Feeds

Short passwords 'hopelessly inadequate', say boffins

Modern processors smash puny defences

Choosing a cloud hosting partner with confidence

The availability of password-cracking tools based on increasingly powerful graphics processors means that even carefully chosen short passwords are liable to crack under a brute-force attack.

A password of less than seven characters will soon be "hopelessly inadequate" even if it contains symbols as well as alphanumerical characters, according to computer scientists at the Georgia Tech Research Institute. The security researchers recommend passwords at least 12 characters long.

The number crunching abilities of graphics processors were recently applied to commercial password auditing and recovery tools from Russian developer ElcomSoft. It's a safe assumption that black hats are able to use the same type of technology for less laudable purposes. Richard Boyd, of the Georgia Tech Research Institute, told the BBC that the number-crunching capacity of graphics cards compares to those of supercomputers built only 10 years ago.

Longer passwords are better at withstanding brute force attacks that rely on trying every possible combination of characters, but just using longer passwords is not enough. Dictionary attacks still work on badly chosen (easy to guess) passwords, while even complex passwords of 20 characters are useless on machines infected with keylogging Trojans.

Practical problems in applying passwords on the web have become a productive area of academic research of late. Joseph Bonneau and Sören Preibusch recently produced a paper titled The password thicket: technical and market failures in human authentication on the web (pdf), presented at the WEIS 2010 conference in Boston back in June. In the paper, and in a subsequent series of four articles on the Light Blue Touchpaper blog, the two computer scientists carried out an analysis of password implementations, based on a study of 150 popular e-commerce, news and webmail sites.

While the Georgia researchers focused on the strength or otherwise of how users choose passwords, the Cambridge team studied how websites develop and apply password security policies. Many sites fail to apply best practice such as storing passwords only as hashes and blocking or at least throttling multiple attempts to guess user names or passwords.

The Cambridge team also studied how lower-security sites can compromise higher-security ones due to the tendency of users to reuse passwords across multiple domains. They suggest that some low-security sites (such as newspaper sites) insist on the use of passwords "primarily for psychological reasons ... as a justification for collecting marketing data and as a way to build trusted relationships with customers". ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Webcam hacker pervs in MASS HOME INVASION
You thought you were all alone? Nope – change your password, says ICO
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Meet OneRNG: a fully-open entropy generator for a paranoid age
Kiwis to seek random investors for crowd-funded randomiser
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
The hidden costs of self-signed SSL certificates
Exploring the true TCO for self-signed SSL certificates, including a side-by-side comparison of a self-signed architecture versus working with a third-party SSL vendor.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.