Passwords & Passphrases

Name: Simovi Petar

I study computer science at the Faculty of Mathematics,
University of Belgrade
Member of Belgrade hackerspace (HKLBGD) sunday
crypto workshop .
Writing for Libre online magazine (FLOSS)

Agenda

Introducint to passwords and pass phrases

Measuring password/pass pharse strength

Service consumer handling secrets: why passwords

migh be dead
Password hacking: phishing, bruteforce, Social
engineering
Alternative methods of authentication

What's wrong with my P4$$w0rd?

Very week & easy to remember.

remember Replacing 's' and 'o' with
'$' and '0' won't help you much.

Or hard to remember & secure

So users reuse them

And If not random -> social engeenering guessing

People are not very good at creating truly random
passwords, even more they are a species of patterns. And
it is hard to remember dozens of different nonsense
passwords with numbers and special characters.

Password security blanket 1k

Lorrie Faith Cranor

Most used Pa$$s0rds

So, what is pass pharse?

Short answer: It is just a phrase.

Long: It contains few word, not neccessery from dictionaty,
words should be picked at random not from book or
website.

What are good and secure pass phrases?

How to generate them?

Secure pass phrase?

pass-phrase1 pass-phrase2 pass-phrase3

My pass phrase is hard to guess

Correct horse battery staple

red cross healty pharmacy medicine

yeti permutes kilobyte visas skin

red green blue cyan magenta yellow

police gun cuffs undercover sherif

Secure pass phrase?

pass-phrase1 pass-phrase2 pass-phrase3

My
/////////////////////////////////////////////////////
pass phrase is hard to guess

Correct
Correct horse battery staple
staple

red cross healty pharmacy medicine

yeti
yeti permutes kilobyte visas skin
skin

red green blue cyan magenta yellow

police gun cuffs undercover sherif

Pass phrase advatages

Easier to create maybe not for humans

Easier to remember

So no need for writing it down or using password

managers
Hard automation attacks [verb adjective noun?] --needs
bruteforce if done right

More secure?

...

Diceware

Method for manually generating pass phrases

Why? PRNG compromissed or paranoid?

How? Diceware wordlist, dice, paper and pen

http://goo.gl/swgFz

Entropy Shannon entropy

Log2 (Character Set password length)

For example: 8 character password length with all 94 possible

character: a-z (26), A-Z (26), 0-9 (10), and
~!@#$%^&*()_-+={[}]|\":;?/><,. (32)

is

Log2(948) = Log2(6 095 689 385 410 816) = 52 bits

For pass pharses character set is number of words in

dictionary, and password length is number of words.
So any 4 word passphare in set of 20 000 words
(average dictionary) has Log2(200004) = 57 bits

Entropy

8 character password from 94 set:

4!VN$Fg = 51 bit entropy

4 word pass phrase from 20 000 words:

yeti permutes kilobyte visas = 57+ bits of entropy

Strength comparation

Passwords & Passphrases

XKCD:
Trough 20 years of effort,
we've successfully trained everyone to use
passwords that are hard for humans to remember,
but easy for computers to guess

https://xkcd.com/936/

P4$$w0rDs done right

Using password manager (allways open-source software

eg. KeePass, KeePassX, )
Let password manager generate long secure (80+ bits)
password. No need to remember any, and no reusing.

Change them all often (at least twice a year)

Public wi-fi needs layer of encryption

How servers handle users

passwords?

They used hashing function (MD5, sha1, sha256, bcrypt)

How servers handle users

passwords?

They used hashing function (MD5, sha1, sha256, bcrypt)

Hashing + salting

How servers handle users

passwords?

They used hashing function (MD5, sha1, sha256, bcrypt)

Hashing + salting
Use slow and good and hash functions like bcrypt never
MD4, MD5 or SHA1.
Generate new random salt for each user, do not reuse salt.

So how dit this happen?

Password cr/hacking

Phishing

Social engineering

2FA

Use Two factor authentication whenever possible:

Google authenticator, Yubi keys, ...

Facial recognition & fingerprints

Kirk Skaugen, Senior VP and general manager of Intel's
Client Computing Group said at Citi Global Technology
Conference: "I can confidently say today, you can
eliminate all your passwords today, if you buy a 6th
Generation Core system." http://goo.gl/dE4j1q

Sixth intel core generation CPU + Windows 10

(Windows Hello program) + Intel's RealSense 3D Camera.

Or use fingerprint verification/authentication like on

Iphone 6 Touch ID.

Are you now 100% secure?

New methods

Hashing is Dead: long live the passwords.

https://goo.gl/0rwfkJ

RSA auth.

Questions?