Password Security

To start with, I'm one of those people that tends to be more security conscious than your average Internet user. That I write as much here (and elsewhere) in a public fashion was a conscious choice done after weighing out the likely risks of doing so.

I've long used complex passwords. Typically, I've used ones that were more complex than required of the systems I use. Hell, where possible, I make it so that I either need two-factor authentication or some kind of difficult to reproduce token rather than a brute-forceable password string.

Still, most web sites, applications, etc., rely on passwords. Most sites are less security conscious than I am allowing short, non-complex passwords that never expire. Of the few sites that show any level of security consciousness, it seems half-assed at best. Some sites only enforce, say, six-character passwords or, worse, only allow 6-10 character passwords. Some sites want you to have "complex" passwords, but then limit the choice of characters you can use to create that complexity.

At least one of the financial institutions I do business with falls into this limited-complex camp.

How freaking secure are your "complex" passwords when you don't allow any of ! @ # $ % ^ & * ( ) _ , or . in your passwords???

What's even more annoying about one, particular, financial institution is that they expire their passwords every 45 days. Now, this isn't an institution I deal with on a regular basis. My day-to-day bank allows me to pay all my bills from their portal. This other institution, I only log into when I need some information. So, every time I log in, I have to change my damned password and deal with the fact that they don't allow me to make my passwords as complex as I'd like. Even more fun, they don't allow me to re-use any of the last dozen passwords.While this is good, in theory, given my access frequency, that means it's going to take nearly two years before I can recycle. Now, given that they hamstring me on the passwords I can/would set, it makes memorization of the password even harder. So, pretty much every time I do log in, I have to go through the "I forgot my password" hassle. If they let me set the passwords I wanted, they'd be good against a brute-force attack for a number of years (basically, a cracking tool would have to work through several hundred quadrillion combinations to stumble on my particular combinations). But, no. I'm stuck with passwords that are several orders of magnitude less complex.

Policy Madness

There's a lot of policies, requirements, etc., out there, that come from "Best Practices" and Good Ideas™. In my line of work, where I run into this, a lot, is with security policies.

Best practices indicate that longer passwords are better. After all, guessing a password of N length requires X number of guesses, but guessing a password of N+1 length requires exponentially greater. So, from a mathematical basis,there's merit to this best practice.

Best practices also indicate that passwords should be changed frequently. After all, given sufficient time, any password of any arbitrary length can be guessed. If you know how fast guesses can be made and the total guessable set size, you have a strong, mathematical basis for setting a password change interval.

Unfortunately, day by day, computers get to be much, much faster. This means that, day by day, an automated attack can be conducted much, much faster. To combat this, you can up the password length and/or complexity requirements or shorten your password lifetimes.

And, that's all great from a "Best Practices" standpoint. Unfortunately, "Best Practices" generally only consider things like machines, not humans. Humans are in no way uniform. So, it's hard to set the kind of mathematical constant that makes it easy to formulate a "Best Practice". Thus, the human component is generally left out of the equation.

Sadly, this means you end up with security "Best Practices" that fail to figure in the fact that humans' memories for long, complex strings tend to be lacking. It fails to factor in that humans like to cheat or otherwise use crutches or mechanisms to assist them with a task. So, yeah, you can say, "Best Practices require that you set a fifteen-character, multi-character-class string as your password and that it be changed every thirty days." But, when you do so, you ignore the human component. You ignore that most people either can't remember such strings unaided or that, if they can, it will take them time to do so. That leaves cheating. And, if your attacker knows the types of cheats used by the humans your policies govern, they can exploit those cheats.

For myself, I find that I can usually come up with a mnemonic or other "cheat" that helps me remember things. Unfortunately, it frequently takes me several days to come up with that cheat. Often times, by the time I've really started to remember my password, it's time to generate a new one.

Unfortunately for the security types, most people have to resort to more exploitable cheats. And then... You're as bad off or worse by enforcing "Best Practices". Sometimes, you have to find a better "Best Practice" - one that factors in more of the limitations (particularly the human limitations).