Yahoo hack: Strong passwords don't have to be hard
Connecting state and local government leaders
The theft of Yahoo passwords, including those of government users, highlights the problem with weak authentication. But it doesn’t have to be that way.
I don’t think that anyone was really surprised when hackers posted 450,000 unencrypted passwords online in what they said was a wake-up call intended to help Yahoo and spur them into improving security. That’s like saying Al Capone “protected” Chicago businesses from fires, stray bullets and other “accidents.”
But the sad truth is that Yahoo joins the growing list of agencies and companies that have recently had their user data stolen or attacked.
Among the stolen passwords were several hundred with federal government e-mail addresses, ending in .gov or .mil, including some from the FBI, Homeland Security Department and Transportation Security Agency, the security company Rapid 7 told CIO.
Related stories:
Why so many bad passwords? Because the rules allow them.
Agencies want more than passwords for online users
In this case, it doesn’t really matter what your password was. Using an alpha numeric super string of numbers, letters and special characters wouldn’t have saved you because the hackers simply stole the database that stored the information, the same type of hack that affected the Sony PlayStation network not too long ago.
However, because these “good” or white-hat hackers posted all that data online, the users' dismal password security was front and center. The guys over at Cnet wrote a program to analyze and count all the different passwords, and the results were not very pretty.
More than 2,000 people used 123456 as their password of choice. Another thousand used “password” or “password” with a number after it to keep their data secure. Almost 500 people thought “welcome” would be a better choice. There were some funny ones too, like the 27 people who used “ncc1701,” which is the Starfleet designation for the USS Starship Enterprise. While not quite a common usage word, it’s relevant enough to make it into a password brute-force dictionary. And I would bet my last dollar that the hackers know the designation of the Enterprise. Call it a hunch.
Of course we all know the problem. We are forced to memorize the passwords to so many secure systems these days that a human can’t possibility keep track of them all unless they are exceptionally easy -- or all the same for every system we use. Or we write them down. All those options are exactly what we’re not supposed to do.
My colleague Greg Crowe recently reviewed RoboForm Anywhere, a program that lets users memorize one password and access all of their systems while remaining secure. The software does the hard work for you.
That can help, and recently I’ve been briefed on even newer token-based systems that work about the same way as RoboForm, but with the added requirement of a USB key drive or an app on your phone before a site can be accessed. The advantage there is that even if you give up your password, as can happen in a phishing attack, hackers can’t get into your account unless they have the token.
Of course, that means you can’t ever lose your phone or key drive either, but that is the only method that would have kept users totally safe in this Yahoo case, so it’s something to consider.
In the meantime, I’ve started using a password method that I think might make users a little more secure. I’m convinced that those programs that tell you how strong your password is are totally off base. What they do is estimate the degree of randomness, or entropy, exhibited by the string of characters. But password-cracker programs follow those same strategies, first searching through dictionary words, then adding numbers to the guesses then trying combinations of words.
So a password like “Green1!” would be considered strong by most programs because it uses capital and lower-case letters, a special character and a number. But it’s not. I used a cracker program on a fast computer and it was able to come up with that password in about a day.
But if you instead come up with a passphrase, a seemingly random string of words that mean something to you so you can remember them, it becomes almost impossible to crack. I used “daily newspaper computer calico” and the cracker is still trying to find out what it is, even though it’s all lowercase letters. I don’t suspect it will ever finish.
In case you don’t believe me, those funny guys over at XKCD have proved this mathematically -- and in a funny way. If they are correct, my computer should crack that password in about 500 years! Regular users can’t do much to protect the backend databases, but personal passwords are in your hands. Don’t fumble.