Password security

November 22, 2011 6:35 PM

Password security strength question.

So, I just came across a site, which I will not link to, which had an extensive list of password requirements, among which are a minimum length of 8 characters and a maximum length of 12 characters. The site publicly and explicitly announces these limits when one registers for the site.

Isn't this essentially a giveway to brute force attacks? Any cracker knows that this site has passwords that range within a 5-character range of length. (12 - 8 + 1) = 5.

Other password constraints which further compromise the security of passwords include:

--maximum repeated characters: 2
--starts with a numeric character

Am I totally off base here? Or is this, in fact, a relatively weak security system?

posted by dfriedman to Computers & Internet (8 answers total)

You aren't calculating it correctly.

A 12-character password that begins wih a digit and has a mix of upper and lower case letters for the rest has a total search field of 10 * 52^11

That's 75168655093509652480 possible choices. 75 * 10^18

A brute force attack is out of the question.
posted by Chocolate Pickle at 6:41 PM on November 22, 2011 [3 favorites]

It's more social engineering than anything. It prevents people from using the same common or brute-forceable passwords ("aaaaa", "password", etc) as they use on other sites. The actual number of passwords in that digit range is acceptably large, especially when combined with some sort of throttling mechanism such as account lockouts after multiple failed attempts.

The "maximum length" requirement is a red flag, though. If they're doing it right, they should be hashing the password rather than storing it verbatim, so the upper bound of its length shouldn't matter (within reasonable limits that would be much much higher than twelve characters).

Mostly this just all sounds annoying, though.
posted by Riki tiki at 6:56 PM on November 22, 2011

It pretty much guarantees that the user writes it down. Honestly, I have an account at a place like this and I just reset my passy every time I need to use the site.
posted by advicepig at 7:02 PM on November 22, 2011 [2 favorites]

Isn't this essentially a giveway to brute force attacks? Any cracker knows that this site has passwords that range within a 5-character range of length. (12 - 8 + 1) = 5

Sure, but that rule (for example) doesn't significantly reduce the number of possible passwords. Out of all possible passwords that are 12 characters or shorter, the passwords that are shorter than 8 characters are a tiny, tiny fraction— around 0.000002% at most (depending on the other constraints in play). The goal of these restrictions is to forbid easily guessable passwords, without forbidding a large fraction of possible passwords, and they mostly do that.

Of course, the downside is that they also forbid easily-rememberable passwords— but that's because those are pretty much the same set of passwords as the easily-guessable passwords. If this is a site you use frequently (eg, daily or more), then you can probably remember a totally random, secure password. If it isn't, you're probably going to write it down, on a sticky note or in KeePass or something. That's still more secure than using "password123", though.
posted by hattifattener at 7:20 PM on November 22, 2011 [2 favorites]

Isn't this essentially a giveway to brute force attacks?

In a sense yes, but not in the way that you mean.

Not because of the permutations issue you mention, but because of the "maximum length of 12" thing. Whenever you see an arbitrary restriction like that on the length or content of a password, you're virtually guaranteed that what that really means is "IMMA PUT IT STRAIGHT INTO THE DB IN PLAINTEXT, BYATCH".
posted by mhoye at 7:25 PM on November 22, 2011 [8 favorites]

Here's one take on password strength.
posted by Margalo Epps at 8:30 PM on November 22, 2011 [1 favorite]

As a strict probability of a brute force attack against a cryptographically random password, yes, the restrictions do, theoretically, weaken the passwords chosen. The probabilities are mostly irrelevant, because the passwords chosen by users in practice are highly non-random. "password" is among the most common passwords if restrictions are not put in place! Users love short passwords, they love passwords that are long repeated sequences, etc., so restricting them is actually helpful for making the passwords more random (again in practice), not less.

Must start with a number is actually the one that weakens it the most, I believe, though it would take a bit of math to confirm that. It would be millions of times better to require a number but allow it to occur anywhere.
posted by wnissen at 10:32 PM on November 22, 2011 [1 favorite]

Anytime a web site places a relatively low upper limit on password length, it most likely means they are storing the password in plaintext in their database, rather than performing a salted hash and storing the hash. This is risky, because if the web site's database is compromised, an attacker will likely have access to all of those users' passwords in plaintext. If any of them have also used the same password elsewhere, they're in trouble. If a salted hash was stored instead, the attacker would have a monumentally more difficult task (practically infeasible) of determining what the actual passwords were.
posted by Nothlit at 5:19 AM on November 23, 2011