the start, middle, and end.

    I feel pretty safe with this.

    Just my 2c
    • Until someone order a DCMA takedown on the site because it's used to store passwords for certain accounts.
      • All user vaults are encrypted before being uploaded to the site, thus such issues are only a concern for those using weak passwords. Personally, I use a very long, very high entropy password to my vault. My only concern regarding the vault is a keylogger or video camera; the latter of which is actually my biggest fear, because someone wouldn't even have to see my screen to see that I'm obviously typing in a very long, high entropy string of characters.
    • by Zocalo (252965)
      Same approach here, although with a different password management tool. Unique passwords for everything, and all randomly generated to the maximum complexity allowed for the login in question, and I also expire and renew the passwords on a fairly regular basis for the accounts that matter to me. That seems like the most sensible approach given the recent occurances of compromised user login DBs (usually en clair, FFS) and subsequent account compromises because of password reuse.

      Let's face it, if some r
  • by MetalliQaZ (539913) on Wednesday March 14, 2012 @10:31AM (#39352233)

    As mentioned, a lot of stock is put into secure passwords, when the reality of computer usage makes all the effort meaningless.

    Lets look at a normal user, Joe. Joe has many corporate logins at his job. His company has a password strength policy, so Joe has ended up with this password: Jason5 (Jason is his youngest son). The last password was Jason4, then Jason3, etc. Some system require more powerful passwords, so he uses _Jason$5. I have met dozens of Joe's IRL.

    Lets look at Lucy. Lucy knows that a good password only has to be easy to remember and hard to brute force. "Simple Man" is one of her favorite songs. Especially these lyrics:

    "Boy, don't you worry you'll find yourself
    Follow your heart and nothing else
    And you can do this, oh baby, if you try
    All that I want for you my son is to be satisfied"

    She selects this password: allthatiwantforyoumysonistobesatisfied
    She'll never forget it, and I won't be cracked by ANYONE. Governments who want her password could crack it, but they would probably just put her in jail until she gave it up.

    Then, Lucy reads the article linked above and starts to doubt the security of her password. She is wrong, her password is WAY better than Joe's.

    Both accounts end up getting compromised. The company had been storing passwords in plain text and was hacked via a 2-year old SQL injection vuln. So much for all that bullcrap.

    -d

  • by mseeger (40923) on Wednesday March 14, 2012 @10:33AM (#39352265)

    Even if you have a very small set of words (about 1.000) to choose from, with four words you reach about 40 bits entropy. No chance to crack this brute force.

    If you take only two words, you would have about 20 bits of entropy which is about as good/bad as cryptic password.

  • by ghostdoc (1235612) on Wednesday March 14, 2012 @10:33AM (#39352267)

    The system is broken if people can't use it. People aren't broken because they can't use the system right.

    If your method of controlling access is nice and easy for computers but hard for people, it's broken and you need to find a new method.

  • The password that I use is "onetwothreefourfive". Is that secure enough?
  • Get 'em from /dev/urandom (or random if you feel like waiting).

  • My method (Score:5, Funny)

    by Anonymous Coward on Wednesday March 14, 2012 @10:40AM (#39352355)

    Fuck it I say. I just always use letmein for all my passwords. Easy to remember and so easy to hack into nobody's going to waste time thinking there's anything valuable protected by it.

    I call it security through insecurity.

  • by MobyDisk (75490) on Wednesday March 14, 2012 @10:40AM (#39352363) Homepage

    Based on my read of the article, I conclude it as saying that pass phrases really are good, just not a panacea. We already knew that people pick stupid passwords. It turns out that people pick stupid passphrases too. That's too bad, but it is really unsurprising.

    One thing I can say from personal experience: smart people still pick stupid passwords. I think most people just aren't paranoid about it, and don't care until something bad happens to them as a result. This might be something that parents need to teach their children: Don't talk to strangers, brush your teeth everyday, and don't pick obvious passwords. Maybe once a generation is imbued with this as obvious then the problem will diminish.

    • by thsths (31372)

      > Maybe once a generation is imbued with this as obvious then the problem will diminish.

      I doubt it. Passwords offer only moderate security. Apart from limited entropy they also suffer from a number of attacks ranging from guessing over imposters to listening on the line or MITM attacks.

      The real solution is two factor authentication, either with challenge response (like ssh keys) or with a code generator (like the RSA key). These offer more security than passwords ever could.

  • If you have a decent vocabulary, you can choose between about 10000 words. So, even against a dictionary attack, a password of 4 words is 53 bits strong, a password of 5 words is 66bits strong (strong enough for everyday use), and a password of 6 words is 79 bits strong (uncrackable today).

    • If you have a decent vocabulary, ...

      Most people don't choose their passwords from a decent vocabulary. I've seen too many instances of P@ssw0rd, that people think is secure.
      Throw some uncommon names and foreign words into your phrase, and it essentially becomes unguessable. But, many people don't know any foreign words.

  • "but they may still succumb to dictionary attacks, "

    If your system can do a dictionary attack on my 5 word phrase in three attempts, you deserve access to my accounts.

  • by OzPeter (195038) on Wednesday March 14, 2012 @10:44AM (#39352419)

    I have started using regex's as the basis for my passwords. Love to see some one crack ^[A-Z0-9]+\([a-z!]+\)$

    The trouble is that now I have regex's ..

  • by Maximum Prophet (716608) on Wednesday March 14, 2012 @10:45AM (#39352429)

    ... Amazon's PayPhrase registration page. Because the page prohibits the use of any pass-phrase that has been used by another user, it's possible to identify which pass-phrases are in use.

    This is a well known, bad idea. Unless you also lock out the original user of an obvious passphrase, you give an attacker information.

    Better is to just start with a dictionary of "bad" phrases, that no-one can use. Then, when an existing phrase is no longer in use, you mark it "bad" and unusable in the future. Of course, someone might start using that phrase berfore the rest stop using it. If it's an especially bad case, you might have to lock all those users, and make them reset their password through a different, secure, channel.

    Throw some uncommon names and foreign words into your phrase, and it essentially becomes unguessable.

  • So, as others have pointed out the only thing that matters is entropy. Entropy isn't just based on the number of characters, and that is true both of one-word and multi-word passwords. I'd probably say that "to be or not" is much lower entropy than "x8Jk$4B" - however, "bicycle tripod tissue diploma" is probably much higher entropy than "Wallets5".

    The key with multi-word passwords is that the words need to be unrelated. If the words are closely associated like "apple banana cherry date" then you are open

  • piffle (Score:3, Interesting)

    by koan (80826) on Wednesday March 14, 2012 @10:55AM (#39352573)

    Just hold down shift and type in your 10 digit phone number.

      (@)%%%!@#$

  • g0|d$U}{d'o'k3yB4|lz` = gold sux donkey balls

    This is easy to break?

  • All these secure password strategies just encourage people to write down their passwords and save them into the browser. Even pass phrases are hard to remember if you have to change them every three months on multiple accounts.

    Secure passwords can still be compromised by social engineering, a key logger or messing with the much needed password reset tool. Stop thinking about the problem one dimensionally.

  • Mix it (Score:4, Interesting)

    by Kjella (173770) on Wednesday March 14, 2012 @01:55PM (#39355199) Homepage

    My recommendation for a really secure pass phrase:

    1. Pick a phrase like "maryhadalittlelamb"
    2. Add (or replace) with one capital letter, one number, one special character. Don't use l33t-speak, just at random.
    3. Remember your three weird words like "maVry" "li6ttle" and "lam!b", it's much easier than when it's all just a hopeless mess.
    4. Your password is now "maVryhadali6ttlelam!b", there not a password cracker in the world that'll find this.

    It's way, way too long and uses from all the character sets for a brute force attack. As for a dictionary attack, there's way, way too many permutations. It could just as easily be "mar#yha1dalittlelRamb" or "m%aryhadalitOtlela9mb" or a million other combinations based on "maryhadalittlelamb", even if you knew that was the basis. Of course the biggest risk is the computer you're typing it into, for example I feel my mail is now much safer now that I can log into it from my smartphone rather from any random webcafe/desktop/laptop I happen to have available. It's a lot more difficult to get a spy app installed or bug my hardware than if I type it in on machines I don't control.

    If I remember correctly, this is how our university got breached once, they bugged a desktop in the computer lab, trashed the software a bit then waited for an admin to come and try cleaning things up with the admin password. Boom, they got admin rights to every desktop on the network. Against that it doesn't matter if your password is a kilometer long, if you can't trust the console it doesn't matter. It only matters if your data is stolen and they never got the password, which is of course one important vector with stolen laptops and all, but it doesn't protect against other threats. All in all I consider my password complexity as being a very low-risk threat. No point in a bullet proof blast door if a burglar would use the window.

  • by Eil (82413) on Wednesday March 14, 2012 @04:09PM (#39357065) Homepage Journal

    This line from the summary was written by someone who doesn't understand the slightest thing about modern encryption and password security:

    of course any password whatsoever is going to be insecure against offline attack

    Look up the concept of key stretching [wikipedia.org]. In a nutshell, you basically take a plaintext password and then apply many thousands of rounds of encryption or hashing to it and then store the end result in the password database. The idea is that you incur a few seconds of computation time every time the password is set or retrieved, which is a very minor inconvenience in normal use but is a humongous amount of overhead to brute forcing even a single account.

    With this technique, a dictionary attack on one account can take days to work through the whole set of words. So if you're using a dictionary word for your password, you're screwed no matter what. But a halfway-strong password that doesn't appear in any dictionary can be completely immune to an offline attack if the hashes were computed securely. The only way for an attacker to get around it would be to find some fatal flaw in the encryption or hashing algorithm. (In which case, the NSA would probably like to speak with him.)

The number of arguments is unimportant unless some of them are correct. -- Ralph Hartley

Working...