This article was originally done by by Bruce Schneier, founder and CTO of BT Counterpane and appeared in the CRYPTO-GRAM newsletter. CRYPTO-GRAM is a free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise.
How good are the passwords people are choosing to protect their computers and online accounts?
It's a hard question to answer because data is scarce. But recently, a colleague sent me some spoils from a MySpace phishing attack: 34,000 actual user names and passwords.
The attack was pretty basic. The attackers created a fake MySpace login page, and collected login information when users thought they were accessing their own account on the site. The data was forwarded to various compromised web servers, where the attackers would harvest it later.
MySpace estimates that more than 100,000 people fell for the attack before it was shut down. The data I have is from two different collection points, and was cleaned of the small percentage of people who realized they were responding to a phishing attack. I analyzed the data, and this is what I learned.
Password Length: While 65% of passwords contain eight characters or less, 17% are made up of six characters or less. The average password is eight characters long.
Specifically, the length distribution looks like this:
1-4 0.82%
5 1.1%
6 15%
7 23%
8 25%
9 17%
10 13%
11 2.7%
12 0.93%
13-32 0.93%
Yes, there's a 32-character password:
"1ancheste23nite41ancheste23nite4." Other long passwords are "fool2thinkfool2thinkol2think" and "dokitty17darling7g7darling7."
Character Mix: While 81% of passwords are alphanumeric, 28% are just lowercase letters plus a single final digit -- and two-thirds of those have the single digit 1. Only 3.8% of passwords are a single dictionary word, and another 12% are a single dictionary word plus a final digit -- once again, two-thirds of the time that digit is 1.
numbers only 1.3%
letters only 9.6%
alphanumeric 81%
non-alphanumeric 8.3%
Only 0.34% of users have the username portion of their e-mail address as their password.
Common Passwords: The top 20 passwords are (in order): password1, abc123, myspace1, password, blink182, qwerty1, fuckyou, 123abc, baseball1, football1, 123456, soccer, monkey1, liverpool1, princess1, jordan23, slipknot1, superman1, iloveyou1 and monkey.
The most common password, "password1," was used in 0.22% of all accounts. The frequency drops off pretty fast after that: "abc123" and "myspace1" were only used in 0.11% of all accounts, "soccer" in 0.04% and "monkey" in 0.02%.
For those who don't know, Blink 182 is a band. Presumably lots of people use the band's name because it has numbers in its name, and therefore it seems like a good password. The band Slipknot doesn't have any numbers in its name, which explains the 1. The password "jordan23" refers to basketball player Michael Jordan and his number. And, of course, "myspace" and "myspace1" are easy-to-remember passwords for a MySpace account. I don't know what the deal is with monkeys.
We used to quip that "password" is the most common password. Now it's "password1." Who said users haven't learned anything about security?
But seriously, passwords are getting better. I'm impressed that less than 4% were dictionary words and that the great majority were at least alphanumeric. Writing in 1989, Daniel Klein was able to crack 24% of his sample passwords with a small dictionary of just 63,000 words, and found that the average password was 6.4 characters long.
And in 1992 Gene Spafford cracked 20% of passwords with his dictionary, and found an average password length of 6.8 characters. (Both studied Unix passwords, with a maximum length at the time of 8 characters.) And they both reported a much greater percentage of all lowercase, and only upper- and lowercase, passwords than emerged in the MySpace data. The concept of choosing good passwords is getting through, at least a little.
On the other hand, the MySpace demographic is pretty young. Another password study in November looked at 200 corporate employee passwords: 20% letters only, 78% alphanumeric, 2.1% with non-alphanumeric characters, and a 7.8-character average length. Better than 15 years ago, but not as good as MySpace users. Kids really are the future.
None of this changes the reality that passwords have outlived their usefulness as a serious security device. Over the years, password crackers have been getting faster and faster. Current commercial products can test tens -- even hundreds -- of millions of passwords per second. At the same time, there's a maximum complexity to the passwords average people are willing to memorize. Those lines crossed years ago, and typical real-world passwords are now software-guessable. AccessData's Password Recovery Toolkit -- at 200,000 guesses per second -- would have been able to crack 23% of the MySpace passwords in 30 minutes, 55% in 8 hours. Of course, this analysis assumes that the attacker can get his hands on the encrypted password file and work on it offline, at his leisure; i.e., that the same password was used to encrypt an e-mail, file or hard drive. Passwords can still work if you can prevent offline password-guessing attacks, and watch for online guessing. They're also fine in low-value security situations, or if you choose really complicated passwords and use something like Password Safe to store them. But otherwise, security by password alone is pretty risky.
MySpace Attack
http://www.infoworld.com/infoworld/article/06/10/27/HNphishingmyspace_1.html
http://news.netcraft.com/archives/2006/10/27/myspace_accounts_compromised_by_phishers.html
http://www.securiteam.com/securitynews/6O00M0AHFW.html
Another analysis of the same data:
http://www.infoworld.com/article/06/11/17/47OPsecadvise_1.html
Other password studies:
http://www.deter.com/unix/papers/passwords_klein.ps.gz
http://ftp.cerias.purdue.edu/pub/papers/gene-spafford/spaf-OPUS-observe.pdf
http://www.fredstie.com/thesis/survey/survey_report.pdf
http://download.lawr.ucdavis.edu/pub/CambridgePWStudy.pdf
Password cracking:
http://www.lockdown.co.uk/?pg=combi&s=articles
http://www.accessdata.com/products/decryption/
Password Safe:
http://passwordsafe.sourceforge.net/
This essay originally appeared on Wired.com.
No comments:
Post a Comment