continued from my last post on the topic...
In addition to warning us about reusing passwords, in Take Control of Your Passwords, author Joe Kissell also points out that there are numerous passwords being used which really do no one any good, other than hackers. For instance, people actually do use the word “password” to provide security; obviously, it does not. There are a number of links in his e-book to various articles or websites that show some of the worst passwords being used. It’s amazing what some people use for passwords even though what they’re trying to do is protect their most sensitive data. Using a bad password doesn’t do anything for security.
Part of the problem is the development of modern, fast computers. In the old days, a burglar would have to work hard, over time, to break a lock or to penetrate a defense. Nowadays, they can get past most passwords which might be used by people. For instance, as of late last year passwords with nine characters which have the suggested elements [upper and lower case letters, digits, symbols] can be cracked in 5 1/2 hours! This is what is called a brute-force attack and can happen either by gaining actual access to the computer or getting the contents offline to hack.
Joe goes into some detail talking about other kinds of threats which would cause your passwords to be stolen: guessing, theft, hacking and sniffing, and social engineering. This last threat to your security comes through “phishing” e-mails. You think you’re getting an e-mail from PayPal, Amazon, your bank or the FBI. Usually, you don’t expect to get something, but every now and then the timing is right and you expect an e-mail and the link you just received. Once you click on the links inside an e-mail or in some fashion provide your real password, you’ve given up any security that password provides. And if it’s a password that covers more than one site, all those sites can be affected. [My personal rule is never to click on links in email or to first view the raw source to ascertain if it's really my friend's email and suggested item to click upon].
Joe’s e-book also discusses the types of tricks people try to use in order to come up with a unique but easily remembered password. He also criticizes the idea of using the two-part username and password as outmoded and not really providing any security. As usual, he provides citations and links to articles along these lines.
Having scared his readers to death, Joe then talks about password security and how a good password is created. Obviously, a good password is something which is used rather than not. But good passwords suffer also from the very real problem of them being easy to crack. There are 2 problems with making a password, guessability and memorability. You carry all these passwords around in your brain, having trouble remembering what password goes to what, and that’s part of the reason for reusing passwords.
What I found to be the most interesting part of the e-book was the part on “All about Entropy”. The idea of entropy with passwords is that in order for a password to be harder to guess, it has to have a higher entropy or complexity. Therefore, randomness and complexity are required of good passwords, in order to prevent cracking software from breaking the password. Of course, that also creates problems for remembering them.
A password’s entropy is made up of several factors: its length, its character set, and its randomness. Obviously, if you only use four characters then a password won’t take long to crack. [In fact, you can set the password lock on your iPhone to more than 4 characters, which I suggest you do]. But, if you have 7, 12, 16 or more characters to choose from, there are many million possible choices. Making a password longer increases its entropy.
Character sets are another way of providing providing entropy. Rather than limiting passwords to only numbers or only letters, if both cases of letters are used plus numbers and various punctuation characters for a short, 5 character password, you then have over 70 possibilities per character which increases the possibilities to 2 billion. Of course, a computer can crack 2 billion passwords in less thana second, but at least you would prevent most hackers from an easy task or buy yourself time.
The last factor in establishing entropy is randomness. If one uses a random password it will be much more secure. Of course, the randomness comes from the lack of a pattern in the word or words, but password cracking software can recognize all sorts of patterns.
An interesting website to check out your password’s entropy is at a free online tool called “zxcvbn” and which can be found at http://DL.dropbox.com/u/209/zxcvbn/test/index.html. Testing your password there is helpful to get a sense of how much time it would take to crack. But it is particularly helpful because it point out areas of weakness which could be cured. Joe recommends using passwords with a higher entropy such as 75 bits, but most of mine still end up in the high 30s or lower 40s, so I have some work to do.
[to be continued, last installment]
