Not participating in the survey, as it misses the option I would choose
and is designed wrong.
As an entertaining intro, today’s story. My mother received documents from an insurance copany, over my mailbox, in an encrypted PDF. The password — as explained in the email itself — is the last four digits of her PESEL number.
(1) I hope I don’t need to explain, how strong a 4-digit password is and how long it stands a bruteforce attack; in particular if the penultimate digit is determined by gender and the last one is a checksum value. If that wasn’t enough, the number is semi-public. The company itself somehow doesn’t understand, that their own worker received something used as a password by simply asking for that. While certainly using even such a weak solution is better than plaintext
(2), it shows something very important: a failure to understand security at even the most basic level by laypersons.
Passwords must go. But the main reason is not their inherent weakness. It’s because of the users. For years now it is well known that:
- Users are horrible at inventing passwords. Not understanding fundamental things about security, people substitute their guesses for knowledge. Based on poorly founded heuristics, often on perception of threats derived from entertainment industry, using schemes not addressing the actual attack methods, falling into “it’s ok because I can’t break it” theme and so on. Common examples: using simple words they think no one will know or substituting letters for look-alikes.
- Policies designed by ignorants or people not updating their knowledge are pushing users to invent even worse passwords. Password rotation, in particular over short periods, have been beaten to death already. Yet you will encounter that type of requirements introduced even now, when I write this post. Worse, there are people who will try to defend it. Both ignoring that no matter what their predictions are, the reality has shown it leads to worsening security, and not realizing that the primary reason for the policy in the first place was blind importing it from eras predating computers, where threat models were very different. Requiring particular characters in the password, which only introduces very predictable changes to whatever the user already had. Almost universally “1!” or one of a very few similar suffixes.
- Limited access to tools leads to users engaging into insecure practices, even if otherwise they would not. Using a properly designed password manager raises the bar for the adversary so high that password-based attacks are doomed to fail in nearly all circumstances.(3) Yet most people will not use them. They do not even know they should. The tools are cumbersome to use; or are proprietary service-based solutions that effectively make you give away your passwords. Users fail to address database loss situations and opt for not having protection at all. Hardware HID keys are so rare that I can’t even recall any specific name. An average member of society has no option to securely generate a strong password. There is no infrastructure to share passwords: the reason the insurance company used the PESEL number is because there is no sane way to given them any password in the first place. All this worsens the situation even more.
Secondary to the above, passwords have problems too. Even the strongest, most perfectly chosen password has them. They are inherently vulnerable to replay attacks. While not a limitation of the technology, the practical use of passwords often involves remembering them, which limits their quality. A password may easily be 256-bit strong (attacks not feasible), but in practice people employing diceware class of generators will obtain 48 to 64 bits, while the general population somewhere between 8 and 32 bits. Passwords are quite easy to acquire, because at least partially they must be transferred over insecure channels.
But there is another issue. For two at least decades we have technologies that are sufficient to deliver much better solutions. Better in many aspects: security, convenience, privacy and freedom. They are widely deployed, so it’s not sci-fi. The problem is both the level of adoption and that they are often partial. Where something more convenient is offered, it’s a privacy nightmare and often involves passing a bit of control to some third party. Where solutions respect your privacy and freedom, using them in practice is a horror story.
(1) An identifier in
PESEL, a national database of all Polish residents. It’s a structured value, directly linked to the birth date and gender, with the last digit being almost universally valid checksum dependent on the other ten.
(2) The adversary is required to put some minimum effort in the attack.
(3) “Nearly all” because phishing attacks are still possible.
Home
Help
Search
Login
Register
Poll
