Reading through TechCrunch’s Depressing Analysis Of RockYou Hacked Passwords:
According to a study by Imperva, [the most common password is] “123456,” followed by “12345,” “123456789″ and “Password,” in that order. “iloveyou” came in at no. 5.
I generate my passwords with APG, which generates passwords like this:
- Irikyak6
- RaypHiam6
- radsErn2
- reebrIjLi
As you can tell, these are for all intents and purposes, secure. However, some sites out there insist that the last one on the list is insecure. Why? It doesn’t have a number in it, so it must be terrible. 123456? That’s cool with them, though.
So riddle me this:
I’ve got a one character password. The password has to contain a digit.
What are the chances of guessing my password? Why, 1 in 10. I can’t use A-z, given the rules, so the password has to be a single digit, 0-9.
However:
I’ve got a 1 character alphanumeric password. There are no rules about how many numbers the password must contain.
What are the chances of guessing my password now? Why, A-Z (1 in 26), a-z (another 1 in 26), and 0-9 (1 in 10): So your chances are 1 in 62.
The same thing applies in longer passwords: the more information you give an attacker about the rules associated with a password, the less work they need to do to crack the password.
A better solution? Integrate a library like cracklib and set some reasonable rules about what passwords are, and aren’t allowed. It’ll stop 123456 in it’s tracks.
Oh, and for goodness sake, encrypt your passwords when you store them in the database.
Cyber image CC-BY-NC fnordeingang e.V.
