Feeds

Short passwords 'hopelessly inadequate', say boffins

Modern processors smash puny defences

Using blade systems to cut costs and sharpen efficiencies

The availability of password-cracking tools based on increasingly powerful graphics processors means that even carefully chosen short passwords are liable to crack under a brute-force attack.

A password of less than seven characters will soon be "hopelessly inadequate" even if it contains symbols as well as alphanumerical characters, according to computer scientists at the Georgia Tech Research Institute. The security researchers recommend passwords at least 12 characters long.

The number crunching abilities of graphics processors were recently applied to commercial password auditing and recovery tools from Russian developer ElcomSoft. It's a safe assumption that black hats are able to use the same type of technology for less laudable purposes. Richard Boyd, of the Georgia Tech Research Institute, told the BBC that the number-crunching capacity of graphics cards compares to those of supercomputers built only 10 years ago.

Longer passwords are better at withstanding brute force attacks that rely on trying every possible combination of characters, but just using longer passwords is not enough. Dictionary attacks still work on badly chosen (easy to guess) passwords, while even complex passwords of 20 characters are useless on machines infected with keylogging Trojans.

Practical problems in applying passwords on the web have become a productive area of academic research of late. Joseph Bonneau and Sören Preibusch recently produced a paper titled The password thicket: technical and market failures in human authentication on the web (pdf), presented at the WEIS 2010 conference in Boston back in June. In the paper, and in a subsequent series of four articles on the Light Blue Touchpaper blog, the two computer scientists carried out an analysis of password implementations, based on a study of 150 popular e-commerce, news and webmail sites.

While the Georgia researchers focused on the strength or otherwise of how users choose passwords, the Cambridge team studied how websites develop and apply password security policies. Many sites fail to apply best practice such as storing passwords only as hashes and blocking or at least throttling multiple attempts to guess user names or passwords.

The Cambridge team also studied how lower-security sites can compromise higher-security ones due to the tendency of users to reuse passwords across multiple domains. They suggest that some low-security sites (such as newspaper sites) insist on the use of passwords "primarily for psychological reasons ... as a justification for collecting marketing data and as a way to build trusted relationships with customers". ®

Boost IT visibility and business value

More from The Register

next story
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Securing Web Applications Made Simple and Scalable
Learn how automated security testing can provide a simple and scalable way to protect your web applications.