Why Passwords Are Getting Easier to Crack

I'm going to do a security series over the next couple of weeks, inspired by last week's post. This week I'm taking a look at an Ars Technica article I read today, called "Why passwords have never been weaker -- and crackers have never been stronger."

It's a long article, but if you have a few minutes, I highly recommend it, especially if you're interested in security. The most important thing to take out of it, though, is that password cracking is making extremely rapid advancements--the past couple of years have brought nearly as much new information to the field as all the rest of cracking history combined.

This is due primarily to an increase in password databases being stolen and cracked, which gives both security analysts and malicious hackers a prime opportunity to see what kinds of passwords people use in the real world. As a result of all the information, password dictionaries have gotten orders of magnitude more effective, making choosing a good password more important than ever.

And get this: what you thought was a "good password" almost certainly isn't. Here are a few things that the bad guys are onto now (mostly sourced from the Ars article, with a bit of personal opinion and other general consensus in security fields included):

• You know those websites that make you include a number and a capital letter (and maybe a symbol) in your password? Turns out those requirements really do essentially nothing, except perhaps annoying users and making them more likely to write down their passwords or otherwise store them insecurely. Nearly all capital letters are the first character of passwords; nearly all numbers and symbols are at the end of passwords. Most of the time, people just capitalize the first letter and stick a '1' on the end. If they're feeling more clever, they might change an 'e' to a '3' or a 't' to a '1'--all those substitutions are in the dictionaries too.
• Shifting your hands sideways on the keyboard or going around keyboards in patterns are in any good dictionary now, too. The same goes for spelling words backwards or both directions. If you're not sure whether your password trick is secure, here's my personal rule of thumb: If you think you're being clever, you probably aren't.
• A $12,000 computer called "Project Erebus" can crack the entire keyspace for an 8-character password in just 12 hours when run on a database that has been stored poorly (which is, unfortunately, most of the companies involved in data breaches lately). That means if your password is 8 characters or less, this computer will always get it in 12 hours or less, no matter what it is. 8 characters used to be a secure password (it still was when I wrote about passwords in 2009); now 8 characters is a terrible password (though still a good sight better than 7 or 6 characters, since password strength increases exponentially with each additional character). This computer is not particularly special; anyone with a few grand to spare and a bit of computer smarts can put together a few graphics cards into a solid password-cracking machine nowadays.
• Average desktop computers equipped with good graphics cards can test about eight billion passwords every second against a file of encrypted hashes (those are what you usually get when you steal a password database from a company).
• The average Web user has 25 accounts but only 6.5 passwords. In my opinion, reusing passwords is even worse than using bad passwords. And that's despite the fact that just about everybody reuses their passwords at least occasionally. That's because if somebody gets your password from one site, no matter if it's "hu!-#723d^*&/"!q4," they can get into your other accounts as well. If you have a bad password and it gets cracked, at least the damage is confined to that one site (unless it's your email account, as described at the very end of last week's post).
• A large number of passwords consist of first names (or worse, usernames) followed by years. There are now dictionaries of names pulled from millions of Facebook accounts which can be used with programs that try appending likely numbers (such as possible years of birth) until a match is found. A good graphics card can crack your password in roughly two minutes if you use this type of password.
• A number of attacks depend on the companies that store your data being stupid. For instance, there's an easily implemented method called salt that makes cracking password databases far more difficult (and one method called rainbow tables completely impossible). It's been around for years. And yet Yahoo, LinkedIn, and eHarmony, among other major companies, were caught dead without it when they lost password databases recently. The same goes for using better cryptographic hashes for encrypting password databases--using a good hash can make a database essentially uncrackable (2,000 tries per second as opposed to several  billion), but most services still choose to use a poor one. Unfortunately, there's not really anything you can do about this, other than contact technical support and boycott them if they don't follow best practices (and given how bad the standards are, you can expect to not be using very many websites). You can, however, mitigate the possible damage by using a different password for every site so that you will have lost less if your password is cracked.

Now is a good time to remind yourself that two-factor authentication would help prevent anybody from logging into your account even if they cracked your password, isn't it? Next week I'll be back with some practical tips for making and using better passwords.