Password selection strategies
Password selection strategies
Password selection strategies:The goal is to eliminate guessable passwords while allowing the user to select a password that is memorable. Four basic techniques are in use.
- User education
Users can be told the importance of using hard-to-guess passwords and can be provided with guidelines for selecting strong passwords.This user education strategy is unlikely to succeed at most installations, particularly where there is a large user population or a lot of turnover. Many users will simply ignore the guidelines. Others may not be good judges of what is a strong password. For example, many users (mistakenly) believe that reversing a word or capitalizing the last letter makes a password unguessable.
- Computer-generated passwords
passwords are quite random in nature.Computer-generated passwords also have problems.If the passwords are quite random in nature,users will not be able to remember them.Even if the password is pronounceable, the user may have difficulty remembering it and so be tempted to write it down. In general, computer-generated password schemes have a history of poor acceptance by users. FIPS PUB 181 defines one of the best-designed automated password generators.The standard includes not only a description of the approach but also a complete listing of the C source code of the algorithm.The algorithm generates words by forming pronounceable syllables and concatenating them to form a word.A random number generator produces a random stream of characters used to construct the syllables and words.
- Reactive password checking
A reactive password checking strategy is one in which the system periodically runs its own password cracker to find guessable passwords.The system cancels any passwords that are guessed and notifies the user.This tactic has a number of drawbacks. First it is resource intensive, if the job is done right. Because a determined opponent who is able to steal a password file can devote full CPU time to the task for hours or even days an effective reactive password checker is at a distinct disadvantage. Furthermore, any existing passwords remain vulnerable until the reactive password checker finds them.
- Proactive password checking
The most promising approach to improved password security is a proactive password checker. In this scheme, a user is allowed to select his or her own password.However,at the time of selection,the system checks to see if the password is allowable and if not, rejects it. Such checkers are based on the philosophy that with sufficient guidance from the system, users can select memorable passwords from a fairly large password space that are not likely to be guessed in a dictionary attack. The trick with a proactive password checker is to strike a balance between user acceptability and strength.If the system rejects too many passwords,users will complain that it is too hard to select a password. If the system uses some simple algorithm to define what is acceptable,this provides guidance to password crackers to refine their guessing technique. In the remainder of this subsection, we look at possible approaches to proactive password checking.
