Another password dump from a big site

I saw in the news this morning that lulsec had posted online about 26,000 passwords from a few porn sites. Article here.

We have seen large dumps of passwords from sites before, and I've blogged about password audits that I've done (with permission) to gauge the effectiveness of a password policy change. And what we've seen is pretty much the same thing from every dump. Thousands of crappy passwords, very low use of multiple character sets, short passwords, etc.

But I have noticed that in all of these password dumps (except mine) we don't get any data about how many passwords were not breakable. How likely is it that we're only seeing the passwords that fall to a dictionary attack? I guess I wonder if we're dragging the bottom of the ocean and concluding that the ocean is made up entirely of muck.

Writing down passwords - yes I am OK with that

The other day I read this article on Threatpost.com:
http://threatpost.com/en_us/blogs/why-you-should-write-down-your-passwords-070610

The article is making the case that in these times people have so many passwords that we can't reasonably expect them to remember them all. It also makes that case that malware is so pervasive that we can't expect passwords to be secure even in password management software like Keepass.

There are things that I like about this article, and things that I don't like about it. The main thing I don't like is that there are a lot of statistics thrown about without a whiff of citation. On the other hand, the advise is sound, and something I have been recommending as one way of remembering passwords.

Yes, I agree that we're probably safer if people can just remember their password, and that's why I advocate that users select pass phrases that are easy to remember, but difficult to crack. for a while my password was 'My password is awesome!' Tell me that you can't remember that. But some people just aren't going to do that, so the next best alternative is to write it down.

See, to me, it seems that it doesn't matter so much if you write down your password. What matters is where you keep it. Working in higher ed, you have to be pragmatic and realistic in the advise that you provide and the audience you're dealing with. Let's face it, PhD's are really well educated in a single topic and seem unable to learn anything else. So trying to teach them to remember all their passwords is a fool's errand. Shame seems to work much more effectively. So try shaming them into realizing that they're not the first person to think of hiding their password under their mouse pad.

What I tell people is that if you keep your password in your wallet, then someone would have to steal your wallet to get your password. You're very likely to realize that your wallet is missing shortly after it disappears. You're very unlikely to notice if I lift up your keyboard and copy down your password. It also seems unlikely that I can steal your wallet, write down your password, and return your wallet. Possible yes; but unlikely.

This is an actual photo from my office by the way. No, it's not my machine.

More password cracking statistics

In my last post I talked about how we anonymized our password database, and took a random sample of hashes to attack with a dictionary. In this post I'd like to talk about the results that we got when we took the same random sample and attacked it with rainbow tables.

I have to say that even I was shocked at this statistics: 84.07% of the passwords in the sample were broken by the rainbow table attack. Incidentally we used Ophcrack with the fast windows xp table.

The average length of a cracked password was 7.84 characters with a standard deviation of 1.70 characters. I still see a lot of password policies written that prescribe passwords to be at least 8 characters long. Statistically speaking, almost half of the broken passwords were at least 8 characters long.

Of the broken passwords, only 2 had four character types. Not 2%, but 2. As a percentage it was 0.22%. 12.15% had three character types, 40.69% had three character types, and 44.82% had only one character type.

As I mentioned in my previous post, I plan to use this data after we've implemented our new password policy to measure its success. It would be interesting to know if other organizations audit their passwords like this and what kind of statistics they have found.