xkcd - password truth

[nudone]

This password epiphany seems to be popping up in several news articles recently. Here's xkcd's take on it.

http://xkcd.com/936/

[Renegade]

YAY~!

+1 for pass-phrases~!

tryandguessthismuther******!

[Deozaan]

I like pass-phrases. 

[worstje]

Problem with pass-phrases is that people will take way too obvious stuff. (The comic is clearly the exception!) For example, you can expect mouser to use 'I like silly acronyms.' or in kyrathaba's case 'nany 2012 hangman YEAH'. Or JoTo... 'Thank God It's Friday'.

This is only going to work if people use unpredictable things. For one, you can expect half the xkcd readers to use 'correct horse battery staple' from now on. Or 'import antigravity'. Or other meme-ish catchphrases.

Finally, it pays off to think that mere bits of entropy are not the defining characteristic when discussing password safety and the likelihood that it may be guessed. For example, suppose a user is english. That brings it to 26 letters plus a space character, assuming the random-string-of-words-thing and that people are likely to stick to lowercase. Assume that 30 characters is a good compromise for a password one has to type in, so you get 27^30 = 2.4244 * 10^36 different permutations. Sounds good, right?

Now throw in social engineering. Psychology. User idiocy. Someone looking over someones shoulder and spotting 30 little password characters being typed, or that only lowercase letters are typed. Maybe you think out loud while you're typing! (I wouldn't, but such idiots exist...) Long story kept short: once you are able to glean just a little bit of information about the format of a password, the effective entropy in the eyes of an attack is reduced significantly. Requiring a user to put in one or two odd characters may seem difficult, it prevents predictability and also prevents a brute-force attack that uses dictionary contents as its source from speeding things up. (Think about it: there are far more strings of letters that aren't words than there are actual words.) Likewise, asking for my mothers maiden name isn't a given to gain access to my email anymore; you at least have to figure out what blend of leetspeak I throw at it. (And password recovery schemes with such fixed questions, or equally constrained answers are an equally horrid disaster, but in this case I was implying my email password might be m4rgret.) Or maybe her year of birth. Etc.

While it may be a wet-dream to expect the full 8 bits/byte (=256 'characters') to be usable in a password, reducing it as many password systems do to merely (26*2 letters +10 numbers + underscore + space) = 64 is a security disaster. Every extra bit of entropy doubles the problem space, and in case of a words and letters you can sooner think in factors of 26 or higher! Even worse, programs/websites half the time demand more than 5 and less than 12 characters. Why not allow 30 characters? All those requirements are little more than a gift for your enemies.

Anyhow, for so far that rant. My point is coming up... Pass-phrases are nice. Digits and weird characters are nice. But seperately, they are weak in the eyes of modern bruteforcing and even social engineering. One is slightly stronger than the other in different aspects, but neither is ideal. But combining them is damn orgasmic for your security. The xkcd examples would skyrocket in complexity, just try the math for yourself.

[Renegade]

12 character limits on passwords is just idiotic. I will never understand how/why some admins come to the conclusion that they should have such small limits like that. If someone wants to have a 123 character password, all the more power to them. At the moment, I think 500 is a good limit. You need to store it, and you're pretty much going to use an nvarchar field anyways, so 500 seems good. I don't know if it could impact performance, but I somehow doubt it. People store ntext fields and blobs... 500 is nothing.

Steve Gibson has some strong password stuff, but really, it's insanely large and impossible to remember. I take it that anything over 8 random characters begins to approach insanity (the higher it goes) for casual use. 64 random characters (last I checked)... Yikes... You can only use that with something like Keypass or ALPass.

[KynloStephen66515]

For the majority of my passwords, I use a variation of my primary one, which is a 32 character password, with some characters from the website, or services' name placed into certain points of the password.

Secret answers never represent the actual question and are usually random sentences (depending on haracter limitation)

Hack that you b***ards 

[rjbull]

I used to use the registration letters+numbers of cars I used to own, but own no longer, concatenated together as necessary.

[Tuxman]

When I was young (tm), I used a German slang word for most of my "old" stuff. Newer versions add some random garbage, even never versions have something completely different ...

A "password" is, basically, a word to pass. Could you imagine Indiana Jones in front of some magic wall or something, spelling "/&jJ"4"(=\}lÖ"?

After all, there's LastPass.  

[Edvard]

I have learned many things from xkcd, but the most important lesson on password security I have EVER learned, I learned from LulzSec:

Your password is only as secure as the server it's stored on.

OK, having a password like "password" or "1234" is stupid, but let's face it, once a nefarious individual gets into the system, it doesn't matter one flipped bit whether you keep one password or a hundred, use Keepass, Lastpass, etc. or if your password is "mickey mouse" or "1h&3bo(8tH45Tew9@hGn=p]#6b".
What does matter is how your password is stored and accessed at the security point.

That said, I use personally use reasonably complex matrix-based passwords (so they're easily remembered) to prevent 'casual' hacking of outside resources, but my home router is locked down enough that I feel confident using a very simple password for my desktop login, just for convenience.

Much has been said regarding plain text vs. encrypted vs. client-side authorization via encrypted hash (or something like that), and I am now in the process of taking up the issue with any company, individual or group that has any claim on any information I would like to see secured.
My bank, my email provider, my social networks, everything.

So then, Mouser old buddy... how secure are the DC passwords?

[mahesh2k]

[40hz]

I usually go with a pass phrase except I'll prefix or follow it with a number and punctuation mark; and capitalize one letter somewhere in it. I do this to satisfy the occasional "complexity" policy you encounter on some servers.

FWIW, 'obsolete' or archaic spellings, words, and phrases (ex: He ferde as freke were fade and oueral enker grene...) provide some good raw material when choosing pass phrase elements. So now you finally have a use for what you learned when you studied The Canterbury Tales or Gawain and the Green Knight back in 'English Lit' class. Wow! Aren't you glad you paid attention?  

For my password on any of my client's machines I'll go with the longest and most complex 'true random' password the system will allow, and use a password manager app to remember it.

But in the case of a client system, this is more a CYA move on my part. That way, if anybody ever did get in masquerading as me, nobody could say it was because their 'Computer Guy' used a weak password.

[nudone]

Anyone have any thoughts on how safe Roboform is (or other password managers too).

I mean, if they are really, REALLY, safe then I'll stop being too concerned. Of course, I understand it's their business so they are SURE to be safe - aren't they. Aren't they? 

[cyberdiva]

So now you finally have a use for what you learned when you studied The Canterbury Tales or Gawain and the Green Knight back in 'English Lit' class. Wow! Aren't you glad you paid attention? 

Oh, darn!  I wish I had known this umpteen years ago when I read these.  Then again, umpteen years ago, I didn't have to think about secure passwords.  My typewriter didn't need them. 

[40hz]

Anyone have any thoughts on how safe Roboform is (or other password managers too).

I mean, if they are really, REALLY, safe then I'll stop being too concerned. Of course, I understand it's their business so they are SURE to be safe - aren't they. Aren't they?  

To a certain extent, you need to trust what you're being told by the publisher. That, and what you hear bone fide security experts saying about a given product.

In the case of Keypass (which I use) the source code is available so you can verify what it does and how it does it. Something that can't be done with a closed source app.

That being said, most publishers who do products like RoboForm go out of their way to make sure they deliver on their promises of properly implemented and secure code. So if you're dealing with a reputable product, you're at least as secure as most people would be if they were using an open source app. Because let's face it - how many people really do examine the source code of the FOSS apps they use? And even more to the point, are they qualified enough coders with enough background in encryption methodologies to have sufficient expertise to pass judgment on the source code if they do?

Probably not.

So it's back to how much you trust the publisher - and what the word is out on the street.

FWIW I trust Keypass and its Linux variant KeyPassX.  

[40hz]

So now you finally have a use for what you learned when you studied The Canterbury Tales or Gawain and the Green Knight back in 'English Lit' class. Wow! Aren't you glad you paid attention?  

Oh, darn!  I wish I had known this umpteen years ago when I read these.  Then again, umpteen years ago, I didn't have to think about secure passwords.  My typewriter didn't need them.  

Yeah. I hear you. Simpler times...

For real security, all you had to do was to lock up the original and copy. And destroy the carbons and ribbons if you were truly paranoid.

No joke either. My old man worked for a DoD contractor that pulled the ribbons from every typewriter every night and locked them in a vault. They passed them back to the secretaries and typists (remember those?) when they returned in the morning. They actually made them sign them in and out! Now THAT'S being paranoid.

[Lashiec]

Anyone have any thoughts on how safe Roboform is (or other password managers too).

I mean, if they are really, REALLY, safe then I'll stop being too concerned. Of course, I understand it's their business so they are SURE to be safe - aren't they. Aren't they? 

There's no such thing as really safe, only safe for the time being . So, for the time being, you'll have to trust their claims, even if the source code is available, which without proper code auditing means nothing.

So, anyway, passphrases and password managers for the win. And hope the services you use don't store the password in clear text or use weak cryptographic schemes.

[Renegade]

Necrothread~! RISE, THREAD RISE~!

Just saw this:

http://blogs.avg.com/consumer/p4ssw0rd-myth/

It’s nothing new that there are bad people out there on the internet who, if they should get the chance, would steal your personal details and your banking ones too.

The news is full of hacking these days, with companies, multinational organisations, governments and individuals on the receiving end of some pretty serious privacy breaches.

Obviously, most of us don’t have a say in government or company security policy so it’s up to us to keep our own digital lives safe and while this can involve a number of steps including both software and hardware, it often comes down to passwords.

Your password is your basic online defence, the key to much of your information. We at AVG and other security experts recommend you to use a different password for each site (or at least a few variations) limiting any damage were your password to be compromised. However, we understand that most people aren’t overly worried by hacking and multiple passwords can be difficult to remember.

Interestingly, randomly generated passwords have become all the rage over the last few years and we at AVG have recommended passwords with a mix of characters and symbols. Sometimes these come in the form of passwords that are generated completely at random such as PhuR7Tr$.

More at the link.

Yeah, old, but on topic and still valuable.

[40hz]

I saw a portable app some time ago (can't remember where) that generated a very long and complex password out of a passphrase and a number you keyed into it. So if you entered something like: Eta kooram nah smech, and a number like: 314159 it would return a string like: r=+-~/[$=a^LADwR0t%W&JT011\b9^A~qrIgvvC]_tgY&f,P0;cO*ZfwD`r&(c. You could then copy and paste it as needed.

You could specify the length of the generated string. And there were checkboxes to select what type of characters (i.e UC, LC, number, symbol) to allow in the string.

Anybody know the name of this app?

[TaoPhoenix]

I saw a portable app some time ago (can't remember where) that generated a very long and complex password out of a passphrase and a number you keyed into it. So if you entered something like: Eta kooram nah smech, and a number like: 314159 it would return a string like: r=+-~/[$=a^LADwR0t%W&JT011\b9^A~qrIgvvC]_tgY&f,P0;cO*ZfwD`r&(c. You could then copy and paste it as needed.

You could specify the length of the generated string. And there were checkboxes to select what type of characters (i.e UC, LC, number, symbol) to allow in the string.

Anybody know the name of this app?

Oh Oh I know this one!

http://www.youtube.com/watch?v=IPphyjkXnPc

[40hz]

I saw a portable app some time ago (can't remember where) that generated a very long and complex password out of a passphrase and a number you keyed into it. So if you entered something like: Eta kooram nah smech, and a number like: 314159 it would return a string like: r=+-~/[$=a^LADwR0t%W&JT011\b9^A~qrIgvvC]_tgY&f,P0;cO*ZfwD`r&(c. You could then copy and paste it as needed.



You could specify the length of the generated string. And there were checkboxes to select what type of characters (i.e UC, LC, number, symbol) to allow in the string.

Anybody know the name of this app?

Oh Oh I know this one!

http://www.youtube.com/watch?v=IPphyjkXnPc

[attach]

[Jibz]

I love this comic .. it has made half the internet remember that one four word combination. I think what it fails to tell you is that if you have more than five of these random four word passwords, they are almost as impossible to remember as random ones. Unless you have some system to relate the words to the actual site, but then, of course, they are no longer random words, and the number of effective bits starts shrinking.

Btw, for all the patent haters (via NH):

https://xato.net/passwords/want-to-block-common-passwords-sorry-that-is-patented/

[Renegade]

I love this comic .. it has made half the internet remember that one four word combination. I think what it fails to tell you is that if you have more than five of these random four word passwords, they are almost as impossible to remember as random ones. Unless you have some system to relate the words to the actual site, but then, of course, they are no longer random words, and the number of effective bits starts shrinking.

Btw, for all the patent haters (via NH):

https://xato.net/passwords/want-to-block-common-passwords-sorry-that-is-patented/

And for those that do not hate patents yet, after you read the above article, you will. (Or there is something profoundly bizarre in your idea of what "non-obvious" means. )