How To Choose Better Passwords With The Help Of Science

For years, computer users have been told they should have complicated passwords, including numbers, punctuation marks and other symbols, and upper- and lowercase letters. Despite those being hard to remember, people were told not to write their passwords down, and forced to make up new ones quite frequently. Users dutifully complied – by capitalizing the first letter of their passwords, adding a “1” or their birth year, or perhaps ending their password with an exclamation point.

Most people couldn’t actually remember lots of passwords without writing them down, so instead they reused a small number of passwords over and over again. And when they were required to change their passwords, they incremented that “1” to a “2” or added another exclamation point. These simple steps to deal with complicated passwords are so common that they actually make it easier for attackers.

As researchers into password security, we’ve known for years that most password advice was not actually based on scientific knowledge. To address this, we have been conducting experiments about the effects of password requirements on security and usability. The federal government recently changed its password recommendations in ways that echo some of our research findings.

Defending passwords from computers

We spent years modeling how different password-cracking approaches work to better understand how attackers guess passwords and to develop an accurate measure of password strength. People who are trying to break into online accounts don’t just sit down at a computer and make a few guesses. Many attackers have been able to steal the entire database of passwords from large companies – for example, this has happened to Yahoo, LinkedIn, Adobe, Ashley Madison and many others. The passwords are scrambled for security, so attackers have to make lots of guesses to unscramble them. But computer programs let them make millions or billions of guesses in just a few hours.

They may start by guessing all the most popular passwords and words in the dictionary, then adding “1” to each of these, and then again with every other digit and symbol, and then with the first letter capitalized, and so on. The end result is that all the complicated password policies don’t prevent – or even really slow down – cracking of many users’ passwords.

Even worse, once an attacker guesses a user’s password for one account, he will often try using that same password on the user’s other accounts. Since users tend to reuse passwords, this can be very successful. An attacker who cracks the password for some website you registered with eight years ago and forgot about may now be able to access your email, your social network account and your bank account.

All this computing power being applied to cracking passwords means users need to go beyond choosing passwords that are hard for a human to guess: Passwords need to be difficult for a computer to figure out.

Testing perceptions of password strength

Our research has informed efforts to teach people how to use this new understanding of password security. More than 50,000 people participated in our online experiments, each creating a password that complied with randomly assigned requirements: for example, “minimum of 12 characters long” or “must include lowercase and uppercase letters, digits and symbols.” We measured the actual strength of the password, a participant’s ability to remember a password a few days later and other metrics. We also analyzed real passwords created by students, faculty and staff at our university.

Our data have shown us that people hold many misconceptions about passwords, such as believing that adding a digit or exclamation point to the end of their password will make it much stronger. This problem is widespread enough that we created an online quiz game to help dispel some of these misconceptions.

In addition, our data have shown us that it is more important to encourage longer passwords (at least 12 characters) than complicated passwords. At the same time, we’ve learned that some users create long passwords that are still predictable – like “passwordpassword” or “xxxxxxxxxxxx.”

We also learned that giving people feedback at the moment they’re creating new passwords can help. Most often this takes the form of what are called “password meters” – color-coded signals that indicate whether a person has chosen a weak password or one that’s very strong.

For years, computer users have been told they should have complicated passwords, including numbers, punctuation marks and other symbols, and upper- and lowercase letters. Despite those being hard to remember, people were told not to write their passwords down, and forced to make up new ones quite frequently. Users dutifully complied – by capitalizing the first letter of their passwords, adding a “1” or their birth year, or perhaps ending their password with an exclamation point.

Most people couldn’t actually remember lots of passwords without writing them down, so instead they reused a small number of passwords over and over again. And when they were required to change their passwords, they incremented that “1” to a “2” or added another exclamation point. These simple steps to deal with complicated passwords are so common that they actually make it easier for attackers.

As researchers into password security, we’ve known for years that most password advice was not actually based on scientific knowledge. To address this, we have been conducting experiments about the effects of password requirements on security and usability. The federal government recently changed its password recommendations in ways that echo some of our research findings.

Defending passwords from computers

We spent years modeling how different password-cracking approaches work to better understand how attackers guess passwords and to develop an accurate measure of password strength. People who are trying to break into online accounts don’t just sit down at a computer and make a few guesses. Many attackers have been able to steal the entire database of passwords from large companies – for example, this has happened to Yahoo, LinkedIn, Adobe, Ashley Madison and many others. The passwords are scrambled for security, so attackers have to make lots of guesses to unscramble them. But computer programs let them make millions or billions of guesses in just a few hours.

They may start by guessing all the most popular passwords and words in the dictionary, then adding “1” to each of these, and then again with every other digit and symbol, and then with the first letter capitalized, and so on. The end result is that all the complicated password policies don’t prevent – or even really slow down – cracking of many users’ passwords.

Even worse, once an attacker guesses a user’s password for one account, he will often try using that same password on the user’s other accounts. Since users tend to reuse passwords, this can be very successful. An attacker who cracks the password for some website you registered with eight years ago and forgot about may now be able to access your email, your social network account and your bank account.

All this computing power being applied to cracking passwords means users need to go beyond choosing passwords that are hard for a human to guess: Passwords need to be difficult for a computer to figure out.

Testing perceptions of password strength

Our research has informed efforts to teach people how to use this new understanding of password security. More than 50,000 people participated in our online experiments, each creating a password that complied with randomly assigned requirements: for example, “minimum of 12 characters long” or “must include lowercase and uppercase letters, digits and symbols.” We measured the actual strength of the password, a participant’s ability to remember a password a few days later and other metrics. We also analyzed real passwords created by students, faculty and staff at our university.

Our data have shown us that people hold many misconceptions about passwords, such as believing that adding a digit or exclamation point to the end of their password will make it much stronger. This problem is widespread enough that we created an online quiz game to help dispel some of these misconceptions.

In addition, our data have shown us that it is more important to encourage longer passwords (at least 12 characters) than complicated passwords. At the same time, we’ve learned that some users create long passwords that are still predictable – like “passwordpassword” or “xxxxxxxxxxxx.”

We also learned that giving people feedback at the moment they’re creating new passwords can help. Most often this takes the form of what are called “password meters” – color-coded signals that indicate whether a person has chosen a weak password or one that’s very strong.

This article was originally published in The Conversation. Read the original article.

Lorrie Cranor is Professor of Computer Science and of Engineering & Public Policy, Carnegie Mellon University.

Blase Ur is Assistant Professor of Computer Science, University of Chicago.

Lujo Bauer is Associate Professor of Electrical and Computer Engineering and Computer Science, Carnegie Mellon University.

Michelle Mazurek is Assistant Professor of Computer Science, University of Maryland.

Nicolas Christin is Associate Research Professor of Computer Science and Engineering and Public Policy, Carnegie Mellon University.