Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror
Security

Selectively Reusing Bad Passwords Is Not a Bad Idea, Researchers Say 280

Posted by Unknown Lamer
from the brain-full-try-again-later dept.
An anonymous reader tipped us to news that Microsoft researchers have determined that reuse of the same password for low security services is safer than generating a unique password for each service. Quoting El Reg: Redmond researchers Dinei Florencio and Cormac Herley, together with Paul C. van Oorschot of Carleton University, Canada ... argue that password reuse on low risk websites is necessary in order for users to be able to remember unique and high entropy codes chosen for important sites. Users should therefore slap the same simple passwords across free websites that don't hold important information and save the tough and unique ones for banking websites and other repositories of high-value information. "The rapid decline of [password complexity as recall difficulty] increases suggests that, far from being unallowable, password re-use is a necessary and sensible tool in managing a portfolio," the trio wrote. "Re-use appears unavoidable if [complexity] must remain above some minimum and effort below some maximum." Not only do they recommend reusing passwords, but reusing bad passwords for low risks sites to minimize recall difficulty.
This discussion has been archived. No new comments can be posted.

Selectively Reusing Bad Passwords Is Not a Bad Idea, Researchers Say

Comments Filter:
  • by medv4380 (1604309) on Wednesday July 16, 2014 @10:02AM (#47466737)
    The advocacy for Password Managers and Password Keepers is just utter BS. If some nothing website insists that I have to make an account just to post one little comment, and I might come back 5 years later to post again then they're getting generic username plus generic password. I'm not waisting my time making some uber powerful password, and utilizing something just to remember it. Even then the OpenID solution would have been great but every once in a while I'm presented with the option of logging in with my Google ID and giving some organization full access to my contact list, or full access to my google drive. Screw them, and I'll just create generic account just for their site though their old interface just so they can't read my contacts or documents. If they're so worried that people are using BS passwords on their site that spammers keep hacking to post then maybe they should accept better business practices.
  • by erice (13380) on Wednesday July 16, 2014 @10:10AM (#47466825) Homepage

    This is why it is infrurriating when low importance sites require high complexity passwords. They create unnecessary exposure for the limited pool of high complexity passwords I can remember. Meanwhile, the bank will take anything.

  • HAHA WUT? (Score:3, Interesting)

    by bmo (77928) on Wednesday July 16, 2014 @10:15AM (#47466877)

    Microsoft researchers have determined that reuse of the same password for low security services is safer than generating a unique password for each service.

    This has to be a fucking joke. It has to be. bmo looks at calendar. Huh, it's not April 1.

    And what, exactly, is a "low security service?" The only "low security service" I can possibly think of is stuff like Mailinator where you don't even use a password.

    Remember when the entire Youporn chat login credentials file was leaked? You know, the one with real names, aliases, emails, and passwords in cleartext? Remember? Nearly every single password was usable on Facebook and the same password was reused in email.

    People had fun with that. I was in /g/ when it happened. I laughed at the results.

    Yahoo lost control of my fucking credentials twice showing logins from Romania and Sweden. I no longer use Yahoo Mail as a result, except as a throw-away, and the last time pushed me over the edge into using a password manager that holds -unique to every site- passwords that I can't even remember myself at 25 characters of complete ASCII gibberish. And you know what? It's easier on top of being more secure.

    Lose control over your login credentials at one place, and the rest is vulnerable if you recycle them elsewhere. Password re-use over multiple sites is fucking bad. Anecdotes aren't data but I don't care about your calculations because my reality trumps your poorly researched paper.

    --
    BMO

  • Re:Bah (Score:5, Interesting)

    by TheCarp (96830) <sjc AT carpanet DOT net> on Wednesday July 16, 2014 @10:18AM (#47466903) Homepage

    I have to say, I REALLY like password manager someone was working on that was based on, I think, a rasberry pi, where it would actually act as a USB HID to enter the password, and keeps your encrypted passwords on its physical hardware device.

    Still susceptable to keyloggers and other malware but...1) they can only get the passwords as you use them and 2) they will NEVER see your master password since it never even gets entered into the machine, but only to the password keeper device.

    Now THAT is how to do passwords right.

  • Re:This makes sense. (Score:5, Interesting)

    by Anonymous Coward on Wednesday July 16, 2014 @10:18AM (#47466905)

    The point of password reuse is to use an algorithm that you can remember but not someone can guess.

    This is not my password but it's an example of how I create one:
    If I visit a site and it's name is GoogleSucks.com, I will use my "easy" word + the first syllable of the site + a padding word that I use on all sites, Depending on how asinine the password requirements are, the beginning or end of the password will be padded with numbers and symbols, but always the same ones.
    So Googlesucks.com might be turkeyGootrucking8
    and another site like a bank site that I want higher entrophy on will use a different algorithm, so BOA might end up a hard non-englisht word + the passing word, then the company's initials + needed password entrophy, so BOA would end up with namastetruckingBOA8

    So when I use sites that want to remember my shipping address or credit card (I never save my credit card number, I don't care how "safe" your site is) I use the harder credentials. I just want to post a comment on the many HuffPo type of sites, easy password all the time. So while each password for each site is unique, effectively the easy password is reused but padded with something unique to the site so that even if the password was stolen it's unusable for any other site.

  • Re:This makes sense. (Score:5, Interesting)

    by vtcodger (957785) on Wednesday July 16, 2014 @10:34AM (#47467081)

    My intuition says that most people do this. Though, I could be wrong.

    Well, some of us try to do it. We are, regrettably, impeded by whacked out sysadmins who insist we must use THEIR idea of a strong password -- which always seems to be different from anyone else's idea of a strong password, and/or that we need to change passwords periodically, and/or that we can't reuse passwords.

    I sometimes seems that there is an inverse relationship between the actual need for security and the system administrator's perception of the need for security.

    But other than the fact that users often have to contend with the idosyncracies of sociopaths who feel that anything that is easy to use is clearly flawed, this seems a pretty good idea. If it gets the attention it deserves, perhaps it might be one small first step toward straightening out the incredible mess that is computer security.

  • Re:This makes sense. (Score:5, Interesting)

    by knarfling (735361) on Wednesday July 16, 2014 @11:26AM (#47467541) Journal

    I see that someone has had problems with a sysadmin.

    Try to remember that not all sysadmins are BOFH. Some actually agree with you on the need for complex passwords and how often they should be changed. Many of them, however, have to follow outdated and impractical guides forced upon them by government standards in order to comply with HIPA, SOX, or PCI.

    There are a couple of things that bother me, though. The first is pattern re-use. P@$$word521 does meet the complexity requirements of many systems. But when you use P@$$word125, P@$$word251, P@$$word215 and then tell everyone that you use P@$$word with the same three numbers and just rotate the numbers, it is not much better than a post-it under the keyboard. Complex passwords do not have to be difficult to remember. Just because someone has difficulty coming up with good passwords does not mean that a hard-to-remember password is actually complex.

    The second thing that bothers me is when a sysadmin will force a password policy on you, but won't use it himself. I know one admin that forced a password change every 90 days for all accounts except his. When he left the company, his password history was completely blank. He had used the same password for years. While I think passwords could live longer than 90 days and twice a year would be sufficient for many passwords, if a change is required, it should be required for all users including the sysadmin.

    Just my little rant.

Wishing without work is like fishing without bait. -- Frank Tyger

Working...