#017: Security, pt. 2: "Sesame, open" is not a good password
In “Ali Baba and the Forty Thieves”, the thieves did something clever: They protected their treasure cave with a password, so other thieves wouldn’t be able to get in. Except they were also stupid about it: Everyone needed to know the same password, and their operational security sucked, so it was easy for Ali Baba to eavesdrop for their password, and you know the rest.
However, the principle of using passwords has survived. You still need one to authenticate yourself on the web. So websites have to work hard to make sure that your password isn’t easily intercepted, stolen or cracked. In How Dropbox stores your passwords, the company explains to what lengths they go to to make sure your passwords are safe. Except good password storage alone isn’t enough. In 1Password is layered with modern authentication, AgileBits, the company behind the 1Password password manager, explains what else a service has to do to ensure safe authentication. It’s a lot more complicated than you would probably expect.
But even if the website does its very best to protect your password from being cracked, no amount of protection helps if you choose a weak password in the first place. So what makes a good password? Almost all advice you’ve heard is probably wrong — including using numbers or special characters. The only two things that matter for password strength are randomness and length. Troy Hunt goes into more detail in Passwords Evolved: Authentication Guidance for the Modern Era. And AgileBits, has some very practical tips for choosing good passwords: Toward Better Master Passwords.
And finally, one more tip: If a service offers Two Factor Authentication (2FA), enable it. Since even the best password might be stolen or cracked, using 2FA means you have an additional thing that authenticates you to the service, which the hackers won’t have, giving you the time to update your password and secure your account.
Next week, we’ll be looking at another aspect of computer security: You, dear reader, who is sitting in front of one.
Other interesting links from around the web:
- Apple’s diseconomies of scale and the next iPhone – You've probably heard of "economies of scale", where something gets cheaper the more you can build of it. But there's also diseconomy of scale: A a new iPhone containing new technology needs its components built in large quantities — but if a component consists of tech that's very, very new, producing the required quantities is a big problem.
- Paging Agent 007 – Sci-Fi author Charlie Stross makes a strong case that we're living in a James Bond universe — without a James Bond in sight so far.
- What football will look like in the future – Just trust me on this one, and try to read through to the end.