'Andyhave3cats' is a better password than 'Shehave3cats,' study finds
Carnegie Mellon University researchers find that certain grammar use can make passwords easy to crack, no matter the length or use of numbers, symbols
Computerworld - Using a long phrase or a short sentence as a password may not be as secure as some security experts think.
Researchers at Carnegie Mellon University's Institute for Software Research have found that long passwords that incorporate grammar -- good or bad -- are easier to crack than short passwords without structure.
The research team tested more than 1,400 passwords containing 16 or more characters against a grammar-aware password-cracking algorithm and found that grammatical structure can undermine security.
Ashwini Rao, a Carnegie Mellon software engineering doctoral student and the lead researcher on the project, said that while phrases and sentences can make passwords easier to remember, their grammatical structure significantly narrows the possible word combinations and sequences that hackers -- and their tools -- need to guess.
"We should not blindly rely on the number of words or characters in a password as a measure of its security," said Rao who is scheduled to present the findings of the study on Feb. 20 at the Association for Computing Machinery's Conference on Data and Application Security.
"I've seen password policies that say, 'Use five words,'" Rao said in a statement. "If four of those words are pronouns, they don't add much security."
The passwords used in the study were gleaned from a previously published research paper on password strengths that was presented at an IEEE security conference last year.
About 18% of the passwords had defined grammatical structures in a sequence of two or more dictionary words, Rao said.
Some of the passwords were simple, some contained letter substitutions (such as a "3" for "e") while others tacked on an extra symbol or number. Examples include "abiggerbetterpassword," "thereisnomorered0ts" and "longestpasswordever8."
Several of the passwords also contained other types of structures, such as email addresses, URLs and postal addresses.
The research team developed what it described as a proof-of-concept grammar-aware password-cracking tool to test how long it would take to crack such passwords. The tool used a dictionary for each part of speech and identified a set of grammatical sequences such as "determiner-adjective-noun" that might be used to create a password.
The research team discovered that the strength of a password often has little to do with its length. In fact, the team found that two passwords of identical lengths can differ in strength by orders of magnitude depending on the use grammar.
According to the researchers, the tool evaluates different parts of speech are be used to construct a grammatically correct sentence or phrase.
For instance, pronouns are used less than verbs, which are used less than adjectives which are in turn used less than nouns, the researchers noted in the paper. So a passphrase like "Andyhave3cats" will always be stronger than "Shehave3cats", because the use of a pronoun in the latter passphrase allows it to be broken with a fewer number of guesses, the team noted.
- Researcher claims two hacker gangs exploiting unpatched IE bug
- Update: Third of Internet Explorer users at risk from attacks
- Microsoft plans another short patch slate for next week, but finds a few XP bugs to crush
- Target attack shows danger of remotely accessible HVAC systems
- Target hackers try new ways to use stolen card data
- Update: Microsoft to patch just-revealed Windows zero-day tomorrow
- NSA spying prompts open TrueCrypt encryption software audit to go viral
- Microsoft warns of Office zero-day, active hacker exploits
- Hackers move to create next Blackhole after 'Paunch' arrest
- Adobe hack shows subscription software vendors lucrative targets
- Silicon Valley's 19 Coolest Places to Work
- Is Windows 8 Development Worth the Trouble?
- 8 Books Every IT Leader Should Read This Year
- 10 Hot Hadoop Startups to Watch
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Neustar 2014 DDoS Attacks and Impact Report For the third consecutive year, Neustar surveyed hundreds of companies on distributed denial of service (DDoS) attacks. The survey reveals evidence that the...
- Acxiom Case Study This case study, which focuses on Acxiom, explores how the company was able to secure employee data, reduce migration costs and boost productivity...
- Windows® XP Migration: Protect and Secure Critical Data With the end of the Microsoft Windows XP operating system's lifecycle on April 8, 2014, businesses are faced with the decision to migrate...
- Enhancing Application Protection and Recovery with a Modern Approach to Snapshot Management This CommVault Business Value and Technology White Paper explains how Simpana IntelliSnap® Recovery Manager can make your application recovery fast and reliable.
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts