Trying To Force Strong Passwords Futile, Counterproductive

Written by Evan Schuman
February 3rd, 2010

The almost daily reports of consumers and retail employees using either weak passwords or the same passwords in multiple places—or both—is being met with yawns by retail security executives. But the kneejerk response—forcing consumers and associates to be smarter about security—has had little effect, beyond being counterproductive.

For example, a company can automate rules for choosing passwords and require that they be changed periodically. But the stronger the password, the more it will fuel its own failure. Let’s say the rules require that passwords be at least 11 characters and include numerals, characters and non-traditional characters (&, %, |, @, #, ~, etc.). Add to that requirement that no character or number be repeated and that each password must pass a dictionary search. Sure, you’ll get a strong password, but you’ll also almost guarantee that that password will be written near the computer in plain sight as well as typed into a desktop file in clear text. As Newton’s IT director said, “To every password action, there is an equal and opposite stupid user reaction.” This is the topic of this week’s StorefrontBacktalk column on the McAfee security blog.


4 Comments | Read Trying To Force Strong Passwords Futile, Counterproductive

  1. Steve Sommers Says:

    Another factor, assuming a user is not using post-it’s, is that passwords will be lost more frequently — expecially in systems users don’t use frequently. This moves the risk from the login authentication, to the password reset/reassignment authentication and these areas of many applications are less secure and usually more vulnerable to social engineering attacks.

  2. Rob Martell Says:

    Stop blaming the customer/consumer. They will HAVE to write down or create a password they might remember and the more ‘secure’ it needs to be, the more likely it will be used in many places. And the ones used infrequently just beg for a personal standard password.

    The problem is, people end up with too many log-ins that are rarely used. Even using an ID card at work makes a mess if it isn’t updated in a timely fashion, and forget about leaving it plugged-in!

    Perhaps there are better ways?


  3. Dave Bradshaw Says:

    Totally agree. But let’s face it – requirements for strong and complex passwords are enforced to mitigate dictionary attacks. How about reducing some of the more onerous password complexity requirements and enforcing 3 or 5 try timed lockouts? Or combining a less complex password requirement with another auth factor?

  4. PCI Guy Says:

    This brings to mind yet more senseless, pointless, burdensome and counter-productive impacts from the “intelligent, thoughtful, capable people” at the PCI Security Standards Council: The PCI DSS not only mandates passwords that are at least 7 characters long and containing both letters and numbers, passwords must be changed every 90 days. And, as if those requirements were not enough to ensure that every user will ultimately be forced to write their password down and keep it in a convenient location, the PCI DSS further requires that each new password must not be the same as any of the previous four passwords.


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.