MS Employee Calls for No More Passwords 614
BobPaul writes "On his blog, Robert Hensing of the Microsoft PSS Security Team makes a really convincing argument for the abolishment of complicated passwords. He argues that precomputed hash tables, network sniffing, and programs like LoftCrack make passwords obsolete and dangerous in the windows environment. What does he recommend in their place? Passphrases: sentences and quotes that are easy to remember but may be more than 30 or 40 characters in length. With many companies requiring frequent password changes, (and we know exactly where that leads) this is a simple idea I'm surprised more people haven't been doing this more often."
Biometrics (Score:5, Interesting)
converting to all passphrases. First, the person will probably use the same passphrase for everything because it's too difficult
to remember multiple passphrases. Second, it's difficult to remember passphrases! Phone numbers (In the US, at least) are limited to
10 digits because research shows the average person can only memorize 10 digits, as a result...we tend to write things down, or in the case of
data people are likely to store their passphrases in a central location that is still prone to theft/decryption.
Biometrics, on the other hand, requires that you only have your body present at the time! No special USB keys to lug around, no pieces of
paper with important passwords/phrases. This won't solve the problem of possible data interception when talking about remote
authentication--but every form of authentication is prone to such attacks when transmitted.
Re:Biometrics (Score:5, Insightful)
Re:Biometrics (Score:5, Funny)
Something I have... Smith and Wesson.
Something I know... How to freaking shoot.
Something I am... Bad MotherFucker.
Re:Biometrics (Score:5, Insightful)
This won't solve the problem of possible data interception when talking about remote
authentication--but every form of authentication is prone to such attacks when transmitted.
No it isn't, because if you use a salted hash (chosen by the server), you can't just replay the traffic.
Re:Biometrics (Score:4, Funny)
That's true
Re:Biometrics (Score:5, Funny)
Ooh...yea--that'll be the downfall of biometric authentication. Someone steals my retina and then all my accounts are 0wned for ever and ever...
Re:Biometrics (Score:3, Insightful)
Re:Biometrics (Score:5, Insightful)
Suppose you are just walking in the streets when someone suddenly shoves a camera to your face and takes a picture. The flashlight blinds you momentarily, so you can't pursue him. He disappears into the crowd with a picture of your retinas in his camera.
What are you going to do ? The picture contains all the data he needs to log into online services as you. You cannot change the password, since you don't have any. In theory, you might be able to burn a distinguishing pattern into your retina with a laser - but, of course, that will negatively impact your vision.
So yes, that's exactly what will happen. Someone will steal your retina (or rather, copy the biometric info that is used to authenticate you) and then all your accounts are 0wned for ever and ever.
Not to mention the privacy concerns - I wouldn't want every online service to be able to link my identity to my real one, would you ?
Biometric identification is an extremely bad idea that will hopefully die the silent death it deserves.
Re:Biometrics (Score:4, Funny)
Good point, but anyone who wants to go through all that trouble is welcome to my slashdot account.
Re:Biometrics (Score:5, Insightful)
Once someone gets a copy of your fingerprint or retina, your credit card is comprimised for life. You can't change you biometrics, which is why they are a total joke.
Re:Biometrics (Score:5, Interesting)
I agree that biometrics can't be changed, but will you ever need to?
Re:Biometrics (Score:5, Informative)
Not to mention that fingerprints are left EVERYWHERE.
Re:Biometrics (Score:3, Interesting)
But let's suppose for a minute that someone sets up a fake ATM machine. First you insert your card, providing them with your account information. Next you authenticate yourself with your fingerprint, retinal scan, DNA sample, or whatever else you choose. Assuming they've installed the same biometric reading equipment as our theoretically real ATM mach
Re:Biometrics (Score:5, Funny)
Gummy Bears! Bouncing here and there and everywhere! Foiling security beyond compare! They are the Gummy Bearrrrrrrrrrrs.
Re: It's no joke! (Score:5, Informative)
Re:Biometrics (Score:5, Informative)
Here's a link to a Norwegian article about one successful breach:
http://www.tu.no/nyheter/ikt/article30692.ece [www.tu.no]
The article links to this Swedish one on the same story:
http://www.nyteknik.se/pub/ipsart.asp?art_id=3739
and this concerning some Japanese experiments:
http://www.rootsecure.net/content/downloads/pdf_d
(mind the
Re:Biometrics (Score:5, Informative)
Even worse, some fingerprint-based biometric sensors that were being toted as secure were able to be broken by simply blowing warm breath on the reader, much like when you go up to a cold, glassy window and fog it with your breath. The biometric sensors, for one reason or another, read the previous fingerprint.
Again, it all depends on which system is in question, but my research found that most biometric systems were able to be broken, sans bloody, cut-off fingers or jelly replicas. Of course, they are toted as super-secure.
That is why the fundamental rule for using biometrics for authentication is as follows:
Biometrics aren't meant to replace passwords/passphrases. They are meant to be used as an added layer of security in addition to the password.
(As a side note, if you wanted to do more than just get the copy of fingerprints, invite someone out for beer and french fries at the local bar and bring some scotch tape with you. When they are done and leave, take their greasy, finger-print covered glass and apply the scotch tape to it. You will lift the oily fingerprint. Depending on how the system works, you can now use watery ink to get a negative of the fingerprint. Print this onto the old boards they used to hand-make printed circuit boards, etch the board with chemicals, and come out with a fairly 3-D version of the fingerprint. Now, make your standard flat, thin jelly mold and, when set, wrap it on your finger. Viola!)
Re:Biometrics (Score:5, Insightful)
There are two definite (and related) advantages to biometric systems.
One -- the bar to "unauthorized use of credentials" is raised to a higher level. Which, to a large degree, is what all security is about. If ${large organization of nefarious intent} wants my data, they have the means to get it. Biometrics helps weed out the less well-funded and well-motivated people. It's like me using one-time passwords for SSH access. No, it doesn't prevent someone from entering my house and installing a tiny hardware key-logger in my PC, but it does stop all of those clowns running dictionary attacks.
With biometrics, people can't just rummage around a desk looking for the password post-it. They (as in your case) have to arrange for greasy finger-print covered glasses and scotch tape. Not insurmountable, just a bit more difficult.
Two -- any kind of remotely plausible deniability in the event of a breach is gone. ("Uh, I don't know how it happened. I just happened to have a jelly mold of this guy's fingerprint..."). Unauthorized access to a biometrically controlled system is pretty solid primae faciae evidence that Evil Deeds[TM] are afoot.
Yes, there are problems with biometric authorization. Irrevocability being a very large one. Almost all of the people complaining about biometrics being ineffective -- and almost all of the people touting them as *the* solution to all security problems -- are forgetting one thing.
Security is about the whole organizational process. Total security is enhanced or diminished by the particular method of authentication that you use -- and poor authentication can undermine a lot of the rest of the system. Hackable authentication does not automatically invalidate the rest of the security process. 100% provable authentication does not automatically mean that your system is 100% secure.
Let's look at the example of an anonymous FTP server. There's no authentication. None. However, any sensible person would be running it read-only. It would be jailed or chrooted. IP addresses would be logged for auditing purposes. The partition that the ftp server is serving data from could be mounted noexec. Blah, blah, blah, etc, etc, etc. Here's a case where zero authentication does not mean zero security.
People often talk about biometrics in the context of some theoretical, non-existent system where there is no other security other than this one, initial biometric authentication...and the whole system is either "secure" or "insecure" based on the authentication. Which is just garbage.
Even in the simplest case -- biometric time-keeping -- there are other checks in the system.
Let's assume that worker A and worker B have colluded to provide each other with false handprints. We'll leave out such annoying real-world problems like, "Hey, Bob, why are you clocking in with that jelly-filled hand-on-a-stick ?" and assume that worker A and worker B can at any time just clock in and clock out as each other without anyone noticing.
OK, at the end of the week, Manager M gets a payroll report. Manager M gives it a cursory glance. Uber-manager N gets the same report, and gives it an even more cursory glance. Let's not even talk about Director O -- we know that it's just sitting in her in-box with all of the other reports.
HR Flunkie T runs the weekly "check for discrepancies between scheduled shifts and actual time worked" and sends those to Manager, Uber-Manager and Director. Manager M fires an email back saying, "Hey, no problem." Or perhaps the email says, "Hey, worker A is showing up as having no discrepancies -- I distinctly remember that he was thirty minutes late on Tuesday".
Every month, Auditor X takes a brief look at all of the discrepancies between last month and today and all of the explanations for them. Auditor X looks for any suspicious or unusual patterns -- and the absenc
Re:Biometrics (Score:3, Informative)
You are co
Re:Biometrics (Score:3, Insightful)
Re:Biometrics (Score:3, Insightful)
I only need a physical representation of your biometric data if one assumes that the system with Analog to Digital Converters and all won't be compromised. What a silly idea. Every security system which is based on control over the equipment failes sooner or later.
Re:Biometrics (Score:3, Insightful)
A real life example: a few months ago my debit card was duplicated. I never lost my card, but some store owner somewhere had a hacked machine that captured my card
Re:Biometrics (Score:3, Insightful)
Re:Biometrics (Score:2)
Re:Biometrics (Score:3, Insightful)
And if someone does get all three you can always change your password and they have to
Re:Biometrics (Score:3, Insightful)
I'm not convinced that biometrics are much better than getting a tatoo of your password.
Re:Biometrics (Score:3, Insightful)
My often-spoken number 1 rule of security: If they get to your hardware, you're screwed.
Corollary: If you depend on biometrics for security, you are effectively bringing your hardware to "them", and leaving copies of it everywhere, in the case of fingerprints.
Which is more insecure: Writing your password on a stickie note and leaving it on your monitor; locking your house,
or,
leaving your fingerprints everywhere, and yet depending on them for security.
~Will
Re:Biometrics (Score:3, Funny)
Or that someone else has your body present. Or just search google for jelly fingerprint to see how to duplicate other people's prints for fun and profit.
Biometrics is bound to stick around for a while, but the fad will hopefully fade before all my bank and credit card accounts get tied to my fingerprint and I have to have new prints carved into my fingers to replace the ones that some identity thief lifted off the s
One Question (Score:3, Insightful)
Becuase your fingerprints will be all over unless you wear gloves all the time.
Other body parts aren't quite this extreame but still have similar weaknesses.
Re:Biometrics (Score:5, Informative)
It's a lot easier to remember a series of words than a series of digits that have no obvious relationship to each other.
Re:Biometrics (Score:5, Interesting)
and if you have any literary knowledge at all (Score:3, Insightful)
if I see
Xow XX thX time XXr aXX good meX to XXme to their coXXCCC's Xid, and I'm ken jennings, I can figure it out...
Re:Biometrics (Score:4, Informative)
Nonsense. I recall the phrase "Whan that April with his showres soote" from 20 years ago when I read it for the first and last time. 3 years before that I memorized pi to 21 decimal places --- I still know them. How about "Now is the winter of our discontent"? or "The lord is my shepherd. I shall not be in want"? or thousands of others?
Memorizing a phrase -- particularly a phrase that means something to you, is not as difficult as memorizing the first 3 entries in the phone book.
Re:Biometrics (Score:5, Insightful)
Great, now what happens when I need to log into a remote server? I currently live in Colorado and have access to machines in Wisconsin and Alberta, and the great security of fingerprint biometrics aside, my arms just aren't that long. And if that remote machine will accept data from a reader at my own machine, well, that reader is vulnerable to tampering and outside their control, and we're back where we started.
At some point, we HAVE to realize that we just can't have some type of perfect security. Like a real safe or vault, someone determined enough to get in WILL get in. However, the better the security, the more chance that you will catch them in the act and prevent it, or deter the would-be attacker in the first place. This is the true goal of security.
Biometric security measures, in my opinion, would be too intrusive and unwieldy for use at the desktop level. If I want to let my friend Bob use my machine, I can give him my password, but I cannot hand him my retina. Of course, for ultrasensitive applications (bank vaults, national security information, nuclear power facilities) it would be an excellent alternative to the current cards and such which can be stolen.
As to the passphrase idea, it's not -terribly- hard to remember multiple phrases. And you don't need a different one for each site you visit-four or five different ones are sufficient for most people. And it's a lot harder for a would-be cracker to guess that your passphrase is "My daughter threw cake at the dog on her second birthday" then it is to look up your kid's date of birth.
Re:Biometrics (Score:3, Insightful)
Remembering a string of numbers is a lot different than remembering a line of poetry, or a bit of dialogue from a favorite book, or movie, or the title of a cool song, or.. I could go on and on. For years I've used fairly short passwords of only around 8 characters, but they neve
Re:Biometrics (Score:3, Interesting)
Wouldn't solve the problem completely, but might make it harder to crack.
Offer Void on pre-2000 MS operating systems. (Score:5, Informative)
Therefore, if you have any legacy systems to support, these password tips don't apply to you, and that's got to be part of the reason there hasn't been much of a movement to suggest that users use longer passwords.
Re:Offer Void on pre-2000 MS operating systems. (Score:2, Interesting)
It combines the best of both worlds.
i) a 'complex' password because it can't be broken by a dictionary-based attack
ii) easy to remember (sentence-based)
Add to the mix some tranposition of characters (use 1's instead of i's etc etc) and you've got yourself a fairly decent password, at least better than mos
Re:Offer Void on pre-2000 MS operating systems. (Score:3, Informative)
Works just fine on password-size challenged systems.
One of the article's points (and a topic of discussion in the security field for some time now) is the practice of pre-computing the hash of every possible password up to a certain length - a.k.a. "rainbow tables". Against this kind of attack, every password of a given length is equally secure.
Long passphrases, however, (15-20 characters or more) should be safe at least until the advent of quantum computing.
The Guy The Microsoft Plagerist Copied is Right (Score:3, Informative)
That won't stop Microsoft from taking credit for this "new, revolutionary idea in computer security," or the Microsoft apologists accusing everyone else from "copying Microsoft instead of i
Re:Offer Void on pre-2000 MS operating systems. (Score:5, Informative)
Took a bloody age to authenticate though.
The only problem with a passphrase (Score:2)
Re:The only problem with a passphrase (Score:2)
I've been doing this for ages (Score:2)
iswtfmtosadgawd
I spend way too fucking much time on slashdot and don't get any work done
Give your users something funny and they won't forget it.
absolutely! (Score:5, Informative)
For more information on this, this [google.com] Google search produced some good sites explaining tihs.
Also, in just conducting that search, I learned that 2000 and XP is apparently immune from this particular problem, according to this site [securityfocus.com].
"With LM, password hashes were split into two separate 7-character hashes. This actually made passwords more vulnerable because a brute-force attack could be performed on each half of the password at the same time. So passwords that were 9 characters long were broken into one 7-character hash and one 2-character hash. Obviously, cracking a 2-character hash did not take long, and the 7-character portion could usually be cracked within hours. Often, the smaller portion could actually be used to assist in the cracking of the longer portion. Because of this, many security professionals determined that optimal password lengths were 7 or 14 characters, corresponding to the two 7-character hashes.
But things are different with newer versions of Windows. Windows 2000 and XP passwords can now be up to 127 characters in length and so 14 characters is no longer a limit. Furthermore, one little known fact discovered by Urity of SecurityFriday.com is that if a password is fifteen characters or longer, Windows does not even store the LanMan hash correctly. This actually protects you from brute-force attacks against the weak algorithm used in those hashes. If your password is 15 characters or longer, Windows stores the constant AAD3B435B51404EEAAD3B435B51404EE as your LM hash, which is equivalent to a null password. And since your password is obviously not null, attempts to crack that hash will fail.
With this in mind, going longer than 14 characters may be good advice. But if you want to enforce very long passwords using group policy or security templates, don't bother - neither will allow you to set a minimum password length greater than 14 characters."
Re:The only problem with a passphrase (Score:2)
I really wonder about the long-term viability of this solution as well. Sure, it makes brute-force attacks harder because the password is longer, but it also makes each character of the password much easier to guess because it makes up a coherent English sentence. Those crazy security wizards will probably come up with a way to defeat p
Re:Auto-completion (Score:3, Funny)
[] Check this box to remember password
Re:Auto-completion (Score:3, Insightful)
turning it off should be located in some obscure dialog box in some unrelated area
it should randomly set itself back to "remember password" without notifying you
the next upgrade will make it the default and change where it's stored
--
People are lazy (Score:4, Informative)
I have convinced a majority of my friends & family to at least stop using dictionary words and names of pets. Instead, I have them pick some favorite line from a movie or book and then use the first letter of each word. It's easy to remember, so they don't stick it on the bottom of their keyboard. It also is not a word in the dictionary so at least Crack & friends can't be used to guess it.
For example, if one of my friends is a Dead Head, he might use "stlasom.oticbs" If you're a Dead Head you'll probably be able to guess the lyric. But you *won't* be able to find it in a dictionary.
Re:People are lazy (Score:4, Insightful)
Re:People are lazy (Score:3, Insightful)
Let me give you an example of how excessive security requirements can do this. Quite a few years ago, I was doing some contract programming for a local university/teaching hospital. I was working with one of their mainframe programmers, and he told
Excellent! (Score:5, Funny)
Old news... (Score:2)
This blog has gained far more attention than I could have ever imagined when I decided to create a small personal blog devoted to security incident response. I never imagined my first ever post would be as controversial or as widely published / linked as it has become!
If he thought his little blog had gained all of the attention it could back in October...
password vs. passphrase (Score:2, Funny)
Lipsum (Score:2)
Only a few thousand years behind... (Score:5, Funny)
Workaround (Score:2)
I wish I had some nachos to eat at work
would become:
IwIhsnteaw
Okay, it can still be brute force attacked but it certainly can't be efficiently dictionary hacked. Furthermore, for most of our needs, this works just fine. Add a number into the phrase and even better.
As the article mentions, passwords get hard to brute force at about 10 characters.
My passphrase... (Score:5, Funny)
or
Make of that what you want, but:
Of course, I changed the password to something more politically correct before leaving the companies....
Irresponsible journalism (Score:2, Informative)
Instead, the Microsoft employee is merely suggesting the use of longer passwords. I am shocked and
Re:Irresponsible journalism (Score:2)
Note to moderators : This is an example of irony [k12.ny.us]
For generation of strong and easy to remember ... (Score:3, Informative)
good news, everybody (Score:3, Interesting)
*yeah, right*
this "idea" is described in every single tutorial/howto/paper/note about password security. it's a good idea, i've been doing it for years, it has most likely been mentioned on slashdot countless times, but here we go again.
at times i forget why i am such an avid reader; it provides me with "stuff that matters" and makes me feel like i know more than all the others, from time to time
jethr0
No one will ever break my password! (Score:5, Funny)
Re:No one will ever break my password! (Score:4, Funny)
Needs a little fuzziness. (Score:2)
Read other people's messages before posting your own to avoid simply duplicating what has already been said.
Read other people's messages before posting yours to avoid simply duplicating what has been said already.
Read other peoples message before posting your own to avoid simply duplicating what's already been said. ...could all be the same passphrase.
In standard user applicati
Bible as the next crack dictionnary? (Score:3, Interesting)
IMHO, passphrase would make it easier for a hacker to successfully hack a system. For example, myself:
- Make a google search for my name
- See that The White Stripes is among my favourite groups
- Add The White Stripes lyrics to the crack dictionnary
- Attack, and probably succeed (password = "Why can't you be nicer to me?").
The list of all quotes in imdb mustn't be THAT big. Thus "I will have my vengeance, in this life or the next" would be a bad password. (not to mention "whoa"
Of course, IANASB (security blogger), I could be wrong.
My solution: Creole words (Score:2)
Mix them together and you have a fairly secure password that can't be guessed unless the attacker knows you very well or has some keylogger.
However, the problem that remains is that people are lazy and a small mistake
Re:My solution: Creole words (Score:2)
The first rule of passwords is...? Anyone?
Bueller?
just tell users to use passphrases (Score:2)
I had to create a secure-shell passphrase. The program, when I created the private key, didn't ask me to name a "password." It said, please enter a "passphrase." As a result, I have a much longer, more secure password, and absolutely no difficulties in remembering it.
Think about it this way:
a) Please enter a password, made of letters, characters, numbers, etc, but no dictionary words, and keep it over 8 characters l
two obvious problems with this idea (Score:5, Insightful)
2) if most people's passphrases are made of dictionary words take from their active vocabularies, dictionary attacks are still very possible. If we figure a typical vocabulary of 25000 words and a six-word phase, hmmm, some quick math indicates we're in the range of a 14-character random alphanumeric+punctunation password -- not too bad. (Especially if you grant people bigger vocabularies [worldwidewords.org]....) But, suddenly, we're open to language-based attacks -- there's probably thesis project in here for someone to come up with good algorithms to narrow down the required attack dictionary.
Thesis? I can do it right now, right here. (Score:5, Insightful)
subject - verb - object
(I like pizza).
Here's another:
adverb/adjective - object - verb
(Mean people suck).
The trick is finding the most common 3 word phrases (in English) and applying the basic grammatical rules you learned in school.
That guy didn't understand that passphrases/passwords are covered in cryptology under "authentication".
And any student of cryptology can tell you that PATTERNS are the problem.
With passphrases, there are too many GRAMMATICAL RULES and PATTERNS that make it simple to crack.
He focuses solely on the number of characters and never looks at how someone else would approach this to crack it.
Re:two obvious problems with this idea (Score:3, Informative)
Correct and insightful.
What I use for high-security applications and recommend to clients is a genuinely random passphrase. You generate it one word at a time without regard to grammar by using 5 dice and the list of 6**5 short words at the Diceware [diceware.com] page. Then you make up some kind of story to go with a phrase like "cleft cam synod yr" (hey, challenges are good for you) so you can remember it.
Bruce Schneier wrote that passwords are dead because normal peop
great password (Score:2)
Simple, easy to remember, contains a number, has a period and comma, and is over 50 characters. I don't know about you, but these phrase passwords sound like a good idea.
It's not LoftCrack (Score:3, Informative)
passwords? passphrases? (Score:3, Interesting)
A password is a string you know, a passphrase is a string you know.
One is probably longer than the other, big deal.
2, or 3, or 4 factor authorisation schemes are the only way forward. Like those used by some banks in, erm, Sweden ?
Re:passwords? passphrases? (Score:3, Insightful)
A password is a string you know, a passphrase is a string you know.
One is probably longer than the other, big deal.
There IS no worthwhile difference.
One may be longer than the other, but the longer the passwhatever is, the more likely I am to use dictionary words.
The REAL solution is to use passwords properly, and to protect anything else with strong encryption.
When is it safe to use passwords
how about public key authentication? (Score:5, Interesting)
Passphrases are just long passwords with (usually) low entropy. They still have the same problems... You have to have a separate passphrase for each account, and you have to trust the computer you're using not to log your keystrokes. I would much rather carry around a device that can authenticate me and never have to remember a password again.
Why don't we all just switch to USB tokens [rsasecurity.com] for authentication? You have one device that can authenticate you by generating an RSA signature without divulging any information that would allow someone else to pretend to be you. It amazes me that more people don't use these things. I've never used one, but have considered ordering one. Does anyone out there have experience with USB tokens? Is there a good model/brand to buy? Is it easy to get them to work with Linux and ssh? Do any brick-and-mortar stores sell them?
Encrypted Key Exchange protocols (Score:3, Informative)
These methods are immune to sniffing and offline dictionary attacks and don't require long passphrases to be secure. You just need a password
Passphrases are MUCH easier (Score:5, Informative)
1. Must contain at least 8 characters
2. Must contain at least 2 lowercase letters
3. Must contain at least 2 capital letters
4. Must contain at least 2 numbers
Since a lot of people cant grok this we start to see passwords like 34erdfCV. If you are using a QWERTY keyboard take a look at that password and tell me whats wrong with it.
Since I saw this article in a MS Security newsletter I've started using passphrases. Here is an example of my Windows Server 2003 administrator login (local only, not going to help you). "Rent is due on the 5th". Now I see many comments already talking about how that is so much harder to type than "34erdfCV" but I beg to differ. For me at least it is much easier to type a coherent sentense than a bunch of random letters and numbers.
This password is not only easy to type, but it is very secure. I'm sure some mathematician is going to come down on my with a bunch of stats about how I'm wrong and what not but just the fact that the LM hash is not stored when you use a password larger than 14 characters helps significantly. Sure you can tell windows not to store a LM hash by editing the registry but do you really expect all employees of a mid size company to follow directions that start out like "Click Start, then Run. Type 'regedit' and click OK"?
Now of course this isn't going to defend you against the ol' linux bootdisk trick, or that awesome "NT Password Recovery" bootdisk, which is basically linux which allows you to overwrite the password, but thats what NTFS and encryption is for. And if you've got physical access all bets are off anyway. At least you know they wont be able to run a rainbow table lookup on your LM hash and figure it out in a few seconds.
Also, passphrases are easier to remember, harder to guess, harder to figure out by watching someone type them, and if your really that dense you can just pick up a book off your shelf, turn to a page, type in the first sentense and remember the book and page number.
And there is an added bonus to having a passphrase over 14 characters that you are all completely missing here. When the hot chick in accounting sees you keying in some enormously long password she will think your smart and savy and will want to have hot sex with you right there in the server room.
Well, maybe not the hot chick and sex part.
Now, what would be a good long slashdot post without a question for you to ponder. If you havent figured yet I'm the sysadmin at this company and am trying my hardest to find a way to "sell" this passphrase idea. It seems that the easiest thing to do in IT is configure complex servers and firewalls and support ID10T's. The hard part is "selling" common sense stuff like SSL and passphrases.
"You mean we're going to have to add an 's' to the end of 'http', do you really expect 100 people to change their bookmarks! They've been using those bookmarks all year!"
Insight from other admins very welcome.
I've got a task for the security team... (Score:3, Insightful)
Passwords matter NOT AT ALL when you can just send a packet and get full admin access without any authentication step.
Who the hell else is better suited to innovate on security than Microsoft? We are to believe that they have 50,000 geniuses working there on groundbreaking amazing stuff... and the best thing they can come up with is a Java ripoff and a desktop search doodad? No. There are enough smart people there (or enough funds to create university research projects outside the softie-dome) to wow the world with some kickass new technology based on either genuinely new ideas, or old ideas that needed a lot of refinement to be usable on real code.
I suspect, though, that this is something they're unwilling to do because the design itself is inherently insecure, and securing it would mean breaking 99% of shipping apps. If that's true, it means that Bill's committment to security is just lip service. Please, Microsoft, break apps that use crappy backdoors. XP SP2 broke stuff to improve security, and that was the right decision. Apple had to do something similar with the Carbon transition (breaking old apps that correctly used well documented but ill-concieved APIs from the pre-OS X days). Microsoft could provide tools to help ISVs be compatible with a Longhorn "clean API" that doesn't let apps use deprecated, unsafe features from the bad old days of not caring about security.
Of course, they won't.
I can't type my 8 char passwords half the time (Score:5, Insightful)
Re:I can't type my 8 char passwords half the time (Score:4, Insightful)
This same jumble of characters I would think would do more to kill typing speed. Again, they're "fat fingering" it because they're not typing in natural letter combinations, so when the authenticator barfs, they slow down the next time and mash each letter slowly and methodically. I think it would be faster for most people that know how to touch type (hunt and peck management types are more or less boned) to type an 8 word phrase than an 8 character random mess.
You do have a point here, but "standard" grammar (not to mention spelling ;)) has a bad habit of widely varying over relatively narrow regions, particularly among languages like English that have very poorly defined grammatical rules. A locally-originating attack might have a chance of succeeding, but some hacker in Asia might have a harder time parsing a passphrase written by someone in the US Deep South.
Yah right (Score:3, Interesting)
Except for that Indian guy in the next office who never misses a key. Should have been a pianist.
This fella will probably suffer for disclosing (Score:3, Funny)
Multifactor auth is the only cure. I wish there was something available to implement it besides smartcards. Something that doesn't require a smart card reader and works everywhere, preferably something wireless within a few feet. You could do three-factor auth, even. This "something", pin code and biometric (fingerprint). That would be pretty darn cool.
Broken implementation, not broken technology (Score:4, Informative)
Everybody else mixes random salt bytes into passwords prior to hashing. Unix was doing this over 20 years ago. Modern systems use long (16+ character) salts that make precomputed hash tables infeasible for many years to come.
Some platforms use a better system [openbsd.org] still, that makes it more difficult for password guessers now and well into the future.
The only intrinsic problem with passwords is that people choose dumb ones, but again this can easily be fixed with a little technology [openwall.com]
What some companies are moving to (Score:3, Insightful)
It's getting crazy out there... (Score:3, Informative)
Come up with a tool to help users choose a quality password and have them change it less frequently. OS X has a password strength indicator which is accessible from the change keychain password dialog box. Click the little i button next to the ? button. It will measure the quality of your password.
We are working on SSO - Single Sign On because the users swamped the outsourced help desk with thousands of extra calls every month due to passwords getting locked out. Most users have an average of 12-20 passwords with admins having many more.
SSO should reduce the number of passwords to 4-5. We will also be implementing something like an RSA hardware key at the same time, this gives you two distinct checks.
Personally, I like the idea of a USB based device that works like a smartcard. Plug it in and type a high quality pass-phrase and then you can access everything and never type another password. Time it out with the screensaver. Auto-lock everything if you unplug the USB device.
If the USB key is lost, replace it and invalidate the keys that were on it. Of course, this sucks if the device is lost and you are traveling.
IBM's running an ad with a biometric scanner built into their ThinkPad's. Now that's an idea, the user can't lose their USB key or RSA token that way, just the whole laptop!
*gets notepad* (Score:3, Funny)
Thanks.
I don't think it's that simple... (Score:3, Insightful)
* As some already pointed out, sentences have a regular structure, where certain types of words go in certain places. That's a lot of predictibility. Almost every normal sentence begins with a capital letter... Uh oh.
* Sentences contain lots of spaces. Words in the English language are predominantly constructed of a very small group of letters; US TV viewers would know the normal suspects as those the contestants guess on the last round of Wheel of Fortune. Repetition is bad.
* Sorry, but sentence punctuation doesn't meet my requirements for possible permutations. Most sentences use only a period, and to a lesser extent, an apostrophe and maybe a comma. There are 29 non-alpha, non-numerical characters on my keyboard.
* My users have more than just a network logon, and not all of those programs accept long passphrases. There's an added possibility for confusion.
* Users are going to do things like forget which letters are capital (oh please - they're still confused by caps-lock), whether there is a comma in some space or not, and very likely lose their place with a long passphrase if they aren't expert typists. This creates frustration, and when users get frustrated, they do things like leave the machine logged on all day (even when they leave the room). And that creates headaches for me, because it's more likely that someone will sit at a logged-on machine than walk into my locked server room, log on as admin, and get a SAM or shadow-file dump off the server.
I like someone else's suggestion, although I don't recall who it was. Make the user type his new, complex password ten times. If I can memorize 20 complex passwords, my users can memorize one.
Typical Microsoft-style innovation (Score:3, Funny)
Patents pending.
This is the dumbest idea ever (Score:3, Insightful)
The average adult has a vocabulary of about 20k words, and actually uses much less than that on a routine basis. Let's be really generous, though, and assume we are dealing with highly literate people with a vocabulary of, oh say, 65536 words.
What you just implemented is a 16-bit character set, and your ten-word phrase is computationally equivalent to a twenty-character password in the 8-bit extended ASCII set.
You can complicate things by making it case sensitive, but I have a feeling that would be more trouble than it's worth with the average end user, who can't be relied upon to handle consistent capitalization. (Scroll up and down through the comments for pertinent examples.)
But it actually gets worse than this. Whereas a ten-character password consisting of random characters has no internal structure, natural language phrases and sentences do. Consequently, if you want to build a brute force password cracker for phrase-based passwords, you can save yourself a lot of time by checking the set of grammatically correct phrases first. After all, "now is the time for all good men to come to the aid of their party" is a lot more likely to be someone's passphrase than "sniffle upchuck defenestrate furry therefore pretense macro recoil lemon beyond". It's no objection to say that a formal grammar for English won't match everyday use; you can just use something like the SEQUITUR algorithm to build an approximate real-world English grammar from Usenet postings, the Wikipedia database, or Google.
In other words, all this extra effort accomplished was to convert a ten-character password into something a bit less secure than a twenty-character password. Or, in the real world, where end users will be using things like five word passphrases, you get something roughly equivalent to a three-character password.
That this idea was proposed in the first place is a perfect example of mistaking data for its representation.
Total number of possible passwords... (Score:3, Interesting)
Simple Strategy (Score:3, Interesting)
2: put them together
3: l337'ify it.
Example:
ViewSonic
\/][eW5()n|K
hard to crack, easy to remember.
Microsoft only has themselves to blame (Score:3, Insightful)
By the way, for those of you managing WIndows networks, make sure that you turn off the LanMan hashing system. Disabling this will do a lot to prevent a compromise of one single system in your network from turning into a cascading compromise of everything. N.B., this is only practical when you don't have Win9x-based OSes on your network, but those don't really belong on a corporate network anyway (easier said than done, I know).
All this being said, you have to be careful to not go too far with password security. The bad guys always go for the weakest link in the chain. If the hash and password strength requirements are too difficult to reasonably break through off-line cracking, then the bad guys will just get the passwords through keyboard loggers or inserting trojan shims into your password and authentication systems. After all, grabbing the password hashes is only practical given administrator access, so you have to assume that a bad guy can install a keyboard logger, too.
If you ban passwords in favor of PKI smart cards, biometrics, SecurID, one-time-passwords, or the other really complicated and expensive solutions, you still haven't done a great deal. The folks advocating these systems are either ivory tower types with little foundation in operational reality, or marketing droids trying to sell you something. Once again, assuming a bad guy already has administrator access to a system, he can wait until you authenticate to another system, and then take control. Remember, you are not authenticating to the remote server, you are allowing your workstation to authenticate to it. If you assume a potentially compromised workstation, then your fancy shmancy authentication system that cost you a bundle to implement just became almost as useless as passwords.
If you want to keep the bad guys from stealing or subverting your authentication mechanisms, then you're going to have to prevent the bad guys from getting onto the systems in the first place, including all of the workstations. Looking at yet another monsterous list of critical vulnerabilities released last Tuesday from Microsoft, it's pretty clear to me that Microsoft hasn't done a great deal to prevent successful remote attacks when they sold their software in the first place.
One Time Passwords. (Score:4, Interesting)
I use s/key or opiekey (depending on OS) for ALL my remote logins. Both of these programs use a pass phrase but (even better) this pass phrase is never transmitted across the network... encrypted or not. What happens is the pass phrase is used to generate a one time pass phrase.
In practice it looks like this:
ssh localhost
otp-md5 498 la7365 ext
Password:
I then open another window: type in
opiekey 498 la7365 ext
Using the MD5 algorithm to compute response.
Reminder: Don't use opiekey from telnet or dial-in sessions.
Enter secret pass phrase:
type my passphrase at the prompt and it spits out:
GIG DIRE EGG HISS HUB COOK
I type that at the password prompt and go on my way (cut and paste between xterms is best here). Even if I was not using an encrypted protocol the password is useless once it is used. You can even hit enter once so the phrase will be echo'ed back to you on the screen so you don't mistype it. Doesn't matter if someone reads over your shoulder because GIG DIRE EGG HISS HUB COOK will never work again.
Next time my password might be:
KNEW LARD ARGO LARD BARE YOGA
Or whatever. The point is that it is a mixture of pass phrases with the ability to avoid sending your pass phrase over an untrusted connection. You can even print out a list of the next 10 pass phrases you will have so you can log in from a computer where you wouldn't trust it enough to run the opiekey program.
How exactly is this an insecure linux system, at least in regards to passwords?
lol, besides that... I think pass phrases are a good idea. Just a little anoying at first.
Passphrases are no silver bullet (Score:5, Insightful)
Users hate passwords, they hate typing them, and they hate having to remember things. They will always opt for whatever is easy. They will hate you if you set a lower limit of 30 characters, and their passphrase was 28.
Passwords or passphrases - same thing - will be chosen easy the more obstacles you place on the users: Requiring users to change password every three months will leave your systems less secure:
Users will choose easier passwords, and/or they will rotate just two different passwords. No security gained.
Further, in the race with a bruteforce attack, nothing is gained unless you change your password to one that has been tried.
In stead, as the administrator you have a head start in the race with the crackers. Go password cracking and require users to change their password when it has been cracked.
If password is cracked too quickly it should be followed by disiplinary actions as a compromise of security. Ofcourse the users must be informed beforehand of such proceedures.
Just my 5euro-cent contribution...
This is outdated by 20 years (Score:3, Insightful)
UNIX used to keep the hashes publicly readable so non-privileged programs could check passwords (xlock), but this was abandoned years ago. On Kerberos, the password hashes are even stored on a separate authentication server.
Technically, the hashing is still done so that a privileged user would not be able to extract another user's password, but as in most machines the privileged user also has full access to everything else (in particular he could intercept the password in transmission) it does not matter much. In practice, when you can get at the authentication hashes you already have full access to the machine.
Also, dictionary attacks can be easily thwarted using the "salt", two bytes of random data that is added to the password before it is encrypted. So each password corresponds to thousands of hashes that you all have to store.
If you do not have the password hashes, the only way to break a password is trial-and-error, and most systems limit password entries to one every few seconds.
Network sniffing attacks are not limited by the length of the password, but by the length and complexity of the encryption keys which are randomly generated. Successful attacks on encrypted communications usually happen when these keys are chosen too short and not randon enough (WEP).
The truth is that even a simple password is relatively secure, and people touting complex password rules do so because they read 10 year old books.
Well, except if you use 20 year old software...
Re:Lol... did he think of this himself? (Score:2, Insightful)
Anyway, believe it or not, "ancient Unix systems" didn't use the same password machinery as what's in your Linux distribution.
Re:Why not a key? (Score:2, Insightful)
Re:As an IT admin I see the need for this. (Score:3, Insightful)
I type the equal of thousands of sentences each day.