Password Memorability and Securability 436
NonNullSet writes "Who would have thought that that something new could be said about how best to select passwords? Ross Andreson of Cambridge University and some of his colleages have performed new empirical studies and found some pretty non-intuitive results. For example:
1. The first folk belief is that users have difficulty remembering random passwords. This belief is confirmed.
2. The second folk belief is that passwords based on mnemonic prases are harder for an attacker to guess than naively selected passwords. This belief is confirmed.
3. The third folk belief is that random passwords are better than those based on mnemonic phrases. However, each appeared to be just as strong as the
other. So this belief is debunked.
4. The fourth folk belief is that passwords based on mnemonic phrases are harder to remember than naively selected passwords. However, each ap-
peared to be just as easy to remember as the other. So this belief is debunked.
5. The fifth folk belief is that by educating users to use random passwords or mnemonic passwords, we can gain a significant improvement in security. However, both random passwords and mnemonic passwords suffered from a
non-compliance rate of about 10% (including both too-short passwords and passwords not chosen according to the instructions). While this is better than the 35% or so of users who choose bad passwords with only cursory instruction, it is not really a huge improvement. The attacker may have to work three times harder, but in the absence of password policy enforcement mechanisms there seems no way to make the attacker work a thousand times
harder. In fact, our experimental group may be about the most compliant a systems administrator can expect to get. So this belief appears to be debunked."
Freaking PDF files. (Score:5, Informative)
I suppose I should make a comment. Okay, here it is: looks like users are still the weakest link in security. Whoever said that social engineering was the ultimate hack is a genius.
Re:Freaking PDF files. (Score:3, Informative)
I don't think that will ever change, unless we use the bio scanning methods (iris scans and whatnot)
I heard about DNA scan, but I can't see that working, it could be falseified. Even a finger print could be carried (cut off their finger if they wanted access enough).
The strongest way to do it is with multiple methods (text password, then voice password, the finger print scan, and then iris scan).
Re:Freaking PDF files. (Score:3, Insightful)
Oh, yeah... I remember him. I forgot that guy after existed he was free and not a symbol of everything that was wrong with the legal system in the US.
Mitnick today (Score:5, Informative)
He was briefly in Chile for a US$420 a seat conference, and the head of the Computer Science Dept. asked him if he could give the students a little talk.
A representative answered exactly this:
Thank you for your inquiry. Kevin is indeed in Chile next week-- and would love to address your students. He does, however, charge a fee for his presentations (it's how he earns his livelihood)--- A standard presentation is 45 min. long plus 15 min. Q&A and covers the information presented in his book, The Art of Deception. The cost for a presentation like that is typically $15,000 US; however, due to the fact that you are an educational institution and Kevin will already be in the area delivering his other presentation, I could offer you a discounted price of $9,000 US (a savings of 40%)plus any related travel costs to/from your organization to his hotel.
Re:Freaking PDF files. (Score:5, Insightful)
I second the HTML version. Good old Adobe - popped up a nice little window in the background bugging me to update and stalled the IE process. Since the window went to the background, all I could see was the stalled process, and I killed IE, which, of course, closed all my windows. I hate pdf files...
Anyway, here's a consideratoin: semi-disgruntled employees. For example, I'm not disloyal enough to actively seek to damage the company's systems or information, but with the way they treat employees, and the way my dysfunctional department operates, I'm not loyal enough to sit and try to think of strong passwords every month. So, I come up with creative ways to circumvent the draconian password policy instead. Ironically, some of my stronger passwords have been defeated by this overly strict ruleset and wound up with me simply appending a character to a weaker password to get around it.
The lesson: draconian password policies hurt security and audit your password lists on a regular basis (at least randomly sample them regularly). Most of your users probably don't give a crap about their passwords because they don't give a crap about what happens to the company's systems and information.
Google (Score:5, Informative)
I just use my phone number..... (Score:3, Funny)
Re:I just use my phone number..... (Score:5, Funny)
Longest... summary... ever... (Score:5, Funny)
Re:Longest... summary... ever... (Score:3, Informative)
quepasa (Score:5, Interesting)
The combination means that I can always "recall" the password for any of my accounts using the quepasa application (all I remember is a single passphrase), and the passwords are not stored anywhere.
John.
Re:quepasa (Score:4, Insightful)
Re:quepasa (Score:5, Informative)
1. There's no file stored anywhere containing the passwords so you can't lose them, or have the file in order to get the password.
2. You don't have to do the random creation of passwords in the first place.
3. When it comes time to change passwords, just change the passphrase.
John.
Re:quepasa (Score:5, Insightful)
4. Encryption software tends to be hard to use, and to use it, you have to understand quite a bit about encryption. (What's a keychain? What's a public key? A private key? What do I do if my private key is compromised?)
Personally I use a GPG-encrypted file, but quepasa does sound like a neat idea. My only misgiving about it is that it still requires users to have a clue, and the point of the article seems to be that having a clue (or caring enough to make an effort) is the limiting factor.
Random Passwords aren't the problem (Score:5, Insightful)
If IT keeps warning, they're told to stop worrying. If something happens, IT is blamed. These morons (leaders) need to figure out that IT isn't something that helps them do business. Their business runs on IT. Without it, they have no business.
Re:Random Passwords aren't the problem (Score:5, Insightful)
Re: Remembering frequently-changing passwords (Score:5, Insightful)
Take a song that you like, and use the first letters of each line as your password.
If your password requires numbers or special characters, use the line number of the song, plus its shifted equivalent.
If it requires both upper and lower case, use one upper-case letter, the same position each time.
For example:
A long long time ago,
I can still remember
How that music used to make me smile.
Month 1: aLlta1!
Month 2: iCsr2@
Month 3: hTmutmms3#
etc.
Each year, pick a new song.
Re:Random Passwords aren't the problem (Score:5, Insightful)
Catchphrases are far easier to remember, and simple mapping of words to punctuation symbols and numbers can go a long way to personalizing even a catchphrase. IT should train appropriate passwords, and run crack to catch problems.
Re:Random Passwords aren't the problem (Score:5, Insightful)
Re:Random Passwords aren't the problem (Score:3, Informative)
It's more likely they'll take care of it, then.
Re:Random Passwords aren't the problem (Score:5, Insightful)
Actually, you're wrong. It's people that the business runs on in almost all cases. IT is a tool that makes people so much more efficient that processes now assume that it's available and most of those people don't know how to function without it (and more to the point the information they need to operate is stored in it rather than kept in folders on their desk where they could get at it).
A design where authentication is centralised to a secure enough server and that authentication attempts are throttled so that guessing attacks are restricted means that you don't _need_ such a draconian password policy. My work uses RSA SecureID for all logins from outside the corporate intranet. Within the intranet we're a little soft and squishy, but that's considered a lower cost than the cost of having to tell people their passwords all the time. And yes, we do have password policies, but they're not insanely complex.
Re:Random Passwords aren't the problem (Score:4, Insightful)
(Why the slam on 40 year olds?)
Anyway. The problem is with passwords--the fact that you're forcing someone who really doesn't want to and shouldn't be made to into picking a password. You should just randomly assign one, give it to the person, and tell them that this is THEIR password until it gets compromised.
The 40-year old woman remembers her PIN, her SSN, and her street address. She can remember a "Strong Passsword"--she just can't choose one.
Re:Random Passwords aren't the problem (Score:5, Insightful)
<sarcasm>
Yeah, I'm a super for an apartment complex, and I have these problems all the time. These fucking 40 year old women use thier kids names as their passwords to get in their apartments, and then complain to me about how getto the apartment complex is because their apartments get broken into all the time. These dumbasses also have me call up tow trucks and passwordsmiths all the time because they cannot remember thier password for their car. I keep telling them to make better, easier to remember passwords, but they are all just morons.
A buddy of mine is a super at another apartment complex, and they still use "old school" technology like keys to get into their apartments and cars, and they rarely if ever have these problems.
</sarcasm>
The moral of the story is that there are such things a physical tokens, smartcards, etc that can provide keys to authentiate people to access computer systems. I hate to break it to you, but username/password schemes only authenticate usernames and passwords.
The only thing that has not been worked out cleanly with keys is revocation. Any ideas here?
I like that analogy (Score:4, Funny)
Re:Random Passwords aren't the problem (Score:5, Insightful)
Password reset is the number one help desk issue. All you need is some basic information about the user and a cracker could get the password reset to whatever they want. It's tough for companies to make resets as tough as they really need to be, the cost would be too high.
I believe that the best solution is to enforce complex passwords and allow those passwords to last 6 months or longer.
Re:Random Passwords aren't the problem (Score:5, Insightful)
No, the problem is with the password police who requires those women to change their password every month. While that theoretically improves security, in reality it makes it worse because people are prone to forgot their changed passwords and thus write them down. That is not the user's fault. That those 40 year old women can't remember their passwords, especially when they change every month, is a fact of life. Ignoring that fact, changing the situation from bad to worse, means that you are stupid, not the users.
</end rant about stupid sys admins>
Anyway, if you really cared about security, you would use smartcards, fingerprints or whatever. Passwords for regular users are about as secure as locking your front door and putting the key under the mat*.
*In a place I worked someone used 'secret' as a password and shouted it across the room. And yes, it was a 40 year old woman.
If IT keeps warning, they're told to stop worrying. If something happens, IT is blamed. These morons (leaders) need to figure out that IT isn't something that helps them do business. Their business runs on IT. Without it, they have no business.
Sure, management is ultimately responsible for everything. But often, IT can also be blamed for not being informative enough. In the case of security, you should ideally have made a comparison between the security mechanisms and offer your boss a clear choice:
- Passwords without enforcement/whining = little security + easy for users
- Passwords with user enforcement = some security + hard on users
- Chopping off a finger for every bad login attempt = good security + lawsuits
- etc...
Spell it out and get management to agree what your job is, what others should do and what things can still happen. Of course, then management can still be unfair, but you will be happy knowing that you are being professional.
Re:Random Passwords aren't the problem (Score:3, Interesting)
Reading this article I remember a time -when I was still an application-manager for a large hospital- when I went to a small department to instruct a group in using the application.
It went something like this:
- Me: "What are your usernumbers? "
- Women of the group: "xxxx, yyyy, zzzz, dddd, ffff"
- Women: "Do you want our passwords too?"
- Me: "No, I just need your login-info so I can fill in the necesarry forms."
- Women: "It's okay, we all share the same password, you can have it."
- Me [frowns]: "You
Re:quepasa (Score:5, Interesting)
Basically it assigns random chars/numbers/symbols to each letter of the alphabet. It tosses things like zero, one, and eight and letters O, H, I, J, L, B (upper or lower, depending on confusion with the aforementioned numbers). Now I print this nice little table and use it for passwords all over the place. For example I could just remember "slash" which maps to the password Z?+JTLZ?4&
Also, if someone gets that little peice of paper or sholder-surfs they don't get my passwords without at least a little effort. Oh and laminating it is a good idea, and an extra copy in a safe place wouldn't hurt too.
Consonant-Vowel Method (Score:5, Interesting)
Re:Consonant-Vowel Method (Score:3, Insightful)
Nice try
Re:Consonant-Vowel Method (Score:4, Insightful)
Re:Consonant-Vowel Method (Score:5, Insightful)
Forcing 8-char passwords is just as inadvisable. There are 6.16*10^15 possibilities for 6-8 character passwords made up of all typeable characters (ACII 33-126). That'll take 195 days to search the whole keyspace at 1M tests per second. And hopefully your password rotation is more often than that.
Re:Consonant-Vowel Method (Score:3, Interesting)
Re:Consonant-Vowel Method (Score:5, Insightful)
Making this kind of argument is valid only if it is practical for people to use passwords from a maximum-entropy pool of acceptable passwords. Think about this for a second: what you are talking about, strictly speaking, is a cryptographic key. However, we keep using the term password. The difference is subtle but significant, and it is the crux of the issue in the article (RTFA). Passwords are a kind of word, used as a cryptographic key in this case. So, they are the intersection of the set of things that can be words and the set of things that can be cryptographic keys. If you get too strict with the definition of either of the two sets, you risk shrinking the intersection to a cryptographically insigificant number of brute-force attempts.
Rules like this do *not* make brute-forcing simpler. What we need is more like them. Instead of forcing people to use a selection of truly random numbers as passwords, we should have a cornucopia of different mnemmonic password generation algorithms with different inputs that are likely to differ greatly (in two dimensions) from person to person and over time. The total brute force guesses would be the UNION of all of those sets, and they would also meet human factors requirements. The way to improve cryptographic security of passwords is to *increase* freedom, and to discourage conformity. Specifically ruling out different password mnemmonics actually shrinks your pool of brute-force possibilities and thus weakens your scheme. It is acceptable for some people to use dictionary-weak passwords sometimes as long as there is a much greater likelihood at any one time that they will not.
The bigger the dictionary, the closer the attack comes to brute-force keyspace searching. GROW the dictionary to obtuse proportions!
Re:Consonant-Vowel Method (Score:5, Interesting)
My applications rarely force complexity (sometimes they require numbers or other non-alpha characters). The instructions are always there, but users rarely ever follow them.
One of my not-so-critical applications (a web messageboard!) from a while back stored the passwords as plaintext in the DB (I now use hashing, thank you very much). I once looked at the password list just to see how complex people chose their passwords:
~60% had one word passwords of about 5 or 6 letters, no numbers
10% used their username (which has since been prohibited)
10% had complex passwords - stuff that made no sense to me and used numbers, non-alphanumeric characters, etc.
The rest (a little more than 20%) had a word + a number, or something around those lines.
I did ask them all about password security, and I got two basic responses: My password is secure, or What does it matter?
Message Boards (Score:5, Interesting)
If someone gets to post as Allen Zadr to slashdot, the worst that would happen is my karma would be burned. No big deal. I drop the account, start a new one, give Slashdot another 5 bucks.
The passwords I use on anything important, are far more secure.
For this reason, I would be far more suspicious of the 10% that use extremely complex passwords. Likelyhood is that those passwords will match their online banking account and work passwords.
Re:Consonant-Vowel Method (Score:5, Informative)
Re:Consonant-Vowel Method (Score:4, Interesting)
At least you aren't l33tifying plain dictionary words,
I recommend any sysadmins to download software like 'crack' or 'john the ripper' just to get an idea of the techniques used to break passwords. e.g. the fact that 'dictionaries' in the case of password cracking also include things likes lists of anime and cartoon characters, actors, actresses, scientists, etc. And, of course, the aforementioned leet pattern replacements like s/ate/8/ and s/e/3/.
Brute Force Attacks (Score:5, Insightful)
Surely by this point in software development it should be regarded as standard for every program to LOCK access for a given account after X consecutive failed logon attempts?
Even setting this to something arbitrarily high like, say 1000, is more than any user would ever try before asking for help, but much MUCH MUCH less than any dictionary attack would require. Combine this with the possibility of real time notification for admins (facilitated by email/inter application messaging, or a small add-on service for the OS) when more than Y accounts are locked for this reason in Z minutes, and as a community we'd effectively end all dictionary attacks - or at least turn them into DOS attacks, but at least we'd know it was going on...
Re:Brute Force Attacks (Score:5, Informative)
> han Y accounts are locked for this reason in Z minutes, and as a community we'd
> effectively end all dictionary attacks
The problem with this solution is that so-called "dictionary attacks" are virtually never carried out using the target's manual authentication mechanism, or even their enrcyption library functions (which are usually deliberately performance-crippled). Any brute-forcer worth its salt (heh) is run on a fast, private computer with an optimized hashing function on hash data that is pulled off of the target wholesale.
In addition to, and more important than, the methods you describe, users must use better passphrases, policies must be enforced, and the authentication schemes used must become more robust (larger key size, multi-layer security, OTP, etc).
Sys admin and internal support (Score:3, Interesting)
Where I work the passwords are changed by internal support and logged into a database as well as entered into the system.
Despite requests to us strong passwords the internal support view is get as quiet a life as possible and just accept whatever password a user chooses.
The number of times I've seen summer1 is ridiculous.
Personally I think users should choose their own passwords and the system should limit them to >8 characters and a %age difference from their last 10 passwords. But I don't make up the policies.
Re:Sys admin and internal support (Score:5, Insightful)
Re:Sys admin and internal support (Score:3, Funny)
Clever users put the post-it on the bottom of their keyboard, where no one will ever think to look.
Re:Sys admin and internal support (Score:3, Funny)
Re:Sys admin and internal support (Score:3, Funny)
"coffee[1-9]" is another one. the best is when people pick embarrassing ones, like "imabadas", "jacked", or "bigman33".
Now keep them away from chocolate (Score:5, Funny)
Length vs randomness (Score:5, Interesting)
Then we can determine a good password policy that fits with the security model at the facility.
Re:Length vs randomness (Score:4, Insightful)
Re:Length vs randomness (Score:4, Insightful)
Plus it's difficult to factor in the domain of characters an attacker will use to brute force a password. Throwing in a puctuation mark on a relatively short password will be strong against any attackers who use only alphanumeric characters in their cracking scheme. But the first attacker who does include said punctuation will crack a short password relatively quickly.
L0phtcrack probably has the best approach in which a basic dictionary attack, then a hybrid attack by attaching numerals and punctuation on to the end of a dictionary word. Etc..
But really, if you're not using a dictionary word as your password, the chances of a brute force attack being successful are very low.
An attacker is going to get your password through other means such as keylogging or packet sniffing.
Passwords are really only one tiny piece to the whole security plan and I think it's too focused on. How about more on how to physically protect a machine, how to prevent keyloggers or packet sniffers. How about social engineering? That's one of the last topics (if at all) to be covered during discussions about security.
Re:Length vs randomness (Score:5, Informative)
An 8 character password using unique upper case, lower case, digits and punctuation has about 94 different characters. If we picked a random 8 character password from this we would have:
94_P_8 = 94! / (94 - 8)! = 94! / 86! = 94 * 93 * 92 * 91 * 90 * 89 * 88 * 87 = 4.4x10^15 permutations
A 10 character password using only unique 26 lower case characters has:
26_P_10 = 26! / (26-10)! = 26! / 16! = 1.9x10^13 permutations.
So, the 8 character password using all characters is about 200 times more difficult to brute force than the 10 character password only using lower case characters.
Peter
No passwords... (Score:3, Interesting)
On the other hand, I don't have a password retention policy either, so really if someone is in my employ for more than six months, there's a good chance of a password getting lost into the wrong hands. Yes, I know this is a bad idea.
Re:No passwords... (Score:5, Insightful)
Also, if you know their password there goes any semblance of Non-Repudiation. And if you can 'remind them' either you have a very short list of users and can remember them, or you have a written list somewhere - nifty, but a bad idea.
entering passwords is the biggest problem (Score:5, Insightful)
Re:entering passwords is the biggest problem (Score:4, Insightful)
Re:entering passwords is the biggest problem (Score:3, Insightful)
Use a "password wallet" (Score:3, Insightful)
Why should passwords be difficult to guess? (Score:5, Insightful)
The key is to detect the attack.
Use these... (Score:5, Funny)
I sense a good social engineering technique here (Score:5, Funny)
Revolutionary... (Score:3, Funny)
a couple things i do (Score:5, Interesting)
1) On my servers te password changer forces them to not use dictionary words, has to have numbers, letters and nonnumeric characters, and they can't use their previous so many passwords
2) For my password I use a few things from my childhood that no one will ever come up with.
3) There is nothing like keeping up on your security patches.
Re:a couple things i do (Score:3, Informative)
Make the attacker work a thousand times harder? (Score:3, Insightful)
Seriously, even if you are using something other than passwords, say biometric authentication, security will remain as shabby as it is today unless users understand the importance of keeping the system secure. And that is a tall order.
The #1 cause of poor passwords (Score:5, Insightful)
I probably have 200 passwords floating around in cyberspace, and 90% of them are "password". For example, I have to supply uid/pwd in order to read the Washington Post (my local newspaper). Is it important to keep this password secret? No, because I'm not very worried about someone reading the newspaper under my name.
Unless I have confidential personal information at stake, I am not usually motivated to create a strong password.
So, sysadmins, if the security of your overall network is more important than Joe User's individual data, you need to enforce strong password rules. Relying on users to create strong passwords voluntarily under such conditions is foolish.
Re:The #1 cause of poor passwords (Score:3, Interesting)
a
1
12
123
1234
12345
123456
1234567
12
123456789
1234567890
A few others use the name of the site and the word "password".
They don't care. That is true.
Randon or mnemonic? (Score:5, Insightful)
Phonetic Passwords (Score:5, Interesting)
My password method (Score:5, Informative)
1. generate a password using some word algorithm: I was born on a Monday = "IwboaM"
2. come up with some kind of replacement strategy: w=m, a=1. IwboaM = Imbo1M
3. bookend it with the year you were born: Imbo1M = 19Imbo1M69.
It looks totally random, but there is a method to the madness. If you need to change it, you can just inc the year, or use some other rule on it. The strength is that you completely make up the rules, and they don't have to make any sense. All you have to do is remember the original phrase (easy) and your rules (easy to complex).
(and the example I gave is completely arbitrary)
You could also do one where your password is the answer to the question. Remember the question "What month was I born?" Answer: October
Password starting point = HalloweenMonth. Then apply crazy rules to it. In this way, you can write down your reminder phrase "Month born?" and it is nowhere near what your password is.
Re:My password method (Score:3, Funny)
The trick is then to remember the passwords. My own personal systems at home have root and at least two users with login, ftp, and samba passwords for each. There are also e-mail passwords,
Re:My password method (Score:3, Funny)
That's what I do with all my passwords, for example:
People Always Suspect Secret Words Or Random Dates
Wait a minute, D'oh!
Keyboard patterns? (Score:5, Interesting)
Looking at the above example it appears to be a password which follows the "strong password" methodology but have there been any studies on the effectiveness of using such a method? I know there are dictionary-based attacks which have some of the obvious patterns (qwerty, poiuy etc) but is such a method random *enough* to be feasible?
It seems to me that it would be much easier to train users to use a muscle-memory-like password than picking some word out of their ass. The human brain has one seriously developed pattern recognition/matching capability... why not use it?
Amoeba
passphrase passwords (Score:3, Informative)
Physical tokens are better (Score:4, Insightful)
Looking at through cynical eyes it doesn't matter how secure your method is because, you are ultimately placing trust in the typical user who will most likely do something stupid when given the chance.
Re:Physical tokens are better (Score:3, Interesting)
Comment removed (Score:4, Funny)
Re:Read Lots Of HP Lovecraft For Password Ideas (Score:3, Funny)
Mnemonics questionable (Score:5, Funny)
And the thing is, we didn't even have a rottweiler, it was a shepherd. But people still guessed it, so I don't use mnemonics anymore.
6. The sixth folk belief... (Score:5, Funny)
My password technique (Score:3, Interesting)
It works like this. I choose a book at random from my work area, choose a page at random and then pick a line. I develop a mnemonic password from that line. If I need a hint, I write down the page and line number on a piece of paper, I can even stick it to my monitor if I need to. My average library of reference books at work is over 50 books. How big a hint to an atacker is 347 12? All I have to remember is what book I chose.
My last job, my boss couldn't remember any password that wasn't part of his name until I introduced him to mnemonic passwords.
Passwords? More like words. (Score:5, Interesting)
Or use SHA2. Cause I don't have rainbow tables to crack that. Yet. For those of you who don't or cannot follow security, the new buzz is creating your own crack tables in a couple of weeks or months. There is more info at the project rainbowcrack [antsight.com] page.
The misconception that everyone has about passwords now (because we as sysadmins pushed it so hard in the late 90s, early 00s) is that alphanumeric is the way to go. With the advent of generating your own cracking tables, that is no longer the case anymore.
An alphanumeric md5 set of rainbow tables can be generated in about a weeks time with a 2.4 ghz processor. That's my rough estimate based on the couple days it took me to make the alphanumeric one for LM hashes.
I would highly suggest that if you want your users to come up with good passwords you have them make a "one-time" password, seed with a 20-character salt that looks like someone pounded the keyboard, and store it inside a SHA2 hash.
A good administrator is going to salt their passwords with a string of characters that already satisfies the "alpha-numeric-symbol" requirement. If there is any reason to do something other than the first name of your child it is to stop coworkers or friends or people that already know about you.
When using brute-force/guess method this is what I try first and my guess is that at least 1% of Slashdot fathers use this or a form of it as their pass. It's okay to be proud of your kid, but don't think you're honoring them by including them in your password.
pwgen (Score:5, Informative)
It's definitely easy to remember mnemonic passwords. I've been able to not log into a machine for months, come back to it and remember the mnemonic password unique to that machine.
Divorces and Passwords dont mix (Score:5, Funny)
Sometimes easy to crack passwords are a GOOD thing
On another note, after I took her to the cleaners at court I decided to TIE one One, well....NEVER....and I mean NEVER....change you passwords while really drunk..it took me 2 days to reconfigure redit and reset all my passowrds I changed on that drunken celebration. I still have NO idea what some of them were or how I came to decide on their usage
passflt.dll (Score:3, Interesting)
Getting users to comply with password policy. (Score:5, Insightful)
-The Libra
"You've got no kids, no wife, no job, and you're not in The Tigger Movie!!!"
- my best friend's son, Gabe, at 5 years old. [everything2.com]
Re:Getting users to comply with password policy. (Score:3, Insightful)
Response to #1: L0phtcrack and several other cracking tools have had character substitution methods for years. This method no longer works as a security measure.
Response to #2 and #6: Breeding fear and paranoia through alarmist propaganda is a really bad idea, because there will always be enough people in that office who will know better, and it's better to have those people on your side rather than in contempt of you.
Response to #3: These tools are not scripts
Alternative to memnonics -- pronounceables (Score:5, Informative)
FIPS-181 [nist.gov] describes a NIST-endorsed system for producing pronounceable passwords. There is a GPLed FIPS-181 implementation here [nursat.kz].
Sample run:
$ apg
dyijenuloa
bifliecar
yishjied&
IfHydrovia
yutsOlg/
DipUkcat
APG is a lot more sophisticated than this, and allows you to do a lot of tweaking of the types of passwords it outputs, print pronunciation guides. It's a good tool, IMHO, for security-conscious types to have around.
For Fedora Core 2 users, Red Hat does not package apg in the base distribution, but it is available from freshrpms.
reusing old passwords (Score:3, Interesting)
I'll give you an example, a place I used to work required all the standard things: caps, non-alpha, 90 day expiration, etc. but what bugs me is that your new password can't be the same as any of your previous 6. Now, I have three or four good solid passwords that meet (or can be made to meet) all those requirements, but when I have to come up with 7 different ones, they start getting weaker and weaker near the end. I know that in most systems you can just run through half a dozen passwords in about two minutes and get your old one back, but they also instituted a minimum age so you couldn't do that.
All these things are generally considered good network security, at what point do you start doing more damage than good though? How many passwords does your system require, and does anyone else find themselves in the same situation I'm in?
As with a large number of problems... (Score:3, Informative)
...you can solve this one by throwing money at it.
Buy one of these [usahero.com] and relax. You'll never have to worry about passwords again.
Great tactic for encouraging good passwords (Score:5, Interesting)
It works well because many people (myself included) just didn't get how easy it is to crack simple passwords until someone does it. If it's your friendly sysadmin, a normal desire to appear less idiotic is a sufficient motivator to choose a strong password.
Slashdot passphrase (Score:3, Funny)
IANAL&IneverRTFA
Oh wait... did I just give away John Katz's password?Re:Size of Study (Score:5, Insightful)
But yes, 400 people is way more than enough - heck you can usually predict the outcome of most elections using exit polls asking less people than that.
Re:The best security (Score:3, Interesting)
All your i286 are belong to us.
Re:The best security (Score:5, Funny)
So, basically, you're saying that Slashdot is impenetrable?
Teach People the Drums (Score:5, Interesting)
1) Put both hands on our friend, QWERTY
2) Move fingers into a natural, systematic position
3) Bang out a pattern using all fingers
4) Randomly include the shift key and those keys at the top, including the Back Space
5) Keep hitting some keys even after you've hit Enter; Then hold the Back Space key (optional)
6) "Practice, practice, practice!" so it can be typed very fast
Results?
* I rarely mistype a password
* I don't know my own password
* I couldn't share my password with security unless a keyboard was around
* I type it in so fast, it would take a video recording to spy-capture it (me thinks)
Of course, nothing can help you with key logging
Re:Teach People the Drums (Score:3, Insightful)
But other than that, your method works, I have a sequence of passwords I remember soley on how my fingers touch the keyboard, although I do still know what the password is, I don't even have to think about it to type it in.
Re:Teach People the Drums (Score:3, Interesting)
Ooh! Hack login.c to do a random keyboard remap just before the password gets typed, then reverse-map the result before hashing it. A software keylogger that looks at characters after scancode conversion will be hopelessly confused. A hardware keylogger will still work, but you'd have to do some work to put one in my laptop.
Re:Teach People the Drums (Score:4, Informative)
Re:Ha (Score:4, Insightful)
Re:Multiword Passwords? (Score:3, Interesting)
I've seen [dictionary word][non-alphanumeric character][dictionary word] (e.g. chrome=turnip) or even [dictionary word][dictionary word] (e.g. purplegearbox), where the concatenated words do not form a dictionary word. Googlewhackers could have fun generating (in)secure passwords along these lines.
Re:pretty non-intuitive results? (Score:4, Interesting)
Yeah, but there's something that makes it worse: Every time you have to make up a password, your first try is rejected because it violates the rules of that software. So you keep trying until you stumble across something that is acceptable.
As a result, my file of passwords now has 68 entries, and that doesn't even include the half dozen logins that I use often enough to remember. I don't keep them on paper, of course. I keep them on my web site, so I can find them from anywhere.
Of course, the file has a misleading name, is hidden behind a number of index.html files, and has a name that starts with a dot so that the server doesn't give it out even during server changes when the index.html files are sometimes ignored for a short time. I know I should still be worried about the URL being intercepted in transit. But so far, this is the best solution I've found to what is a rather intractable problem.
The real problem is security dummies that impose such complex password rules on users that we are forced to resort to schemes like this to "remember" our passwords.