Thoughts on Passwords
We are more dependent on our computers than ever. There’s no sign of this slowing and almost every part of our lives has a computer or smart phone aspect.
As our lives go more and more digital, the number of passwords we need and use grows. For those in the Defense and Intelligence industries we have been well trained to create, use, and remember passwords. Never write them down, never reuse them, make sure they are complex, and change them often. In fact many systems automate these features so you can’t use a weak or old password.
It’s not realistic to hope that every person can keep every password safe and unique.
At last count I have about 60+ passwords and about 20 are really important.
Let’s talk about the core password concept… Challenge and Verify.
Imagine your back in prohibition time and you wander to a local door and knock three times, the small window in the door opens and a person says yes and you whisper “I have some flowers for you”. The door opens and in you go…
The first aspect is which door to knock on
The second aspect is how many knocks
The third aspect is a Challenge-Verify question
Perhaps you could watch from a distance and identify the door or even the number of knocks, but the Challenge-Verify is a bit harder and you’d have to be pretty close to overhear a whisper.
At the core of every password system is a Challenge-Verify process.
The system asks for a user ID and a password and then in one form or another “looks up” the matching info and either “opens the door” or leaves it locked.
Even biometric password systems (fingerprints and eye scans) look at the data from the sensor and compare it to valid data the system has. It’s still a Challenge-Verify process albeit a bit harder to fake. For a while USB fingerprint readers were hoped to revolutionize the password industry (apparently some thought fingers would be hard to steal) – unfortunately the data between the reader and the computer was not encrypted and was easily hacked… and at times the readers don’t work as well as hoped…
https://www.blackhat.com/presentations/bh-europe-06/bh-eu-06-Kiviharju/bh-eu-06-kiviarju.pdf
You can even make fake fingerprints and fool a reader…
http://www.instructables.com/id/How-To-Fool-a-Fingerprint-Security-System-As-Easy-/
So it’s clear even with a fingerprint or password we are not secure. True, you can’t forget a fingerprint but they are not easy to change either.
For most of us we are overwhelmed with passwords and use patterns. Sometimes this is a way to remember passwords – “Let’s see… this is a online personal site so I use a Beatle’s song name…” But then the system says you need to use a number, a capital letter and a special character. Suddenly “yellowsubmarine” becomes “YellowSub1!” or some other form. Now you have a compliant password and maybe a way to remember it but you also need to remember the extra parts – likely you capitalize the first letter, the last letter or each letter of each word, you probably use a favorite special character like “!” or “@” and a favorite number or two.
Amazingly, each year passwords are often audited and weak words used frequently make it on a list – and yes the hackers now and use these lists – why not!
http://gizmodo.com/the-25-most-popular-passwords-of-2014-were-all-doomed-1680596951
I wish a strong password was enough but if you easily share it the complexity doesn’t matter; ask Jimmy Kimmel! It would be funny if it wasn’t so scary… https://www.youtube.com/watch?v=opRMrEfAIiI
The complexity is growing… Think about credit cards. First you just swiped it, then they asked for the expiration date (to make sure you had a valid card), then they asked for the 3-digit code on the back or 4-digit code on the front (an extra piece of data), then they started asking for your zip code. Each one of these was to increase the information you provide to make fraud more difficult.
The problem is that in the challenge-verify process – this doesn’t make the challenge that much harder. Ok, if I don’t have the card or haven’t seen it I’m blocked, but if I stole the credit card from your mail box I likely have everything including the zip code…
The trick is to use info that’s hard to get or fake. When you think about your ATM card you need a PIN. It’s not on the card and it’s not something you can just guess – even though it’s 4 digits the system won’t allow you to try and try until you get it right…
For a while thieves were using skimmers at restaurants and even ATMs. At restaurants someone with your card can read the numbers on the front and back and run it through a machine that will copy the magnetic strip. That’s why they started asking for zip codes – it’s not on the card or the strip so make that skimming hard. On ATMs you might wonder how do they get my pin… and the answer is with a small camera – yep they build hardware that reads your card as you innocently put it into the ATM and then watches your fingers on the keypad… Yep you should be scared and cover the pad with your other hand… Below is a photo of a pop-on ATM skimmer…
Until recently in the US, Smart Credit cards we not too common. That’s changing and like the UK the US is moving to smart credit cards. If you look at the image below you’ll notice a copper metallic puzzle. What you are looking at are metallic contact pads that connect inside the card to a computer chip – yep smart card means that card is more than plastic or even plastic with a magnetic strip. It’s a mini encryption device. You plug the card in and a new reader connects with those pads and the Challenge Verify becomes more complex and secure. In simple terms you enter a pin and the smart uses the pin and internal encryption to generate a password that’s sent to the online credit processing company.
So a smart ATM card even kills the skimmers deal. Sure they can read your magnetic strip and maybe even record your pin but without the card and it’s internal chip your pin is useless… No card, no deal. The point is a smart card defeats a lot of current threats. Of course, this makes things like online Amazon purchases from your laptop a bit harder, back to passwords…
So with so many passwords, the next challenge is what happens when you can’t remember the password. A while ago it often required a call to the help desk and some human-to-human interaction. That often included some extra info like your address or SSN or some other info that would let the administrator confirm you were likely the right person with a forgotten password. They’d reset your password with some form of default password and process to logon and change it. These are often called one-time passwords.
Well with so many passwords, human-to-human service for recovery isn’t efficient and many companies have moved to some form of automated recovery. Almost every password page has a link called “forgot your password”. This link either sends you a password-reset link to a previously supplied email or some form of recovery questions – another form of Challenge-Verify. Can’t remember your complex password? What was the color of your first car? Silly but true…
So what does this mean? It means your email is a very dangerous thing. It’s likely right now if you search your email for “password” I bet you will find a bunch of reset emails. Ok, so if someone has access to your email – they have essentially the ability to find, request and then reset access to other accounts – maybe your ebay account, 401K, facebook page… Guard your email password. Keep it safe and strong! Purge emails that are about passwords – delete them after you use them and don’t use email as a file folder…
Sure on the system side there’s still a “list” of authentications that can be hacked but usually that’s encrypted and reasonably protected. Passwords are often hashed and the hash remains in the system so it’s the hash of your password that resides in the lookup.
So you enter your password, it’s hashed, and the result is compared and you either pass or fail. There is still a risk – If I know my password and get a copy of the hash table I can calculate the hash pretty easily, so systems often do something called “salting” where your password is “salted” with extra data. Now even you don’t know what the password is as it’s your password plus the systems “salt”.
So the user is typically the easier target and you need to stay aware.
Security folks don’t ignore these threats. Even with strong passwords, recovery is a big risk – especially if automated. The way we are increasing security on passwords is with a concept called Mulit-Factor Authentication (MFA). A smart card or system that sends a code to your smart phone is MFA. With MFA suddenly you need more than just knowledge – you need “something” this is often called the trifecta: somewhere you are, something you know and something you have. Think ATM – you have to be at a connected ATM, know your PIN and have YOUR ATM card. If you don’t have all three you cannot access your account.
MFA is far more powerful than just a strong password. It makes stealing a password more difficult on the user side. You can just read a password written down or look over someone’s shoulder you also need his or her cell phone or card.
Multifactor can have more than 2 variables – at my bank for in-person transactions I have a card, a PIN and then the teller asks me for a code word. So even a card and a PIN isn’t enough.
Memory: The weakness in almost every password system is our memory. We either write passwords down or reuse them for multiple accounts. Both are bad and need to be avoided. It’s also not realistic to have and remember 20+ complex passwords especially if systems make you update them frequently.
The Future: There’s no single answer as to where we are going. There are many tools that will save and manage your passwords. Some are standalone; some built into the O/S or browser and some on a cloud. Most/all require, you guessed it a password. So in reality these password storage tools really keep things safe until they are compromised and then it’s like Christmas.
Before the Internet and mass connectivity, our risks were often physical – some one steals your keys and then your car, or breaks into your home when you are at work. So most of our protections where physical based – like “Don’t write down your password in a book; what if someone steals the book?” Even the tools like Bento, that are actually a database, use an access password and sit online on your computer. Ok, encrypted but there is still a chance of them being stolen and used…
Multi-Factor Authentication is here and becoming more common. Ever have to enter a password and then receive a code on your cell phone to complete the transaction or log on? This helps a bunch as the password alone is only part of the equation and you’d need your phone to get the text message. It doesn’t make remembering the password any easier but it means that a stolen password alone is not enough.
I hate to say this but a smart plan might be to write your passwords down with some type of personal code and lock this list up – yep that violates some security standards but the truth is no one online can steal a piece of paper that is locked up… The threats have changed… we need to change… The passwords are longer and more complex, we have many of them and with automated recovery some of us simply use the “I don’t remember it I’ll just make another password” as our main way to access infrequent sites – not good.
I suspect that perhaps smart credit cards and the PINs they use may also become part of our Internet access – what if a log on costs one cent and the process uses the credit card to verify you? This is pretty close to what the military does with a CAC Card (Identification Card). Some might suggest we need some form of smart identification – I’d agree but the topic of smart driver’s licenses or national IDs opens up concerns about privacy, tracking and liability. If and until we have a smart ID the most likely path is smart credit cards. We have to secure and trust credit cards, so it’s not hard for me to imagine them also becoming part of my logon to my bank, 401K or really any website. Perhaps it will become a business where each logon costs a few cents but the credit card company processing makes your access more secure. We shall see, but “just remember your password” isn’t safe and doesn’t work for most people.
No Comments Yet.