Today's the final day for a majority of the action at RSAC. There's plenty happening tomorrow, but the expo halls close today, so most of the crowd will be heading home soon.
Over the last few days, as I walked from meeting to meeting, I noticed the same thing repeatedly -- people using a device to access information of some kind. In order to do this, all of them required authentication of some sort, and that means there were passwords involved.
Passwords are a necessary evil in the workplace. True, there's 2FA and biometrics, but the majority of the world protects their data with a single password. The problem is, technology has rendered most passwords useless.
The old advice, 8 characters, with a mix of upper and lower case letters, a number and random character, just doesn't cut it these days when someone can use a GPU and make millions of guesses per second.
So the next step was to create longer passwords, but people can't remember those so they extended an existing password by adding guessable content, such as the current year or a pattern on the keyboard. These days, length doesn't help like it used to. Randomness does, but humans can't do random all that well.
Last week, a researcher from Praetorian Labs discussed how statistics could be used to crack a password, proving that the number of guesses per second is secondary when it comes to protecting or even compromising passwords.
"Throwing away money in attempt to eventually improve the rate of hash generation is not worth the cost. Therefore, implementing a methodology and a streamlined process using statistics and tools as a means of attack can facilitate the cracking of passwords," the report said.
But until everyone starts doing passwords better, the cracking rigs that do large volume guesses will win each time they come into play.
Yesterday, I spent some time with Trustwave. They were running demos of their password cracking tools, which are part of their managed security service. The setup they use is impressive.
The rig has four (soon to be eight) ATI Radeon R9 290x GPUs; 32GB RAM; two six core Intel E5 processors; and a 2TB RAID array. In all, it's able to 47.708 Billion hash guesses per second. They used four dictionaries, each one custom built in-house, with a combined total of 6,316,324,295 entries. All of the password cracking tools and rules they use are commonly available and in a lot of cases open source (e.g. Hashcat, etc.)
The conversation focused on the problems with passwords, and how long, random passwords were better than easily guessed phrases or predictable password policies. For example, I gave them hashed passwords (MD5), which follow some of the more common policies on the Web and in the office. All but one were cracked in less than five minutes.
The fifth hash was a phrase, which had some degree of randomness. It will eventually be cracked -- I just didn't give them enough time to do it.
- 1E091A88703C6AE122D27142B7FA560C (Mju765tgb)
- 2AC9CB7DC02B3C0083EB70898E549B63 (Password1)
- 161EBD7D45089B3446EE4E0D86DBCF92 (P@ssw0rd)
- 32F6BDC00ADB77635E78FF8CAB9D7DFD (Zaq123edc)
- E26EB03A0A62B42C37CD44833178099E (Steve'sjobiswithIDG1234)
"Passwords are not going away any time soon, so what we need is a stopgap; and passphrases are one possible solution," said Garret Picchioni, security consultant with Trustwave.
"They provide a win-win alternative for both the end user and the organization itself. For the organization it's a win because passwords of a required length overcome many technological cracking techniques that exist today. For the user, it's a win because it's a password they can remember."
There's nothing wrong with using a weak, easily broken password on a website that isn't all that important, especially if you save long, random passwords for the websites that matter -- like a bank.
I'm still a fan of password managers, as they only require me to remember a single phrase. For the record, my phrase is actually random words separated by other characters. That password I know, the same goes for my throwaway passwords, but I couldn't tell you my VISA password to save my life.