Writing

Passwords, aka that thing people hate and try their hardest to mess up.

By Brandon Eckert

From the archive: originally published in January 2017. The examples below retain the original discussion, with clarifications about password storage and the limits of two-factor authentication.

Illustration accompanying the passwords article

Passwords. Your whole online existence relies on them, so why do so many people mess them up?

A typical password-based sign-in asks for a username and a password. Tell the system who you are and supply the right secret, and you are in.

The problem is that usernames are often easy to discover through OSINT or predictable naming conventions: FirstNameLastName, FirstNameMiddleInitialLastName, FirstInitialMiddleInitialLastName, or FirstInitialLastName. Without another authentication factor, the password may be the only secret protecting the account.

“But my password meets the minimum requirements of 8 characters or more!”

Password12 is not a strong password. Neither are Brandon5 or Linkedin!. Adding a number or symbol to a dictionary word may satisfy a site’s rules, but it also follows a predictable pattern. Password-cracking tools account for those patterns.

“Fine! I’ll 1337 the password up some! P@ssw0rd12 it is!”

P@ssw0rd12 is still predictable. Replacing letters with numbers and symbols is familiar to attackers, too.

“Arrrgh! What makes a good password then?”

In the original article, I illustrated one way to remember a password: taking the first letters of a phrase and mixing in numbers and symbols. These were the examples:

  • !MfnRI3BmshTR!
  • $2005MRx8wMfc!
  • !IliaBho202NL$

They came from these phrases:

  • My Favorite Nursery Rhyme Is 3 Blind Mice See How They Run
  • 2005 Mazda RX8 Was My First Car
  • I Live In A Black House On 202 Niles Lane

Those examples explain the technique; publishing them here makes them unsuitable for use as passwords. Personal meaning also does not guarantee strength, especially when the underlying details are public.

A password manager can generate a different random password for each account and store those passwords in an encrypted vault, locally or through a cloud service.

“Yay! My strong password is now Iaa1337HsAYcgm! and I will use this on all of my accounts!”

Now you are putting all of your eggs in one basket. If one site exposes that password, an attacker can try it with the same username or email address on other sites. A strong password loses much of its value when you reuse it everywhere.

Services should store passwords using a suitable salted password hash, rather than reversible encryption. Good storage helps protect passwords after a breach, but it does not make password reuse safe.

“OK, fine! I have unique passwords for every website. I am invincible! …Oh, look, an urgent email wants me to sign in.”

A convincing phishing page can still trick you into giving away a password. Two-factor authentication adds another barrier by requiring two different kinds of evidence, such as something you know and something you have.

The original article mentioned phone calls, text messages, and codes from a fob or authenticator app. These methods do not all offer the same protection, and one-time codes can also be phished. Two-factor authentication reduces risk; it does not guarantee that an attacker cannot sign in.

For current guidance on password storage, password managers, and phishing-resistant authentication, see NIST’s Digital Identity Guidelines.

← All writing