GCN LAB IMPRESSIONS

Yahoo hack: Strong passwords don't have to be hard

I don’t think that anyone was really surprised when hackers posted 450,000 unencrypted passwords online in what they said was a wake-up call intended to help Yahoo and spur them into improving security. That’s like saying Al Capone “protected” Chicago businesses from fires, stray bullets and other “accidents.”

But the sad truth is that Yahoo joins the growing list of agencies and companies that have recently had their user data stolen or attacked.

Among the stolen passwords were several hundred with federal government e-mail addresses, ending in .gov or .mil, including some from the FBI, Homeland Security Department and Transportation Security Agency, the security company Rapid 7 told CIO.


Related stories:

Why so many bad passwords? Because the rules allow them.

Agencies want more than passwords for online users


In this case, it doesn’t really matter what your password was. Using an alpha numeric super string of numbers, letters and special characters wouldn’t have saved you because the hackers simply stole the database that stored the information, the same type of hack that affected the Sony PlayStation network not too long ago.

However, because these “good” or white-hat hackers posted all that data online, the users' dismal password security was front and center. The guys over at Cnet wrote a program to analyze and count all the different passwords, and the results were not very pretty.

More than 2,000 people used 123456 as their password of choice. Another thousand used “password” or “password” with a number after it to keep their data secure. Almost 500 people thought “welcome” would be a better choice. There were some funny ones too, like the 27 people who used “ncc1701,” which is the Starfleet designation for the USS Starship Enterprise. While not quite a common usage word, it’s relevant enough to make it into a password brute-force dictionary. And I would bet my last dollar that the hackers know the designation of the Enterprise. Call it a hunch.

Of course we all know the problem. We are forced to memorize the passwords to so many secure systems these days that a human can’t possibility keep track of them all unless they are exceptionally easy -- or all the same for every system we use. Or we write them down. All those options are exactly what we’re not supposed to do.

My colleague Greg Crowe recently reviewed RoboForm Anywhere, a program that lets users memorize one password and access all of their systems while remaining secure. The software does the hard work for you.

That can help, and recently I’ve been briefed on even newer token-based systems that work about the same way as RoboForm, but with the added requirement of a USB key drive or an app on your phone before a site can be accessed. The advantage there is that even if you give up your password, as can happen in a phishing attack, hackers can’t get into your account unless they have the token.

Of course, that means you can’t ever lose your phone or key drive either, but that is the only method that would have kept users totally safe in this Yahoo case, so it’s something to consider.

In the meantime, I’ve started using a password method that I think might make users a little more secure. I’m convinced that those programs that tell you how strong your password is are totally off base. What they do is estimate the degree of randomness, or entropy, exhibited by the string of characters. But password-cracker programs follow those same strategies, first searching through dictionary words, then adding numbers to the guesses then trying combinations of words.

So a password like “Green1!” would be considered strong by most programs because it uses capital and lower-case letters, a special character and a number. But it’s not. I used a cracker program on a fast computer and it was able to come up with that password in about a day.

But if you instead come up with a passphrase, a seemingly random string of words that mean something to you so you can remember them, it becomes almost impossible to crack. I used “daily newspaper computer calico” and the cracker is still trying to find out what it is, even though it’s all lowercase letters. I don’t suspect it will ever finish.

In case you don’t believe me, those funny guys over at XKCD have proved this mathematically -- and in a funny way. If they are correct, my computer should crack that password in about 500 years! Regular users can’t do much to protect the backend databases, but personal passwords are in your hands. Don’t fumble.

 

Reader Comments

Mon, Jul 16, 2012 CJ

Not to mention, by the time you add the common "two upper case, two lower case, two numerals, two special characters and no spaces" restriction on a twelve character password, you've actually reduced the number of possible passwords by over 99%

Mon, Jul 16, 2012

Nice idea, but most systems force you to use at least one captital letter, one lower case letter, one number, one symbol wtih some requirement for length, typically 15 characters in government. So pass phrases are not that simple to implement in the real world as we have it today...

Mon, Jul 16, 2012 Mark Jaeger Lansing, MI

I'll never forget my original Compuserve password: collie.style (only two words and a special character) -- so are you saying that simpler is better?

Mon, Jul 16, 2012 earth

Another letter substitution is to move your fingers to different home positions when putting in the phrase. This can add numbers and special characters if you move them up and have capital letters in the phrase. And you can try alternating first and second letters with every first letter assumed to be capital. Get creative with yourself.

Mon, Jul 16, 2012 Skipp

Don’t you think creating “safe” or “strong” passwords is kind of a moot point? People need to understand that neither the strength of your password or having it locked-up in Fort Knox will mean anything when it is stolen from the source! The only real solution is to add additional layers of authentication for access and transaction verification without unreasonable complexity and this will of help to their customers if they implement some form of a two-step or two-factor authentication were you can telesign into your account and have the security knowing you are protected if your password were to be stolen. You might want to spent more time encouraging users to opt-in for this since it is available to their users and is called “second sign-in verification”? It is not promoted but it is available.

Show All Comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above