Risk
1/30/2013
12:41 PM
Connect Directly
RSS
E-Mail
50%
50%

Want Stronger Passwords? Try Bad Grammar

Beware passwords built using too many pronouns or verbs, Carnegie Mellon security researchers say. String together nouns instead.

Want to build a better password? Stick to nouns and adjectives, and avoid verbs and pronouns.

That finding comes from a research paper written by Ashwini Rao, a Ph.D. student at Carnegie Mellon University, and two colleagues, titled "Effect of Grammar on Security of Long Passwords." Rao will present the paper at next month's Association for Computing Machinery's Conference on Data and Application Security and Privacy (CODASPY 2013) in San Antonio, Texas.

"Use of long sentence-like or phrase-like passwords such as 'abiggerbetterpassword' and 'thecommunistfairy' is increasing," the researchers said in their paper. But could some types of passphrases be inherently less secure than others?

To find out, they built a grammar-aware passphrase cracker and preloaded it with a dictionary for speech, as well as an algorithm for recognizing the types of sequences that are typically used to generate passphrases, such as "noun-verb-adjective-adverb."

Passphrases are an often-recommended technique for creating complex passwords. Instead of creating a password like "sheep," for example, security experts recommend a passphrase such as "wolves8sheep@sleep." Simply put, passphrases can add complexity -- making passwords harder to crack or guess for an attacker -- while still being easy to remember.

[ For the latest on Java's security vulnerabilities, see Java Security Work Remains, Bug Hunter Says. ]

But as is always the case with passwords, some types of passphrase complexity are better than others. The researchers tested their proof-of-concept software against 1,434 passwords, each containing 16 or more characters, and found that by taking grammar into consideration, they were able to crack three times as many passwords as current state-of-the-art cracking tools. In addition, their tool alone cracked 10% of the password data set.

Cue their resulting finding: The strength of long passwords does not increase uniformly with length.

Based on their research, good grammar comes at a security cost because some grammatical structures are scarcer than others, which in passphrases makes them easier to crack. In terms of scarcity, the researchers noted that pronouns are far fewer in number than verbs, verbs fewer than adjectives, and adjectives fewer than nouns.

The bottom line: Emphasize nouns and adjectives in passphrases. For example, the researchers found that the five-word passphrase "Th3r3 can only b3 #1!" was easier to crack that this three-word passphrase: "Hammered asinine requirements." Meanwhile, they found that the passphrase "My passw0rd is $uper str0ng!" was 100 times stronger than "Superman is $uper str0ng!" and in turn that phrase was 10,000 times stronger than "Th3r3 can only b3 #1!"

The researchers said their findings should be applied to help users select more secure passwords. They also said the research may apply not just to passphrases but to securing other types of structures such as postal addresses, email addresses and URLs present within long passwords -- or perhaps even encrypted sets of data.

"I've seen password policies that say, 'Use five words,'" said report author Rao in a statement. "Well, if four of those words are pronouns, they don't add much security."

To keep those recommendations in perspective, complex passwords won't immunize people's passwords against every type of attack -- especially if the passwords get stored insecurely.

But in cases where attackers obtained stored passwords that have been hashed or encrypted, the more complex the password, the longer it may take for an attacker to decrypt the password, if it can be decoded at all. Any delay can buy website owners time to spot the related breach, notify customers and immediately expire all current passwords, thus helping to contain the breach.

Your employees are a critical part of your security program, particularly when it comes to the endpoint. Whether it's a PC, smartphone or tablet, your end users are on the front lines of phishing attempts and malware attacks. Read our Security: Get Users To Care report to find out how to keep your company safe. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
ComputerPhil
50%
50%
ComputerPhil,
User Rank: Apprentice
2/6/2013 | 4:48:54 PM
re: Want Stronger Passwords? Try Bad Grammar
Came to make a comment recommending RoboForm and am happy to see someone beat me to it. RoboForm creates statistically secure passwords for me, then encrypts and stores them so they can be replayed automatically by RoboForm and I don't have to worry about typing in the long passwords. I strongly suggest anyone concerned with security (or just looking to make their life on the internet easier) check out RoboForm by Siber Systems.
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
1/31/2013 | 12:42:33 AM
re: Want Stronger Passwords? Try Bad Grammar
As an editor, I don't know if I can condone the use of bad grammar, even in the name of security.

Drew Conry-Murray
Editor, Network Computing
JDC3
50%
50%
JDC3,
User Rank: Apprentice
1/30/2013 | 8:02:13 PM
re: Want Stronger Passwords? Try Bad Grammar
Good article. I find it interesting that the special characters did not add as much complexity as I would have thought. For strong passwords I recommend using a password manager like RoboForm. I use the password generator to create the strong passwords, and then the software saves the passwords so I don't need to remember them. There's others out there, but I like RoboForm the best.
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6335
Published: 2014-08-26
The Backup-Archive client in IBM Tivoli Storage Manager (TSM) for Space Management 5.x and 6.x before 6.2.5.3, 6.3.x before 6.3.2, 6.4.x before 6.4.2, and 7.1.x before 7.1.0.3 on Linux and AIX, and 5.x and 6.x before 6.1.5.6 on Solaris and HP-UX, does not preserve file permissions across backup and ...

CVE-2014-0480
Published: 2014-08-26
The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL ...

CVE-2014-0481
Published: 2014-08-26
The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a d...

CVE-2014-0482
Published: 2014-08-26
The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors relate...

CVE-2014-0483
Published: 2014-08-26
The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field ...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.