Account Security - Making a Secure Password

-
Most common passwords 2018

Making a Secure Password

If you use any of the passwords in the lists above (or anything close to them), this post is for you. Even if you think you've got a strong password I'd ask you to keep reading, as many people have the wrong idea about what makes up a strong password.

It's been stated for years to use capital letters, numbers, special characters, and not your pet's name as a password. This is true for Facebook logins, company domain logins, and even bank account logins. I believe it's simply human nature -- we're given a set of requirements with the expectation that if we follow them then our password is secure. Then we create the easiest, most memorable passwords that meet those requirements and don't think twice about it believing we're all set. While not on the "top 15 most common" list, what usually results from these requirements is something like "FacebookPassword123!" or worse "Password1" if the site's requirements are especially lacking.

This is a recipe for disaster and why so many people's accounts are compromised on a daily basis (database dumps containing millions of records of usernames and passwords don't help either). So what actually is a good password?

I completely agree with Troy Hunt in that the only secure password is the one you can't remember. For 99% of your passwords, I recommend a password manager. Paid or free, it doesn't matter (as long as strong encryption methods are used). You can then have your password manager randomly generate a 32 character password for you that you don't have to worry about remembering. The only passwords you will have to remember are your computer login and the master password to your password safe.



So what about the passwords we do have to remember? Or if you choose not to put your online banking information or some other login in your password safe? The latest NIST Guidelines do a pretty good job with minimum recommendations, though I think the 8 character minimum should be increased. 

The major takeaway I like to emphasize is the concept of pass phrases. A pass phrase is a series of words such as "John Baked 1 Cake For The Party!". 32 characters, easy to remember, and good luck cracking it in any reasonable amount of time. Most operating systems support the use of spaces in account passwords, and every password manager I've ever used does the same. 

There is no reason not to take advantage of this and make your accounts exponentially more secure.

XKCD

Multi-Factor Authentication

A password -- something you know -- is a single factor of authentication. You present your identity (username) and then provide the password to gain access. This is true even if your phone is reading your fingerprint instead -- your account still has a password you could enter if your fingerprint reader  broke. As a second step of verification you can request that a text message be sent to you, or that you need to enter a code given by an authentication app. Having just the code or just the password to the account will not work, you need both. This is multi-factor authentication.

While far from perfect (SIM swaps, Social Engineering, etc), multi-factor authentication significantly reduces the chance that your account will be compromised. If a service offers it, enable it. If a service offers both the ability to use an app and SMS for MFA, choose the app (Google Authenticator, Authy). Finally, TwoFactorAuth has a great site that compares services' multi-factor offerings.


I've only scratched the surface of these topics with what's written here, but these are some of the most important points to make and will make the biggest difference for the least amount of effort.





Comments

Post a Comment

Popular Posts

Hashcat - Cracking MD5 and NTLM Hashes

-
Image
Today we'll be exploring Hashcat -- "the world’s fastest and most advanced password recovery utility". This, along with similar tools, should be used only for password recovery, pentest engagements, CTFs, etc and never for illegal purposes. I could write an entire series about the capabilities Hashcat provides, but we will cover a few basic examples for now ( besides, Hashcat does a pretty good job of that themselves ): Crack MD5 hashes using the rockyou.txt wordlist. Crack NTLM hashes using the rockyou.txt wordlist. Crack NTLM hashes using a mask attack (modified brute force). I'll be using Kali Linux as Hashcat comes pre-installed, but Hashcat can run on Windows, macOS, and other Linux distributions as well. As you'll see, I'll be using some lists of hashes I made previously. Tools to generate hashes using dozens of algorithms are available online -- just save the output as a text file if you want to follow along. Cracking MD5 Hashes Using rockyou.txt Wordl...
Read more

Configuring Secure Ciphers Suites and TLS

-
Image
Hey everyone, today we're back on cipher suites. If you want a refresher of TLS and secure cipher suites overall, check out my previous post . There are many instances in which you'll need to edit cipher suites on a system -- compliance efforts, CIS benchmarks, or simply ensuring your system doesn't use insecure suites. There are a few ways to go about this and I'll detail two of them now: IIS Crypto and the Windows registry. IIS Crypto My favorite way of editing TLS versions and cipher suites is using IIS Crypto . IIS Crypto allows you to select your desired TLS/SSL version, cipher suites, and backup the registry, all with a few mouse clicks. Only downside is that it's Windows only (even the command line version). This is what IIS Crypto will look like on an unmodified Windows 10 system. Note the separate  Server Protocols  and  Client Protocols  sections. These are important to keep straight depending on what system is listening for connections and what system is ...
Read more

Configuring SSH Key Based Authentication

-
Image
Overview Most personal computers and many organizations running Linux servers utilize password-based authentication. This is what most of us are used to -- you enter a username and password in order to authenticate your account and gain access to a system. While straightforward and commonplace, this isn't the best solution in most cases. Today I'll be explaining why key based authentication is more convenient, more secure, and allows for automation of tasks without saving credentials in plain-text in a text file. Key based authentication involves the use of private and public keys ( public-key cryptography ). The private key is stored on the client and the public key is stored on the server in a special file ( ~/.ssh/authorized_keys ). This allows any system with the corresponding private key to login to the server where we just stored the public key. Our steps are: Generate key pair (public / private key). Transfer public key and add it to the authorized_keys file on the remot...
Read more