The availability of password-cracking tools based on increasingly powerful graphics processors means that even carefully chosen short passwords are liable to crack under a brute-force attack. A password of less than seven characters will soon be “hopelessly inadequate” even if it contains symbols as well as alphanumerical characters. We recommend password of at least 12 characters long.
The number crunching abilities of graphics processors were recently applied to commercial password auditing and recovery tools from Russian developer ElcomSoft. It’s a safe assumption that black hats are able to use the same type of technology for less laudable purposes. Richard Boyd, of the Georgia Tech Research Institute, told the BBC that the number-crunching capacity of graphics cards compares to those of supercomputers built only 10 years ago.
Longer passwords are better at withstanding brute force attacks that rely on trying every possible combination of characters, but just using longer passwords is not enough. Dictionary attacks still work on badly chosen (easy to guess) passwords, while even complex passwords of 20 characters are useless on machines infected with keylogging Trojans.
While the Georgia researchers focused on the strength or otherwise of how users choose passwords, the Cambridge team studied how websites develop and apply password security policies. Many sites fail to apply best practice such as storing passwords only as hashes and blocking or at least throttling multiple attempts to guess user names or passwords.
The Cambridge team also studied how lower-security sites can compromise higher-security ones due to the tendency of users to reuse passwords across multiple domains. They suggest that some low-security sites (such as newspaper sites) insist on the use of passwords “primarily for psychological reasons … as a justification for collecting marketing data and as a way to build trusted relationships with customers”.
