Password security: No easy answers
After the discovery of a huge trove of stolen Internet logins and passwords, many people are wondering what they can do to protect their personal data online.
The bad news is that much of the advice available about passwords is useless, misleading — or worse, complicit in the identity theft-strewn landscape of today’s Internet.Continue Reading
“Change your password often.” “Never, never write a password down.” “Have a unique and complex password for each and every account you log on to.”
Familiar advice on passwords like this is what you get when cybersecurity specialists know more about computers than about the humans who use them.
As many researchers now acknowledge, they’re rules that just aren’t realistic, even for the security-conscious and technologically savvy.
Take password re-use, a supposedly verboten practice. In fact, almost everybody does it — it’s unavoidable if you’re relying on your memory to keep them straight, concludes a recent paper from Microsoft Research.
Users of today’s interactive Web may have upward of 100 accounts. “The idea that you’re going to have random passwords for each of them and not to do any re-use seems to be just beyond the capacities of the brain,” said Microsoft researcher Cormac Herley, a paper co-author.
It’s a common thread running through the conventional wisdom on passwords: a disregard for the limited capabilities of the humans who must create and use them. And its persistence bears much of the responsibility for the mess that password security has become, experts say, feeding the growing epidemic of identity theft.
In 2012, 12.6 million Americans were victims, each spending on average $365 to rectify it, according to Javelin Strategy.
Faced with impossible exhortations to never re-use a password, users instead re-use them in the worst way possible. Not all sites requiring passwords are equally secure. A pizza delivery service likely has much more lax cybersecurity than a bank. But hackers will test credentials stolen from a take-out food site against bank, email and social media accounts. And those who’ve re-used their password will suffer.
Herley and his co-authors contend that rather than “barking unrealistic orders at people” the correct question is how to make password security practical for users.
Password re-use isn’t a bad habit that shouting or fear-mongering will eventually eradicate. Rather, Herley says, users should put forethought into password re-use. Divide accounts into three or four groups with similar risk exposure in the event of a breach and assign a single password to each group. Some accounts, like online banking, may be so valuable that no-reuse is acceptable.
Frequent password change is another unrealistic rule: Experts say it’s something that users typically never do unless forced to by punctilious IT administrators. And again, the result is worse security, not better.
“How they’re going to deal with it is not how you’re hoping, which is to make a strong unique password,” said Joe Siegrist, chief executive officer of LastPass, a password manager software maker.
Instead, users typically create variations of existing passwords or rely on passwords as stripped of complexity as possible.