Passwords: The Good, the Bad and the Ugly

Pick anyone in the world who uses a computer now and then and chances are they've had to think up a password somewhere along the line. Regular computer users will have stacked up quite a few, your work pc, Web mail, online banking, blogs, etc. It's no wonder that a lot of people get overwhelmed by the sheer weight of things to remember and forget why they've got the passwords in the first place.

It's not uncommon to see a Post-it note with a password written on it stuck to the top of the computer that it accesses, and when that happens it's easy to see that something has gone wrong somewhere down the line. For users, it's important to remember why passwords exist in the first place, and for administrators setting a password policy, who tend to err on the side of paranoia, it's important to remember that sometimes too much security is just as bad as none at all. To understand what makes a good password, we need to first look into how passwords get broken.

People trying to break your password will generally fall into one of two categories. The first will be professional cyber criminals, indiscriminately trying to gain access to accounts for their own gain. Maybe it's access to your bank account and your funds, maybe it's control of your computer so they can add it to their botnet, maybe it's an attempt to gain access to your work account for the purposes of industrial espionage, or maybe it's just some bored kid looking for something to vandalise.

Whatever the situation, the common factor is that they're not necessarily singling you out and you haven't necessarily done anything to draw their attention. You may just be one of a thousand hit, or one of a hundred thousand chosen at random on the Internet, and the only thing protecting you is the strength of your password.

The second group are people who have chosen to target you; either they know you or they have the means to find out. They may have chosen you for any of the reasons above, or through curiosity or spite. Many people choose passwords that relate to personal information, such as birthdays, addresses or family names -- thinking that either nobody knows these little facts, or that those who would know would never try to use them.

Most people aren't aware how much information ends up being available about them on the Internet, one way or another -- and with search engines getting better all the time, it's getting easier to find out more about people.

How are passwords broken?

There are a number of different ways in which passwords are broken. The oldest, and least sophisticated method is called the brute force attack. An attacker runs through every possible sequence in the set of possible passwords until they find the right one. While it's not clever, the advantage of the brute force attack is that given enough time it will always work. The key factor here is time, but to understand this, let's take an example: cracking a four digit PIN number.

Now in this case, there are four characters and each character has 10 different options -- meaning that there are 10 ^ 4 possible combinations. Or 10,000 attempts to generate every possible password in the set, but since on average you only need to go through half the set to find a given password, a cracker will need only 5000 attempts per password, which a computer can run through in a matter of seconds.

That was a simplistic example, but let's take something a little more commonplace: six digit password, letters only and not case sensitive. This means that there are 26 options for each character, giving us 26 ^ 6 or 308,915,776 different options. Now clearly this is going to take a lot longer, but it's still not going to be enough to discourage an attacker.

At the 2005 Ontario Universities Computing Conference, Johnathan Graham claimed an optimised copy of a password cracker running on a 2.7Ghz G5 Mac had managed to generate 900,000 encrypted passwords per second; a six letter password space could be entirely generated in only five minutes (presentation notes). An eight character password, using the full printable ASCII character set, including uppercase, lowercase, digits and punctuation, would take 200 years of constant computation to crack at this rate.

The second method is the dictionary attack. In this kind of attack the attacker has a big list of possible passwords, so that rather than having to try every possible combination of letters and numbers, they need only try combinations that are likely to be someone's password, somewhere. Don't be fooled by the name into thinking that this list contains only words found in a common dictionary, although that will certainly be part of it.

Your typical password cracker will have several dictionaries, ranging from a short list of only the most common passwords, up to a comprehensive dictionary containing obscure words, names, places, phrases and common misspellings. Oftentimes a cracker will use this dictionary with itself to generate a list of concatenated words, including the addition of digits and punctuation. A password cracker's largest dictionary may run into the 10s of gigabytes, and may run for days.

The last method is the simplest -- trying passwords manually is the sort of attempt your little brother might try. Normally this is a negligible threat -- few attackers have the patience to sit and type out 10 thousand different passwords. The danger here is when the attacker already has the password, even sticking to low tech approaches there are plenty of ways an attacker can get the password of a careless user. The easiest is to just read the password, either on the traditional Post-it note, or on the list of usernames and passwords to company accounts stuck to the side of the secretary's desk -- if you put your password in plain sight then you're trusting everyone who steps into your office to respect your privacy.

Another common trick to look out for is the fake e-mail asking you to "verify" your account by sending your username and password through e-mail -- in fact delivering it right to the attacker who's trying to compromise your account. The success of this scam has led many online sites that use password verification to place warnings to inform users that they will never request a password through e-mail.