Why are passwords compromised?

An interesting article by Dan Goodin, and this article by Melanie Pinola informs us that your technique of setting secure passwords is not so clever as you think! Why?

1. Password databases are not protected enough

Well.. Since there have been so many password databases cracked, and software CPU power has improved, hackers are now knowing what you use. Remember the LinkedIn database last year? (or any other more recent article about a password databases being stolen? Like this one). Thanks to all database breaches hackers has a really good idea of what passwords we use, since password cracking is all about probability. Check out the most common passwords 2013

 2. We are human and we are NOT random

The article above mentions that for optimal security you should use at least 9 characters and they should be ABSOLUTE random. Since you are human, you are not random! We are all creatures of habit and we follow patterns that can be figured out. For example: You usually start your password with a capital letter, and since password cracking is all about using probability, there is a 13% probability that it is the letter E, since it is the most common letter in the English language. Want to know more about Cryptography? Check out Stanford professor Dan Bonehs free coursera course: Cryptography

3. Strong passwords are bypassed by “password reset”

Even if you use a 45 character strong RANDOM password (which by the way is not supported by most services, usually 30characters are max for passwords). The way of resetting a password is usually weak! Think about how easy it is for you to click “forgot password” link and receive an email and just enter a new password. Super-easy! But what about if your email has been compromised?.

Conclusion; only using your password (one factor) to authenticate yourself is not enough. What is the next step?

Solution: a layered security approach

In physical security we use something that is called: DiD (Defence in Depth) made popular by Mary Lynn Garcia in her book: PPS – Design and evaluation of Physical Protection Systems DiD is the theory that you can never have 100% secure systems (if humans are involved) and therefore you want to make it as hard and as much resource and time consuming for an adversary to break the system, since different techniques most be used. To achieve this we use “DiD” sometimes called: layered approach (or onion approach in physical security. Other techniques can be target hardening, these techniques can also be applied to IT security.

What is Two-Factor authentication?

In a digital world, we want to be sure that a user is who they say they are. This is called: authentication. To authenticate a user we use “factors”. The factors that we use are

1. Something the user knows – example: a password factor
2. Something the user has – example: smartcard
3. Something the user is – example: a fingerprint

Single factor authentication is to only use one of the above, This is not optimal since passwords as are so easily compromised. Two-factor authentication (aka multi-factor authentication, or TFA, T-FA, or 2FA) is a way to verify your authenticity by providing two (or more) factors. Example of a TFA is to provide my username + password + a One-time Password (OTP) that I have received as an SMS.

How can I enhance the protection of my personal information?