<p>But memorise it — never write it down. And, oh yes, change it every few months.<br /><br />These instructions are supposed to protect us. But they don’t. Some computer security experts are advancing the heretical thought that passwords might not need to be “strong”, or changed constantly. They say onerous requirements for passwords have given us a false sense of protection against potential attacks. In fact, they say, we aren’t paying enough attention to more potent threats.<br /><br />Here’s one threat to keep you awake at night: Keylogging software, which is deposited on a PC by a virus, records all keystrokes — including the strongest passwords you can concoct — and then sends it surreptitiously to a remote location. <br /><br />“Keeping a keylogger off your machine is about a trillion times more important than the strength of any one of your passwords,” says Microsoft Research principal researcher Cormac Herley, who specialises in security-related topics. He said antivirus software could detect and block many kinds of keyloggers, but “there’s no guarantee that it gets everything”.<br /><br />After investigating password requirements in a variety of settings, Herley is critical not of users, but of system administrators who aren’t paying enough attention to the inconvenience of making people comply with arcane rules. “It is not users who need to be better educated on the risks of various attacks, but the security community,” he said at the New Security Paradigms Workshop, a meeting of security professionals at Queen’s College in Oxford, England. <br /><br />One might guess that heavily trafficked websites — especially those that provide access to users’ financial information — would have requirements for strong passwords. But it turns out that password policies of many such sites are among the most relaxed. These sites don’t publicly discuss security breaches, but Herley said it “isn’t plausible” that these sites would use such policies if their users weren’t adequately protected from attacks by those who do not know the password.<br /><br />Herley, working with Dinei Florencio, also at Microsoft Research, looked at the password policies of 75 Web sites. At the Symposium on Usable Privacy and Security, held in July in Redmond, Wash., they reported that the sites that allowed relatively weak passwords were busy commercial destinations, including PayPal, Amazon.com and Fidelity Investments. The sites that insisted on very complex passwords were mostly government and university sites. What accounts for the difference? They suggest that “when the voices that advocate for usability are absent or weak, security measures become needlessly restrictive.”<br /><br />California-based design consulting firm Nielsen Norman Group’s co-founder Donald A Norman makes a similar case. In “When Security Gets in the Way”, an essay published last year, he noted the password rules of Northwestern University, where he then taught. It was a daunting list of 15 requirements. He said unreasonable rules can end up rendering a system less secure: users end up writing down passwords and storing them in places that can be readily discovered. “These requirements keep out the good guys without deterring the bad guys,” he said.<br /><br />Northwestern has reduced its password requirements to eight, but they still constitute a challenging maze. For example, the password can’t have more than four sequential characters from the previous seven passwords, and a new password is required every 120 days. By contrast, Amazon has only one requirement: that the password be at least six characters. That’s it. And hold on to it as long as you like. A short password wouldn’t work well if an attacker could try every possible combination in quick succession. But as Herley and Florencio note, commercial sites can block “brute-force attacks” by locking an account after a given number of failed log-in attempts. “If an account is locked for 24 hours after three unsuccessful attempts,” they write, “a six-digit PIN can withstand 100 years of sustained attack.”<br /><br />Northwestern senior data security analyst Roger A Safian says that unlike Amazon, the university is unfortunately vulnerable to brute-force attacks in that it doesn’t lock out accounts after failed log-ins. The reason, he says, is that anyone could use a lockout policy to try logging in to a victim’s account, “knowing that you won’t succeed, but also knowing that the victim won’t be able to use the account, either”. <br /><br /><em>(Randall Stross is an author based in Silicon Valley and a professor of business at San Jose State University.)</em></p>
<p>But memorise it — never write it down. And, oh yes, change it every few months.<br /><br />These instructions are supposed to protect us. But they don’t. Some computer security experts are advancing the heretical thought that passwords might not need to be “strong”, or changed constantly. They say onerous requirements for passwords have given us a false sense of protection against potential attacks. In fact, they say, we aren’t paying enough attention to more potent threats.<br /><br />Here’s one threat to keep you awake at night: Keylogging software, which is deposited on a PC by a virus, records all keystrokes — including the strongest passwords you can concoct — and then sends it surreptitiously to a remote location. <br /><br />“Keeping a keylogger off your machine is about a trillion times more important than the strength of any one of your passwords,” says Microsoft Research principal researcher Cormac Herley, who specialises in security-related topics. He said antivirus software could detect and block many kinds of keyloggers, but “there’s no guarantee that it gets everything”.<br /><br />After investigating password requirements in a variety of settings, Herley is critical not of users, but of system administrators who aren’t paying enough attention to the inconvenience of making people comply with arcane rules. “It is not users who need to be better educated on the risks of various attacks, but the security community,” he said at the New Security Paradigms Workshop, a meeting of security professionals at Queen’s College in Oxford, England. <br /><br />One might guess that heavily trafficked websites — especially those that provide access to users’ financial information — would have requirements for strong passwords. But it turns out that password policies of many such sites are among the most relaxed. These sites don’t publicly discuss security breaches, but Herley said it “isn’t plausible” that these sites would use such policies if their users weren’t adequately protected from attacks by those who do not know the password.<br /><br />Herley, working with Dinei Florencio, also at Microsoft Research, looked at the password policies of 75 Web sites. At the Symposium on Usable Privacy and Security, held in July in Redmond, Wash., they reported that the sites that allowed relatively weak passwords were busy commercial destinations, including PayPal, Amazon.com and Fidelity Investments. The sites that insisted on very complex passwords were mostly government and university sites. What accounts for the difference? They suggest that “when the voices that advocate for usability are absent or weak, security measures become needlessly restrictive.”<br /><br />California-based design consulting firm Nielsen Norman Group’s co-founder Donald A Norman makes a similar case. In “When Security Gets in the Way”, an essay published last year, he noted the password rules of Northwestern University, where he then taught. It was a daunting list of 15 requirements. He said unreasonable rules can end up rendering a system less secure: users end up writing down passwords and storing them in places that can be readily discovered. “These requirements keep out the good guys without deterring the bad guys,” he said.<br /><br />Northwestern has reduced its password requirements to eight, but they still constitute a challenging maze. For example, the password can’t have more than four sequential characters from the previous seven passwords, and a new password is required every 120 days. By contrast, Amazon has only one requirement: that the password be at least six characters. That’s it. And hold on to it as long as you like. A short password wouldn’t work well if an attacker could try every possible combination in quick succession. But as Herley and Florencio note, commercial sites can block “brute-force attacks” by locking an account after a given number of failed log-in attempts. “If an account is locked for 24 hours after three unsuccessful attempts,” they write, “a six-digit PIN can withstand 100 years of sustained attack.”<br /><br />Northwestern senior data security analyst Roger A Safian says that unlike Amazon, the university is unfortunately vulnerable to brute-force attacks in that it doesn’t lock out accounts after failed log-ins. The reason, he says, is that anyone could use a lockout policy to try logging in to a victim’s account, “knowing that you won’t succeed, but also knowing that the victim won’t be able to use the account, either”. <br /><br /><em>(Randall Stross is an author based in Silicon Valley and a professor of business at San Jose State University.)</em></p>