What is worse than reusing passwords?

Crimeware
by Markus Jakobsson

http://www.itworld.com/tech-society/54193/beware-meta-password-reuse

August 12, 2008, 09:22 PM —

Do you use the same password all over the place? Yes, you probably do – whether you know it or not.

The fact is, while some people still casually use the same password for many sites, almost all of us reuse what we may think of as “meta passwords” – the information used to reset passwords. That, I argue, is worse than reusing passwords - but harder to avoid!

When you have forgotten your password, some sites send you an email with a link for you to click. Phishers who have stolen access to your email account can do that, too. Other sites will ask you for your mother’s maiden name, the name of your best friend, what city you grew up in, or what brand your first car was. Did you know that phishers can answer those questions, too?
Like the city you grew up in, your mother’s maiden name can be derived from public records – from birth certificates and marriage certificates to be specific. (Download PDF for details.)

Facebook might unwittingly tell the name of your best friend. And,until quite recently, Ford with its 25% market share had a pretty good chance of being the brand of your first car!

This same set of popular password reset questions are reused on many sites. What if one of them is hacked? And, yes, a shady site can ask you the same questions as big banks ask, hoping to learn your answers if you set up an account there.

Password reset techniques have several problems. One is that many of the answers can be found in public databases, or guessed. Another is that many sites ask the same questions. And yet another one is that some questions are not very memorable at all, or change. Last name of your kindergarten teacher and favorite movie are two examples. My favorite in this category is from Virgin America. How much wood would a woodchuck chuck if a woodchuck could chuck wood? And can you enter any of the answers using a phone keyboard? Probably, but it is not so much fun to do.

Password reset does not have to be a weak link.

Psychologists know that people’s preferences are stable – often more so than long term memory. And very few preferences are recorded in public databases, especially slight preferences. Take a look at http://www.blue-moon-authentication.com/to try out what the setup and password reset may look like in a system based on preferences. You will see that the password reset step can be done on a phone, by the way.

Related reading
http://www.i-forgot-my-password.com/
Security Questions in the Era of FaceBook
Love and Authentication (presentation)

There's a nice white paper about exactly this topic, to help organizations design stronger authentication for when users forget their passwords:(psynch.com)
by idan (not verified) on 8/13/08 at 10:30 pm reply

Here are two papers you can read for more details on preference-based authentication: http://www.ravenwhite.com/files/quantifying.pdf(to appear in DIM '08)http://www.ravenwhite.com/files/chi08JSWY.pdf(appeared in CHI '08)

Cheers,Markus
by Markus Jakobsson on 8/14/08 at 1:23 am reply

http://www.ravenwhite.com/ifo

http://www.ravenwhite.com/iforgotmypassword.html or the i-forgot-my-password link (they go to the same place) are much more informative than the link in the article text. From there you can see the scholarly papers and a layman's explanation (with screenshots) of the site linked in the article text.
by Anonymous (not verified) on 8/14/08 at 8:14 am reply
View all comments »