Improving Password Based Security

Improving Password Based
Security

What is a Password?
• A password is a secret word or string of characters that is used for
user authentication to prove identity, or for access approval to gain
access to a resource (example: an access code is a type of password).
• The use of passwords is known to be ancient. Sentries would
challenge those wishing to enter an area or approaching it to supply a
password or watchword, and would only allow a person or group to
pass if they knew the password.
• In modern times, user names and passwords are commonly used by
people during a log in process that controls access to protected
computer operating systems, mobile phones, cable TV
decoders, automated teller machines (ATMs), etc.
Brought To You by www.rareinput.com

What is the need of a password?
There are many reasons to use passwords. Here are some common
reasons to use them:
to prevent unauthorized access to important information
to guarantee security of personal information
to prevent unauthorized access to user accounts, such as computer and email
accounts
to be able to use various Internet services securely


How does password work?
Whenever we create a login on any website or any stand alone
system/application, we are generally asked for two things one is the username
and other is the password.
The combination of these username and password is then saved into the
database of the system/application.
And when the user tries to log in to that particular system or application, he is
asked for these two things. If the username and the password entered by the
user matches with the password and the username previously stored in the
database, then he/she is granted the access, else the access is prevented.

Challenges in password based security
Password Creation
Password strength
Password storing
Password Protection
Password cracking


How to Improve Password based
security?
A very simple answer to this question is “to improve the strength of the password”.
But what actually is a good strength to ensure the proper security??
Well, there are some techniques and do’s and don'ts which may ensure a better
security while using password security.
Some of them are discussed in the next slides.


I. Creating a strong Password:
We all must create strong passwords which are tough to guess and break. In
order to create strong passwords we shall follow following points.
a) A minimum password length of 12 to 14 characters.
b) Generating passwords randomly where feasible
c) Avoiding passwords based on repetition, dictionary words, letter or number
sequences, usernames, relative or pet names, romantic links (current or past), or
biographical information (e.g., ID numbers, ancestors' names or dates).
d) Including numbers, and symbols in passwords if allowed by the system
e) If the system recognizes case as significant, using capital and lower-case letters
f) Avoiding using the same password for multiple sites or purposes
g) Avoid using something that the public or workmates know you strongly like or dislike


2. Storing Encrypted Password:
• When we are planning to authenticate users via passwords, we must ensure the security of the
password in our database.

• If we store user passwords as plaintext, against which to compare user log on attempts. If an
attacker gains access to such an internal password store, all passwords—and so all user
accounts—will be compromised. If some users employ the same password for accounts on
different systems, those will be compromised as well.
• More secure systems store each password in a cryptographically protected form, so access to the
actual password will still be difficult for a snooper who gains internal access to the system, while
validation of user access attempts remains possible.
• A common approach stores only a "hashed" form of the plaintext password. When a user types in
a password on such a system, the password handling software runs through a cryptographic hash
algorithm, and if the hash value generated from the user's entry matches the hash stored in the
password database, the user is permitted access.

3. Random Passwords:
• Random passwords consist of a string of symbols of specified length taken from some set of
symbols using a random selection process in which each symbol is equally likely to be
selected. The symbols can be individual characters from a character set (e.g., the ASCII
character set), pronounceable passwords, or even words from a word list (thus forming a
passphrase).
• However, these are often not truly random, but pseudo random

• Random password programs often have the ability to ensure that the resulting password
complies with a local Password Policy.


4. Password longevity (ageing):
• "Password aging" is a feature of some operating systems which forces users to change
passwords frequently (e.g., quarterly, monthly or even more often)
• There is often an increase in the people who note down the password and leave it where it
can easily be found or Users may use simpler passwords or develop variation patterns on a
consistent theme to keep their passwords memorable. Because of these issues, password
aging is effective.
• Password aging is also required because of the nature of data of the IT systems.


5. Limits on the number of password guesses:
• An alternative to limiting the rate at which an attacker can make guesses on a password is to
limit the total number of guesses that can be made.
• The password can be disabled, requiring a reset, after a small number of consecutive bad
guesses (say 5); and the user may be required to change the password after a larger
cumulative number of bad guesses (say 30), to prevent an attacker from making an arbitrarily
large number of bad guesses by interspersing them between good guesses made by the
legitimate password owner.


6. Transmission through encrypted channels:
• The risk of interception of passwords sent over the Internet can be reduced by, among other
approaches, using cryptographic protection.

• The most widely used is the Transport Layer Security (TLS, previously called SSL) feature built
into most current Internet browsers.
• Most browsers alert the user of a TLS/SSL protected exchange with a server by displaying a
closed lock icon, or some other sign, when TLS is in use.


Do’s and don’ts of a password
Do’s of a password

Don’ts of a password

• DO pick a password you will remember
• DON'T write your password down.
• DO change your password regularly
• DON'T make obvious choices like your last
name, first
• DO use a mix of uppercase and lowercase
name, nickname, birthdate, spouse
characters and special characters such as
name, pet name, make/model of car, or
#, $, %.
favorite expression.
• DO use random passwords.
• DON'T choose your username as your
• DO use a password that you can type quickly
password.
without having to look at your keyboard. This
• DON'T share your password with anyone.
makes it harder for someone to notice your
Once it is out of your control, so is your
password if they happen to be watching over
security.
your shoulder.
• DON'T use a word contained in English or
• DO use a password with 8 or more
foreign language dictionaries, spelling lists or
characters. More is better.
commonly digitized
• DO create different passwords for different
• DON'T use an alphabet sequence
accounts and applications.
(lmnopqrst), a number sequence (12345678)

By using these mentioned techniques we can significantly improve our password based security and
can save ourselves from the numerous threats of this cyber world.


References
• http://www.google.com
• http://www.securepasswords.net/site/Password-Dos-andDonts/page/25.html
• http://en.wikipedia.org/wiki/Password_strength
• http://en.wikipedia.org/wiki/Password


Thank You

Saurabh Kumar Jha
CTO and Co Founder
www.rareinput.com

Improving Password Based Security

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

Similaire à Improving Password Based Security

Similaire à Improving Password Based Security (20)

Dernier

Dernier (20)

Improving Password Based Security