3 ms·

There's a widespread misconception that cryptic, hard-to-remember passwords are more secure. That's why people do foolish things such as displaying credentials

There's a widespread misconception that cryptic, hard-to-remember passwords are more secure. That's why people do foolish things such as displaying credentials on mega-TV screens. Forget words. Use memorable, unique phrases. It's not a new concept, but it's worth repeating, considering that we're still using the term "password" in 2014. http://www.codinghorror.com/blog/2005/07/passwords-vs-pass-phrases.html http://www.codinghorror.com/blog/2005/07/passwords-vs-pass-p...

drdaeman 13y ago
You're right. But it just reminded me of this fact: "Most people use passwords. Some people use passphrases. Bruce Schneier uses an epic passpoem, detailing the life and works of seven mythical Norse heroes." Jokes aside, I'd really prefer if we'd ignore passwords and passphrases (and passpoems) altogether, leaving them for emergencies, and generally switch to keypairs and, preferably, hardware security tokens.
- lstamour 13y ago
  Or you know, set individual credentials for each authorized user. So they remember their own passwords and can be better tracked. Just sayin'. 2FA is a bonus in that scenario. Edit: keypairs works too. Doesn't change the advice.
- mkaito 13y ago
  What exactly is keeping the world from turning a regular flash drive into a security token, and actually using it?
  - fragmede 13y ago
    What's to stop me from copying the security token files from my flash drive to my laptop?
  - drdaeman 13y ago
    Not flash token but a proper HSMs. They're quite common. Many laptops have TPM modules, popular SoCs (like nVidia Tegra) have them too, and most modern motherboards at least have a socket for one. Yet, the only use of them I've ever seen is validating the boot chain's integrity. Also, USB tokens are not common in users' possession, but if necessary I believe you could get one within a day. It just need a little push from software vendors. Imagine your OS or browser says "Hey, do you want to secure your credentials? Here's how...". Or just start with an option "use hardware security token" somewhere under settings - while of less impact than active suggestion, it will still strike users curiosity and start things moving bit by bit.
mikevm 13y ago
Instead of running a dictionary on words, password crackers will run dictionaries on phrases (concatenated words). So in essence 1 word becomes equivalent to 1 character and since people will probably use less than 10 words these passwords might be easier to crack.
- DanBC 13y ago
  Diceware uses a known list of 7776 words. Imagine a 6 word phrase. 7776^6 = 2.2107391972073e+23 That's pretty good and that's only six words from a list of published words.
  - ultramancool 13y ago
    log_2(7776^6)=77.5 bits of strength. Not too bad, but I wouldn't use it for anything cryptographic with local attack potential. If you want phrases to work properly, just put 1 (or many) non-dictionary word in them. This means the attack has to go to an alphabetic one instead of a phrase one, making it _much_ more painful.

drdaeman 13y ago

You're right. But it just reminded me of this fact: "Most people use passwords. Some people use passphrases. Bruce Schneier uses an epic passpoem, detailing the life and works of seven mythical Norse heroes." Jokes aside, I'd really prefer if we'd ignore passwords and passphrases (and passpoems) altogether, leaving them for emergencies, and generally switch to keypairs and, preferably, hardware security tokens.

lstamour 13y ago
Or you know, set individual credentials for each authorized user. So they remember their own passwords and can be better tracked. Just sayin'. 2FA is a bonus in that scenario. Edit: keypairs works too. Doesn't change the advice.
mkaito 13y ago
What exactly is keeping the world from turning a regular flash drive into a security token, and actually using it?
- fragmede 13y ago
  What's to stop me from copying the security token files from my flash drive to my laptop?
- drdaeman 13y ago
  Not flash token but a proper HSMs. They're quite common. Many laptops have TPM modules, popular SoCs (like nVidia Tegra) have them too, and most modern motherboards at least have a socket for one. Yet, the only use of them I've ever seen is validating the boot chain's integrity. Also, USB tokens are not common in users' possession, but if necessary I believe you could get one within a day. It just need a little push from software vendors. Imagine your OS or browser says "Hey, do you want to secure your credentials? Here's how...". Or just start with an option "use hardware security token" somewhere under settings - while of less impact than active suggestion, it will still strike users curiosity and start things moving bit by bit.

mikevm 13y ago

Instead of running a dictionary on words, password crackers will run dictionaries on phrases (concatenated words). So in essence 1 word becomes equivalent to 1 character and since people will probably use less than 10 words these passwords might be easier to crack.

DanBC 13y ago
Diceware uses a known list of 7776 words. Imagine a 6 word phrase. 7776^6 = 2.2107391972073e+23 That's pretty good and that's only six words from a list of published words.
- ultramancool 13y ago
  log_2(7776^6)=77.5 bits of strength. Not too bad, but I wouldn't use it for anything cryptographic with local attack potential. If you want phrases to work properly, just put 1 (or many) non-dictionary word in them. This means the attack has to go to an alphabetic one instead of a phrase one, making it _much_ more painful.