Muffett on Passwords

TL;DR Summary

What Is Good About Password Technology?

These are the architectural benefits:

  1. passwords are easy to deploy
  2. passwords are easy to manage
  3. passwords don’t require identity linkage between silos – so your Google username can be different from your Skype username, can be different from your FetishPornSite.com username, nor need you register identities centrally
  4. passwords are scalable – you can use as many different ones as you like
  5. passwords can be varied between silos so that loss of one does not impact the others
  6. passwords don’t (necessarily) expire
  7. passwords are the purest form of authentication via ‘something you know’, and thus ideal for the network or “cyber” environment.
  8. you don’t need to pay an intermediary or third-party a surcharge just to get a new password, nor to maintain an old one.

What Is Bad About Password Technology?

The advice in the first section addresses most of these:

  1. passwords are easy to deploy
    - which means they’re used everywhere
  2. passwords are easy to manage
    - which means they’re managed haphazardly
  3. passwords don’t require identity linkage between silos
    - but people are generally too lazy to maintain more than one or two identities
  4. passwords are scalable
    - but people are generally too lazy to remember more than one or two passwords
  5. passwords can be varied between silo
    - but people are generally … see above
  6. passwords don’t expire
    - but most of them are guessable in a matter of minutes or hours
  7. passwords are ‘something you know’
    - and so anyone who knows your password is indistinguishable from you
  8. you don’t need to pay … oh, wait, that’s a good thing, unless you’re an intermediary?

“Why Passwords Both Do And (Importantly) Do Not Suck” Blog Posts

“Choosing A Good Password” Blog Posts

“What To Do When Your Password Gets Leaked On The Internet” Blog Posts

“Password Implementation For/By Developers” Blog Posts

“Password Recovery Dialogues” Blog Posts

“Password Technology” Blog Posts – updated 2013/2/1

“Password Cracking Technology” Blog Posts

How Security and Identity Really Work

One thought on “Muffett on Passwords

  1. Jerry

    I’d add one more to your “tl;dr” – “protect the hashes on the back end as carefully as you protect anything on the system”. bcrypt is good, but a hash that the adversary can’t get a hold of is a hash he can’t even *try* to mount an off-line brute-force attack against. The view that “if it’s hashed, I don’t have to worry about protecting it” is dangerous. (It’s also, unfortunately, almost written into law, such as laws on required notifications.)

    Layered security. Defense in depth. These are good concepts; apply them.

    — Jerry

    Reply

Leave a Reply