Yet vast improvements in computational
power, more sophisticated and duplicitous password-cracking techniques, and the
proliferation of sensitive network-accessible information mean the threat from using
weak passwords has never been greater.
Security purists have long
advocated abandoning the username/password authentication model in favor of cryptographically
strong, hardware-based two-factor alternatives. However, these aren’t technically
feasible or cost-effective for many applications or businesses. Properly constructed
text-based passwords can still be hacker-resistant and used to secure all but the
most critical and confidential applications.
Elements Of A Strong Password
James Quin, senior research analyst at
Info-Tech Research Group, says the key to a strong password is length and complexity.
“Length is simply the number of individual characters used in the creation
of the password, while complexity refers to the number of characters that could
potentially be used in the creation of the password,” he says. “Of the
two, complexity is far more important to password strength than is length,”
he adds, because augmenting the number of possible characters exponentially increases
the number of potential passwords.
There are many rules for generating
strong passwords, but experts agree on the basics: They should have at least eight
characters, including a mixture of upper- and lower-case and some numbers and special
characters. The password should also not use personal information, the account name,
or dictionary words in any language.
One system for easily implementing
these rules, useful on systems that allow spaces in passwords, is the pass phrase—a
memorable sentence such as “My sister lives @ 314 Main St.”
The SANS Institute has developed
a clever technique known as the SFSP (Simple Formula for Strong Passwords), which
can systematically generate strong passwords using easily remembered subelements.
The formula involves mixing a meaningful word, such as your spouse’s name,
with a related secret code, such as his birthday, with a rule for adding special
characters (for example, start and end with a tilde and insert the secret code after
the word’s third character).
As the SANS Institute summarizes
the algorithm, “You basically take your easy-to-remember password and stick
your birth date in the middle of it surrounded by quotes. Then add the date to the
front of it, and you’re done.”
Password strength is measured
using a concept from information theory known as information entropy, or bit strength.
This is expressed as the length in bits of the number of possible password combinations
given its length and complexity. For example, a password with a strength of 10 bits,
for example ‘ab123’, has 210 or 1,024, possibilities. There are numerous
online applications that calculate bit strength and offer categorical appraisals,
from weak to strong, of a password’s strength.
Cracking Passwords
As Quin notes, systems store passwords
encrypted with a one-way hash function that converts the text string into a jumble
of data. Unlike symmetrical data encryption algorithms, there is no way to take
the encrypted data, reverse the hash, and reveal the clear text. Thus, password
cracking entails repeatedly hashing potential password strings and comparing them
against the encrypted data. Sequentially comparing every possible character combination,
a so-called brute force attack, is inefficient and quickly becomes infeasible with
longer, more complex passwords.
Of course, clever hackers
don’t randomly march through every potential password but start with more
likely targets based on dictionary words. Passwords containing a single dictionary
word, or a word and an appended digit, can be compromised almost instantaneously
with widely available tools. Unfortunately, a recent survey of more than 30,000
MySpace passwords found that about 16% met this criteria and that 65% were eight
characters or shorter.
Realizing that most passwords
are based on dictionary words, a more sophisticated cracking technique known as
Rainbow Tables can drastically increase the speed of hash comparisons by using precomputed
tables of words and common word/number combinations. Hackers may also use social
engineering or online searches to unearth personal information about a targeted
account, such as the names of a spouse, children, and pets, to prioritize the word
list and reduce the search time.
Making Strong Passwords Convenient
While mnemonic techniques such as pass
phrases or the SFSP attempt to make strong passwords easy to recall, even these
can be problematic when dealing with dozens of accounts. Automation tools, such
as SSO (single sign-on) software or a password safe, can help by generating, storing,
and replaying strong passwords for an unlimited number of user accounts. With an
encrypted password database, users need only recall one strong password or phrase.
Using SSO, Quin points out that users often don’t even know their individual
passwords; thus “you can create ridiculously long and complex passwords for
each application.”
SSO can not only increase
security but also reduce support costs, according to Rick Carlson, founder and president
of SurfSecret (www.surfsecret.com). He says the No. 1 reason users call the IT help
desk is because of lost or forgotten passwords, a side effect of using strong passwords
that collectively costs businesses millions of dollars. SSO applications also enhance
IT management control over password policies and management, Carlson says, by allowing
admins to easily reset either individual application passwords or the SSO master
passphrase.
Despite improvements in hardware
security tokens, text-based passwords, much like the mechanical lock and key, are
a technology that just won’t die. While cracking techniques have grown more
sophisticated, well-constructed passwords can still resist most attacks. Password
management software such as SSO or password safes improve security by enabling the
convenient use of extremely long, random, and complex passwords.
Article by Kurt Marko for 
.