Password Security and Attacks

Inferring Passwords Likely for a User

• A user may use a password derived from well-known personal information, such as:
  • The same as the user ID
  • Is, or is derived from, the user's name
  • A common word list (e.g., password, secret, private) plus common names and patterns (e.g., qwerty, aaaaaa)

Exhaustive Attack (Brute Force Attack)

• In an exhaustive or brute force attack, the attacker tries all possible passwords, usually in an automated fashion.
• The number of possible passwords depends on the implementation of the particular computing system.
• For example, if passwords are words consisting of 26 characters (A-Z) and can be of any length from 1 to 8 characters, there are 26^1 + 26^2 + ... + 26^8 = 5 * 10^12 possible passwords.

Good Passwords

• To improve password security, use practices such as:
  • Using characters other than just a-z (e.g., digits, uppercase and lowercase letters)
  • Choosing long passwords, as the combinatorial explosion of password guessing difficulty begins around length 4 or 5

Authentication

• Human authentication involves recognition of someone's identity, often based on familiar characteristics (e.g., face, voice).
• Computer authentication involves controlled access, where someone is authorized to take some action on something.
• Authentication is the act of proving that asserted identity, that the person is who they say they are.

Identification versus Authentication

• Identities are often well-known, predictable, or guessable (e.g., user ID, name, bank account number, email address).
• Authentication should be reliable and private.
• Authentication mechanisms use any of three qualities to confirm a user's identity:
  • Something the user knows (e.g., passwords, PIN numbers, passphrases).
  • Something the user is (e.g., biometrics, such as a fingerprint, voice pattern, or face).
  • Something the user has (e.g., identity badges, physical keys, driver's license).

Authentication Based on Phrases and Facts

• User authentication and verification using passwords:
  • A user enters a piece of identification (e.g., name, user ID).
  • The system requests a password from the user.
  • If the password matches, the user is authenticated and allowed access.

Attacking and Protecting Passwords

• Passwords are limited as protection devices due to the relatively small number of bits of information they contain.
• People often pick passwords that do not take advantage of the available bits (e.g., choosing a well-known string, such as qwerty or password).
• Dictionary attacks can be used to infer user passwords.
• Countermeasures include:
  • Posting dictionaries of phrases and specialized lists to identify weak passwords.
  • Using utilities like COPS Crack and SATAN to scan a system for weak passwords.
  • Password recovery software.

Secure Authentication

• To achieve true security, consider the problem, tools, and possible attacks.
• Additional information can be used to authenticate users, such as:
  • Time of access (e.g., limiting access to specific hours or days).
  • Physical location (e.g., limiting access to specific workstations or offices).
• Limiting users to certain workstations or times of access can cause complications, but may provide added security.

Learn about common password derivation methods and exhaustive attack techniques used to compromise password security.