By Patrick Tilley, Product Security Engineer, Pathwire
As organizations continue to navigate these unprecedented times, the fight against bad actors lives on. Cybercrime in the past year went up 600% due to the transition into remote work. With digitalization continuing to increase at a rapid pace, both businesses and consumers must take extra precautions when it comes to their security posture.
When it comes to a compromise of an email account, no one has any fun. If an adversary takes charge of an email, the end user could be at risk for identity theft, bank account or credit card fraud, and more. Worse, the threat actor can pose as a legitimate user and continue to lure in other victims from your organization.
There are many factors that can contribute to an account compromise. Not surprisingly, a common vector is one of the first things people set up when creating an account – their password.
Strong passwords are critical for a good security posture, but creating a powerful password can be a tedious task. Many users simply default to simple and/or weak passwords. In order to properly protect businesses and consumers, organizations need to work to eliminate this bad habit once and for all.
Examining the Role of Rules and Requirements
Many organizations use a password strength meter on the account signup form as a way to encourage better choices in password creation.
Typically, password meters consist of several rules or requirements. Some of the most common include:
- Must be at least eight characters or more
- Must include at least one uppercase letter
- Must include at least one lowercase letter
- Must include at least one number
- Must include at least one special character from a chosen set of acceptable symbols
While the above rules are fairly standard for most organizations today, the unfortunate reality is that these requirements alone will fail to block most hackers.
Humans Fail, Adversaries Take Advantage
Including all the rules above in a password is a step in the right direction, but it doesn’t necessarily make it harder for adversaries to crack it. Why? Even with all of the above prerequisites, someone can still make their password as easy as Password1!.
Individuals have poor random generators in their head. After all, people typically gravitate toward words or phrases that have special meaning to them. The brain is also primed to use associated words when exposed to a specific environment.
Based on Security Boulevard’s analysis of the top 250 passwords found on the Dark Web, the most categories of information used to generate bad passwords in 2020 were: Names, Sports, Food, Places, Animals, and Famous People/Characters. The analysis said most passwords originate from these groups – 59% of Americans use a person’s name or family birthday in their passwords, 33% include a pet’s name and 22% use their own name. Also, the average user reuses that bad password about 14 times!
Rising Above Password Rules and Human Nature
With this in mind, how do we overcome human behavior to judge the strength of the password a user creates? For starters, one of the most effective ways to mitigate account takeover due to insecure passwords is to cross-check them against a database of hashed exposed credentials.
One of the most famous databases to do this is haveibeenpwned.com. Organizations can log onto the website and see if the password an individual is trying to use has been exposed. If it has been, the user should not be able to move forward in the process. Another benefit is to encourage the user to change this particular password if they are using it for other purposes.
In addition, businesses should also mark passwords that are shorter than 10 characters or include any information previously provided in the signup form such as an actual name, company name, domain name, etc.
Examining Password Predictability
Occasionally, a password might not exist in the exposed password hashes list or meet other requirements. Take our previous example of Password1!. Luckily, there is an extra step companies can take in this circumstance.
An additional way to measure the strength of a password is to calculate its entropy. Entropy is a measurement of how unpredictable a password is based on the character set or sets used as well as the password length.
When considering weak passwords that have yet to be leaked or cracked, using password entropy to render a message to a user via a password strength meter is useful to show them that they should consider using something better.
However, measuring the strength of a password-based just on its entropy is flawed. For instance, let’s take the example “Password01.” Unfortunately, this is pretty common and could be easily guessed. However, a password meter with minimum requirements of character length, as we’ve discussed, is flawed.
A password strength meter may show that the example password is “Very Strong.” However, as is, this password has been seen on haveibeenpwned.com more than 400 times.
Let’s examine another example with a password consisting of five randomly selected words, with no uppercase characters, no special symbols, no numbers, and each word varying in length.
For this example, we will use the words “fit”, “heat”, “scale”, “pot”, and “kneel.” In terms of entropy, this password has a smaller character set, but while it’s measured out to be a “weak” password based on complexity, it hasn’t been stolen (as far as what is seen from haveibeenpwned.com‘s response).
When taking into consideration the number of permutations and combinations users have when choosing five words out of the number of three, four, and five letter words at random out of the English language for instance, it fortunately can be very complex.
Despite the sign-off from haveibeenpwned, just because it hasn’t been stolen doesn’t necessarily mean it should be the golden standard when it comes to passwords. However, the benefit lies in the fact that it is more memorable to humans while it is harder for computers to crack.
So Are Password Meters a No-Go?
As discussed, we’re aware that the common password requirements don’t work well and entropy is flawed, so how can engineers prevent end users from leaving themselves vulnerable?
Companies should consider a password strength meter that goes beyond human nature. In addition to providing feedback on the password itself, the meter can provide suggestions such as setting up multi-factor authentication. This can drive home the message that additional security measures add further protection.
Engineers also need to consider that most password strength meters are flawed because of the positive reinforcement. As soon as an individual meets the requirements, they are treated to responses praising their password and that there is nothing additional they need to do. In other words, they never need to worry; they will never be compromised.
What organizations should strive for is for end users to be opposed to their choice of password most of the time and indifferent the rest. Adversaries today are not thrown off by the gate of a password and as such, companies need to encourage additional security measures.
My general recommendation to developers wondering whether or not to implement a password strength meter on their website is no. All in all, making a good password strength meter is tricky, and can lead users to making weaker passwords as opposed to better and stronger ones. Utilizing resources like haveibeenpwned.com to check for exposed passwords is much more robust compared to inventing and using strength-checking algorithms.
Utilizing a password manager that can generate passwords from a sufficiently large set of characters to achieve a desired level of entropy is one of the best options currently for creating strong and unique passwords.
Even so, users should still consider utilizing any and/or all other forms of security options available, such as any available passwordless sign-on methods, security keys, authenticator apps, or any other available multi-factor authentication methods beyond using just a password to win the fight against cyber adversaries.
##
