Password Infomania - Part Two
By Benjamin Rich


Protecting Yourself - How to Choose Secure Passwords

In Part One of Password Infomania, Benjamin Rich discussed ways crackers figure out passwords. In today's installation, he covers hints on selecting good passwords that are difficult to guess or crack.

Length: Unlike baboons but similar to elephants, length is crucial. A 4-character password, no matter how clever, only has about 81 million possibilities, a pathetically small search-space for a Pentium-level processor to move through. Even with every possible practical ASCII combination, covered in no particular order, a 4-character password can be cracked by a brute force program on our aforementioned 1,000,000 password/sec machine in just over a minute twenty. Most machines aren't capable of this kind of speed, but even at a thousandth of the speed, this can be accomplished in just under 24 hours.


Complexity: Sometimes called entropy. Making your password as free of plausible patterns as possible can indeed bring it closer to 'uncrackable'. Obviously, a 16-letter password, fridge explosion can be quickly sorted out with a dictionary attack. Even fr1dge expl0sion, as explained, can also be accounted for in most dictionary attacks. Therefore, a password that increases the theoretical search-space to the largest possible, with the fewest recognizable patterns, is best. 5-character passwords are fairly easily cracked, although Q+f@~ is still infinitely better than h4ppy (not that you should use a 5-character password, but your see what I mean).

Apathy: Don't choose a password close to your heart - remember, any cracker, or worse, someone who wants to do you real harm and has real surveillance expertise and equipment, is going to find it much easier to crack your password if they don't even have to use a program to do it. If it's 11 characters long, but also happens to be your girlfriend's or boyfriend's name, it will be on the list of first choices for anyone seriously wanting to get into any of your systems.

We've already gone through the pitfalls of using real words or names, or even 'non' words like those from the popular vernacular, or from l33t-sp34k substitution, but add to this list: your birthday; your partner's birthday; your car's number plate; foreign words; famous phrases; pet-names; Social Security number; etc.

Remember - as typified by numerous security breaches in supposed 'impervious' systems, the weakest link is always the human one. It means nothing if the main projects repository server of your company is secure to thousands of outside attacks if it has a 5-letter root password which is the name of the CEO's dog, whom he or she tells their niece in the advertising department 'in case of emergency'. Likewise, it means nothing if your password is easily accessible, guessable, or findable (as in written down somewhere) even if it happens to be long and have reasonable entropy.

Uniqueness:A highly common pitfall is to use the same password for many things: your email, your Linux root, your eBay account, etc. For the love of christ, don't do this: a clever password it may be, and 36 characters long, plus alphanumeric and memorized, but if you're using it for your Joe-Blow JavaScript-R-Us online email account, and it's stored in plaintext in a MySQL database with no password prompt hidden on the site under the directory 'secret'... and you also used it as your Linux root... you're in an extremely dangerous position indeed. Your password may be a secure one, but the different agencies protecting it may not all be secure. Using one password for everything means that a) you're done for - repetition is the sort of thing an immoral cracker will try first upon cracking your online email and finding your use-all password, email-address and geographical location in plain text, and b) you've wasted a good password because you'll have to change it to n different other passwords on all your systems - and this is assuming you figure out someone has your password before said password has been used to break into and gain control of all your protected systems.

Memorability: If you can't remember it, you'll have to write it down, and that's inefficient and means it can be found by immoral others. Mind you, good password practices really should be the cornerstone of computer usage, not necessarily called into question for their practicality - as a Linux user for example, it's unlikely anyone will even attempt to crack your system because most immoral people use Windows (I'm not joking on this one) - and at that, broadband users are more at risk than dialup users, since broadband is a valuable commodity and is more 'prominent' as it were, on the network due to a permanent or long-standing IP1.

Sure, sure, you're just a PC owner - unobtrusive, and you don't have the same 3-letter password for your email as your root access - so, theoretically, having a password less than 19 characters, or writing it on the inside of your sleeve cuff just in case, or even telling it to a trusted friend, aren't necessarily security-compromising activities which will see your credit card stolen and your family dead within the week. Nonetheless, it helps if your password is a good one, a long one, and also something you don't have to record anywhere except your memory - just as you take precautions in other areas of your life regardless of the likelihood of extreme misfortune.

Generating a Good Password
Inconvenient as it is, a good password must be long; have a good combination of upper and lowercase letters, symbols, and numbers; and use as many twists and turns as possible. An example of a highly secure password might be:

C#e%4/*W1

9 letters long, utilizing letters, numbers and symbols, and being more or less uncrackable with dictionary means. Resist the temptation also of 'disguising' words with obfuscation - as stated, an English word, even made entirely out of symbols and numbers, can still possibly be guessed by an advanced dictionary attacker.

A good way to choose and remember a complex password is to generate the password using a random exercise, and then type it many times to remember it. Remember, then, the position of the keys you type; the pattern of your fingers moving across the keyboard - not a particular word or phrase, which is easily remembered but also easily cracked.

Generating a good password can be as simple as finding a list of ASCII characters, and then rolling a pair of dice several times to pick out the ones you want - a good example for this sort of thing can be found at http://world.std.com/~reinhold/diceware.html; another way, and a much more trodden path, is using a password generation program. Password generating programs are mostly found for *nix environments, but there are some for Windows, and I've included a list of useful links below - remember to use a program that generates random ASCII gibberish, not combinations of words or English elements. Always be on the lookout for password generating programs that only have fixed character sets (only letters and numbers, which alone doesn't generate enough entropy for a password) or only English-like generations (if it can be generated, it can be second-guessed by a dictionary attacker program).

Good Security Practices
Finally, and this is perhaps hardest of all, remember to change your passwords fairly regularly. With highly complex passwords like the one above, stored on a secure system, there is little need for the average unobtrusive user to change their password very regularly - but as a necessary habit for maintaining a secure system, it should be noted, and particularly by those who do work in high-risk areas.

If anything can be said for good security practices, it's the reminder that what really makes a system secure is diligence, vigilance, and knowledge - a strong human factor. All the high-priced software in the world will not save your company server from attack if it's system administrator is inexperienced, unobservant, and lax in practice; the best system is still not impenetrable if it has an obvious password - no matter how cosseted away that password is.

Good Random Password Generators:
Windows
>> Password Generator v1.1.2
Linux
>> Keymaker v1.0
Online
>> LoTekk Password Generator

Footnotes

Dialup providers change their users' IP addresses each time the user logs on - but cable providers usually give their users permanent IPs, or IPs which have 'leases' of several months. This means that, since your address is unchanging and constantly present on the internet for months at a time, or forever, an attacker could theoretically track you, suss you out, and come back later at any time to collect.


Benjamin Rich is the Web master of CSD.