- Everyone Knows What "Cybersecurity" Means
- We Can Measure How Secure Our Systems Are
- The Primary Goal of Cybersecurity Is Security
- Cybersecurity Is About Obvious Risks
- Sharing More Cyber Threat Intel Will Make Things Better
- What Matters to You Matters to Everyone Else
- Product X Will Make You Secure
- Macs Are Safer Than PCs, Linux Is Safer Than Windows
- Open Source Software Is More Secure Than Closed Source Software
- Technology X Will Make You Secure
- Process X Will Make You Secure
- Faerie Dust Can Make Old Ideas Magically Revolutionary
- Passwords Should Be Changed Often
- Believe and Fear Every Hacking Demo You See
- Cyber Offense Is Easier Than Defense
- Operational Technology (OT) Is Not Vulnerable
- Breaking Systems Is the Best Way to Establish Yourself
- Because You Can, You Should
- Better Security Means Worse Privacy
- Further Reading
This chapter is from the book
This chapter is from the book
This chapter is from the book
Passwords Should Be Changed Often
One topic on which almost everybody has experience and opinions is passwords. It is a reality that after more than 60 years, passwords—including words, phrases, and PINs—are still the dominant form of authentication. This scheme seemed like a secret key that would protect our valuables. In reality, we have experienced the dangerous downsides of making users choose and remember many passwords. A brighter passwordless future has been promised for decades. In 2004, Bill Gates promised their demise because “they just don’t meet the challenge for anything you really want to secure.”58
The password to a computer is not like the key to a house. Nobody makes homeowners pick the teeth and notches on the blades of their house keys, and they do not need to reconstruct them every time they come home. Yet, we require users to self-generate and remember digital passwords (like the combination to a lock) or carry physical tokens. Multifactor authentication was introduced in the 1990s, dramatically improving security but inconveniencing users. “With all that said, it’s difficult to see anything killing the password,” said John Viega in his 2009 book The Myths of Security.
Despite the abuse heaped on passwords, they are unlikely to disappear anytime soon. The paradigm is understood by even novice users, requires no additional investment in hardware, and is still a reasonable mechanism when used appropriately. The key is using it with an understanding of the context and risks—a theme we will mention repeatedly. Poor password selection, password guessing, and interception/spoofing are all potential problems with passwords; however, there are circumstances where those are not significant threats or have mitigations. Effective authentication should be more than computational strength or resistance to every possible attack. To a cybersecurity professional, the priority for choosing an authentication scheme might be security, but we should also factor in the threat model, the cost, and user acceptance (at least). One approach will never fit every situation, as we noted in Figure 1.1.
){kind=link}
As we know, 100-character passwords might be more secure than 10-character passwords but impossible to use in practice without assistance (such as a password manager). It is no myth that different authentication mechanisms have different cryptographic strength. That is, how much time and space are required to break the encryption? Experts note that the relative strength of passwords versus biometrics differs not only in the key but also in other considerations. For one, we cannot change our fingerprints if they are our authenticators and are compromised. And as with all things cybersecurity, bugs in implementing algorithms can happen even if the cryptographic protocol is fantastic.
This is not to say that many people have not worked on improving the password situation for users. Password meters nudge us to pick better passwords. Password managers remember strong passwords on our behalf. But it’s challenging to shift the momentum of passwords and retool our systems for other options.
One myth is that nobody can guess our password if they do not know us well. Maybe our favorite sports team is Liverpool, or our dog’s name is Charlie. If liverpool or charlie is our password, these are guessable in less than a second even if the attacker didn’t have access to your memory board, as in Figure 1.3. Do not bank on the assumption that attackers need to know us personally with passwords such as those!
)
FIGURE 1.3 Strong passwords are difficult to generate and remember.
Another myth is that passwords should be changed frequently. Research shows frequent changes are counterproductive to good security because they lead to simple patterns or workarounds. Similarly, complexity requirements such as requiring symbols and numbers have resulted in worse passwords. That rule is no longer recommended.
One authoritative source for password guidance is NIST 800-63B (Digital Identity Guidelines), last updated in June 2017. In particular, Appendix A describes how to think about the strength of memorized secrets. NIST recommends that users not be allowed to choose passwords from “previous breach corpuses, dictionary words, and specific words (such as the name of the service itself) that users are likely to choose.”
In 2021, Microsoft announced that users could go passwordless for Microsoft accounts used to sign in to Microsoft Outlook and OneDrive.59 To do so, users were invited to use an authenticator app, security key, or verification code. This might be the first of new authentication alternatives that are both strong and usable. Or not. Passwords might not be here forever but don’t bet on it.