Below are
some of the latest media articles about password problems and my comments on
them.
- Russian
Gang Amasses Over a Billion Internet Passwords
“A
Russian crime ring has amassed the largest known collection of stolen Internet
credentials, including 1.2 billion user name and password combinations and more
than 500 million email addresses, security researchers say.”
My
comment: We do not have to panic. It
will be possible to put such situations under control.
The
Expanded Password System that we advocate handles a “character” as an “image”. Each character/image is identified by the
image identifier data which can be any long.
Assume that your password is easy-to-remember but easy-to-crack, for
instance, “ABC123” and that those characters are identified as X4s&, eI0w,
and so on by the randomizing program.
When you input ABC123, the authentication data that the server receives
is not “ABC123”, but something like “X4s&eIwdoex7RVb%9Ub3mJvk”, which may
automatically change periodically or at each access. When such very-high-entropy data are hashed,
it would be next to impossible to quickly crack the hashed data back to the
original password. Give different sets
of identifier data to “ABC123” and the different servers will receive all
different very-high-entropy authentication data.
Brute
force attacks and rainbow-table attacks are effective for low-entropy data, not
for very-high-entropy data. Even if the
hashed passwords were stolen, we could stay calm when we know that criminals
would have to give up. There exists such
a sweeping solution. We do not have to
panic.
The
Expanded Password System, which enables us to make use of autobiographic image
memory that is the least subject to the cognitive phenomenon named “interference
of memory”, also helps enhance the precious text passwords that we have somehow
memorized.
- How to
Solve the Password Problem: Teach Kids When They're Young
My
comment: We cannot remember more than 5
text passwords on average, not because we are silly, lazy or uneducated, but
because our memory of text passwords get too heavily influenced by the “interference
of memory” We cannot run as fast as
horses, not because we are silly, lazy or uneducated.
- Poor
password management leaves service accounts open to attack
“The
latest study has revealed that professionals don’t practice what they preach
when it comes to passwords”
My
comment: What I have long suspected is
now confirmed.
- Password
manager remembers all your passwords
My
comment: Password manager remember all
my passwords and loses all my passwords to criminals as soon as hacked.
*************************************************************************************
*************************************************************************************
About Me
About Expanded Password System
"Mnemonic Guard"
http://mneme.blog.eonet.jp/default/files/outline_of_mnemonic_security.pdf
*************************************************************************************
*************************************************************************************
