Who knew that Carnegie Mellon had a passwords research TEAM!? (looked to be about 10 people).
Lorrie Faith Cranor noted that everyone hates passwords, but no matter how much we hate them, text passwords are here to stay. These types of passwords have a lot of attack vectors: shoulder-surfing, online attacks and offline attacks.
Offline attacks are difficult to protect against and are very effective and the cause of many publicized breaches. Passwords are leaked hashed or encrypted and the computers an take BILLIONS of guesses per second, comparing hashes to find matches. Additionally, they exploit the common usage of the same password at mutliple sites.
CMU had rolled out a new password policy (number of numbers required, upper/lower case, allowed symbols, etc). Everyone hated the rules and blamed her (alas, IT department did not consult her). She asked them, though, where they got the rules from: NIST. Sounds good - so looked into where NIST came up with their recommendations. Seems they came up with their rules based on what they thought would be a good idea, but had not done any tests on actual passwords.
System administrators don't want to get in trouble - they are going to use "best practices". If Dr. Cranor wants them to use something "better" - she has to prove it and get it published in a respected source.
How can you get passwords to study?
One of the easiest ways to get passwords is to ask users to come into your lab and create passwords for you - bu not everyone wants to walk into your lab to do this. You can expand the reach by doing online and get thousands of passwords. The problem? You're asking people to NOT give you their real password, so this is not real data.Another approach? Steal passwords. Of course, CMU cannot steal passwords - it's not ethical. But, hackers like to post hacked password lists, so they can do research on some real passwords.
You can ask users to tell you about their passwords (where they put the special symbol, where do they put the number and capital letter, etc).
Or you can ask sysadmins for passwords, but they usually don't want to give these out. [VAF note: the sysadmin should NOT actually have access to the raw password?]
The passwords you get from leaked systems are often from throw-away sites, so not high quality.
Her lab was able to convince CMU to give them 25,000 real, high value passwords. Could compare these passwords to leaked and previous study data to see how relevant it was. These CMU passwords have the CMU password restrictions. They also got the error logs:how often people logged in using the password, error rate for wrong passwords, and h ow often they changed - along with information about gender, age, ethnicity, etc.
To get this information took a LONG time. Had to have two computers - one off of the Internet, locked in a room and not accessible by the researchers. Researchers would write their tests and analysis scripts on a separate machine - then hand it over to the IT staff to run. Black box testing.
How did they get these passwords that should've been hashed? Many enterprises don't actually use hashes, they encrypt them with a system they can reverse so they can more easily deploy new systems. [VAF: ARGH!?!?!? what?!] So, at CMU they could decrypt the passwords (in the locked environment that the researchers did not have access to).
CMU Real Password Study
Dr. Cranor's team looked at things like how guessable the password was? Simple ones, like 1234 would be guessed in 4 tries. More complicated may be 'impossible'.
Since they had clear text passwords, they could run a guessability meter on them, as opposed to actually guessing them. They could see that CS students createad the strongest passwords, business students did not create as good of passwords.
Could not find an effect for facutly vs student vs ethnicity made no difference in password strength, but men didmake a passwords that were 1.1x stronger than women.
You can make your password stronger by dong simple things - like adding a digit. If you put the digit at the beginning of your password, it was better than no digit - but not as good as having a digit in the middle. If you have multiple numbers in your password - if you spread them out, it's harder to guess.
Password creation was annoying - if you're annoyed while doing it, though, you'll create a weaker password. :-)
They additionally took a look at leaked hash/cracked passwords - those were weaker than those created by sites like CMU that has an "annoying" password policy.
But, they could then compare the spread and diversity of their passwords collected in studies against real CMU passwords and found they were similar enough that her team could do further research with study passwords.
Large-Scale Online Experiment
Used Mechanical Turk - a site you can pay users to participate in your study (10 cents, a dollar, etc). Found this is a great way to do online studies, as Amazon has to manage credit cards, etc.Asked participants to create passwords under randomly assigned constraints. They could see entropy estimates and guessability estimates. They could also see that people would drop out of the study the more difficult and onerous the password rules were.
NIST research has shown various password entropy estimates. NIST notes that adding dictionary checks raises entropy and that having one with more rules (comprehensive 8) would be 24 bits of entropy. Compared to "basic 16" (no dictionary check), they estimate the highest entropy.
Users only seem to use very few symbols (@ sign and ! are the most popular), even though many are available to them.
Found that in general, basic 16 could be pretty good - except for dumb users. Found these passwords quite easily: baseballbaseball, 123456789012345 and xxxxxxxxxxxxxxxx. Oops!
Some minor restirctions will bring the basic 16 (which is less annoying to set and easier to remember) will make it stronger than a comprehensive 8 password.
Longer passwords though take longer to type... so that is annoying in a different way.
Recommended Policy?
Not sure - our password cracking algorithms are fine tuned to 8 character passwords, so just that they are having a hard time cracking 16 character passwords may not really be because it's harder, but rather because they have the wrong tools.So... more research on N-grams (Google, book quotes, IMDB, song lyrics, etc) - now 16 character passwords become much easier to crack (Mybonnieliesovertheocean, ImsexyandIknowit#01). Her students used this to win the DefCon password hacking context this year with their new tools.
Found that password meters can be frustrating - the same password gets different ratings on different meters, but they do make people make better passwords.
XKCD?
Did XKCD solve this all already?
So, Dr. Cranor's team studied this! Found that that the passphrases were not easier to remember, and people didn't like the random word passwords (but didn't like them any less than other password rules). They tried a method of adding "auto correct" to the random word passwords, which helped people log in faster.
Research uncovered one of the most common words that appears in passswords: MONKEY! Why? Updated their password survey and asked any user that included "monkey" in their password and asked them WHY!? A: a lot of people have pets named Monkey or a friend nicknamed Monkey or... well, they just like monkeys.
As much as they've tried, they have not found a way to make users be random. More research... :-)
Interesting thing about Dr. Cranor? She made her dress and it's covered with discovered password graph (iloveyou in giant letters along the side).
Her team is starting to do more research on Mobile vs Desktop: users are seeming to avoid anything that involves shift key on mobile.
Interested in going to grad school and studying this? Join her team: http://cups.cs.cmu.edu/passwords.html
Question from audience: does changing passwords make them better? No, her research shows that changing your password more frequently: you end up with a BAD password. People do simple incremental changes to their passwords that make them easier to guess, particularly if the attacker has an "old" password. The only time sysadmins should make users change their password is in response to a breach.
Password reuse: sure, for junk websites (newspapers, etc), but do NOT use that for work, bank, personal email. It's better to write them down (requires someone breaking into your house, as opposed to attacking a news site and then having access to your bank account).
This blog is syndicated from Security, Beer, Theater and Biking!
Posts
No comments:
Post a Comment