Rethinking passwords
“We have to do better … The bad guys are pros, they’re just as good as you are and maybe better.” That’s Bill Cheswick’s message to the audience in his talk “Rethinking Passwords.” Comparing the password policies of various companies and educational institutions yields a confusing and sometimes contradictory set of requirements. This makes managing passwords difficult for users. Perhaps the solution doesn’t lie in stronger passwords, but in better authentication?
Dictionary attacks are not the major the major threat anymore. The common threats now are keystroke loggers, phishing and other social engineering attacks, and password database compromise. Strong passwords are no protection against any of those attacks.
In order to improve system security, it’s necessary to think beyond the traditional password mechanism. Multi-factor authentication is one solution that has worked for ATM cards for decades. Although users sometimes resist having to carry a RSA token or similar, there are solutions available now. Softkeys are available for smart phones, which many people have with them at all times.
If strong passwords must be used, it’s better to make them easy to remember and fun to type. The goal of a strong password isn’t necessarily to make a string of gibberish, but to to meet a minimum level of entropy. Phrases or sentences composed entirely of dictionary words can provide that level of entropy and are often much easier to remember. Bill has provided a sentence generator at http://www.cheswick.com/insult (some content may be unsuitable for children) which he claims to have 42 bits of entropy.
There’s no requirement that authentication be done with text, either. The idea of a password map has not yet caught on, but it holds promise as an easy-to-remember-but-difficult-to-guess method of authentication. In a password map, the user zooms in on map or an image (such as the Mandelbrot set) and clicks a selected point.
The current password paradigm is in need of repair. It will involve the development of a consistent set of password recommendations (perhaps an ANSI standard) and user education. Bill encourages users to use a tier of passwords, with the same password for all sites where a compromise is unimportant. A variation of the same strong password can be used for sites, and it’s okay to write notes as password reminders (for example “use the strong password except that this site doesn’t allow spaces”).
Rethinking passwords also requires work on the part of the admins providing the authentication mechanism. Authentication attempts should be counted and managed, locking out accounts after some number of attempts. Inquisitive addresses or networks should be blacklisted. A single reliable authentication server is preferable to replicated servers from a security standpoint, and the most important thing is to not let the authentication server be compromised.
