Passwords and Pins

Speaker A: 00:00:00

Hello and welcome to the Cognitive Engineering Podcast produced by me, Fraser McGruer, for Aleph Insights. In this series of podcasts, we take a look at interesting topics and discuss what we think they tell us about analysis and decision making. I'm here with Nick Hare, Anna Pearson, and Peter Coghill of Aleph Insights, and this week we're discussing forgetting your password or passwords. And due to the new lockdown, unusually, we're recording this remotely.

Speaker B: 00:00:30

Can't we just be, and we're Aleph Insights and we've forgotten our password?

Speaker C: 00:00:36

Help us.

Speaker A: 00:00:37

Yes, yeah, we're locked out. Help us, please. Nick, we need someone to help us with your passwords, with our passwords.

Speaker D: 00:00:44

Yeah, so I, a couple of weeks ago, I went on a work trip, which obviously was, you know, trying to take advantage of the brief interregnum between lockdowns, to Porton Down, near Salisbury, where I had to access a particular computer system that I'm not, you know, is not connected to the internet, and for which I needed not one, but two separate passwords to access. And I had, a couple of weeks previously, gone and got myself an account to use this computer system.

Speaker A: 00:01:21

And you've written down: 11111

Speaker D: 00:01:24

I had not written down anything. I didn't need to, right? Because I've got a really amazing and impregnable way of generating passwords, which I'm not going to go into, because I don't want to give anything away. But essentially, it gives me unique passwords for everything. But it means I don't need to rely on a password manager. And I can, and I can, you know, I can more or less, most of the time, remember my password, right? And so I was pretty confident about this. And I got there. Yeah, it turns out,

Speaker A: 00:01:54

you've got this bulletproof system.

Speaker D: 00:01:56

Yeah, the utterly bulletproof system. I got there, tried the first password. Then I thought, oh, no, okay, I know. I know why it's not that, then. And I tried the other password, which it would have been, and that didn't work. And then I tried a third password, and a fourth one, and a fifth one. And at some point, I thought, at some point, it must say you've been locked out, get in touch with an administrator. But it didn't. And I kept trying. And eventually, you know, there's no, there's no help desk there that I can go walk over to see there's only a phone line I can call. And I phoned them, and they said, we'll call you back. And so I was sat about for about two hours, and eventually didn't call back. And so I came home again. So I'd had a quite a nice day out to Salisbury. Yeah. And then on the way back, I did discover a note in my wallet, reminding me of a specific feature of this password, right, which was imposed on me. It was something, it was like, when we had to create our passwords, there was this thing, I couldn't use my normal system, because I had to add something to it. Because, you know, the password, there was a specific rule about it. And then I realized where it had all gone horribly wrong. And so yeah, basically, passwords, the whole problem of passwords, I think it's, it's a common, certainly not an uncommon problem for people to forget them. But also, what do we do about the fact that we there are so many things we need passwords for so many things we need to authenticate ourselves for? How do we avoid, you know, kind of cognitive meltdown? What are the strategies that we can use? And, and what's good?

Speaker A: 00:03:36

What's good practice? So Peter, what's your take on this? Do you have you got? Have you got a password system like Nick does?

Speaker B: 00:03:43

No, I well, I do for certain passwords, which are kind of the core ones. So a lot of how we'll talk about identity and how how you authenticate your identity online and things later on, I think, but this is a core passwords from which other things get their identity. I have a system for those. And that is again, it's a secret system only known only to me robust and lets me generate very long passwords. I think my password for my main Gmail account is about 24 characters long, with all sorts of special characters in it. So it's very long that I can just remember, with no problem whatsoever, and type and crucially type very quickly, because you type it a lot. So, but then from those kinds of passwords, I use to manage a password manager. So for each service, and there are hundreds of services, I have accounts or passwords for each one is unique, but they're managed by a sort of centrally very strong password, but strong identity. So I don't have a universal system API everywhere, because that would be that would be a bit more cognitively demanding. So I do rely on the systems to sort of help me out. What I'm keen to explore a bit, though, is the restrictions, because it seems that the problem that Nick had was his system was broken by a particular requirement, a particular policy about the shape and form of the password imposed on him when he created the password, and that broke his system wasn't compatible with that. So he had to have this little addendum for this one particular case, which is obviously going to you're going to forget that. And now I think I might be able to speak to this. But in my mind, I think generally restrictions are bad, because they just for a number of reasons, apart from good restrictions, length, you want to use a password longer, the better. I mean, there's in modern systems, there's no should be no restriction on the length of the password. It's only older systems where there was kind of only space in the database for short strings of characters and things that cause you to have short passwords. But modern systems really should not place no upper limit on the length of the password, and encourage you to use ever to use as long as possible. And like things like use of special characters, numbers, uppercase, lowercase, really, I think that it shouldn't, it shouldn't mandate the use of those, but it shouldn't restrict the use of them. So it should allow you to use them, but not say exactly where they should go or anything else. Any, any other restrictions about like how long it should be about a maximum length or where special particular characters should go or Yeah, um, really, that, that, that, that is actually a security problem, because security risk, because that will narrow the search space in all possible strings. Yeah. If those rules are known. So if it said that your character, your password must be exactly 10 characters long, have a capital at the beginning, a full stop at the end and a number in the middle, then if the if an attacker gets to know those rules, that eliminates a huge number of passwords, they have to then try in

Speaker A: 00:06:46

exactly to find a find a valid one. And actually, weirdly, you know, talking about risk restrictions, and also Nick being sort of caught out because he was asked to do this password a certain way that happened to me recently, where weirdly, so I have a system for generating passwords as well. And it always incorporates the sort of things you're asked for, like capital letters and numbers and special characters and stuff like that. But I was signing up to something with BT actually, and they restricted me to it had to be quite short password. I wasn't allowed any special characters or capital, and it just completely messed me up. And now I've got a password, I can't even remember what it is. Anna, any thoughts on restrictions? And is I mean, are passwords are passwords a good way? Are they a good way to do things, but maybe maybe

Speaker C: 00:07:29

restrictions first, actually, some interesting sort of topic that's often more often than not discussed in information security. Because organizations want to have a password policy password management, and they want to restrict the user and sort of force them into having a complicated password. And that's why you'll always see that a lot of the times you'll see a sign of bar that says, you know, going from sort of red, amber to green to state how weak or how strong the password character input is. But I think it's tricky to find the sort of right definition, because if you're explaining to any user that there's a character limit to have one special character or a capital letter, then actually an adversary would look at that and say, Oh, I know that there's a minimum of one special character. So I know for each individual password that they must have that. And then they can at least pull a list and use that when they're trying to potentially brute force to conduct a brute force attack. I mean, I don't know if

Speaker D: 00:08:41

anyone's looked at this, but I suppose the problem is if you give people the freedom to choose their own passwords, they will like nincompoops, choose rubbishy passwords. I mean, I don't know what a rubbishy password is, or how predictable people are, if not, if not given those restrictions.

Speaker C: 00:08:59

I think as an example, password is one of the most used and weakest passwords on the planet. I think it's the number one password word used. We've rumbled your system, Nick.

Speaker D: 00:09:11

Yeah. I'm up to password 279 now.

Speaker C: 00:09:17

Yeah, but if you say to a user, right, can you just put one special character in, they're likely just to change the A and put an at sign and then it's passed and accepted. I think it's always tricky to find a balance between sort of usability and security. On the one hand, you don't want to enforce the user to change their passwords all the time or too frequently, particularly in an organisation. I think when we're talking about users, we have to sort of be aware of users as customers and as clients of a service and also users within an organisation and they're actually accessing a service or a database with data. They might be different ways of managing passwords based on that, but I think there seems to be some kind of universal way of restricting passwords, which is at the current stage length, so 12 to 15 characters or a minimum of eight for some companies and then these additional sort of capital letters and special character usage. But also, what about things like, I think Peter

Speaker A: 00:10:25

was referring to earlier on, about a central place like a deadbolt sort of thing. Do you guys use those? One place where you can centrally store all your passwords? Anna, what are your

Speaker C: 00:10:37

thoughts on that sort of stuff? Yes, I have used KeePass in the past and they are very good because you can store, as Peter mentioned, really long passwords that are strong and complex, but I think you should also take them with a pinch of salt. I recently read an article from Kate O'Flaherty. She wrote an interesting article for Forbes magazine and she looked into a report that master passwords actually can be sometimes counterintuitive because they have the master password that's used to access the database, the password manager database, and that master password is actually stored in clear text on the machine in RAM. So if an adversary happened to access that, then it's completely counterintuitive. They've got everything. Yeah, exactly. They have everything. That sounds like quite a badly designed

Speaker D: 00:11:33

bit of software. It might be worth just briefly summarizing how you crack passwords because I don't think it's widely. A lot of people imagine it's something a bit like you see in the films where they try different combinations to access the account or the service until they find the right one. But in nearly every case, what happens is that there will be a leak of not the passwords themselves because they're hardly ever stored just as plain text. So they don't have a file somewhere saying this is the user and that's the password. What they do is pass the password and often some other information through an algorithm that essentially scrambles that password in a way that is not reversible. So it'll scramble it in a way that what you end up with is a sort of big, long kind of hash as it's called. You can't take the hash and find the password. It's not reversible. It's a bit like if you gave me 50 numbers and I added them all up and then removed the first digit, you wouldn't be able to work out what that first digit was kind of thing. But what attackers do is they'll have a list of the hashes and the usernames and then they'll just try the algorithm with loads and loads of different passwords until they match the hashes that come at the end with the hashes associated with each user. So there's essentially two different ways of doing that. One is to do a brute force where you try literally every combination of characters to try and find the hashes and match them to the accounts. And obviously that's then an issue about length. So the longer the password, the harder it's going to be for someone to find it through that method. But the other is a dictionary based attack where you look at a list of known passwords, of common known passwords. And obviously even if they're long, if they're predictable and they've been used before, then they're going to find them. So that gate immediately tells you just make sure that your password is long, right? Number one thing, but also make sure it isn't-

Speaker A: 00:13:41

How long is long? How long is long?

Speaker D: 00:13:43

Well, it's unfortunately, it's getting longer all the time, long because computers are getting faster and actually cracking is a combinatorial exercise and can be parallelized because it doesn't need to be done in serial, which means that you can just buy a thousand computers and speed it up by a factor of a thousand. So I mean, essentially longer than the other guy. I think that's what I'd say. I mean, if you're trying to crack passwords, you're going to try and get all the easy ones, particularly because the easy ones are probably people who are a bit shit with computers. And as soon as you've got their passwords, not only can you use them on that account, but those are probably people who use the same passwords for multiple accounts. And so you break into Amazon and you've also got their eBay account.

Speaker B: 00:14:26

There's probably a good sort of crossover with the population of people who are more likely to fall for phishing scams and other things that you're ultimately trying to see where you're stealing their money from their bank account and things.

Speaker D: 00:14:36

And so just it is worth saying that this is common, right? It's not by any means unusual. So I mean, there's a list on You've Been Pwned, which is a really good website if you want to see if your passwords have been compromised or are known to have been compromised. And they've got a list of several hundred examples, you know, of which 60 were in this year alone. And they're not obscure things that you won't have heard of or dodgy kind of websites. I mean, they include things like LinkedIn and Tumblr and Tesco, you know, who've had their password, you know, hashes leaked. And they're cracked within days, you know, typically those when that happens. Now, I reckon I've got, I reckon I've got, according to You've Been Pwned, my password's been leaked or hashes associated with my passwords have been leaked eight times over the last 10 years. So that means that, you know, if I've got, and I reckon from my Google sort of password manager, I've got about 200 online accounts. So that suggests that about, you know, there's probably about each of my accounts has about a half a percent chance of being compromised in any given year. So, you know, you're looking at roughly one a year. Now, if I use the same password for all of my staff, then all of those accounts would be more or less 100% chance of being cracked every year. Hmm. So it's not uncommon, people should assume it happens. And so, yeah.

Speaker B: 00:16:00

And yeah, I'll just shout out again, Have I Been Pwned? Brilliant service. It's really, really good. It's definitely something you should-

Speaker A: 00:16:06

What's it called again? Have I Been Pwned?

Speaker B: 00:16:08

Don't worry, Fraser, we'll put a link in the show notes. Hold on, there's an urgency to this. I want to know now. So yeah, and it's the people who run that, they pull hashes and all sorts of things from various nefarious places to facilitate the service. And it's often integrated and services like are integrated with password managers. So password manager will automatically check the strength of your passwords for you and tell you if you've been compromised. That's another advantage of using a password manager is that you don't have to manually check your passwords. It will tell you if you need to change it.

Speaker A: 00:16:45

But what I want to talk about is, are passwords the best system? Are there other ways of doing this? Something that's happening more and more is authentication verification. And I guess even things like physical recognition, like iris and fingerprints and things like that. Anna, can you talk to that? Anything to say on those sort of things? I mean, will there come a time where we don't have passwords anymore because we just rely on other things? Or I guess the authentication thing as well?

Speaker C: 00:17:10

I think it seems to be going more that way. I mean, now when you go on to Google Gmail, you're already prompted by using an additional passcode, a one-time password on your phone. And those types of systems where you have multiple entity authentication across devices. So if you're trying to access your email from your desktop machine, and you're prompted with the password for access by your phone, you have that sort of additional security. And I think moving forward, it will become more commonplace. And I do see that in terms of potentially more biometric style technology, probably moving, maybe moving more away from fingerprint scanning, but maybe more facial recognition.

Speaker A: 00:17:59

Why moving away from fingerprint recognition?

Speaker C: 00:18:02

Just as a suggestion. I think it could be more marketable, I guess.

Speaker D: 00:18:08

Instead of branching out from, I guess, rather than moving away from.

Speaker C: 00:18:12

Yeah, yeah, exactly.

Speaker B: 00:18:13

Yeah, there are inherent weaknesses, problems with biometrics, it might be worth mentioning at this point. So depending on how it's done, of course, likewise, with passwords, you don't actually transmit the image of the fingerprint or the iris scan or whatever it is, it's important to make sure you pass that through some sort of algorithm and only keep locally, i.e. on the user's device, the image. But biometrics particular problem, fingerprint, for example, once compromised, it can't be changed. It's not like a password, which could be changed. Your fingerprint is, you know, with you for life. And you've only got 10 fingers, so you're going to run out pretty quick if they keep getting compromised and chopping them off. It really isn't a palatable solution. So yeah, the use of biometrics should be very carefully considered when you're designing any kind of authentication solution. It's really for convenience and for reasonably low assurance kind of authentication of the person and really only should be used as

Speaker A: 00:19:08

one of many factors. Yeah, okay. I want to talk about bad passwords and bad habits and that kind of thing. Sometimes something, you know, I don't want to give too much away, but I think foreign languages can be useful in passwords and stuff like that. Anyone got any thoughts on that side

Speaker B: 00:19:25

of things? Yeah, so Fraser, if your password comprises of just like one word, no matter which language it is, that is very susceptible to a dictionary attack. So even if it's an obscure language, the hash of that using various algorithms will be in some dictionary somewhere. So don't think Portuguese is quite an obscure language. I'll just use a Portuguese word for hello as my password. That just won't work, I'm afraid. Okay. Anna, any thoughts on this?

Speaker C: 00:19:54

Yeah, there was an interesting study by safety detectives. They're a group of experts that sort of build knowledge bases on antivirus and VPN tools. And they did a study on, I think 9 million passwords or hashes of passwords. And they identified that there are quite a lot of sort of behavioral traits that are similar in different countries. And I think it was an interesting, particularly interesting because they assessed passwords from non-English speaking countries. And more often than not, there tends to be a bias in security research only focusing on sort of English speaking countries. And even though non-English speaking users are just as likely to be targeted or a victim of cybercrime. And actually what they identified was like bad passwords were common in most other languages. So passwords, for instance, in French is also high upon the list. And that she said common words or phrases associated to that country was quite prevalent. So things in French was related to food and in Spain, it was related to places. Yeah, it's a really interesting list. And I suggest, I suggest reading it. I think it was chocolat, I'm not sure. Okay. And in Italy, first names were quite popular or common, most common passwords. And I thought that the most fascinating thing was keyboard patterns. So obviously, one, two, three, four, five, six being an obvious one or QWERTY. There were variations of QWERTY in different countries. So the German keyboard system, the Y is replaced with a Z. In the French, I think Q is replaced with an A. And one quite interesting thing is that it's the same in different countries. So Russia was the most, was the one country that used the most keyboard pattern passwords. So using one, Q, two, W, three, E, etc. And it's the same also in the US. So I think they were both on the same sort of common, common. So in the hierarchy of their list, they were on the same kind of...

Speaker B: 00:22:20

I think Anna is going to get a general sort of useful piece of advice there, which is if you think you found some really clever way of using a keyboard layout to generate password, don't do it. Because if you thought of it, somebody smarter than you probably already has.

Speaker D: 00:22:34

n numbers in his data set are: 1234

Speaker A: 00:23:49

pin number. Why is: 2580

Speaker D: 00:23:56

Exactly. It's just what Anna was saying is that you go straight down the middle on a phone phone number pad. So yeah, same thing. All you've got to do is pick one which isn't isn't there pick one pick one, you know, which is I mean, you know, four random digits, you really cannot beat that

Speaker A: 00:24:15

there's no excuse for not having four random digits. I think before we finish off, I think the reason why is partly because most people, let's say, I think, are probably quite honest. And they don't quite imagine the depth and breadth of people out there to get them. Right. And so I think that's partly it. And they think, Oh, this will be fine. And they don't quite understand how quite how much activity there is out there, trying to get their pin numbers, etc. I think that's partly it. But also, it's partly the convenience thing. And people just want to remember stuff, right. And they don't want to sort of, I think those are the two reasons why. And those two factors play into the hands of, you know, of nefarious people. Yeah, let's finish this off. We were started talking about there's some sort of bad passwords. Has anyone got anything on this?

Speaker B: 00:25:00

n. So what top of the list is: 123456

Speaker A: 00:25:53

Okay. Yeah, yeah. Pass that. That's what I shall take away from this. Incidentally, I don't know if I'm giving too much away here. But I mean, weirdly at my work, at my regular work, I sit within an IT department, which, which is odd, because I never have anything to do with IT. But that means I have access to a lot of systems which IT people have generated the passwords. And every single bloody password is some reference to Star Wars. So I think, you know, there's a nice hint there for all the hackers out there, if they're trying to get into anything that's been generated by an IT person. Anything to say anyone before I wrap up? That's a very public way of exposing your company's cyber risk to try and get it fixed, Fraser. Fortunately, I was very clever in not giving away the company and no one can ever know what that might be.

Speaker B: 00:26:40

Oh, yeah, I'm sure that schooling your name will bring up anything.

Speaker A: 00:26:46

Okay, let's stop there. Thank you, as always, for listening to the Cognitive Engineering podcast. I'm Fraser McGruer. I've been here with Peter Coghill, Anna Pearson, Nick Hare of Aleph Insights. Until next time, goodbye.