Welcome to Software Development on Codidact!
Will you help us build our independent community of developers helping developers? We're small and trying to grow. We welcome questions about all aspects of software development, from design to code to QA and more. Got questions? Got answers? Got code you'd like someone to review? Please join us.
Are "strong passwords" at all meaningful?
Whenever registering to diverse sites on the net, you are often forced to enter a so called "strong password", which would ideally contain both upper case letters, lower case letters, digits, and some other character like punctuation. As hard to remember as possible.
What I don't understand from a software development point of view is how these characters would make that much of a difference.
All of it seems to assume that a hacker trying to break a password would utilize so-called brute force. That is: try "A", try "B" ... "try AA" and so on. The more variations, the longer it takes to execute the brute force algorithm.
If I have a password of up to 10 capital letters A to Z plus "empty", that's 27 combinations, for a total of 2710 combinations.
As opposed to having a 10 letter password in the whole UTF8/ASCII 7 bit range, 127 combinations - 32 non-printable + 1 empty = 96, for a total of 9610 combinations.
Sure, a significant difference, astronomical even. But... if they would execute a brute force across TCP/IP they can maybe try one combination every millisecond or something, assuming great bandwidth. Worst case scenario for the 2710 scenario is then 57 days. Some 4 weeks on average. Assuming there's no big latency or packet drop for a significant lower bandwidth, in which case this isn't really feasible at all.
I don't see anyone setting up a brute force operation for that in order to access John Doe's Gmail account or whatever... it is already too much of an obstacle. Unless they hope to get lucky on the initial bunch permutations, which can of course happen.
Assuming that brute force is actually what's used, which sounds quite unlikely to me. Instead of something else entirely: keyword logging, packet sniffing, the human factor ("Hi this is your bank please send us your password") etc etc.
So is the usefulness of this whole "strong password" thing just an urban legend, where companies force us to memorize ridiculously hard to remember passwords for no real gain? Why is the number of symbol table combinations in the password oh so important on almost any Internet site these days?
4 answers
The following users marked this post as Works for me:
| User | Comment | Date |
|---|---|---|
| ...mimus... | (no comment) | Jan 10, 2024 at 01:05 |
Passwords are annoying. Nobody really enjoys passwords, which is why "The End of Passwords" articles keep circulating. I'm looking forward to the day the prediction comes true, but in the meantime passwords are the most common way to do authentication anywhere with a computer.
I made a chart to classify the important distinctions in making a new password. I'll elaborate on the regions below.
Bad Passwords
Worst
One of the top-used passwords
Think abcdef, 123456, iloveyou, Pa$$w0rd, etc. Most of these fall afoul of any website with criteria, but some of them are crafted specifically to get past the "rules."
A leaked password of yours
Remember that forum you signed up for that was later hacked? You better hope you never used that password with that email address anywhere else.
It's an incredibly common attack to find an email/password pair and just try that everywhere. And once that combination is public, anyone can do the same.[1]
Bad
Any leaked password
Consider this to be the next step down of "One of the top-used passwords." Brute-forcing may as well try these first. It's going to try them eventually, and there's evidence that real humans used these sequences.
Some web services have recently started reacting to this. I've heard of some that refuse to set your password to the 10,000 most common things they've found in password dumps. I look forward to more of this.
Any password of yours
This is a hedge against those services getting hacked in the future (or already hacked, but no one knows yet). This also includes cute password "schemes" like n79bx4ccb-facebook, n79bx4ccb-microsoft, and so on. Don't do that.
Stuff about you
In all likelihood, this is already covered by "Any leaked password." But just in case, I'm adding the "movie detective" style passwords where they try your daughter's birthday, your favorite poet, or whatever.
Not good
Easy to brute force
Now we're getting to your real question. Like tarhalda implies, this is the place where attacks typically fall into two modes:
Full database exfiltration
Sometimes the attacker gets the whole database. This wouldn't be because of your password (unless you're an administrator). It may be a hack of the server. It may be a backup stored improperly. Credentials accidentally included in public source code. All these have happened.
-
If the Important Stuff™ is not encrypted, you've already lost it. Sorry.
-
If the Important Stuff™ is encrypted, a good place for the attacker to start would be to crack the password hashes and see if those creds still work on the live system.
- This is a real thing that real attackers do.
- Sometimes they sell the hashes to other bad people before they're even cracked.
- Cracking gets faster all the time, and it's already really fast.
- The first place they're going to try the password is on the system it came from, but they're going to try it anywhere else you might have an account, too.
Vulnerable web service
XKCD posits a badly designed web service that doesn't throttle password guesses or lock you out after enough bad attempts.[2] That's where the math comes in from Lundin, tarhalda, and the XKCD comic.
Historically, the way that security policies defended against this kind of attack was to expire your password and make you change it. In theory, that still works. You could set a kind-of-hard password that doesn't make any of the "worst" or "bad" mistakes and change it every 3 2 1 0.5 months.
But that's a terrible user experience. NIST, a US government standards body, changed its longstanding recommendations[3] to suggest longer, easier-to-remember passwords instead of forced expiration. Not to mention: people will just make their password jimmyjohn-2023Q4 or something and advance it each time. Computers are not great at figuring out the pattern someone used from a single data point.[4]
I haven't seen anyone doing this, but I think it is reasonable for the service to randomly generate a diceware password and offer it as an alternative to following the "X letters, Y numbers, Z symbols" rules. It's basically the same as how services make a fully random "app password" for computer-to-computer credentials and force you to use it. If someone wants to devise their own password, they can fulfill all the password requirements just like before.
The only nice thing about a vulnerable web service is that the attacker probably doesn't care about your data on this site, whatever site it is. If it doesn't restrict suspicious logins, we desperately hope that it's not that critical a website.
What the attacker probably wants is your credentials to try them on GMail, Apple, Amazon, your national taxation system, your work accounts, etc. If you've avoided password re-use, you're probably somewhat safe.
Upshot
Don't
- Don't use anything that can be tied to you.
- Don't use anything known to be in use by anyone.
- Don't try to remember all your passwords.
Do
- Have something to remember the passwords for you.
- Have something pick completely random passwords[5] so they are expensive to crack.
Options
- A password manager from a reputable source[6]
- A FIDO key (please have a backup!)
- A password card
- A physical notebook
-
There are free services where you can check your email address(es) or register to be notified if any of them is discovered in a password dump. The original one was called Have I Been Pwned?, but there are others now, too. ↩︎
-
If you run a web service, please prevent rapid or repeated login abuse, both per-account and per-IP, plus any other way to identify abusive attempts. ↩︎
-
Between 2003 and 2017, NIST had the 90-day expiration and letters / numbers / symbols recommendations that you may be familiar with. It has nominally repudiated all of those guidelines, and the guy wrote them says he was wrong. ↩︎
-
The server can't look directly at your old passwords to compare with the new one you're setting since they old ones are hashed. You may protest that the "change password" page says "Old password / New password / Retype new password." Yes, but there's also the "Forgot my password" page that only needs a new password.
AnnoyingClever users will just use that page instead.To catch someone using an unsafe scheme, the server has to speculatively invent all old passwords they might have used for their last password and hash each of them. That's designed to be expensive since it's basically an attempt to crack the server's own password database. You can't compete with the bad guys' bespoke hardware on operations like this. ↩︎
-
Ideally, this is totally random, but it can be random within interesting bounds, assuming there isn't a length limit[7] on your password. ↩︎
-
There are plenty of great password managers out there. I'm hesitant to suggest or denigrate any specific ones, but you should do a little research. You want to see if any particular program is untested (i.e. a toy), cutting corners, or actually good. ↩︎
-
There is a special InfoSec hell for anyone who designed a password field for no more than 16 characters. NIST says to allow at least 64 characters. ↩︎
0 comment threads
Disclaimer: I am not a security expert nor a security professional.
There is, of course, a relevant XKCD comic for this:
The entropy numbers appear to be accurate based on this security.stackexchange post. It actually assumes a dictionary attack, which involves checking for common words in passwords and is sometimes used to discredit the "correcthorsebatterystaple" method of password generation. However, when password checkers are looking at password strength, they usually are comparing passwords of equal lengths. An 8 character password with only alphabetic characters will be weaker than an 8 character password with digits, special symbols, and alphabetic characters. If you assume that people will use the shortest password they can get away with, then forcing them to include more variety makes sense. It also allows the site to use less database storage space while forcing better passwords than just 8 alphabetic characters.
In my personal experience, security professionals assume people will use some kind of password storage program. They don't seem to consider the difficulty of remembering the sheer number of passwords required for various necessary accounts. None of the various security seminars I have participated in for work offered any solutions. Password requirements are based on site security for that site alone; they don't take into account how users are supposed to handle 50 sites with difficult to remember passwords.
To answer your question about attacks per second: attackers aren't necessarily trying to attack over the internet. They will use copies of databases full of hashed passwords and run hundreds of attacks per second on them. Once they have a plaintext password, they can try that on other sites such as banks (people reuse passwords enough for this to be worth it). So the password strength really can matter, especially if you reuse passwords.
NIST Special Publication 800-63 says that "strong" password requirements are not only useless but counterproductive. They recommend only a minimum length requirement and a small blacklist of common passwords.
Length and complexity requirements beyond those recommended here significantly increase the difficulty of memorized secrets and increase user frustration. As a result, users often work around these restrictions in a way that is counterproductive. Furthermore, other mitigations such as blocklists, secure hashed storage, and rate limiting are more effective at preventing modern brute-force attacks. Therefore, no additional complexity requirements are imposed.
This has been NIST's recommendation for at least the several years that I've been paying attention. It's painful to watch naive companies hiring naive developers pushing outdated practices like "strong" passwords and even "security questions" (encountered yesterday on an Arizona government site!)
The assumption of 1k attempts/s is wishful thinking, as is the idea that a hacker will go on mail.google.com and try to guess your login (they would get a captcha after like 5 failed attempts).
Password security comes into play when someone steals the whole table of all accounts and password hashes from the website operator, and then they start trying to hash different putative passwords to see if any of them match. This is very similar to cryptocurrency mining, so it's probably fair to say that about $1000 can get you hardware that can do about 1 billion password hashes/s.
When the website discovers their hashes are stolen and offered for sale on black market, the reasonable thing to do is invalidate all current passwords so that all users will be forced to reset password (using phone, email...) at next login. This will make the hashes useless. However, it will take some time for the site operator to find out, so if you have a very easy password the cracker could find it very quickly, use it and do some harm. If your password takes at least a few weeks, there's a good chance that by the time the cracker solves it, it will not be valid. I think this is the main reason why they require strong passwords.
By strong here I am thinking of 16 random chars A-Za-z0-9. This is about 95 bits, and even if you had a year you would need to try 10^15/s which is not feasible with today's tech. If/when better techs comes out the website admins would switch to a harder hash type, which would still take long even on the newer hardware.
companies force us to memorize ridiculously hard to remember passwords
They assume you will use a password manager, rather than memorizing it.
I don't see anyone setting up a brute force operation for that in order to access John Doe's Gmail account or whatever
A Gmail account is probably very valuable, because it can be used to send a lot of spam that will be treated as legitimate because it's coming from Gmail, and also people usually have Gmail set up for password recovery in other accounts so you can gain access to those from the Gmail. However, Google uses MFA, so just knowing the password won't be enough to gain access to it.
2 comment threads
5 comment threads