Password advice from the father of the firewall

[one...two...tree 2,762]

By Larry Greenemeier

As more and more personal business is conducted online, passwords (make that dozens of passwords) have become a necessary evil of daily life. We all know the rules for coming up with good passwords, or at the very least we hopefully know there are rules—choose an alphanumeric combination, don't write it down, don't use it for multiple accounts, etc.

Despite this guidance, "people are lousy at picking passwords that computers can't guess, especially computers with multi-core processors," Bill Cheswick said at a cyber security conference held recently at New York Institute of Technology. Cheswick has some credibility in this area. In addition to his current position as lead member of AT&T Research's technical staff, he played a key role in developing the first firewall systems more than two decades ago.

The cyber security pioneer ran through about a dozen different corporate password creation policies from a variety of companies and concluded, "These rules don't make anything more secure." Even the longest and most complicated password is useless if it fall into the wrong hands.

Cheswick offered instead his "non-moronic password rule": A password should be an alphanumeric combination that a family member or friend can't guess in five tries, and it should be complex enough so a person can't figure it out by watching you type it one time. If you need a reminder, rather than writing down the password itself, write down something that will remind you of the password.

It's also important to weigh the value of the information you are protecting. Cheswick breaks this down to three levels. The "who cares?" category is for any account that simply provides access to information, such as an online subscription to The New York Times. If someone steals the password, the most they can do is read the publication or perhaps fill out a survey, so feel free to reuse passwords for these sites.

Other accounts deserve more protection and their passwords should be created and guarded more carefully. On one level are accounts where it would be "inconvenient" if a password were stolen, but the consequences (i.e. someone ordering a book via your Amazon.com account) could be rectified with some effort. Accounts demanding the highest level of protection are those that enable you to access bank accounts, trade stocks or otherwise deal with financial matters.

Of course, the bad guys have all sorts of ways of stealing your log-in information, and many of these thefts are no fault of the password holder, Cheswick said. Some of the most common ways for passwords to be stolen are through keystroke loggers, phishing attacks and password database hacks.

Keystroke loggers are typically installed on a person's computer without their knowledge when they download software or images from unsavory or compromised Web sites. Phishing attacks are delivered via e-mails posing to be from your bank, credit card provider or some other seemingly trusted source. Clicking on links in these bogus e-mails will take you to equally bogus Web sites created to resemble a bank or credit card company's site. When you try to log in, your information is captured. Hackers often attack password databases (such as those maintained by financial institutions or Internet service providers) directly, where they can steal dozens or even hundreds of passwords.

In these cases, much of the security burden falls on your bank, Internet service provider or whomever else is in charge of protecting your information. One way for them to improve security is to limit the number of password guesses, locking an account if the limit is exceeded. Unlocking such accounts should also be carefully thought through. If a Web site offers a secondary question for authentication, that question should be related to the password rather than you yourself, Cheswick said, noting that it's not too difficult to figure out the "maiden name" of a person's mother.

link

[spookyturtle 9,466]

I use this password for all my accounts,

asdjfp89u43384kfv9240945krgfg7we557249re48478+)&$#$%^*()_)GFGHlwejsdu97er4j39fndsflar9845dsk;/..//;03e89hjddghdetge484889f8dofjdpofjdpfujapdf87uq0rufjpu3409346543@#@#%^&**()_+++JHTERFGhsdyodq9e67sdyuoE67UJ0398430948UJNML;75F#$%^*()_)+osjjohU0F9I039847777@@@###$%%^^&*()_)_+jhhgttrdssetASDKFJ;ASDFJAPOFIUW0E87Q23404R705R8723R89=23458234785WEPOIFDJA;DFJ0A97`12037478485895858376236656^^&(&**(&^8$3#$@542542543267*^I*%^8(^098_89_+8_)&*()^^89&&%^((*&(^&%&%$HNHFNVSDHFDFHPWERUQPWER4782348URPAHDLAHDFOASDYDY9QW87E6796ATUIHHOIUYHOUIOIOIU871251272529837340-374%^$()_+{p}}}|||'//.,<<>?MJHGTYWY7EWEYE

It took a while to memorize, but I feel it is quite secure.

[Calypso 464]

I'll just download a software that makes secure passwords for me.

[rsn 135]

lastpass

[mawilson 2,133]

I use this password for all my accounts,

asdjfp89u43384kfv9240945krgfg7we557249re48478+)&$#$%^*()_)GFGHlwejsdu97er4j39fndsflar9845dsk;/..//;03e89hjddghdetge484889f8dofjdpofjdpfujapdf87uq0rufjpu3409346543@#@#%^&**()_+++JHTERFGhsdyodq9e67sdyuoE67UJ0398430948UJNML;75F#$%^*()_)+osjjohU0F9I039847777@@@###$%%^^&*()_)_+jhhgttrdssetASDKFJ;ASDFJAPOFIUW0E87Q23404R705R8723R89=23458234785WEPOIFDJA;DFJ0A97`12037478485895858376236656^^&(&**(&^8$3#$@542542543267*^I*%^8(^098_89_+8_)&*()^^89&&%^((*&(^&%&%$HNHFNVSDHFDFHPWERUQPWER4782348URPAHDLAHDFOASDYDY9QW87E6796ATUIHHOIUYHOUIOIOIU871251272529837340-374%^$()_+{p}}}|||'//.,<<>?MJHGTYWY7EWEYE

It took a while to memorize, but I feel it is quite secure.

Not anymore.

[Ban Hammer 13,360]

Not anymore.

hey where's my dollar!

[JohnSmith2007 353]

Passwords will soon be obsolete. Biometrics is the way to go in the future.

[Saddle Bronc 124]

Passwords will soon be obsolete. Biometrics is the way to go in the future.

Careful--that has already been rendered obsolete on-screen (Diamonds Are Forever, Never Say Never Again, Codename Foxfire).

[spookyturtle 9,466]

Not anymore.

Australia has mind reading software so passwords are unnecessary.

[mawilson 2,133]

Passwords will soon be obsolete. Biometrics is the way to go in the future.

That's incorrect.

Biometrics prove who you are.

Passwords are what you know.

A token or smart card is what you have.

Good security systems use at least two of the above (or all three) authentication methods.

[Marilyn. 340]

at the gym my husband goes to they are starting to use fingerprint scans instead of cards...

[JohnSmith2007 353]

That's incorrect.

Biometrics prove who you are.

Passwords are what you know.

A token or smart card is what you have.

Good security systems use at least two of the above (or all three) authentication methods.

If you can prove to the system who you are then that is all that is necessary. The system knows what access to grant which people so all that is needed is to prove you are who you say you are.

[mawilson 2,133]

If you can prove to the system who you are then that is all that is necessary.

But you can't - no biometric identifier is 100% accurate. Out of the world population

of some 6 billion people there will be at least two persons with the same fingerprints

and iris scans. Identical twins have (almost) identical DNA.

A criminal might kidnap an authorized person, cut off their fingers or remove their

eyes to obtain the biometric. They might steal their access card or torture them to

get their password.

It's a lot harder if you need all three to gain access.

[spookyturtle 9,466]

But you can't - no biometric identifier is 100% accurate. Out of the world population

of some 6 billion people there will be at least two persons with the same fingerprints

and iris scans. Identical twins have (almost) identical DNA.

A criminal might kidnap an authorized person, cut off their fingers or remove their

eyes to obtain the biometric. They might steal their access card or torture them to

get their password.

It's a lot harder if you need all three to gain access.

What if you were kidnapped, had your fingers cut off, eyeballs ripped out and were tortured into revealing your password?

[mawilson 2,133]

What if you were kidnapped, had your fingers cut off, eyeballs ripped out and were tortured into revealing your password?

Well if I knew they were going to cut my fingers off, rip my eyeballs out and probably

kill me anyway, I wouldn't give them the right password.