Language Selection

English French German Italian Portuguese Spanish

Voluntary Disclosure Is the Threat to Password Security

Filed under
Security

Computers can remember complex bits of data effortlessly, but people routinely fumble that task. Naturally, one of the big trends in computing security is making users memorize complex passwords -- then regularly wipe those from their memory in favor of equally obscure replacements.

To judge from the stern advice handed out by banks, Internet providers and information technology departments -- often, I suspect, after prodding by accounting departments and liability lawyers who don't want to be blamed for a security breach -- computer security hinges almost entirely on you choosing a string of letters, numbers and symbols in an order that has no correlation to any word or phrase that has ever been spoken or written in English or any other language.

That's fiction. First, while avoiding obvious passwords still constitutes a common-sense defense, that won't stop most password theft attempts these days. Second, forcing people to choose the most obscure passwords possible, then choose new ones every few months, is more likely to grease the skids for a successful compromise of those users' accounts.

This is because passwords aren't stolen in ways you might expect; a bad guy doesn't sit down in front of your computer and start typing in guess after guess until he succeeds. In the real world, accounts are usually cracked in two ways -- only one of which can be slowed or stopped by the use of a sufficiently inscrutable password.

One is to get access to the computer that stores users' login info. If the master password file stored on that machine is encrypted -- it should be, but sometimes is not -- the attacker then runs a password-cracking program to break that encoding. Otherwise, he or she can read the file as-is.

The other method relies on someone surrendering a password voluntarily. For example, an attacker can hide a program on a victim's computer to record each tap of the keyboard -- often by exploiting an old, long-since-patched vulnerability in Windows or by hiding the "keystroke logger" in a tempting download.

Or the attacker can just ask nicely for the password -- what's called "social engineering." The victims can be technical staff at a bank or an Internet provider who get a call from somebody claiming to be a colleague elsewhere in the company. Or the victims can be individual users who receive "phishing" e-mails imploring them to verify their account information by clicking on a link to a phony Web site done up to appear like that of a trusted institution.

The quality of a password matters only against the first type of attack -- the brute-force, code-breaking assault, which will hit pay dirt more quickly if stored passwords appear in dictionaries.

That's why security experts tell password creators to avoid using real words or names, even when altered by substituting letters with similar-looking numbers or symbols (for example, replacing "i" with "!" or "1"). One common suggestion is to use words only as ingredients -- say, by combining the first letters of names of friends or titles of favorite books.
But if an attacker employs keystroke logging or social engineering, it doesn't matter whether your password is "password" or "92nkkcx-j1!" Even the most inscrutable login offers no defense against those tactics -- which are what most attackers seem to employ these days.

"If you go back 10 years ago, password cracking was the way to do things," said Marty Lindner, a senior member of the technical staff at the CERT Coordination Center, the network-security center founded at Carnegie Mellon University in 1988. Now, however, he said that phishing and other social engineering attacks are "far more prevalent, far more devastating than anything else."

Granted, getting actual numbers on how people's accounts were broken into is difficult -- few institutions want to discuss how some teenage hacker managed to own them. But there's no arguing that phishing and spyware attacks are only getting worse, and understandably so; why should an Internet con artist waste time mastering password-cracking routines when there are smoother roads into the bank vault?

And yet too many companies seem content to rely on password Puritanism as their response. Sometimes it's just silly -- for example, when some newspaper sites force readers to choose passwords with at least one number.

But more often, it's self-defeating. When users are pushed to remember too-obscure passwords, they'll start writing them down on Post-It notes stuck to a monitor or (worse yet) start reusing passwords among multiple high-value accounts. Worst of all is the policy of some companies and financial institutions to require users to change passwords every 30 or 90 days.

Not only do those periods still offer more than enough time for a minimally competent hacker to swipe an account login, the regular changing of passwords can easily soften up people for social engineering attacks.

Think of what happens every time a user must change a password -- or inevitably forgets the login of the month or the quarter: They'll have to go to a Web page or call up a help desk to get the password reset. That interaction represents a regularly scheduled opportunity for an attacker to try to step in and impersonate either party.

A few weeks ago, confronted by an obscure Web-mail login subject to one of these inane password-expiration rules, I called the support number listed on that site to have my password reset. (No, I won't name the firm involved). I expected to have the new login e-mailed to me -- but instead the helpful fellow on the other end of the line just read it to me over the phone, making no attempt to verify my identity.

If I'd been interested in stealing access to somebody else's account, I could have had a lot of fun. Instead, I could only wonder why we keep wasting our time with these illusory measures.
There are real problems with network security these days. But treating customers as if they were reprogrammable robots won't solve any of them.

By Rob Pegoraro.

More in Tux Machines

Android Leftovers

  • 1B Android phones shipped in 2014, but they don’t all help Google
    When Android first arrived in 2007, it was (and still is) a key part of the OHA, or Open-Handset Alliance. OHA partners — which include Samsung, LG, Dell, HTC, Huawei and ZTE, to name a few — all loosely work together to help improve Android, while competing against one another by using Android on their respective hardware products. Android is the commonality between all of the OHA partners. And then there’s Google.
  • Android beats iOS for app downloads, but revenues are still a different story
    There are plenty of caveats to this line of reasoning, though. First, Google Play is not the only Android app store – Amazon and Samsung run their own stores, while in countries like China there are dozens of stores offering Android apps.
  • HTC One M8 Android 5.0 Lollipop Update: What U.S. Owners Can Expect
    When Google announced Android 5.0 Lollipop back in October many smartphone owners like those with the HTC One or HTC One M8 instantly started waiting for details regarding the Android 5.0 Lollipop update. It has arrived for a few devices already, including the HTC One and HTC One M8 Google Play Edition handsets, but below we’ll go over what regular HTC One owners need to know about the Android 5.0 update.
  • Samsung Galaxy S4 Updated To The Android Lollipop 5.0 OS
    The Android Lollipop 5.0 update is finally available for the Samsung S4. The operating system is also available for the Samsung Galaxy S5, Note 4, Note 3, and Note Edge. Samsung Galaxy and Note users will be happy to hear that the long waited update is coming in the near future. But should Galaxy S4 users take advantage of the Android Lollipop update?
  • Don’t wait for Android 5.0, this app makes your phone look like Lollipop for free
    Android 5.0 Lollipop is a huge upgrade for Google’s mobile operating system. The only problem with it, of course, is that it’s only available for a handful of devices. Most Android smartphone users still have plenty more waiting to do before Lollipop is finally available for their handset, but now there’s a terrific app that will make your older version of Android look just like Lollipop — and it’s free!
  • Is this Apple’s secret weapon that could force Android users to buy an iPhone?
    There are many reasons why Android users switch to iPhone, and vice-versa, but Apple may have a secret (or not-so-secret) weapon that could pressure some Android fans to considering a move to the other side. No, it’s not Apple Pay, an exclusive iPhone 6 feature that’s heavily marketed by various banks in the U.S., further helping Apple market its 2014 iPhones. It’s actually a stock iOS app that has been hiding in plain sight for years.
  • Android 5.0.2 Lollipop Problems Frustrating Nexus Users
    Google rolled out its Android 5.0.2 Lollipop update to fix Nexus Lollipop problems. And while it did fix some of the bigger issues, Android 5.0.2 Lollipop problems continue to frustrate Nexus users.

Libreboot X200 laptop now FSF-certified to respect your freedom

This is the second Libreboot laptop from Gluglug (a project of Minifree, Ltd.) to achieve RYF certification, the first being the Libreboot X60 in December 2013. The Libreboot X200 offers many improvements over the Libreboot X60, including a faster CPU, faster graphics, 64-bit GNU/Linux support (on all models), support for more RAM, higher screen resolution, and more. The Libreboot X200 can be purchased from Gluglug at http://shop.gluglug.org.uk/product/libreboot-x200/. Read more

Ubuntu 15.04 Now Based on Linux Kernel 3.18.4, Devs Are Tracking the 3.19 Branch

A new Linux kernel has been made available for Ubuntu 15.04 (Vivid Vervet) and the developers are also tracking the current 3.19 branch of the kernel, which will eventually be adopted after it reaches a stable state. Read more

Ubuntu Users See Private, Hybrid Cloud Expansion

Canonical, the company behind the open source cross-platform operating system Ubuntu, released its annual cloud and server survey this week that seeks to cast more light on the makeup of cloud infrastructure, how it is managed, and what is driving cloud adoption. Canonical said it surveyed 3,100 customers, most of whom are Ubuntu server and cloud users, about the makeup of their cloud infrastructure and how it is being used. Read more