05:54 PM

Passwords: Tips For Better Security

You can make your passwords more secure if you follow a few simple rules: Don't reuse passwords, make them long and random, and don't be afraid to write them down, say security experts.

Strategic Security Survey: Global Threat, LocalPain
Strategic Security Survey: Global Threat, Local Pain
(click image for larger view and for full slideshow)
How safe are your passwords?

The LulzSec hacking group may have ceased its 50-day hacking spree, meaning that users of InfraGard, the U.S. Senate, and Sony websites, among others, can sleep more soundly at night. But people shouldn't let the apparent cessation of the latest laugh-seeking hacking campaign lull them into a false sense of security.

There's a growing body of evidence--based on numerous LulzSec exploits, last year's hack of Gawker, even a 10-year-old study of the password-picking habits of Unix users--that people prefer short, non-random, and therefore unsafe passwords. They also tend to reuse those same passwords across multiple sites. The underlying rationale is clear: it makes passwords easier to use.

Unfortunately, it also makes for poor security. For example, look at one of LulzSec's attacks against the Atlanta branch of FBI affiliate InfraGard, in which the hackers stole members' username and password combinations. Those credentials then allowed LulzSec to gain access to Atlanta InfraGard member Karim Hijazi's business and personal Gmail accounts. Hijazi is a somewhat controversial security consultant who is CEO and president of botnet monitoring startup firm Unveillance. But even he reused his passwords.

Password reuse, however, isn't the only issue. Another threat is that attackers will gain access to a website's password database and steal a copy. At that point, even if the database is encrypted, attackers can hammer away at it offline, using a tool such as Password Recovery Toolkit from AccessData to crack it in relatively little time. Processing power is no object. Indeed, researchers at Georgia Tech have tapped the graphics cards built into PCs to crack even hashed passwords with fewer than 12 characters, in short order.

Not coincidentally, the Georgia Tech researchers recommend using passwords that are at least 12 characters long, and which mix letters, numbers, and symbols. But who's going to remember a unique, randomized (aka highly entropic) 12-character password for every semi-critical website they use?

Thankfully, options abound for creating long and strong passwords. For example, people can use pass phrases--sentences, really--instead of passwords. Another option, meanwhile, is to build passwords using some kind of predetermined logic. The password "mniE," for example, would be short for "my name is Earl." (Ideally, of course, the password would be much longer.) Proponents of this approach often recommend using a variation that builds in the name of the website, so that one password can be altered to address various other websites. For Amazon.com, for example, the variation could be "mAMAniE."

Despite the potential security improvement, according to Jesper M. Johansson, formerly the security program manager at Microsoft, and now the principal security architect at Amazon.com, it's unclear if many people bother to use pass phrases. Furthermore, based on some rough estimates, he said that it's likely that a person would need to use a six-word pass phrase--which is starting to get clunky--to attain the same level of entropy as a nine-character password. Finally, reusing parts of passwords across different websites means that attackers who steal username and password combinations might be able to reverse-engineer the logic.

1 of 2
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Current Issue
Five Emerging Security Threats - And What You Can Learn From Them
At Black Hat USA, researchers unveiled some nasty vulnerabilities. Is your organization ready?
Flash Poll
The Top Cybersecurity Risks And How Enterprises Are Responding
The Top Cybersecurity Risks And How Enterprises Are Responding
The information security landscape is a constantly shifting risk environment. Today's IT security department must manage both internal and external threats' ranging from malware to mobile device vulnerabilities, to cloud security and ransomware. Download the Dark Reading 2016 Strategic Security Survey to gain insight into how security professionals view these risks, and how they are addressing them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
According to industry estimates, about a million new IT security jobs will be created in the next two years but there aren't enough skilled professionals to fill them. On top of that, there isn't necessarily a clear path to a career in security. Dark Reading Executive Editor Kelly Jackson Higgins hosts guests Carson Sweet, co-founder and CTO of CloudPassage, which published a shocking study of the security gap in top US undergrad computer science programs, and Rodney Petersen, head of NIST's new National Initiative for Cybersecurity Education.