AOL Password Warning: Time to Change Your Password?

I try to avoid posting what everyone else is posting, but this case is special. Due to the number of AOL users I'm going to post this brief message and link to the original post.

Brian Krebs posted AOL's Password Puzzler on his Security Fix Blog yesterday May 5th. In short even though AOL allows passwords up to 16 characters it *only* uses the first 8 characters. I'll be the first to admit that there are other systems that have an 8 character limit, but these are well known and documented. *Not hidden away*!

As Brian points out in his post people have a habit of using their names as their password, but may add some extra characters on the end such as:

• tomsmith1
• tomsmith#1
• tomsmithGr81

Simply typing in tomsmith will work without a complaint.

Even with a more complex password it is considerably less time consuming to break an 8 character password than a 16 character one. As far as I know all, non dictionary, brute force implementations of password crackers sequentially add characters to their attempts. In other words trying to break an password that is 2-16 characters will first try all 2 character combinations then move on to 3 characters...

AOL is a big company and a fix for this will take time. Even if AOL could change it tomorrow how many people would be locked out of their account? Consider anyone with a password longer than 8 characters trying to login would fail since only 8 characters are stored... I suspect the fix will be a new implementation of the password back-end and a new front-end to migrate users to the new infrastructure, but only time will tell.

UPDATE: In case anyone is looking for information on good password generation/selection or password tools I did a couple of previous posts on these: Anatomy of a Password and Password Tools. All of my posts on passwords, including this one. are here.

Hot Cocoa

Based on my recent blog entry on insecure endpoints "https is all I need, right?" (http://sec-soapbox.blogspot.com/2007/03/https-is-all-i-need-right.html)Joe of 2 Guys Named Joe (http://www.2gnj.com) wants to know how to determine if he is secure and if his information is already out there.

First my warning the Cocoa is very hot be careful that you do not burn your tongue. In other words there is no silver bullet in security. My second warning is that since I have covered some of this previously I will reference any previously written blogs entries rather than reproduce them.

Balancing Act

One of the points to understand is that security is a process not a goal. If it was a goal then when your village/town/city was established the police would show up and secure it. Then the police would leave and there would never be any crime. I don't think anyone would subscribe to that option.

On the other hand we can't have a police officer assigned to every person and building to provide 100% security and protection. But some institutions hire guards to protect valuable assets.

In computer security it is much the same. Too much security prevents people from getting anything done and will cause people to circumvent it (the sticky note on the monitor for the assigned password). There must be a balance between security and ease of use. Additionally there must be a balance between value of an asset and cost to protect the asset.

See Risk Options (http://sec-soapbox.blogspot.com/2007/03/risk-options.html) for additional details.

The Basic Goal

The best you can do is make sure you are not the easiest target. In short unless there is a reason to target you the dark side will tend to go after the "low hanging fruit." If a burglar is walking down the street looking for a house to burglarize they will tend to avoid the ones with a alarm in favor of one that doesn't.

See Predators and their Prey (http://sec-soapbox.blogspot.com/2007/01/predators-and-their-prey.html) for an old security joke and more details.

Passwords

Everyone hates passwords, but at the moment they are the a fact of life. Everyone has to have passwords, and too many people use simple easy to break passwords.

I subscribe to the use a very long complex password to protect your password data base. See Anatomy of a Password (http://sec-soapbox.blogspot.com/2007/01/anatomy-of-password.html) for more information on complex usable passwords.

I personally use Password Safe (http://passwordsafe.sourceforge.net/), but it is not the only option. See Password Tools (http://sec-soapbox.blogspot.com/2007/01/password-tools.html) for more information.

More to come

This is a complex topic and I will flesh it out with additional blog entries.

Anatomy of a Password

With my recent post concerning password tools it seemed like a good idea to discuss passwords and what makes a reasonable password. I wont get overly technical or as in depth as Perfect Passwords (http://www.syngress.com/catalog/?pid=3420) which is full of good advice for the average user and administrator.

The Good, Bad and Ugly

Good: Secure passwords are long and complex making it difficult anyone else to use your ID and password.

Bad: The hardest to type and remember are the long and complex passwords.

Ugly: Always forgetting those good passwords, using a sticky note to post the passwords on your monitor, using simple insecure passwords, etc.


The Balancing Act

Personally I use Password Safe (http://passwordsafe.sourceforge.net) which I blogged about here. Even then a good password should be used to protect all your stored passwords. as an example password and abc123 are not good passwords.

The best passwords are long easily remembered and use upper and lower case letters, numbers and symbols (including spaces). I usually take a phrase, misspell some of the words, use capital letters in odd places and add unusual punctuation. As an example (and don't use this):

DoC+doktor w3re gona kr4sh#

Butchered from the following phrase:

doctor doctor we are going to crash

Password Tools

Passwords are the bane of security. Users hate them. Technical support spends too much time with password problems. Other options cost too much up front imagine spending thousands of dollars to setup a solution that costs an additional $100 or more for each user.

Different systems have different requirements for user IDs and passwords. Password expire at different times.

Some site use pre-defined questions and answers for password "recovery." Others require you to use your e-mail address to verify your identity.

Many people use a standard ID and password for multiple sites. Then there are those sites that won't work with the "standard." So a variant is used, but how many variants can be remembered?

What to do... write down IDs and passwords? Then you have to remember to change your paperwork when the password changes.... and how well does that work for most people.? Then there is the lost paper syndrome. There is no know recovery method for a lost password list.

Now let's look at standard IDs and passwords. With all the site hacked and compromised. It only takes one site to that is compromised to give the "keys to your kingdom" away. Imagine some minor site gets hacked and now your keys (standard ID, password, and e-mail address) are now public domain. It is a small step to access your e-mail. Monitoring e-mail reveals things like your bank...

What most people need is a secure password repository. A password repository needs to have a long complex master password. The master password is used to unencrypt the stored passwords and IDs. The repository should generate random passwords for use on sites. The repository has to allow automated use of the ID and password (it should not force a user to read and retype the password).

Password Safe

One option is Password Safe (http://passwordsafe.sourceforge.net). Password Safe is an open source windows application originally developed by Bruce Schneier's Counterpane Labs (http://www.counterpane.com/).

On the technical side Password Safe uses Twofish and SHA-256 for encryption since version 2.0. The original database used Blowfish and SHA-1. Since it is open source there are versions for other operating systems, but be careful about the data base encryption for compatablilty. Password Gorilla (http://www.fpx.de/fp/Software/Gorilla/) is a Tcl/TK version that will work with Windows, Mac and Linux, and uses the newer encryption (twofish and SHA-256).

On the usability side installation can install it on a thumb drive saving the settings to an ini file or on a hard drive using the registry. Password Safe can run on login. Either prompting for the master password or minimizing as a icon on the taskbar. A tree structure can be used for organization. Right clicking on an item provides several options including:

• Open the website


• Autotype the ID and password


• Edit the entry


• And more...

When editing an entry there are a number of options including generat a password. Options for this include the number of characters ans the character sets. ( a-z, A-Z, 0-9, punctuation symbols, etc.)

UPDATE 3/8/2007: U3

There is now a U3 version of Password Safe available.

RoboForm

RoboForm(http://www.roboform.com/) is a commercial password repository product. It includes a toolbar for your browser that simplifies its use. It will monitor your browser and save IDs and passwords with the "autosave" feature. With AES encryption the length of you password determines the strength of the algorithm.

AES key length depends on Master Password (MP) key length*:

• 128 bit for MP less than 32 chars,
• 192 bit for MP from 32 to 47 chars,
• 256 bit for MP 48 chars or longer.

RoboForm has two variants designed for use with USB drives RoboGorm2Go (http://www.roboform.com/pass2go.html) for standard USB drives and RoboGorm2Go for U3 (http://www.roboform.com/pass2go-u3.html) that is designed for U3 (http://www.u3.com/) thumb drives. [Note:] U3 is designed to make U3 versions of programs portable storing registry information on the U3 USB drive. I have one and have mixed feelings about the technology.

Feature list*:

• AutoSave passwords in browser.
• AutoFill passwords to login form.
• Click Login button for you.
• Fill personal info into online forms.
• Save offline passwords & notes.
• Generate Secure Random Passwords.
• Encrypt passwords and personal data using AES, Blowfish, RC6, 3-DES or 1-DES algorithms.
• All personal info is stored on your computer only.
• Take RoboForm with you on USB disk for ultimate portability.
• Sync your passwords and notes to Palm or Pocket PC.
• Backup & Restore, Print your passwords.
• More features: drill down for more.
• It is well-behaved: NO ADWARE, NO SPYWARE.
• Works under Windows as an add-on to IE-based browsers.
• Works with Netscape, Mozilla, Firefox under Windows.

* Taken from http://www.roboform.com/features.htm