Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations //

Identity & Access Management

01:30 PM
Andrey Dulkin
Andrey Dulkin
Connect Directly
E-Mail vvv

Weak Password Advice From Microsoft

Tempting as it may seem to do away with strong passwords for low-risk websites, password reuse is still a significant threat to both users and business.

Researchers from Microsoft and Ottawa's Carleton University this month issued a 16-page report urging Internet users to use (or re-use) weak and easy-to-remember passwords for “low risk” websites, as spending any effort on these passwords “would be wasteful.” This is bad advice for any Internet user, but even more so for those in corporate environments who may have reused passwords across personal and corporate services.

The primary reasoning behind the “weak password” recommendation is to help users maximize their ability to remember more complex passwords that are needed to protect high-risk accounts and sites. Another way to read it would be that people just can’t remember a multitude of unique and complex passwords, so stop trying, and use something easy for the “less important” things in life.

While this research flies in the face of years of recommended best-practices, it’s understandable that the cyber realities we all face may present a convincing argument that strong passwords are a fruitless endeavor. We are continually inundated with examples of how we’re facing greater and more constant online threats, how nothing is secure, and how motivated attackers will always find a way to infiltrate networks and steal information, passwords, and more. Add to this the recent disclosures on password manager vulnerabilities, and it seems as if passwords are doomed anyway, so why even bother with unique or complex passwords? Here are several reasons.

Diminishing distinctions
The advice provided by the Microsoft research focuses on using and reusing weak passwords for non-important sites. The authors provide a measure of loss, which attempts to quantify the harm to the user from disclosing information at a specific web service. This, the argument goes, makes it possible to distinguish important versus non-important services. But what exactly is non-important?

While everyone can likely agree that banking services are important, the distinction is not as clear for other services. Is Twitter or any other social media channel important? How about forums or blog comments? To some users, yes, they’re important -- social media are a critical tool in their daily lives and entwined with their work lives. Others deem social media unimportant.

But while social media may not be important to the latter group, they most definitely are to hackers. Social media accounts are a gold mine of personally identifiable information (PII). Although you may not be an avid user of a social media account, you can bet that hackers will be avid users of your information if they get their hands on it.

In addition, compromised social media accounts can open up a new set of threat and attack vectors, as they enable impersonation of legitimate users to others. One of the most prevalent ways targeted cyber attacks on businesses begin is through a simple phishing attack -- designed to gain a foothold in an organization to steal and elevate insider credentials. Hackers could target the personal-use web accounts of employees, co-workers, vendors, and others as launching points for broader attacks on a business. It just takes one click of a bad link to let the attackers in, and the perceived identity of the sender can be the reason for that click to occur.

Password reuse is a significant threat
As organizations move to cloud services, outsource IT, and require employees and users to log-in to activate these services, the opportunity and desire to share passwords for personal and organizational uses is common -- and a significant threat.

Hackers are smart enough to figure out that users often reuse passwords for multiple purposes -- so if they gain access to someone’s password, and know from their online identities that they work at a specific company, the logical conclusion is that they will try those passwords across the organization’s online surface.

And if you think it’s not easy for an attacker to find the cloud solutions that a company is using -- CRM, HR management, ERP, sales management, and many others -- then you’re vastly underestimating the threat landscape.

Memory is not the only option
One fundamental disagreement I have with the research is the researchers’ assumption that people are just incapable of remembering complex passwords and need to be coddled with passwords like "password," "123456," and so on.

Even if the world were made up of only people who can’t remember the growing number of increasingly complex passwords we use, there is a better way than giving up entirely and exposing the users to the dangers of password reuse.

Local password managers are a good option for both personal and organizational use. While cloud-based password managers are indeed less secure and face some real vulnerabilities and problems, locally hosted password managers are strong and secure and are quite challenging for an attacker to break into.

Obviously, we can’t expect all users to have organizational password management solutions deployed in their networks, but even local password managers installed on user endpoints provide a significant boost to the overall security of user accounts. They make it possible to use unique and complex passwords, while the user only needs to remember one password for authenticating to them.

Ultimately, nothing is ever completely safe. Sufficiently motivated hackers will always present a challenge as they try to find a way to steal and exploit the information they’re targeting. But against opportunistic attacks, it is never a good idea to set yourself up as the easiest prey. When criminals steal hundreds of thousands or millions of password hashes, they are not going to discern the pattern used by a specific user -- they will simply attempt to break the hashes and try the passwords on other services, such as email accounts, social media, and corporate services. At this point, password uniqueness can make all the difference between a nuisance and an identity theft.

Andrey Dulkin has more than 12 years of experience in information security research and development, both in technical and managerial positions. In his current position, he leads the CyberArk Research Labs, where his research focuses on targeted attacks mitigation, critical ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Oldest First  |  Newest First  |  Threaded View
<<   <   Page 2 / 2
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
8/4/2014 | 4:29:11 PM
Re: password mess
TGUT your brain is much smarter than mine to be able to keepall your passwords straight -- even the simples ones! 

User Rank: Apprentice
8/9/2014 | 4:07:40 AM
The textual memory is just a minor part of our overall memories
Being a strong password helps a lot against the attack of getting the stolen hashed passwords back to the original passwords.  The problem is that few of us can firmly remember many such strong passwords.

 At the root of the password problem is the cognitive phenomena called "interference of memory", by which we cannot firmly remember more than 5 text passwords on average.  What worries us is not the password, but the textual password.  The textual memory is only a small part of what we remember.  We could think of making use of the larger part of our memory that is less subject to interference of memory.  More attention could be paid to the efforts of expanding the password system to include images, particularly KNOWN images, as well as conventional texts.
User Rank: Apprentice
8/13/2014 | 11:02:06 AM
Easy Passwords
As someone that pen tests for a living I say YES! PLEASE! use easy passwords it makes my job so much easier.



I couldn't believe it when I read this story.  You wouldn't believe how many networks I have cracked that used common passwords on user accounts and then escalated from their.

Your better off using something even a sentence that is long like "My dog has fleas."  This is 17 chars long and would be hard to crack under a normal brute force attack and it isn't on any common password list.
Andrey Dulkin
Andrey Dulkin,
User Rank: Apprentice
8/14/2014 | 4:39:18 AM
Re: The textual memory is just a minor part of our overall memories
HAnatomi - That's a good point, I think both Microsoft and Facebook have tried this to some extent. My suggestion to ease the "memory requirements" is to employ, for some sites, the same fixed password, but add some letters from the target service name (for example, "dark" for DarkReading), or even the entire target service name, to the fixed part. This way, we can avoid password reuse, without the trouble of remembering many strong passwords. 
User Rank: Apprentice
8/15/2014 | 3:38:27 AM
Re: The textual memory is just a minor part of our overall memories
Hi Andrey, I have heard of such ideas many times, which means criminals must be well aware of it.  It shoud be noted that simple ones might well have been incorporated in the attackers' dictionaries.  If complicated enough to avoid such dictionary attacks, we might well be trapped in the holes that we dug as I myself experienced.  Your idea could be recommended to the people who are proud of the vert bright brains, not to most of us.
User Rank: Strategist
9/17/2014 | 11:28:16 AM
Re: password mess
You can change passwords. You can use 2nd factor authentication when its supported. You can't easily change your fingerprints and/or irises.  If you RELY on biometrics, once your information is compromised you better be willing to undergo some serious surgery.

I use a passwordcard (easily found on the web), and only have to remember the starting row/column for the password.  On sites which permit password hints, that is all the info I need.  Only I know if I'm parsing UP/DOWN/Left/Diagonal,Knightwise, etc.  And I know how many characters I'm using - more than 8, less than 50.

I've used the same process when sending secured data to someone who does not have a valid PGP key on my keychain.  Share a passwordcard with them, email the starting location and pattern, and encrypt the 7Z using that password. Cumbersome, but unfortunately easy security is easily defeated.



<<   <   Page 2 / 2
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/5/2020
How AI and Automation Can Help Bridge the Cybersecurity Talent Gap
Peter Barker, Chief Product Officer at ForgeRock,  6/1/2020
Cybersecurity Spending Hits 'Temporary Pause' Amid Pandemic
Kelly Jackson Higgins, Executive Editor at Dark Reading,  6/2/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: What? IT said I needed virus protection!
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-06-05
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability. An author user can create posts that result in a stored XSS by using a crafted payload in custom links.
PUBLISHED: 2020-06-05
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. An author user can create posts that result in stored XSS vulnerabilities, by using a crafted link in the custom URL or by applying custom attributes.
PUBLISHED: 2020-06-05
In Combodo iTop a menu shortcut name can be exploited with a stored XSS payload. This is fixed in all iTop packages (community, essential, professional) in version 2.7.0 and iTop essential and iTop professional in version 2.6.4.
PUBLISHED: 2020-06-05
In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload. This is fixed in all iTop packages (community, essential, professional) for version 2.7.0 and in iTop essential and iTop professional packages for version 2.6.4.
PUBLISHED: 2020-06-05
In the cheetah free wifi 5.1 driver file liebaonat.sys, local users are allowed to cause a denial of service (BSOD) or other unknown impact due to failure to verify the value of a specific IOCTL.