Password Best Practices

Good Security Practice:

Government employees should not use their internal passwords for external services.

What does this statement mean?

You should not use your IDIR password for anything other than logging on to your government account, i.e. do not use it for a Hotmail or Yahoo account, a PIN for a bank machine, your Amazon account, etc.

Why?

There is a possibility that unauthorized people could use your unsecured password to access secure accounts associated with you such as your IDIR account. By using different passwords for unsecured accounts and your secure IDIR account you close this security exposure. There are two ways that unsecured passwords could be exposed:

• Compromise of e-tailers databases happens too often. If the database containing your password becomes exposed, your IDIR account may be vulnerable to attack.
• When logging into a commercial service, your password may be sent in clear text (i.e. not encrypted) over the Internet. This makes it subject to capture by others as it travels over the Internet.

Are there any methods available to ensure I have created a strong password?

Employees are asked to create and manage lengthy and complex passwords. This is necessary because encryption algorithms are only as strong as the password used to encrypt and to open the file. Short length passwords (even complex passwords of 8 characters in length) are relatively easy to break as the attack technology for password guessing has dramatically improved recently. Large complex passwords may seem daunting, but they can be quite easy to create, and more importantly, easily remembered without the need to write them down. Although the method offered below will not create a password as strong as one using truly random characters, it will help you create and use lengthy and complex passwords when needed.

Step 1.  Think about a phrase that you can easily remember (titles, famous quote or something that means something to you). For example:

• My one pet ‘Sam’ is so fat he equals three.

Step 2. Take the first letter from each word, this is easy to do while you say it to yourself:

• Mopsisfhet

Step 3.  Substitute capitals, numbers and symbols for some of the words:

• m1pSi%Fh=3  (capitalize the important words like Sam and Fat, substitute % for small s)

From a simple sentence, you now have a 10 digit password that cannot be recognized by any dictionary attack and by adding symbols and numbers, it is nearly uncrackable (see chart below).

Some Interesting Facts:

How much time is needed to crack a password by brute-force?

If the password cannot be guessed and is not found in a dictionary, the cracker has to try a brute-force attack. When brute-forcing, the time to crack the password depends on the amount of possible passwords that the cracker has to try. The amount of possible passwords increases with password length and with increasing diversity of characters being used (complexity).

Let’s take the scenario of a cracker trying 15 million passwords per second. This is currently the maximum speed being claimed by password cracker vendors. You need a pretty fast computer to achieve this. The following table shows the computed time to crack a password with 15 million tries per second.

Notice the incredible increase in time to try all possible combinations when password length and complexity increase

length: 4, complexity: a-z ==> less than 1 second length: 4, complexity: a-zA-Z0-9 + symbols ==> 4.8 seconds length: 5, complexity: a-zA-Z ==> 25 seconds length: 6, complexity: a-zA-Z0-9 ==> 1 hour length: 6, complexity: a-zA-Z0-9 + symbols ==> 11 hours length: 7, complexity: a-zA-Z0-9 + symbols ==> 6 weeks length: 8, complexity: a-zA-Z0-9 ==> 5 months length: 8, complexity: a-zA-Z0-9 + symbols ==> 10 years length: 9, complexity: a-zA-Z0-9 + symbols ==> 1000 years length: 10, complexity: a-zA-Z0-9 ==> 1700 years length: 10, complexity: a-zA-Z0-9 + symbols ==> 91800 years

What we see is that:

* any password shorter than 5 characters can be cracked within 5 seconds

* any password shorter than 7 characters can be cracked within a day.

* With the password length of 9, the cracking time goes to hundreds of years. In most cases this can be considered acceptable while mostly we need to keep a secret for a maximum of 30 years.

To be on the safe side, we recommend a minimum password length of 10 characters.

Note: the crack times mentioned in the table are needed to try all the possible passwords. There is a great chance that the cracker only needs 50% of this time. Also bear in mind that a cracker can always have a lucky shot at his first try and crack the password immediately. The chance is very small, but theoretically it is possible.

Some Other Resources:

Wikipedia:

1. Password Strength
2. Password Cracking