Online insecurity

  • March 23, 2012
Online insecurity

Analysis of largest ever sample of passwords shows most are easy to crack.

Online passwords are so insecure that one per cent can be cracked within 10 guesses, according to the largest ever sample analysis.
The research was carried out by Gates Cambridge scholar Joseph Bonneau and will be presented at a security conference held under the auspices of the Institute of Electrical and Electronics Engineers in May.
Bonneau [2008] was given access to 70 million anonymous passwords through Yahoo! – the biggest sample to date – and, using statistical guessing metrics, trawled them for information, including demographic information and site usage characteristics.
He found that for all demographic groups password security was low, even where people had to register to pay by a debit or credit card. Proactive measures to prompt people to consider more secure passwords did not make any significant difference.
There was some variation, however. Older users tended to have stronger online passwords than their younger counterparts. German and Korean speakers also had passwords which were more difficult to crack, while Indonesian-speaking users’ passwords were the least secure.
Even people who had had their accounts hacked did not opt for passwords which were significantly more secure.
The main finding, however, was that passwords in general only contain between 10 and 20 bits of security against an online or offline attack.
Bonneau, whose research was featured in The Economist, concludes that there is no evidence that people, however motivated, will choose passwords that a capable attacker cannot crack. “This may indicate an underlying problem with passwords that users aren’t willing or able to manage how difficult their passwords are to guess.”

To read his full research paper, click here.

Picture credit: Salvatore Vuono and www.freedigitalphotos.net

Latest News

Shaping policy and Alzheimer’s research

Just six years since leaving Cambridge, Brianne Kent has secured a role as Assistant Professor, won multiple awards,  become the first early career researcher on the Governing Council of the Canadian Institutes of Health Research [CIHR] and is currently setting up her own laboratory to further her studies on Alzheimer’s disease. Since January, when she […]

Ed-tech wins Gates Foundation funding for access work

An ed-tech non-profit co-founded by a Gates Cambridge Scholar has received a $980,000 grant from the Bill & Melinda Gates Foundation to develop its free college affordability tool. Moneythink, co-founded by Greg Nance who is also its Board Chair, says the money will help it to accelerate the development and reach of DecidED, its free […]

Gates Cambridge: a purposeful community

As the Gates Cambridge Scholarship reaches the end of its 20th anniversary year, its alumni association is holding an event late this month which celebrates some of the factors that have shaped the scholar community. That sense of community, of a global network of leaders, developed and owned by the scholars and alumni themselves, is […]

Fibre optic project aims to improve Sri Lanka’s infrastructure

A Gates Cambridge Alumnus has formed a partnership between his university, Cambridge and Oxford universities and a local engineering company to introduce a cutting-edge technology to Sri Lanka. A team of researchers and industry experts from the University of Moratuwa in Sri Lanka, the Cambridge Centre for Smart Infrastructure and Construction (CSIC), the University of […]