Good Passwords, Bad Passwords, and How to See the Difference David - PowerPoint PPT Presentation

Good Passwords, Bad Passwords, and How to See the Difference David Klaftenegger Department of Information Technology Uppsala University, Sweden 20. January 2020

Caveat Auditor Background Passwords this talk contains opinions Diceware Questions my opinions Overture not the university’s nor do I claim to be an expert ... so expect some imprecision and errors 20 Jan 2020 Passwords @ Cryptoparty - 2 - David K

What’s the problem? Why use passwords? Background Passwords Diceware Questions Overture 20 Jan 2020 Passwords @ Cryptoparty - 3 - David K

What’s the problem? Why use passwords? protect accounts Background Passwords Diceware Questions Overture 20 Jan 2020 Passwords @ Cryptoparty - 3 - David K

What’s the problem? Why use passwords? protect accounts (so that I can’t use them) Background Passwords Diceware Questions Overture 20 Jan 2020 Passwords @ Cryptoparty - 3 - David K

What’s the problem? Why use passwords? protect accounts (so that I can’t use them) Background protect against Passwords • your ex? Diceware • your coworkers? Questions • police? Overture • nation state attackers? 20 Jan 2020 Passwords @ Cryptoparty - 3 - David K

What’s the problem? Background Passwords Diceware Questions Overture https://www.xkcd.com/538/ https://creativecommons.org/licenses/by-nc/2.5/ 20 Jan 2020 Passwords @ Cryptoparty - 3 - David K

What’s the problem? Why use passwords? protect accounts (so that I can’t use them) Background protect against Passwords • your ex? Diceware • your coworkers? Questions • police? Overture • nation state attackers? This talk people who know you well computers guessing very quickly not: people willing to hurt you not: attackers with other access 20 Jan 2020 Passwords @ Cryptoparty - 3 - David K

Bad Passwords Only I myself know how the password is chosen! Background Passwords Diceware Questions Overture 20 Jan 2020 Passwords @ Cryptoparty - 4 - David K

Bad Passwords Only I myself know how the password is chosen! Background The town I live in Passwords My birthplace, a special character, and two numerals Diceware Questions "onetwothreefourfivesixseveneight" Overture "41229411121620514577518" 20 Jan 2020 Passwords @ Cryptoparty - 4 - David K

Bad Passwords Only I myself know how the password is chosen! Background The town I live in Passwords My birthplace, a special character, and two numerals Diceware Questions "onetwothreefourfivesixseveneight" Overture "41229411121620514577518" Security by obscurity 20 Jan 2020 Passwords @ Cryptoparty - 4 - David K

Bad Passwords Only I myself know how the password is chosen! Background The town I live in Passwords My birthplace, a special character, and two numerals Diceware Questions "onetwothreefourfivesixseveneight" Overture "41229411121620514577518" Security by obscurity When someone knows how you construct your password it is trivial to guess it Therefore the password should be chosen randomly 20 Jan 2020 Passwords @ Cryptoparty - 4 - David K

Choosing Passwords Background Passwords Diceware Questions How to choose good passwords? Overture (audience suggestions) 20 Jan 2020 Passwords @ Cryptoparty - 5 - David K

Choosing Passwords Background Passwords Diceware Questions Overture https://www.xkcd.com/936/ https://creativecommons.org/licenses/by-nc/2.5/ 20 Jan 2020 Passwords @ Cryptoparty - 5 - David K

Good Passwords Background Gold Standard Passwords I tell you exactly how I choose my password Diceware Questions You still cannot guess it before we’re all dead Overture 20 Jan 2020 Passwords @ Cryptoparty - 6 - David K

Good Passwords Background Gold Standard Passwords I tell you exactly how I choose my password Diceware Questions You still cannot guess it before we’re all dead Overture Entropy means using randomness have a random number generator 20 Jan 2020 Passwords @ Cryptoparty - 6 - David K

Good Passwords Background Gold Standard Passwords I tell you exactly how I choose my password Diceware Questions You still cannot guess it before we’re all dead Overture Entropy means using randomness have a random number generator use it until you have a secure password 20 Jan 2020 Passwords @ Cryptoparty - 6 - David K

Good Passwords Background Passwords Diceware Questions Please bear with me it’s just an example Overture 1 20 Jan 2020 Passwords @ Cryptoparty - 7 - David K

Good Passwords Background Passwords Diceware Questions Please bear with me it’s just an example Overture 15 20 Jan 2020 Passwords @ Cryptoparty - 7 - David K

Good Passwords Background Passwords Diceware Questions Please bear with me it’s just an example Overture 151 20 Jan 2020 Passwords @ Cryptoparty - 7 - David K

Good Passwords Background Passwords Diceware Questions Please bear with me it’s just an example Overture 1512 20 Jan 2020 Passwords @ Cryptoparty - 7 - David K

Good Passwords Background Passwords Diceware Questions Please bear with me it’s just an example Overture 15124 20 Jan 2020 Passwords @ Cryptoparty - 7 - David K

Good Passwords Background Passwords Diceware Questions Please bear with me it’s just an example Overture 151245 20 Jan 2020 Passwords @ Cryptoparty - 7 - David K

Good Passwords Background Passwords Diceware Questions Please bear with me it’s just an example Overture 1512452 20 Jan 2020 Passwords @ Cryptoparty - 7 - David K

Good Passwords Background Passwords Diceware Questions Please bear with me it’s just an example Overture 15124524 20 Jan 2020 Passwords @ Cryptoparty - 7 - David K

Good Passwords Background Passwords Diceware Questions Please bear with me it’s just an example Overture 151245241 20 Jan 2020 Passwords @ Cryptoparty - 7 - David K

Good Passwords Background Passwords Diceware Questions Please bear with me it’s just an example Overture 1512452415 20 Jan 2020 Passwords @ Cryptoparty - 7 - David K

Good Passwords Background Passwords Diceware Questions Please bear with me it’s just an example Overture 1512452415263112214316331622221641 20 Jan 2020 Passwords @ Cryptoparty - 7 - David K

Remembering Passwords Background Now we have a good password Passwords can’t remember that many numbers in order Diceware slow to type Questions Overture 20 Jan 2020 Passwords @ Cryptoparty - 8 - David K

Remembering Passwords Background Now we have a good password Passwords can’t remember that many numbers in order Diceware slow to type Questions Overture Diceware transform numbers into words much easier to remember still equally hard to guess 20 Jan 2020 Passwords @ Cryptoparty - 8 - David K

Diceware Process roll die five times Background write down results (in order) Passwords look up word in wordlist Diceware repeat until desired number of words Questions Overture 20 Jan 2020 Passwords @ Cryptoparty - 9 - David K

Diceware Process roll die five times Background write down results (in order) Passwords look up word in wordlist Diceware repeat until desired number of words Questions Overture Example 15124 52415 20 Jan 2020 Passwords @ Cryptoparty - 9 - David K

Diceware Process roll die five times Background write down results (in order) Passwords look up word in wordlist Diceware repeat until desired number of words Questions Overture Example 15124 52415 carrot rotunda 20 Jan 2020 Passwords @ Cryptoparty - 9 - David K

Diceware Process roll die five times Background write down results (in order) Passwords look up word in wordlist Diceware repeat until desired number of words Questions Overture Example 15124 52415 carrot rotunda 21146 11646 13351 56154 20 Jan 2020 Passwords @ Cryptoparty - 9 - David K

Diceware Process roll die five times Background write down results (in order) Passwords look up word in wordlist Diceware repeat until desired number of words Questions Overture Example 15124 52415 carrot rotunda 21146 11646 13351 56154 correct animal battery staple 20 Jan 2020 Passwords @ Cryptoparty - 9 - David K

Diceware Process roll die five times Background write down results (in order) Passwords look up word in wordlist Diceware repeat until desired number of words Questions Overture Example 15124 52415 carrot rotunda 21146 11646 13351 56154 correct animal battery staple 11512 45241 52631 12214 31633 16222 21641 20 Jan 2020 Passwords @ Cryptoparty - 9 - David K

Diceware Process roll die five times Background write down results (in order) Passwords look up word in wordlist Diceware repeat until desired number of words Questions Overture Example 15124 52415 carrot rotunda 21146 11646 13351 56154 correct animal battery staple 11512 45241 52631 12214 31633 16222 21641 ambiguity premium sampling apostle gallstone clumsily cursor 20 Jan 2020 Passwords @ Cryptoparty - 9 - David K

Diceware How secure is it? Background Passwords Diceware Questions Overture 20 Jan 2020 Passwords @ Cryptoparty - 10 - David K