Online insecurity

  • March 23, 2012
Online insecurity

Analysis of largest ever sample of passwords shows most are easy to crack.

Online passwords are so insecure that one per cent can be cracked within 10 guesses, according to the largest ever sample analysis.
The research was carried out by Gates Cambridge scholar Joseph Bonneau and will be presented at a security conference held under the auspices of the Institute of Electrical and Electronics Engineers in May.
Bonneau [2008] was given access to 70 million anonymous passwords through Yahoo! – the biggest sample to date – and, using statistical guessing metrics, trawled them for information, including demographic information and site usage characteristics.
He found that for all demographic groups password security was low, even where people had to register to pay by a debit or credit card. Proactive measures to prompt people to consider more secure passwords did not make any significant difference.
There was some variation, however. Older users tended to have stronger online passwords than their younger counterparts. German and Korean speakers also had passwords which were more difficult to crack, while Indonesian-speaking users’ passwords were the least secure.
Even people who had had their accounts hacked did not opt for passwords which were significantly more secure.
The main finding, however, was that passwords in general only contain between 10 and 20 bits of security against an online or offline attack.
Bonneau, whose research was featured in The Economist, concludes that there is no evidence that people, however motivated, will choose passwords that a capable attacker cannot crack. “This may indicate an underlying problem with passwords that users aren’t willing or able to manage how difficult their passwords are to guess.”

To read his full research paper, click here.

Picture credit: Salvatore Vuono and www.freedigitalphotos.net

Latest News

Affecting change for the Māori community

Self-determination lies at the centre of Māori culture. “It’s a way of life,” says Chris Tooley. That idea is also at the heart of his PhD studies at Cambridge and his subsequent work in Parliament and in the community. Chris grew up with a strong sense of being part of the Māori community. He has ancestral […]

On the COVID frontline

Three Gates Cambridge scholars who have been on the medical frontline during the COVID-19 pandemic will be speaking about their experiences at a virtual event next weekend. The event, organised by the Gates Cambridge Alumni Association, will be moderated by Elizabeth Dzeng, Assistant Professor of Medicine at the University of California, San Francisco in the […]

New game tackles Covid conspiracies

A new online game that puts players in the shoes of a purveyor of fake pandemic news is the latest tactic in the UK Government’s efforts to tackle the deluge of coronavirus misinformation that is misleading many and costing lives across the world. Launched to the public today, the Go Viral! game has been developed by the […]

“Democracy does not work on a ‘trust me’ basis”

When Jennifer Gibson started her MPhil at Cambridge in 2001 as part of the inaugural class of Gates Scholars, no-one knew what it meant to be a Gates Cambridge Scholar. Twenty years later, Jennifer is now a human rights lawyer focused on national security issues, something she never could have anticipated, but which she credits in no small part […]