10 ms·

The Worst Password Tips

• casca 14y ago
  TL;DR: * Simple Substitution < Add a whole word * First Letters from a Phrase < Take the 3-4 words from a common phrase, add some punctuation * Random Password Generators < longer password * Personal Algorithms < longer passwords
• casca 14y ago
  While this list is not unhelpful, the most likely risk is that your password will be captured when a single site that you've signed up to is compromised. This means that the most important password choice you can make is to have a completely different password on every site.
  • jiggy2011 14y ago
    Or, of course a keylogger which will can just sit on your PC until it's got them all.
    • NateDad 14y ago
      That requires that you do something stupid to get a key logger installed on your machine. And yes, in that case you're screwed. However, you're far less likely to have that happen than some random site you're on getting hacked. You are one target, the site is thousands or millions.
      • RexRollman 14y ago
        Out of curiosity, would a key logger be able to capture of the contents of a cut and paste? I currently use 13 character randomly generated passwords and, usually, I don't type them in manually.
        • damncabbage 14y ago
          A hardware keylogger, sitting between keyboard and machine? No. A software trojan, that can capture keystrokes, mouse movements, selected text, screenshots... Most certainly yes. :(
        • nwh 14y ago
          If you're storing them in plain text, then they can grab them regardless. If you're storing them in lastpass, then they can grab them regardless. If you're storing it in an encrypted partition, then they can grab them regardless. Once somebody has access, it's game over.
      • jiggy2011 14y ago
        Would be interesting to know if there's any research on the number of site compromises vs desktop compromises. There are still plenty of computers out there that are probably running vulnerable versions of Flash/Java etc. I imagine one of the biggest incentives to hack some random blog is to infest it with drive -by malware and compromise a bunch of machines if it has high traffic. Also if you have a keylogger on a machine you can look for things that might be site admin passwords. So it wouldn't surprise me if there was a relatively symbiotic relationship.
  • undantag 14y ago
    I usually recommend supergenpass to friends for this particular reason. Some prefer stuff like keepass that let's them store everything - i'm happier to rely on an algorithm. Key point is to make using different passwords in different places really simple, so that people do it.
• jiggy2011 14y ago
  Not so sure about #3 (random password generator). This might be true in the case of a true brute force where each attempt is almost free, such as somebody getting your password from a database secured by a single round of md5. In reality, most brute force attacks are attempted remotely where there is a bottleneck in terms of bandwidth and many services are rate limited. In such a case it would always make sense to try the most common passwords first. The problem with letting people choose their own passwords is that most people just aren't that good at it and will choose stuff like p4ssw0rd1982, because people's minds are somewhat similar they will tend to converge on similar "good" passwords. I ran an IMAP service for a time. We would constantly get bots attempting to brute force email accounts, we had fail2ban set to ban them after 5 attempts but they could get more guesses simply by having a lot of IP addresses. When I looked at the sort of passwords they would try they didn't start with aaaa and move on from there, they would start with stuff that looked like it had been pulled from a common password list. About once every 3 months we got a call from somebody who's email had been hacked. They all insisted that they were using strong passwords that nobody could have possibly guessed, however when I enforced a strong password policy on the server and offered a random password generator these problems went away.
  • rquantz 14y ago
    Correct me if I'm wrong, but aren't you describing a dictionary attack, not brute force?
    • jiggy2011 14y ago
      I guess I just see a dictionary attack as a subset of brute force in that it's still a pretty naive attack, but it's not raw brute force. OTOH I don't see why anyone would bother using a raw brute force attack against a password rather than just grabbing a dictionary of the most common passwords and exhausting those first. In reality you are likely to run out of guesses before you hit the end of a common password list anyway.
      • ams6110 14y ago
        A good system should take a significant but not intolerable amount of time to reject a bad password. Just a few seconds will impose a huge burden on a remote dictionary attack, while not diminishing the experience for a user who legitimately fat-fingers a password. Also use fail2ban to impose a lockout after a certain number of failures. The lockout does not have to be permanent, it just has to make a remote dictionary attack so time-consuming as to be infeasible (of course this does open up a DOS vector, depending on how you implement the lockout).
• jere 14y ago
  >Better advice: Use a long password rather than a random password. facepalm. You can't use both? I do. This is horrible advice if taken on face value. To be fair, the author mentions things like KeePass. Use that. Make very long, random passwords. >See, when it comes to a brute force attack, entropy makes no difference at all, because a brute force attack is a sequential attempt at every possible password, starting with the shortest first. I think this is the biggest misconception regarding passwords. If we're using the phrase "brute force" literally, then yes. But if I were to write a cracker, I wouldn't be limited to that. The first thing it would do is grab the low hanging fruit. Examples: 1. Regarding the post, check all variations of a single digit repeating (say up to 100 times) in 1000 attempts. That's faster than I could check all variations of 2 character alphabetic passwords. 2. Check the same thing, but with all common keys on a keyboard layout (e.g. $$$$$$): < 10,000 attempts 3. Check common words in english dictionary: ~100,000 attempts 4. Check 10,000 most commonly used passwords: 10,000 attempts Let me stop here and say that I can check ALL of the above in less time than it would take to check all variations of 3 characters using alpha, numeric, and common special characters. To put it another way, I could grab all that low hanging fruit in a billionth the time it would take to grab all the passwords in the "weak" format (8 random characters) given by the author. What I have come up with above is my armchair ramblings. For some people, it is THEIR JOB to break your password. Please don't think you're going to create a good password by being clever. And please stop dismissing the issue by repeating the words "brute force"
  • NateDad 14y ago
    Yes,thank you. Exactly what I was thinking. Anything you can think of as an algorithm, someone else can think of too, and then they can test that instead of going through billions of combinations. There's only two good pieces of password advice: Use long, randomly generated passwords (16+ characters). Don't use the same password on more than one site. This can be accomplished with KeePass, LastPass, and there such utilities.
    • dkersten 14y ago
      My LastPass master password is a randomly generated long password containing upper and lowercase letters, symbols and numbers. Yes it was difficult to memorize, but its the only password I need to remember. Everything else uses a random unique password that I don't have to remember.
• Samuel_Michon 14y ago
  Relevant XKCD: http://xkcd.com/936/ http://xkcd.com/936/
  • laumars 14y ago
    That's another common misconception as that advice is only true for brute force attacks, which are usually only the last resort for password crackers. Dictionary attacks are pretty sophisticated these days so I really wouldn't gamble on a short list of common words being secure these days.
    • marcosdumay 14y ago
      If you think Randal calculated the entropy wrong, state so, and show the error. Your argument from incredulity won't add anything to the discussion.
      • laumars 14y ago
        I did state so. You're still thinking in terms of brute force attacks but actually dictionary attacks are more common as they rattle off the 'low hanging fruit' much quicker. The danger of using common words like Randall did is that they might be in the dictionary so get cracked even before the attacker attempts to brute force the remainder of the passwords from a stolen database. In fact around half of the passwords people pick are vulnerable to such attacks (i'm on my phone though so can't easily cite a reference (I'm out of town this weekend) but it averages at either 40% or 60% of passwords use "guessable" / common terms) If Randall has thrown in some punctuation and numbers then he's reducing the odds of that password being cracked. But as the example stood, it's advertising complacency against the most common method of modern password cracking.
        • dllthomas 14y ago
          Um, no. It is absolutely the case that dictionary attacks are better than per-character brute force against the passwords Randal suggests, but he's not calculating entropy based on per-character brute force. He's calculating entropy based on per word brute force, and if the words are in fact chosen randomly that's the best you can do. Any dictionary attack against XKCD-style passwords are a brute-force attack in word-space. "Throw[ing] in some punctuation" does comparatively little.
• guard-of-terra 14y ago
  The worst password tip is using a password-protected system in the first place. Passwords are neither theoretically or practically reliable. They off-load security to the user, who is the weakest part of all the scheme obviously. Who is obviously uncapable of remembering by heart dozens of long passwords of random gibberish. We should know better than use passwords.
  • simonbrown 14y ago
    What should we use instead?
    • guard-of-terra 14y ago
      Something based on public key cryptography. Private keys contained in some kind of protected device where they can't be easily stolen from. Or, even better, distributed.
      • gnosis 14y ago
        Are you going to protect your private key with a password? Or are you recommending we use password-less private keys? Also, please let me know when you've convinced the major banks and web service providers to use public key cryptography instead of passwords.
        • guard-of-terra 14y ago
          I'm going to store my private key in an arrangement you can't read it from even if you control the system. For stupid services we can generate long random passwords, store them along. Not bothering the user with that.
• aetherson 14y ago
  There is certainly some truth to this post, especially right at this moment in time. But it's the most exuberant example I've yet seen in a new category of bad password advice, to ignore everything but length. A truly random eight character password containing upper and lowercase letters and digits is a keyspace of size 2x10^14. A four word passphrase containing random words selected from a 5000 word dictionary is a keyspace of size 6x10^14. They are comparable. Right now, since almost everyone uses short passwords, length gives you amazing protection, because attacks are geared to find the common short password. But to the extent that the tech elite convinces the world to move to longer passphrases, that will quickly stop being true. It's no harder to program a brute force attack to try phrases of very common words, or very long, very low entropy phrases of other sorts (to be or not to be), than it is to try variations of dictionary words. To the extent that we are giving people advice on security, it should be advice that is robust against the possibility of its own success.
  • deleted 14y ago
    [deleted]
• tete 14y ago
  It is safe to use dictionary words: http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html
• drucken 14y ago
  Not good advice. 1. Use a different password for every application, especially every site. 2. Use a strong random password generator, typically software, to generate your passwords. The first tip, which is not mentioned at all by the article, is particularly critical.
  • olivier1664 14y ago
    I'm a human: I'm too dumb to rememer more than some passwords (even worst if they must be 16 letters long). And I'm too lazy to use a software to manage my passwords. And worst of all, now, I've my bad habits with passwords. The password problem is here to stay...
• kingkawn 14y ago
  It's a subjective impression, but it seems that most password compromise comes from phishing not brute force cracking. Maybe those are just the ones that make it into the media.
• bizarref00l 14y ago
  echo "mykitten name"|sha1sum. will get me a very good password?
  • dllthomas 14y ago
    Not if anyone knows that's what you're doing (or can guess because others are doing similar). It would be slightly better than the bare string in terms of crackability, because running the hash would take some time if they're doing it live, but only slightly.
• Bloodwine 14y ago
  I disagree with his "First Letters from a Phrase" point. I find mnemonic passwords very useful and keeps me from having to open up KeePass every time I want to log in to a system because I can't remember the random password. I agree that longer passwords are better, which is why I use very long phrases to generate my mnemonic passwords (typically 20-26 characters in length).
  • dllthomas 14y ago
    I find "first letters from a phrase" harder to type than the phrase itself, because it doesn't behave like the rest of the typing I do. Given that it also has less entropy (necessarily, because of collisions), why not just type the whole phrase?
• pbreit 14y ago
  I've used the same 6/8 char passwords (no symbols or caps) where possible for the past 20 years or so with no discernible problems. I'm not sure what to make of this post beyond relief that I don't make myself miserable trying follow such guidance.
  • freditup 14y ago
    And sure, let's say in 90% of cases using the same 6 char password for everything is okay. But let's take a not unlikely scenario - one website that you frequent is compromised and an attacker gets an unsalted hash of your password. Because your password is so commonplace, they can easily get it as well as a lot of other users' passwords. Now for every password and email combo they have, they try to log onto a google account or bank account with the same information. Since you use the same password everywhere, they succeed. You're essentially now screwed and the attackers could do all kinds of devastating things. Perhaps you say the scenario is unlikely - I'd say it happens more often then you would think. And this is the case where you're not even being individually targeted. Overall - a little preventative action is hardly a burden and goes a long way to securing yourself online.