- The Guardian,
- Thursday December 6 2007
Online shopping accounts with weak passwords are at the mercy of hackers. Photograph: Meredith Parmelee/Getty
Just as you hit the button to pay for your online purchase it happens: "First, create a username and password."
The temptation is to pick something easy: your name, your spouse's name, or a standard password you use everywhere. But if the site will store your credit card details, or is one you use for banking or trading shares, think more carefully.
Passwords are a perennial problem. They're hard to think up, to remember and protect. Worse, they're not in themselves secure - your data depends on the carefulness of many strangers. The security of the HMRC discs with the Child Benefit database lost some weeks ago - Zip-encrypted with a password - depends on the strength of that password.
Since Zip encryption uses the AES method, which the US deems good enough for officially secret documents, the HMRC files should be safe from a "brute force" attack. But other password encryption is threatened in quite a different way.
Google's password cracker
Last month, the security group at the University of Cambridge's Computer Lab had its group blog, Light Blue Touchpaper (lightbluetouchpaper.org), hacked via a previously unknown vulnerability in the popular blogging software Wordpress. While cleaning up, researcher Steven Murdoch discovered a new problem: Google makes a fine password cracker.
The hacker gained access via an unused default administrator-level account. Once in, he created another admin account for himself. Murdoch disabled that, but got curious: what was its password?
Basic security principles prohibit storing a list of valid usernames and passwords in clear text. Instead, they are stored in a encrypted ("hashed") form, so the list is unreadable to anyone who does gain access. To check a password, you encrypt it and compare the result against what is stored. Your password never resurfaces in the clear.
Wordpress encrypts passwords using a popular algorithm called MD5, a one-way function that had turned the hacker's password into "20f1aeb7819d7858684c898d1e98c1bb". Murdoch tried cracking it, then tried a Google search on the string. It spat back a few pages showing that the original word - the hacker's password - was "Anthony". (You can try your favourite password at pajhome.org.uk/crypt/md5/ and then search Google for the result.)
The risk to the average user is that if hackers break into a database-dependent site they could be able to read off the hashes of your password, and then work back to your original password.
Murdoch points out that "salting", which protects against this type of problem by adding random characters to each password before it's hashed, has been known since 1978. Since every password can have many hashes, it's harder to build a lookup table. It also makes cracking passwords by brute force much slower.
However, all sorts of password-cracking assistance is readily available online to help system administrators as well as hackers. Plus, says Robert Schifreen, author of Defeating the Hacker, given two random letters of a nine-letter password (like banking site picklists) you can get the rest from a crossword-solving program.
Fighting future hackers
But even well-established advice isn't always infallible. Security consultant Eugene Spafford pointed out that the common company rule requiring users to change their passwords once a month is outdated. That 30-year-old policy, he said, was derived when the contractors in charge of non-networked mainframes calculated it would take several months to crack system passwords by brute force.
Several initiatives are trying to create single sign-on systems that present different passwords to each site, but require the user to know only one. OpenID is intended for blogs and is easy to implement, while Liberty Alliance is an industry consortium working on creating strong authentication hardware and software. Microsoft's Cardspace, installed by default in Vista, also enables secure authentication that's intended to be two-way. But what happens when you're away from your computer?
In the longer term, authentication will move on to a second device like those banks are beginning to send out. Murdoch works with Cronto (cronto.com), which uses mobiles and other devices to generate one-time passwords. You register your phone with your bank and enter a Pin to get a single-transaction password. Nothing is stored, and it would foil phishing attacks - but the system is still vulnerable to real-time attacks. Nothing's perfect.
What makes a good password?
The ideal password is hard to guess and easy to remember - a tough combination. In general, don't use a word that can be found in a dictionary: hackers use dictionary lists to generate password attacks. Avoid well-known personal facts, such as your name, address, birthday, user ID and so on.
A couple of strategies can help. The first is to pick a sentence that's meaningful to you and use the first letter of each word, including punctuation. For example: IlrtGTs (for "I love reading the Guardian's Technology section"). Add a number - 04 (for Thursday, the fourth day of the week, when it's published): IlrtGTs04. Who'll guess that?
A second is to take two unrelated words and link them with one or more non-alphabetic characters - for example: quirky!fun. To make it more secure, capitalise one of the letters.
Most standard password protection advice was designed for use in companies: don't write your password down, don't disclose it to anyone and don't use the same password for more than one application. But in a domestic setting, writing down your password may be sensible, as may disclosing it to a family member in case you happen to be incapacitated.
Even some security experts reuse the same memorable, lightweight password for unimportant applications such as media sites, but unique, more secure ones for sensitive apps like online banking, brokerage sites and so on. One solution here is to store all your passwords in a simple text file and to encrypt that file, protecting it with a password that is then the only one you have to manage: Apple's Keychain system works like this for system-wide passwords including Wi-Fi networks and websites.
If you must use computers in public areas, pick passwords you can type quickly and accurately (to make them harder to pick up by shoulder-surfing), and change them often to avoid them being copied.
- Contact us |
- Print |
- Clip |
- Share | Email
-
Contact the Technology editor
tech@guardian.co.uk
- Report errors or inaccuracies: reader@guardian.co.uk
- Letters for publication should be sent to: letters@guardian.co.uk
- If you need help using the site: userhelp@guardian.co.uk
-
Call the main Guardian and Observer switchboard:
+44 (0)20 7278 2332
