Off the Beat: Bruce Byfield's Blog

The cracking of at least six million passwords from LinkedIn this week (http://www.bbc.co.uk/news/technology-18338956) had me scrambling to change my own password. It also has me considering whether LinkedIn is a social media site I could do without. But mainly, it has me thinking how predictable -- and, in many ways, how useless -- the response has been.

The problem is not that LinkedIn hasn't handled the situation well by the usual standards. The company responded quickly, and posted blogs telling users what was happening, what would happen, and how to set a strong a password (http://blog.linkedin.com/2012/06/06/updating-your-password-on-linkedin-and-other-account-security-best-practices/).

Probably, most users are unaware of the blog, but that wasn't the real problem. The problem was that the blog dished out the usual advice -- things like make your password a mixture of characters, don't write it down, don't use the same password for every site, and change it every few months.

All this is sound advice, in keeping with the best security practices. Unfortunately, though, most users are going to ignore some or all of the points. Security requires care and thought, and the majority of users are going to choose short-term convenience or care and thought every time.

Unclear on the concept
If you have any doubts, consider the surveys of the leaked password. All the passwords that security experts tell you not to use, such as "qwerty," "password," and "123456" are among those that were cracked. Others, such as "linkedinpassword" and "ihatemyjob" would be easy to guess in the context of the LinkedIn site (http://www.geek.com/articles/news/linkedin-passwords-cracked-here-are-the-worst-2012067/#).

What these passwords suggest to me is that many users are unaware of what a password is for. At the most, they must see passwords as simply a way to make sure they open their own data. The idea that the password might protect their data doesn't seem to have occurred to them, or they would pay more attention to choosing a good one. If they are aware of security, then I suspect that they have concluded that the chances of anyone wanting to crack their accounts is so remote that they can ignore it.

Either way, many people seem to act like the Facebook users who chatter away about their private concerns, unaware that anyone who comes along can read what they are saying -- an attitude so prevalent that, charges were brought against a number of participants in last year's Stanley Cup riots in Vancouver based on their boasting online.

Mind you, I can't say I'm surprised. When friends and neighbors ask me for computer help, I almost never find them using passwords. If I add even a simple one -- let alone a strong one -- invariably, I find it's been removed the next time I help out. Apparently, it's not inconvenient to haul computers into the shops to get viruses and trojans removed every six months or so, but it's unacceptably inconvenient to spend ten seconds entering a password. Very likely, the only reason their wireless routers have passwords is because the setup programs insist on one these days.

This attitude is hardly unique. A few years ago, a small business was even offering notebooks for recording your passwords (http://web.archive.org/web/20080516004343/http://www.analogonbook.com/). The site emphasized the convenience of these notebooks compared to writing your passwords on scraps of paper. It also suggested that the notebook was more secure than storing passwords online, although to be any use, the notebook would presumably be left close to a computer.

But, for me, the strongest indication of how the average user regards passwords was a survey done in 2004 on the London subway. A man offered a chocolate bar in return for the office passwords of passersby -- and seventy percent made the exchange (http://www.nytimes.com/2004/04/25/weekinreview/ideas-trends-your-password-please-pssst-computer-users-want-some-candy.html?_r=1).

When the study was repeated three years later, the number who gave their password was sixty-four percent (http://www.theregister.co.uk/2007/04/17/chocolate_password_survey/). The number was only twenty-two percent at an IT conference, but when asked if the password was something like the name of their pet and engaged in conversation, another forty-two percent eventually revealed their passwords indirectly.

The list of weak LinkedIn passwords suggests that nothing has changed. Despite the efforts of security experts, many people still fail to understand why passwords matter and why they should choose a strong one.

In my experience, when taxed with not using a strong password,  most users will give an embarrassed grin then go right on using a weak one -- assuming they use one at all.

Realistic security
Under these circumstances, no wonder alternatives like fingerprints or picture passwords (http://blogs.msdn.com/b/b8/archive/2011/12/16/signing-in-with-a-picture-password.aspx) are being considered. However, fingerprint authentication has failed to catch on, and I suspect that picture passwords will be too easy to crack. At any rate, for better or worse, conventional passwords are likely to predominate for some years to come.

So, what, if anything can be done to improve how passwords are used? The pessimist in me says very little. You can enforce strong passwords with packages that disallow weak ones, but that only means that users are more likely to write their passwords down. Close one security problem and another pops up to replace it.

However, I suspect that security experts may have been too uncompromising in their efforts to educate the average user. Instead of telling people not to use the same password on every site, maybe they should advocate setting up a list of four to six words that can be recombined to produce different passwords while still being easy to remember. Instead of repeating the characteristics of a strong password, maybe they should advocate using the initial letters of a line from a favorite song. Add a few numbers and special characters, and the result would be a strong password that users would actually remember.

Even if the result was not as strong as it could be, it would probably be good enough for average users -- besides having the added advantage that they might actually use it.

The point is, we know that security will never be as important to the average user as convenience. Perhaps it's time to stop delivering lectures that are going to be ignored and start developing on ones that have some chance of being listened to. The result might not be ideal security, but it could be considerably better than what we have now.

Comments