Trying To Force Strong Passwords Futile, Counterproductive
Written by Evan SchumanThe almost daily reports of consumers and retail employees using either weak passwords or the same passwords in multiple places—or both—is being met with yawns by retail security executives. But the kneejerk response—forcing consumers and associates to be smarter about security—has had little effect, beyond being counterproductive.
For example, a company can automate rules for choosing passwords and require that they be changed periodically. But the stronger the password, the more it will fuel its own failure. Let’s say the rules require that passwords be at least 11 characters and include numerals, characters and non-traditional characters (&, %, |, @, #, ~, etc.). Add to that requirement that no character or number be repeated and that each password must pass a dictionary search. Sure, you’ll get a strong password, but you’ll also almost guarantee that that password will be written near the computer in plain sight as well as typed into a desktop file in clear text. As Newton’s IT director said, “To every password action, there is an equal and opposite stupid user reaction.” This is the topic of this week’s StorefrontBacktalk column on the McAfee security blog.
-Marc
February 4th, 2010 at 1:00 pm
Another factor, assuming a user is not using post-it’s, is that passwords will be lost more frequently — expecially in systems users don’t use frequently. This moves the risk from the login authentication, to the password reset/reassignment authentication and these areas of many applications are less secure and usually more vulnerable to social engineering attacks.
February 5th, 2010 at 9:41 pm
Stop blaming the customer/consumer. They will HAVE to write down or create a password they might remember and the more ‘secure’ it needs to be, the more likely it will be used in many places. And the ones used infrequently just beg for a personal standard password.
The problem is, people end up with too many log-ins that are rarely used. Even using an ID card at work makes a mess if it isn’t updated in a timely fashion, and forget about leaving it plugged-in!
Perhaps there are better ways?
Grins,
Rob
February 7th, 2010 at 11:26 pm
Totally agree. But let’s face it – requirements for strong and complex passwords are enforced to mitigate dictionary attacks. How about reducing some of the more onerous password complexity requirements and enforcing 3 or 5 try timed lockouts? Or combining a less complex password requirement with another auth factor?
February 8th, 2010 at 4:57 pm
This brings to mind yet more senseless, pointless, burdensome and counter-productive impacts from the “intelligent, thoughtful, capable people” at the PCI Security Standards Council: The PCI DSS not only mandates passwords that are at least 7 characters long and containing both letters and numbers, passwords must be changed every 90 days. And, as if those requirements were not enough to ensure that every user will ultimately be forced to write their password down and keep it in a convenient location, the PCI DSS further requires that each new password must not be the same as any of the previous four passwords.