The world’s worst passwords
by Steven E.F. Brown, San Francisco Business Times on Thursday, March 8, 2012, 11:04am PST
To be fair, it is hard to dream up (and remember) the many passwords we need for various business systems and benefits portals and online shopping accounts and so on. A quick count tells me I have 10 different passwords I use to access different online and technical systems at work.
Worse still, we’re required to often change our password these days, and a kind of password fatigue sets in. You’re always warned never to write your password down, but how are you supposed to keep track of so many?
Now, if you’ve ever gotten one of those “your password is about to expire” messages, you know that there are certain requirements these days that are supposed to make your password harder to crack. Passwords have to contain a number, an uppercase letter, or an unusual character like @ or % or &.
Trustwave, an IT security company which analyzed passwords and their weaknesses in a recent report, found that “creativity was found to decrease with each successive password” a person had to come up with. Think “petname1” followed by “petname2” and so on.
Chicago-based Trustwave, which tried to hack the passwords of some 2.5 million of its customers as a test, was able to break an astonishing 200,000 of them. Many were set with default terms like “changename” and “welcome.”
“Service accounts … were discovered to also include poor default passwords, and IT administrators forgot to change them,” Trustwave said.
But even when people changed passwords, a whole lot of them changed the password to … wait for it … “password.”
Under the new rules, they used a capital letter and a number, giving “Password1” as the official dumbest password in the universe. Six months later, when forced to change it, they created “Password2.” If forced to use an unusual character, they chose “P@ssword” or “Pa$$word.”
As you can imagine, these sorts of things are pretty easy for hackers to figure out.
Trustwave spent less than $1,500 on its custom password cracking system built with off the shelf parts. In 10 hours they had cracked 200,000 of the 2.5 million passwords they tested.
Among the things they found:
- 27,191 passwords were English names of months like “January,” “February,” and so on.
- 72,368 were names of states, while 74,368 were seasons of the year and a whopping 170,013 were baby names on the “Top 100” list of male and female names.
The list of most vulnerable passwords, the ones they cracked fastest is pretty embarrassing, including:
- Password1 (also Password2, Password3 and so on)
- Welcome
- Welcome1
- 123456
- P@ssw0rd
- Passw0rd
Length matters
So, what can you do to create a tough to crack password?Well, length matters here -- a password with 3 characters, even using all the 95 characters on a U.S.-English keyboard gives 857,375 possibilities. That may seem a lot to you, but to a “brute force attack” by a computer that is child’s play.
Upping the length to 7 characters gives 69,833,729,609,375 possibilities. So that’s “Password1” and 69,833,729,609,374 others.
When you hit 10 characters, you get 59,873,700,000,000,000,000.
So even a weird looking four letter password like R$*k that you think no one would ever guess (or remember) is easier to crack by brute force than a long one like “ThisIsMyPasswordNoReallyItIs,” which is somewhat easier to remember.
But security software systems don’t always recognize what type of password is harder to crack.
Bring back the Classics
Of course, one solution is to come up with passwords no one will ever guess but which are easy for you yourself to remember.You may know of the Navajo Code Talkers from World War II who baffled any Japanese listeners by speaking in a code language outsiders couldn’t possibly understand, even if they heard it.
So all you need to do is learn some obscure language yourself and get your passwords from it.
My passwords these days are all in Ancient Greek, with a few letters changed into numbers. Who says an education in the classics isn’t useful in the modern world?
No comments:
Post a Comment