* Reader weighs in on password management
Reader Andreas Englisch from Munich wrote to me with some interesting suggestions about improving password management.
By the way, readers are welcome to write to me in German and French as well as English; and with the help of my translation program I can also manage to muddle through Spanish, Italian and Portuguese.
With his kind permission, here are some of his comments, followed by my response.
* * *
If you force passwords to expire after a fixed interval, people tend to define passwords containing a number. When their passwords expire, they simply increase that number by one; e.g., password1, password2, password3, etc.
Most systems prevent reuse of a password for a set period. For example, the last 15 passwords are saved and may not be re-used. This password-numbering habit prevents a new password from being rejected by the system, but if anybody gets hold of such a password by shoulder surfing, dumpster diving, finding the sticky note under the keyboard and so on, it is not going to be very difficult to find the next password in the series.
Moreover, I do not like password expiry by fixed intervals from another perspective: It treats all passwords the same, no matter how “good” (i.e., complex) they are. But would it not be better to set the password expiry interval as a function of password complexity? For example, if I use a really complex string of alphanumerical characters, I would have to change my password much less frequently than if I chose a more guessable password. This strategy would encourage people to use and remember better passwords than they currently use; in addition, they might stop using the same-old-password-1, same-old-password-2 approach to new passwords. Using this kind of approach, perhaps a bad password would have to be replaced after 30 days but a good one after 90 days and a really tough one after 180 days.
* * *
Dear Herr Englisch,
Your analysis of passwords with numbers is correct: any password with a number in it suggests that the next one will have similar characteristics. Therefore, password-checking algorithms should compare new passwords against old ones not only by a simple lookup list but also by using wildcard matching algorithms to detect static passwords that change in only one number or character or which shift all characters by the same increment of the sort sequence (e.g., “alpha1” becomes “bmqib2” and then later “cnrjc3”) (and no, these are not my passwords!).
However, I worry a bit about long password lifetimes. It seems to me that the primary reason for forcing password changes is that passwords can be compromised by inadequate security practices, as you yourself pointed out.
The cryptographic strength seems to be a lesser vulnerability. For example, an eight-character password with uppercase and lowercase letters and numbers available could take months to crack, depending on processing power – see https://www2.norwich.edu/mkabay/methodology/keyspace.xls – but a single instance of shoulder-surfing could compromise it within a day of its being changed.
So perhaps the reward for more complex passwords can be tempered by concern over possible compromise; 30-60-90 days, for example?
In any case, I appreciate your taking the time to write and thank you for letting me quote you. Danke sehr!
