Taking in mind that being a a deterministic machine a today computer is incapable of producing random sequences and all computer-generated "random" sequences are pseudo-random actually, aren't computer-generated random passwords insecure? Isn't it more secure to just press keys randomly to create a random password than to use a digital generation algorithm?
Tell me more
×
Server Fault is a question and answer site for
professional system and network administrators. It's 100% free, no registration required.
|
|
Humans typically do a very poor job at generating randomness. It is possible to get truly random numbers for computer generating passwords. One way would be to setup your computer to seed itself from random.org which generates numbers by monitoring atmospheric noise. A computer mostly like does as good or a better job then the typical person who probably doesn't care too much about how much randomness their password has. These days passwords are really not that useful anyway. If you do a search you can fine several security professionals arguing that people are going overboard on their expectations about passwords. I think you'll find that it is becoming far more common for passwords to be acquired by phishing, keyboard loggers, and other types of attacks where the password length and level of randomness is completely irrelevant. Any well designed system will prevent an intruder from running any kind of dictionary attack remotely by using lockouts and rate-limiting authentication attempts. The secret hashes will be pretty well protected against interception. Of course this like all things security related depends on the amount of risk. For a low value system with reasonable safe-guards computer generated passwords are almost certainly fine. If you are responsible for security of the codes for the nuclear weapons you probably will want to spend a bit more effort on coming up with good passwords.
I am sorry, but secure never has and probably never will be binary. Nothing will every be in a state of 100% secure or not. Correctly generated passwords in many cases will be far more secure then the alternatives. |
|||||||
|
|
Your argument has a couple of premises: Given: Good passwords are completely random IF deterministic THEN not random Therefore: Generated passwords are not good. QED. Your premise that good passwords are completely random is incorrect. Experience has shown that good passwords have a number of traits. Good passwords have to resist certain kinds of attacks, only one of which is password guessing. 50+ years of experience with passwords has shown that good passwords have a number of traits:
The (welcome) death of the 8-character limit on passwords has opened up a whole new universe of good password possibilities. It has also divided what counts as a good password. A good password on Solaris: 1ŤŁÃb$R= The first has very high entropy out to eight characters. The second has laughable entropy out to 16 characters, but passable entropy after that. The second would be an insane password for Solaris since it would be truncated after the 8th character, where the first would be lamentable on Windows if that password hash ever got discovered (sniffed in flight, sucked down from a domain controller, that kind of thing) thanks to Rainbow Tables. (I had a blog post about this a while back that goes into more detail about this issue in the context of cross-platform password policies. Link) Therefore a good password has high entropy AND length. When you can't use length (that 8 character limit again) you're stuck with high entropy. When you have very large length (512 characters!) the password can include significantly less entropy for the same attack resistance. To whit, good passwords can be completely random. Not must be. As for your second point, about a deterministic machine's inability to produce random output. A deterministic machine using a random input can produce output containing zero to the amount of entropy it got as input, but not introduce any new entropy. In this way a password generator using 2 bytes of entropy from /dev/random (not /dev/urandom) can produce a 40-character password of high apparent randomness. Of course, if those two bytes and the algorithm used to generate passwords are known to the attacker the actual password can be derived. The algorithm is easier to find out than the actual random bytes used to seed the algorithm. They're well published, since high quality pseudo-randomness is a valuable thing for everyone. That means that attackers have to try (in this case) every possible 2-byte combination for every permissible length. (See also: Rainbow Tables) To whit, Passwords generated by a deterministic machine can have high randomness. And finally, what makes machine-generated passwords bad is not their ability to be derived post-facto, it is that third bullet point I made about what makes a good password: able to be memorized. Machine-generated passwords, especially long ones, can be VERY hard to memorize which will in turn lead to them being written down somewhere insecure. Or quickly changed to something else with less length/entropy strength. |
|||||
|
No. For a given length of password, one that is generated randomly from the full possible symbol set will be significantly more secure than just pressing keys randomly. |
|||
|
|
In practice, it could be, although while pressing keys randomly the chances of you holding shift to make some symbols is unlikely :) For pseudo-random passwords, it all depends on how you're generating them. There is a myriad of sources you can use as input into an algorithm, and many algorithms to utilize. The things that would make a long, randomly-generated password weak is disclosing:
essentially it is a 2-piece puzzle that just takes a while to complete. If they have the details it's just a matter of time before it's cracked. Speaking of time, it's one of the most common seeds used in pseudo-random generation. If there's one tip I can give you to keep a secure password, computer generated or not, it would be to use a very long password which will take a long time to crack. Also, don't use any tools online to generate passwords. In 1 simple line of code, the people hosting the generator can insert the generated passwords into a database. |
|||
|
|
You said it, it depends on how "random" the passwords are. A computer-generated password program that looks like this: isn't going to be very good. The downside of "pressing randomly" is that your ratio of "special" characters (!@#$%^<> etc) is going to be low, as you're unlikely to be pressing the shift key at the same time you strike `-0 or any of the other non-alpha keys. |
|||||
|
|
I will pay you 200 US$ for cracking my Now, seriously, a hacker might probably find a randomly generated password if:
So I have some doubts that every hacker can do it. Now, the most obvious way used to crack passwords is brute force. If a target typed her password "randomly" on his keyboard, then the password has strong chances to match a pattern: for example, if the first letter the person typed is on the left side of a keyboard, the second one will probably be on the right side or be a number or a symbol. It would be interesting to test it asking people to type a "random" thing using only four digits. My expectation is that, first, the typed numbers will not be random at all, and that some will be much more frequent than other ones (for example, if we are asked to type something "random", we will never type "1234" or "7458" or "3197" or "5555"). Since both machine-generated and human-typed passwords leak some randomness, IMHO the best thing would be to combine both. For example, the password will be generated from a user input, or combined with it. By the way, some sort of such implementation is a salt (for example where a password of a user submitted on a website is combined to a randomly generated set of symbols before calculating and storing a hash: in this case, if two users have the same password, the hash will still be different). |
|||||||||||
|
