A while back I wrote an article about password security, discussing common password requirements and how to create better passwords. The takeaway of that article is that common wisdom concerning password security is wrong, and the best passwords are long (16 characters or more) and use memorable made up words. Patreon recently sent out a link to some password advice, which includes more common wisdom on passwords and authentication in general that I want to challenge.
Patreon makes a number of claims about password security. One is that the more random a password the more secure it is. This is actually false. Increasing randomness of a password only makes a difference if it changes classes. Suppose a password uses the birth date of the account owner. This is a highly insecure class of password, because anyone who knows sufficient identifying information about the account owner can gain knowledge of his or her birthday. Name may be sufficient if it is fairly unique, and name and state/country of residence can be sufficient even if the name isn't terribly unique. Name and place of birth may be enough to gain access to birth certificates. Even if this is not enough, an attacker might be able to narrow it down to the birth dates of only two or three people, which is still easy enough. Birthday and other personally identifiable information is one class, which also includes things like names of children and pets, other dates of personal significance, personal catch phrases, and so on. This is an incredibly weak class of password, as those familiar with you or who have access to content you have published will likely have access to the information used in your password. Another class is common words. This category is much larger and thus more secure, though it is not more random, and it is still very insecure. Both of these categories are easy to crack, because the total entropy in the password is less than the entropy of the sum of the characters. Increasing randomness of these classes won't make a significant difference. It does not matter how random the common words or elements of personal information are, passwords in these classes will be approximately equally insecure to all passwords in the class, given that they have about the same number of elements. (In this instance, elements are not characters but rather words or coherent pieces of information.) Going from common words to uncommon words is a solid jump into a more secure category, but entropy is still lower than the sum of the entropy of the individual characters. The impact of increasing randomness is still negligible here. This might be represented as the difference between a phrase made of uncommon words and a series of random uncommon words. If the phrase is significantly more common than the words, increasing randomness will make the password more secure, but if the phrase is less common, it will not make any difference. Security is based on the most common coherent element. A phrase is more coherent than a series of words, but if the phrase is less common than the words, an attacker is far more likely to attack the words than the phrase. Once you get into classes where there is no coherency above the character level though, increasing randomness will have no affect. In other words, a 16 character password composed of made up words is not going to be any more secure than a random password made of characters from the same classes. Thus a 16 character password of made up words made of all lowercase characters is no more secure than 16 randomly selected lowercase characters, but it is many times harder to memorize. Adding additional classes of characters (numbers, special characters, uppercase letters) does increase security, but only negligibly, at the cost of making it even harder to memorize. Increasing randomness only increases the security of a password if it pushes the password into a more secure class. Otherwise it just makes the password harder to remember without having a significant impact on security. Once a password is in a class where strategic attacks either will not work or are not worth the cost, increasing randomness will not increase security even if it does push the password into a theoretically more secure class. Suggesting that increasing randomness increases security of a password is rather irresponsible, because in real life applications doing so makes far less difference than merely increasing the length of the password by a few characters, and making a password less memorable motivates the user write it down, making it far less secure.
Another recommendation of Patreon is to use a password manager. Patreon claims that password managers are highly secure, but this is not actually true. A password manager is no more secure than the authentication it uses, which is typically no more secure than the password a user would make up for another account. Password managers have three advantages. One is that they can generate more secure passwords than the average user would make up, without the user having to memorize them. This cannot make passwords significantly more secure than long passwords of made up words though, because there is no universal way to do that. Even going from all lower case to both cases, number, and symbols increases password entropy by less than 2 bits per character. Adding an additional character or two will have a far larger impact. In short, this is not a significant advantage over just making up a few words for a password. Another advantage is having different passwords for different accounts. This is a significant security advantage, but it comes at a heavy cost. Reusing passwords is a significant security issue. In theory, if one account is compromised, reusing passwords can compromise all accounts with that password. In practice, it is more complicated than that. To leverage this, an attacker would have to learn the usernames for all accounts sharing that password. That might be easy if the compromised account is an email account that the other accounts report to, with emails that mention the account usernames. It might also be easy if the attacker has gained access to your computer, though this is less relevant, because in this case the attacker has already compromised something more valuable than a single account. The attacker could just track your logins directly. Further though, compromising one account is only sufficient to obtain a password if the security on that account is already poor. Any competent organization will use obfuscation techniques to protect passwords, such that even if an attacker did gain access, your password would be in little danger. There are still companies that store passwords in plaintext, but this is becoming far less common, and major companies have pretty much all been scared into using good password security by the massive liabilities doing otherwise would entail. The third benefit of a password manager is not having to memorize passwords. Typically, a password manager has a single password used to access all of the others. The passwords are all encrypted, to maintain security, and they are only decrypted when being used. Tracking passwords for you is quite convenient, but it does not increase security. The only place where password managers improve security more than just using easily memorized made up words is making it easier to avoid password reuse. This is certainly valuable, but as internet security in general improves, the value of this diminishes rapidly. The vast majority of people reuse passwords all over the place. If this was as big of an issue as companies like Patreon make it out to be, large scale compromises would be happening constantly, and every large scale security breech would be followed by large scale financial fraud. The fact that we periodically see large scale compromises without immediate large scale financial fraud suggests that current password security measures are sufficiently mitigating the threat of password reuse. Not to suggest that password reuse is entirely without risk, but rather, the evidence suggests that it is no more risky and perhaps significantly less risky than merely using the weakest allowed password.
Password managers come with a serious downside though. If you use a password manager, that means you do not know any of your passwords. It is easy to forget that security has two goals. One is to protect assets from those who should not have access to them. The other is to grant access to those who should have it. Imagine you have a trusted secretary who memorizes all of your passwords for you. What are the risks involved with that? The risks for a password manager are the same. If your secretary dies, you lose access to your accounts. If your password manager quits working, maybe because your hard drive was corrupted, you will also lose access to your accounts. If your secretary is compromised, all of your passwords and usernames could get leaked. If your password manager is compromised, the same could happen. A password manager is a single point of failure in both cases. A password manager that backs up your passwords to the cloud might be able to avoid the first issue, but that is like your secretary telling someone she trusts your passwords or writing them down and storing them somewhere. This mitigates the problem of losing your passwords at the expense of increasing the attack surface, making them more likely to be obtained by someone who should not have them. This can actually increase the attack surface a lot. Commercial password managers store the password data on commercial servers managed by multiple people. This means that backing up the data to the internet could give a lot of people you have never even met access to your data. True, it may be encrypted, but encryption is inherently reversible. Secure web sites typically hash passwords, which is close to impossible to reverse. A password manager needs to be able to reverse it though, to use the passwords, meaning they have to store the passwords in an inherently less secure form. Password managers can be quite valuable, but suggesting that they significantly increase security is also rather irresponsible, without at least discussing how they do that and where they can reduce security.
The final recommendation that needs some discussion is multi-factor authentication. This legitimately increases security, fairly significantly. Multi-factor authentication uses two or more independent authentication methods. Typically one is a password. Entering the correct password will generally trigger a second step, where some other strategy is used to verify that the person logging in is the person who created the account. The most common form of multi-factor authentication is through text messaging. The user will enter the username and password, and the site will send a text to the user's phone and prompt the user to enter some data included in that text. Another form of multi-factor authentication is the use of a separate device that generates temporary keys, which can then be used for a limited time to prove possession of the device. All common forms of multi-factor authentication rely on the possession of some physical device associated with the user, however this is their weakness. If the user loses the device or the device is damaged, access to the account can be lost. Any form of authentication used to recover an account using this sort of multi-factor authentication is either less secure than the multi-factor authentication, rendering it useless, or it is so complex and time consuming that it denies access to the legitimate owner of the account for a potentially unacceptable length of time. Multi-factor authentication can be a very powerful means of increasing security, but the risks associated with it are quite high.
One of the biggest security recommendations for passwords is to never write them down or to keep them in a highly secure location if they are written down. All three of these recommendations either create motivation to write down passwords or are equivalent to writing down passwords. Making a password more random makes it harder to remember, which is why people write passwords down in the first place. A password manager literally writes down your passwords in a digital form. In multi-factor authentication, your phone or key fob becomes a tool for accessing a password. (The key texted or generated is nothing more than a second password.) The risk with all of these is the same as well. Every single one has a high risk of loss. A random password is difficult to remember thus easy to forget. A password manager relies on the integrity of the system or systems the passwords are stored on. A multi-factor authentication device can easily be lost or destroyed. And of course, password managers increase the attack surface, actually decreasing overall security, compared to a strong password that used only on trusted accounts.
Password security is far more complex than even most internet companies understand. Security should both protect from unauthorized access as well as guarantee authorized access. This is why passwords were chosen as the default form of digital security in the first place. A well memorized password is very difficult to lose or steal, but it can grant very quick access when needed. The problem is that "experts" who are too clever for their own good have been recommending bad password generation practices for decades, and this has lead to security issues that have prompted the creation of products that really should not be necessary for anything short of national security, where denial of access may be vastly favorable to a leak of information to unauthorized parties.
A good password has two properties. One is that it is hard for someone who is not authorized to know it to figure it out. The other is that it is easy for those who are authorized to know it to remember. Security is not just preventing unauthorized access. If that was the case, perfect security could be achieved merely by destroying the assets we want to protect. Providing timely and convenient access to those who are authorized is no less important than preventing unauthorized access. This means that any form of security that significantly hinders or compromises authorized access isn't very secure, even if it does perfectly prevent unauthorized access. A password that is hard to memorize cannot reasonably be considered secure, because it does not provide access the way it should. A tool that makes accessing secured assets significantly more difficult is a compromise of security. Any security strategy that creates a significant risk of denial of access to authorized parties cannot reasonably be considered secure. When assets being protected have extremely high value, it may be worth trading some of the accessibility side of security for protection, but this is not the same as increasing security. It is exchanging security for protection. And this should be a decision made by the owner or owners of the assets, not a decision that the owners are pressured into by second or third parties. Patreon should not be telling its users that they should adopt these security measures. Patreon should be telling its users about these security measures, including the risks associated with them, and then it should leave the decision up to its users, without pressuring them into it. Patreon should also be informing its users of alternatives, for example, making your password longer is a far more effective strategy than making it more random.
Password security is a poorly understood topic, especially among those who have the biggest voice on the topic. It is a lot simpler than many people seem to believe, and many of the strategies that are recommended actually reduce security, either by increasing odds of denial of access or by motivating users to circumvent more legitimate protections.
