There was a lot of talk about passwords after White House
Press Secretary Sean Spicer supposedly tweeted his password not once but twice.
The password was a random 8 character string composed of
numbers and characters. This password in
itself is not a terrible password. The
new draft NIST guidelines (https://pages.nist.gov/800-63-3/sp800-63b.html#sec5)
regarding passwords recommend passwords at least 8 characters in length. For the tl;dr version of the guidelines, let’s
review.
- Minimum 8 characters
- Passwords should be rejected if found to be on a blacklist of compromised values
- No password expiration
- Store the password using an approved password hashing algorithm such as PBKDF2 (I prefer bcrypt)
- Implement two-factor authentication
Microsoft published their own password guidance which echoes
these requirements. Microsoft dives
deeper and explains why passwords greater than 10 characters in length can
result in worse passwords, not better.
The guidance is worth the read (https://www.microsoft.com/en-us/research/wp-content/uploads/2016/06/Microsoft_Password_Guidance-1.pdf).
Password composition requirements are only one part of
securing the authentication workflow.
With no other protections, the password could be brute forced within
minutes. There is also a difference
between online and offline attacks.
Online Attacks
Online attacks happen when a malicious user attempts to
login to someone else’s account. To
defend against this kind of attack, the first line of defense is implementing a
lockout after a certain number of failed attempts. This is typically set fairly low to keep
attackers from trying to brute force their way into someone’s account. As long as the password is somewhat complex,
an attacker will have a difficult time getting in. That is why NIST recommends banning the use
of passwords commonly found on lists from password dumps from data
breaches. Passwords such as “Password”
should be banned as these are some of the most common passwords and will be the
first passwords to be attempted.
If an attacker is successful in guessing or obtaining a user’s
password then the second line of defense is to implement two-factor
authentication (2FA) to protect against online attacks. Two-factor authentication can be implemented
in any number of ways but involves generating a one-time passcode (OTP) either
using a time-based approach (TOTP) or hash-based approach (HOTP). The OTP is communicated through a number of
ways:
- SMS
- Soft token
- Hardware token
·
The point is, not only does the attacker need to obtain the
user’s password but they also must be able to obtain the OTP that usually has a
short life (no more than 5 minutes according to NIST guidelines).
Offline Attacks
The strength of a password is tested during an offline
attack. NIST guidelines recommend using
a password hashing mechanism such as PBKDF2 to properly store passwords at
rest. Algorithms such as PBKDF2 are
meant to slow down the process of hashing the passwords and prevent password
cracking rigs from cracking as few passwords as possible. Using Sean Spicer’s password as an example,
because it doesn’t show up in any commonly used password lists, it would be
near impossible using today’s technology to crack it during an offline attack
if somehow the password hashes were dumped.
Summary
Sean Spicer’s password really is not that insecure assuming
the government took action to implement other controls around the
authentication workflow. To summarize:
- Banning passwords found on commonly-used password lists from previous breaches
- Implementing an account lockout mechanism to protect against online attacks
- Implementing two-factor authentication
- Properly storing passwords using an approved password hashing algorithm
