Friday, August 15, 2008

What is worse than reusing passwords?

by Markus Jakobsson
August 12, 2008, 09:22 PM —

Do you use the same password all over the place? Yes, you probably do – whether you know it or not.

The fact is, while some people still casually use the same password for many sites, almost all of us reuse what we may think of as “meta passwords” – the information used to reset passwords. That, I argue, is worse than reusing passwords - but harder to avoid!

When you have forgotten your password, some sites send you an email with a link for you to click. Phishers who have stolen access to your email account can do that, too. Other sites will ask you for your mother’s maiden name, the name of your best friend, what city you grew up in, or what brand your first car was. Did you know that phishers can answer those questions, too?
Like the city you grew up in, your mother’s maiden name can be derived from public records – from birth certificates and marriage certificates to be specific. (Download PDF for details.)

Facebook might unwittingly tell the name of your best friend. And,until quite recently, Ford with its 25% market share had a pretty good chance of being the brand of your first car!

This same set of popular password reset questions are reused on many sites. What if one of them is hacked? And, yes, a shady site can ask you the same questions as big banks ask, hoping to learn your answers if you set up an account there.

Password reset techniques have several problems. One is that many of the answers can be found in public databases, or guessed. Another is that many sites ask the same questions. And yet another one is that some questions are not very memorable at all, or change. Last name of your kindergarten teacher and favorite movie are two examples. My favorite in this category is from Virgin America. How much wood would a woodchuck chuck if a woodchuck could chuck wood? And can you enter any of the answers using a phone keyboard? Probably, but it is not so much fun to do.

Password reset does not have to be a weak link.

Psychologists know that people’s preferences are stable – often more so than long term memory. And very few preferences are recorded in public databases, especially slight preferences. Take a look at try out what the setup and password reset may look like in a system based on preferences. You will see that the password reset step can be done on a phone, by the way.

There's a nice white paper about exactly this topic, to help organizations design stronger authentication for when users forget their passwords:(
by idan (not verified) on 8/13/08 at 10:30 pm reply

Here are two papers you can read for more details on preference-based authentication: appear in DIM '08) in CHI '08)

by Markus Jakobsson on 8/14/08 at 1:23 am reply or the i-forgot-my-password link (they go to the same place) are much more informative than the link in the article text. From there you can see the scholarly papers and a layman's explanation (with screenshots) of the site linked in the article text.
by Anonymous (not verified) on 8/14/08 at 8:14 am reply
View all comments »


About CherryPal for Everyone (CP4Every1 or CPFE)

CP4Every1 is constantly crawling the web (on human hands and knees) to find unique information of value regarding green technology, cheap and reliable connectivity, personal, portable and sustainable industry developments, future and social/cultural transformative technology, political relevance and news that is NOT just another re-posting of the same press release pushed out by the industry.

Please note that all copyrights and links to original material are provided and respected. NO robots were used to post content.

Your comments are invited.

Enter your Email to receive CPFE Updates

Preview Powered by FeedBlitz


for $10 off purchase price


Scroll to bottom for Google Custom Search Results

Search Results

Other CherryPal Brand Angel Blogs