|
|
Password Security Hints and Suggestions
What does everyone need to know about passwords?
This document was updated on Sunday, November 1, 2020. Please keep
in mind that, while the principled thinking is believed to be
reasonably applicable at the time of writing, any analysis about
tactics and technology is likely to be vulnerable to changes over
time, so if it's been "a long time" since the document was updated,
you'll probably want to do some google searches and see what other
suggestions and thinking is out there to make sure the approaches
still make sense.
The unfortunate reality is that passwords are pretty terrible for protecting security.
Anyone who's active on the Internet is going to have a lot of
passwords. The thing to remember is, system operators and services
use passwords because passwords are inexpensive to deploy, and pretty
convenient. It's not because passwords provide good quality
protection. Remember, a password is just a piece of information --
"some secret you know." If someone else knows it, it's not really all
that safe. In fact, a password can only be as an idea can be. Once
anyone uses it, shares it, or even write it down, there's a potential
for the password to be copied in an unauthorized manner and misused --
the hard, cold reality is that any secret can leak.
The underlying weakness of passwords isn't limited to leakage by
malice or mistake: passwords can also be guessed by attackers. One
way attackers guess passwords is to use really big dictionaries and
special software to handle easily guessed variations on those
dictionaries. Even well-trained, smart people are likely to
end up choosing really bad passwords when they create passwords by
hand. In some security-conscious environments, I've still
seen "password1", "abcdef", or "summer2018". Password attackers have
figured out that password selection is really weak, and have built a
lot of good mathematic models to predict those weaker
passwords.
Another method is to use "brute force" or "rainbow" style attacks
-- where an attacker iterates across every possible combination of
characters within a certain length. Computers can easily guess
17,000,000 keys per second right using a consumer grade, "gaming
ready" computer one might find at the local electronics store (the
kind of computer that parents might buy their kids today). Password
cracking computers don't take the budget of the NSA or a nation-state
anymore -- and, when they need a lot of computing power, criminals
steal computing time by infecting computers with malware, and have
even been known to rent high speed computing by the hour with a
(stolen) credit card and a working email address.
But attacks aren't the only threat we have to address. People still
have to be able to type and access (and in many cases remember) any
passwords they need to use.
Making passwords have the "right amount" of complexity is kind of
a big deal.
High quality passwords are quite difficult to create, manage,
remember, and protect. And even if somone does it well today,
password assignment still needs to be revisited periodically because
the situation and assumptions that underlying those assignments
change. Remember that hacking dictionaries and techniques get better
over time, and the technology (such as that being used for attacking
passwords) improves pretty substantially (capabilities might actually
double approximately every 18 months, following Moore's
Law).
What makes it worse is that we're always going to be balancing
trade-offs between USABILITY and SECURITY-ASSURANCE. The harder a
password is to break/steal, the more likely it is to be forgotten
unless precautions are taken, and the more likely it is to have errors
when used. And the easier it is to remember and type, the more likely
it is to be vulnerable to even relatively unsophisticated attackers
who are able to arm themselves with a rapidly expanding array of
technological capabilities and have weaponized statistically informed
models that can predict how people choose passwords. This is why real
randomness, with a wide statistical aggregate distribution, is the
best solution. Sadly, this becomes pretty complex and difficult to
think about... but explains why passwods aren't very good for
protecting security.
Most people don't choose fully random passwords -- they usually
have some kind of logical pattern to it, which can end up giving a big
shortcut to a password attacker.
Magic Wands and Silver Bullets for this password connundrum: how can anyone be safe?
Anyone who tells you they have a complete, usable, useful answer to
the password problem probably also has a bridge to sell
you.
In reality, passwords can only function as part of a mature,
intellgent approach to protect authentication. There are almost
certainly other elements that are going to be required. It seems like
there are going to be non-technology protections that are required.
For instance, user and administrator training can maintain awareness
of how our practices put ourselves and others at risk. Good passwords
don't do any good without having an audit/logging/review and response
capability, to deal with problems when mistakes are made. But beyond
that, we probably need to be looking at how to use "Multi factor"
authentication -- a password PLUS something else. This combination,
offhand, seems to be the best path forward, but it's inconvenient and
still has significant implementation challenges that need to be
understood and addressed.
Most security problems can be considered across a handfull of
stages of problem resolution:
- Identify the threat landscape, the nature of the vulnerabilities
you're facing, the degree of risk that environment poses, and your
readiness and willingness to accept the probability and impact of an
adverse event occurring.
- Protect yourself from the vulnerabilites and threats by
implementing protections in technology, process/procedure, and
awareness. Invest in as much protection as you're willing to spend
on, based on a recognition of diminishing returns and the reality that
the overall risk will never get down to zero.
- Detect problems by monitoring behaviors. There has been a shift
in the strategic thinking for information security. Given the speed
of change and the complexity of systems, there's a very high
probability that -- regardless of how well we work on protection,
we're still going to have occasional security problems despite our
best efforts. By instrumenting and working on detection, we have the
capability to limit the overall impact and damage of a security
breach.
- Respond to detected problems with a well-considered plan to
address the hazards in a manner that will contain or mitigate damage
down to an acceptable level.
- Recover by knowing how to approach fixing whatever ends up broken
as a result of the adverse event. Learn from what happend and work to
improve your identification, protection, detection, responses, and
recovery for next time... because there will be a next time.
Ultimately, it's not just the IT department or your service
provider that needs to be involved in finding solutions: there are too
many behaviors outside their control (including a bunch of behaviors
that are ultimately user behaviors). By taking on this
"Identify-Protect-Detect-Respond-Recover" mentality, and learning how
to ensure what role you as an indvidual play in this process, we can
build more successful solutions. Ultimately, achieving a state of
well-managed security will have to include you and the collaboration
and cooperation of others.
BONUS: are passwords the only thing I have to worry about?
Any information or data you care about -- and that list of data is
probably a lot bigger than just your passwords, bank account numbers,
and baby/wedding photos -- will probably benefit from periodically
undergoing some real, deliberative scrutiny. The process of thinking
about the security of your data (which reflects the degree to which
confidentiality, integrity, and avaialabiilty is being protected from
adverse impacts) doesn't change, though some of the questions we
detail below might need a little tweaking to hit your exact use cases.
Just a little something else to think about.
Back to the top of this article
|
|
What is WDY Enterprises doing to support its users?
WDY Enterprises, LLC does have a series of security controls in
place that help to protect your hosted accounts. While we don't
document the extent of our security implementation on public web pages
(and don't disclose all of the details, even in private to customers),
we do have a number of things which are pretty clear and evident:
- All authentication channels offer encryption so that your
credentials can have some protection in transit. HOWEVER, users do
have the option to use unencrypted POP3, unencrypted IMAP, or
unencrypted SMTP/Submit (which is provided for backward compatibility
for older computers). Webmail is not offered without encryption.
- Even so, WDY Enterprises authentication still has several
technical limitations stemming from how we interface with users. For
instance, passwords have both maximum and minimun lengths (customers
can contact our support apparatus to discuss current limits, because
we do update things occasionally). And we explicitly and deliberately
won't stop you from picking a bad password, if that's what you want to
do (if your choices are likely to affect the security or stability of
our services, we'll step in, but not before).
- We do monitor open intelligence sources to look for evidence of
compromised user accounts that can link to users' email addresses. On
a best-effort basis, we will check and will notify you of any such
discovery by an automated email message. As of this writing, we limit
users to no more than one email alert per week.
- The system has a number of techniques to limit the effectiveness
and speed of brute force attacks, but we recognize (and so should you)
that this is just a delaying tactic. No general defense can be 100%
effective against well-resourced, well-planned, and well-executed
attacks -- especially when the underlying asset and strength of
protection is ultimately controlled by the user and when,
unfortunately, the most common attacks are based on leveraging users'
inattention or misunderstanding.
- We do provide awarenesss materials online, like you're reading
now, and our support capability can help educate our customers when
opportunities arise and circumstances permit.
- WDY Enterprises, LLC believes in self-determination and user
empowerment. Ultimately, we think customers will be dissatisfied if
we become unnecessarily heavy-handed with security requirements.
Adding additional technical security implementations comes at a cost
and the degree of net positive return is very unclear. Fundamentally,
password management is a user "security hygiene" problem. Behaviors
need to be regulated and evaluated by you, the user, to really be
effective.
Back to the top of this article
|
|
Password practices we try to follow, when passwords are necessary
- What are the alternatives to using passwords in a given context?
Sometimes, you need a password because it's the only kind of mechanism
you can apply... other times, it's too expensive or complex to do
something else. If there aren't alternatives, is this a risk that you
either need--or ultimately want--to accept? If there are
alternatives, what are the costs and benefits? What are the
advantages and disadvantages? What choice is right for you?
- Use a unique, high entropy password for every single service you
access online, based on pushing up toward the technical limits of what
you can use. Re-use of any password--even a great one--at multiple
sites or services significantly increases the risk that it will be
captured or lost and find its way into the hands of nefarious
elements.
- Use strong passwords that mix combinations of both upper and lower
case letters, numbers, symbols, and shift across both cases. The full
ASCII alphabet of printable characters has only 95 possible values, so
the number of password cmbinations is 95 raised to the power of the
length of the password you choose. At the time of this
writing, Internet-facing passwords probably need to be at least 17
characters long to avoid being "completely trivial." It has
ceased to be possible to have a high assurance authentication process
that relies solely on passwords.
- In our view, the current best practice is to use high quality,
password generating software and to store the password in a
software-based password vault that allows you to not have to type in
every password every time you need it. This generates long, complex,
random strings and helps to facilitate understanding exactly how
strong a password is before it gets relied upon to protect
anything.
- No matter how you choose passwords, it's really a good idea to use
and manage some kind of "password vault," in a manner consistent with
your level of risk tolerance to losing control or access to everything
the vault references. The key characteristics of a good vault are its
safety from loss or destruction, the ability to control access to the
vault, and the accuracy and completeness of the password data you
maintain.
- It's okay to use a notebook as a password vault, for instance.
It's low tech, but that's not fundamentally a problem... just look at
the characteristics of a good vault and make sure you're addressing
those three characteristics sufficiently for your personal appetite
for risk. Just be aware that you still have to manage the complexity
problem of how you enter, manage, and make backups of your passwords,
if you keep them on paper.
- It's also okay to use a digital password vault program (the
question is whether it mitigates the right risks for you, though, and
whether it introduces new risks that require additional effort to
control). There are some instant gotchas you need to work to avoid
with a software based password vault -- because it's electronic, it's
much easier to lose a copy somehow, so we do recommend that you ensure
it's an encrypted password vault, using a mathmatically strong form of
software-based cryptography... which will almost certainly exclude
office suite programs (word processors, text editors, and
spreadsheets).
- It's probably even okay to use a digital password vault service,
where your passwords are stored in an online "cloud-based" service, at
least as long as you understand the risks and the rewards and are
comfortable with how it works and how it might fail. A password vault
service needs to be reviewed in terms of all of the same ways that a
password vault program, and in addition must consider the degree of
security within the service and how the service is designed and
implemented to ensure your stuff doesn't end up in someone else's
hands. The cryptographic issues are more complex and will require
further work to understand fully. That doesn't mean that a service
can't work... but it does mean you have due dilligence to
do.
- Ask yourself the following questions about passwords and password
vaults, and be sure you're comfortable with your answers and the
consequences of those answers. Keep in mind that, ultimately, you're
probably going to end up having to extend some degree of trust. It's
up to you to decide how much trust you're willing to extend, what the
advantages and disadvantages are, how might things go awry, how likely
is that, and what will the results look like.
- What are the ways I might lose access to or control of my password
or password vault? Are there particular kinds of risks I need to
think about being able to recover from, or special forms of
vulnerability I need to address, e.g. "forgetting" or "misplacing" or
"destruction due to fire/water damage"?
- Who and what will have access to my passwords? What assurances do
I have that any of those people or things are not going to introduce
confidentiality, integrity, or availability problems with my password
data?
- What happens if I lose a password or password vault? How hard
will it be to recover (can I recover?) to a known good state if it
gets lost? Can it be misused if someone gets their hands on it (or a
copy of it)?
- What happens if I'm incapacitated and someone needs access my
stuff? Getting technical, it's important to think about someone who
might have to act on your behalf, which I'll call your agent -- it
might be your successor, attorney, trusteee or, yes, even executor.
Will they need to be able to access to the vault? Can they? How do
you ensure that they can GET access, but don't necessarily already
HAVE access?
- How much change will occur to your password vault? How will you
ensure that whatever you do to address the "what if I lose it"
question doens't lose "too much" data when getting to an acceptable
state? How will you ensure that your agent has access to complete and
accurate information, or that the agent can recover from the vault
being lost? How long will it take to recover? Are all of these
limitations okay?
Back to the top of this article
|
|
Password mistakes to avoid
- Never (ever!) re-use your GCFN.ORG password (or the
password to any email account). If you do, you're
really increasing the likelihood that you'll experience some kind of
identity theft online. Many (maybe even most) online services use or
offer email based resets and confirm all sorts of stuff by email -- so
once they get your email, they can look for the receipts of where
you've been doing business and reset your passwords, giving them
access to huge amounts of your online life.
- A generalization of the above: don't re-use the same password at
multiple sites. If site A has a security problem and leaks their
credentials, it really shouldn't give them credentials to site B.
Even more generally speaking, password re-use across any context is a
bad security practice.
- Do not use words that can be directly found in any known
dictionary or published book. Pretty much every dictionary of words
can be (and probably have been) plugged into password cracking
software.
- Do not choose a password that in any way resembles the username or
account identifier it's linked to, as that's part of the guessing
strategy most password cracking software uses.
- Do not use simple, adjacent keyboard combinations. Phrases like
"qwerty" and "asdzxc" and "123456" are trivial to crack and are
well-understood in attacker tools today.
- Do not choose passwords based on details that may not be as
confidential as you might expect, such as your birthdate, social
security number, phone number, names of family members, pets, home
address, zip code, housing history, income history, current and past
employers, etc. Based on the highly publicized credit bureau
data breaches at Experian and Equifax and the Federal and state
government data breaches that have made it into the news, one should
expect that highly detailed profiles including most imaginable
personal data about you are readily and easily
available..
- Don't let youself be convinced that the simple transformations of data
you do in your head are protecting you.
- First off, many forms of simple transformation will not stop an
attacker. The various ways you can substitute symbols or numbers for
letters ("p@$$w0rd") are finite in number and are well understood, as
are common misspellings and can be expressed in automated rules to
follow: password attackers use these "rules based" transformations as
part of their dictionary attacks. Any transformation that's not based
on cryptographic principles and which has not undergone strict
scrutiny (either in the academic community or in the non-classified
government space) should be considered suspect. Transformations are
not always entirely worthless, but they have far less security value
than most people seem to think.
- While it's true that pass phrases based on some transformation of
memorable phrases can generate reasonable passwords, the approach
isn't guaranteed to work. It's unpopular to say this, but most people
aren't as smart as they think they are about security issues (and that
includes security professionals!). Leveraging a wide amount of
research and my review of the literature has led at least me to
conclude that phrase generation is inconsistent at best, and that with
almost no exceptions, you're better off doing something more
predictably effective.
- At the same time, simple transformations are likely to make it
MUCH harder to remember and recover passwords if you need to. You're
much more likely to be protecting your password against
yourself (that is, making it harder to use without
gaining security value) when you use simple transformations.
If you keep an electronic copy of your passwords on your computer,
make sure it's got some reasonably strong encryption on it.
Unfortunately, most people don't have the right training to recognize
what makes encryption strong or weak. While this is certainly not
sufficient for a complete assessment, a good start is to look for
documentation that identifies the product as storing data in an
encrypted form, using an encryption algorithm like the Advanced
Encryption Standard ("AES" also known as "Rijndael"). Appropriate
"key lengths" vary by application, but looking at today's technology
for this application I would be skeptical of anything that doens't use
AES-256 (256-bit key length). Don't use basic productivity
tools (word processor, text editor, spreadsheet or the like) to retain
electronic copies of passwords because they don't store data in
encrypted form: you really want your passwords to be stored
in a purpose-built password manager... and not all of those programs
or services are of equal strength and quality. For service-oriented
password vaults, ensure that the access mechanisms are also encrypted
using the strongest possible encryption methods.
Don't forget to keep a backup of your password vault whenever it
changes, and periodically in addition to whenever it changes (just in
case). Further, make sure that backup is stored safely in a manner to
mitigate the possibility of loss or damage.
Back to the top of this article
|
|
|
