Impervia has released an interesting study of 32M user passwords obtained incidental to a data breach. We’re used to this kind of thing by now, I suppose. But in any case it appears that only 0.2% of user accounts had passwords meeting their minimum criteria for a “strong” password:
- Eight or more characters
- Some mixture of the basic character classes: upper- and lower-case, digits, and symbols.
We’ve been hearing this advice for years. In fact, it’s now recommended practice for new password entry text fields to enforce some minimal complexity requirements. Looking at the “top 20″ list of common passwords, anything would be an improvement.
But are mechanical complexity requirements always enhance security? More importantly, is it possible that they could actually decrease security for careful and conscientious users who choose reasonable passwords in the first place?
Consider Schneier’s example password from the report. Distilled from a pass phrase, it comes out as “tlpWENT2m”. For most systems, I like to use the pwgen utility to generate reasonably good passwords. For example, it just suggested the password “Aisah4ahw7″ (I agree they should be written down and managed with careful physical security).
These example passwords have 9 or 10 characters with apparently good probabilities of encountering capital letters and digits. The upper- and lower-case letters and digits amount to 62 possibilities for each character, putting a hard upper limit on the entropy of about 6 bits per character. At 10 characters in length, we could theoretically approach 60 bits of total entropy in our password! “Good enough for government work” as they say. Or at least it used to be.
So what happens when a well-intentioned user interface rejects our thoughtfully-chosen password on the basis that “it must contain a symbol”? Assume that the user has already chosen the password they want to use and has written it down, and it’s otherwise a good one. Perhaps also the UI enforces the recommendation (the report attributes this to NASA) that “if there is only one letter or special character, it should not be either the first or last character in the password.” My guess is that most users at this point get out the eraser and replace one of the characters with a symbol in order to satisfy the rule.
But herein lies a problem: On my (typical US) keyboard there are only 32 choices for symbol characters. In addition, UI text fields have a reputation for rejecting (or silently munging) quote-like or escape-like characters which probably rules out some of the more interesting choices. We have just reduced the maximum entropy contributed by that character from 6 to 5 bits!
But you forgot to consider … Yes, there are a number of holes with this theory. Lacking any more interesting rhetorical device at the moment, I’ll pretend to discuss them with myself. Here are a few I can think of:
- Those example passwords were derived from rules for English text in one way or another. They won’t be anywhere close to theoretical maximum entropy. - True, but neither will the replacement symbol. More than likely the user will simply replace an ‘a’ with an ‘@’ or some such change. Note the sample characters in the recommendation: !@#$%^&*,;” Even those authors seem to like to type “123456″!
- The user has some freedom to choose which of the characters he will replace with the symbol. - Applying all the “best practices” to the ten character password leaves eight options. Potentially, this could represent three bits of added entropy and in fact push the symbol requirement into a net gain.
- The user could add or change more than one symbol. - Sure, the user has just been required to type one digit, one uppercase letter, one lowercase letter, and five other chars. How much more tricky typing are they likely to be in the mood to add? Oh, and they have to type it perfectly twice in a row right now, and an indefinite number of times in the future.
So this analysis is largely inconclusive. Adding a new password complexity requirement may increase the effective entropy somewhat, but there may even be cases where it decreases it. What is clear though is that there is no set of practical, enforceable requirements that can magically take the users from dictionary words to that perfect, even distribution over the 94^10 = 5e19 possible passwords.
But above all, look out for the law of unintended consequences. Especially when feeling the urge to subject us humans to new sets of rigid mechanical rules, however great they might seem on paper.
