By Bruce Schneier
Dec, 14, 2006
How good are the passwords people are choosing to protect their
computers and online accounts?
It's a hard question to answer because data is scarce. But recently, a
colleague sent me some spoils from a MySpace phishing attack: 34,000
actual user names and passwords.
The attack was pretty basic. The attackers created a fake MySpace login
page, and collected login information when users thought they were
accessing their own account on the site. The data was forwarded to
various compromised web servers, where the attackers would harvest it
MySpace estimates that more than 100,000 people fell for the attack
before it was shut down. The data I have is from two different
collection points, and was cleaned of the small percentage of people who
realized they were responding to a phishing attack. I analyzed the data,
and this is what I learned.
Password Length: While 65 percent of passwords contain eight characters
or less, 17 percent are made up of six characters or less. The average
password is eight characters long.
Specifically, the length distribution looks like this:
1-4 0.82 percent
5 1.1 percent
6 15 percent
7 23 percent
8 25 percent
9 17 percent
10 13 percent
11 2.7 percent
12 0.93 percent
13-32 0.93 percent
Yes, there's a 32-character password:
"1ancheste23nite41ancheste23nite4." Other long passwords are
"fool2thinkfool2thinkol2think" and "dokitty17darling7g7darling7."
Character Mix: While 81 percent of passwords are alphanumeric, 28
percent are just lowercase letters plus a single final digit -- and
two-thirds of those have the single digit 1. Only 3.8 percent of
passwords are a single dictionary word, and another 12 percent are a
single dictionary word plus a final digit -- once again, two-thirds of
the time that digit is 1.
numbers only 1.3 percent
letters only 9.6 percent
alphanumeric 81 percent
non-alphanumeric 8.3 percent
Only 0.34 percent of users have the user name portion of their e-mail
address as their password.
Common Passwords: The top 20 passwords are (in order):
password1, abc123, myspace1, password, blink182, qwerty1, fuckyou,
123abc, baseball1, football1, 123456, soccer, monkey1, liverpool1,
princess1, jordan23, slipknot1, superman1, iloveyou1 and monkey.
(Different analysis here.)
The most common password, "password1," was used in 0.22 percent of all
accounts. The frequency drops off pretty fast after that: "abc123" and
"myspace1" were only used in 0.11 percent of all accounts, "soccer" in
0.04 percent and "monkey" in 0.02 percent.
For those who don't know, Blink 182 is a band. Presumably lots of people
use the band's name because it has numbers in its name, and therefore it
seems like a good password. The band Slipknot doesn't have any numbers
in its name, which explains the 1. The password "jordan23" refers to
basketball player Michael Jordan and his number. And, of course,
"myspace" and "myspace1" are easy-to-remember passwords for a MySpace
account. I don't know what the deal is with monkeys.
We used to quip that "password" is the most common password. Now it's
"password1." Who said users haven't learned anything about security?
But seriously, passwords are getting better. I'm impressed that less
than 4 percent were dictionary words and that the great majority were at
least alphanumeric. Writing in 1989, Daniel Klein was able to crack
(.gz) 24 percent of his sample passwords with a small dictionary of just
63,000 words, and found that the average password was 6.4 characters
And in 1992 Gene Spafford cracked (.pdf) 20 percent of passwords with
his dictionary, and found an average password length of 6.8 characters.
(Both studied Unix passwords, with a maximum length at the time of 8
characters.) And they both reported a much greater percentage of all
lowercase, and only upper- and lowercase, passwords than emerged in the
MySpace data. The concept of choosing good passwords is getting through,
at least a little.
On the other hand, the MySpace demographic is pretty young. Another
password study (.pdf) in November looked at 200 corporate employee
passwords: 20 percent letters only, 78 percent alphanumeric, 2.1 percent
with non-alphanumeric characters, and a 7.8-character average length.
Better than 15 years ago, but not as good as MySpace users. Kids really
are the future.
None of this changes the reality that passwords have outlived their
usefulness as a serious security device. Over the years, password
crackers have been getting faster and faster. Current commercial
products can test tens -- even hundreds -- of millions of passwords per
second. At the same time, there's a maximum complexity to the passwords
average people are willing to memorize (.pdf). Those lines crossed years
ago, and typical real-world passwords are now software-guessable.
AccessData's Password Recovery Toolkit would have been able to crack 23
percent of the MySpace passwords in 30 minutes, 55 percent in 8 hours.
Of course, this analysis assumes that the attacker can get his hands on
the encrypted password file and work on it offline, at his leisure;
i.e., that the same password was used to encrypt an e-mail, file or hard
drive. Passwords can still work if you can prevent offline
password-guessing attacks, and watch for online guessing. They're also
fine in low-value security situations, or if you choose really
complicated passwords and use something like Password Safe to store
them. But otherwise, security by password alone is pretty risky.
Bruce Schneier is the CTO of BT Counterpane and the author of Beyond
Fear: Thinking Sensibly About Security in an Uncertain World. You can
contact him through his website.
Subscribe to InfoSec News