Cyber Security: Passwords – what are they for?

Millions of people use online services every day, and it is crucial that these systems prevent users from accessing each other’s information. To do this, they need a way of uniquely identifying each user in a way that prevents users from impersonating each other. This is called identification and authentication.

Passwords and passcodes are the most common way of authenticating users. Examples of their use includes the PIN (Personal Identifier Number) you use with your debit and credit card as well as the many passwords you are expected to remember when logging in to computer-based services.

An ideal password must satisfy two conflicting aims. It should be:

• memorable enough that the user can recall it without writing it down
• long enough and unique enough that no one else can guess it.

As you’ve almost certainly found out, remembering passwords is hard and it can be even harder to think of one that is secure. For these reasons many services are thinking about replacing passwords.

What happens when you enter a password?
When a user enters a password it is matched against the password stored by that website. If the passwords match, the user is granted access.

There are a couple of potential weaknesses with this approach that you can probably recognise:

• The password is transmitted as plaintext (what you see is exactly what you get; it isn’t hidden in any way) – it could be intercepted as it travels across the network.
• The password is stored as plaintext – an attack on the server could not only reveal the user’s password, but all the passwords for all the users of the system.

The first problem is usually overcome by encrypting the communication between the user and the server. The most common form of encryption is the SSL standard (Secure Socket Layer). You’ll recognise that SSL is being used when you see ‘https’ at the beginning of a web page address instead of ‘http’, and by a padlock symbol in your browser.

The second problem can also be solved using a technique called hashing. A hash is the result of processing plaintext to create a unique, fixed length identifier. It cannot be used to reconstruct the original data – even if the hash falls into hostile hands. In this scheme, a hashing function is used to create a hash of a password, which is stored on the server – the password itself is discarded. When the user enters a password, this is sent over the network and hashed on the server using a copy of the same hashing function. The resulting hash is compared to the hash stored on the password server. Only if they match will the user be granted access. Some implementations of this scheme will hash the user’s password before sending it across the network to be compared with the hash stored on the server.

Almost all online services and computer systems store passwords as hashes – but surprisingly, errors still happen. The problems described in the following case study could have been avoided if hashing had been used.

 

Case study: RockYou
The game and advertising company RockYou suffered a major security breach in 2009 when 32 million user accounts were compromised, revealing that not only did the company store passwords in plaintext, it encouraged insecure passwords by only requiring them to be five alphanumeric characters long.

RockYou’s problems were made worse when it became clear that they had known that their database was vulnerable to an attack for more than ten years. The company had previously been criticised on privacy grounds for sending emails containing complete lists of their advertising partners, and for poor security in issuing passwords through insecure email.

Even when hashing and encrypted communications are used, there are still ways in which attackers can successfully learn your password.

https://www.futurelearn.com/courses/introduction-to-cyber-security/8/steps/83045