Is the end of the password upon us?
Are password-strength requirements getting too hard for humans to handle, and are password-encryption cracking mechanisms improving so quickly that all passwords will soon be useless?
That's what many security experts have been saying for the past couple of years. Their predictions are neatly summarized in a paper recently issued by the global accounting firm Deloitte Touche Tohmatsu.
The paper notes that if everyone used 8-to-12-character passwords spanning all 94 characters on a standard keyboard, hackers would have a hard time extracting any passwords out of data breaches that expose thousands or millions of encrypted passwords.
"But, given human nature and users who struggle to remember long passwords, refuse to regularly change passwords and frequently re-use passwords across accounts, neither longer nor truly random passwords seem likely to be embraced," the Deloitte paper observes sadly.
That's why, for example, Google is working on a tiny chip, worn on a ring, that users can carry at all times and plug into computers for authentication.
Wait, hold on here
But a Cambridge computer scientist thinks such dire predictions about the end of the password are rubbish, and that the real problem is lazy implementation of encryption algorithms.
"Human memory isn’t more of a problem today than it used to be," writes Joseph Bonneau on Light Blue Touchpaper, the security blog of the Cambridge computer lab. "The problem is that we’ve chosen to let password verification become too cheap."
"Password cracking is certainly getting faster," Bonneau, a Californian who finished his Cambridge Ph.D. work last year, wrote. "The good news, though is that password hash functions can (and should) co-evolve to get proportionately costlier to evaluate over time."
Almost all websites encrypt, or "hash," usernames and passwords by running them through mathematical algorithms that output enormous numbers that look like strings of gibberish.
Websites don't even store the real passwords; they store the hash, and compare it to the hash of what you type every time you log in.
Longer, more complicated passwords make it harder for password-cracking software to do its job. So do more complex algorithms that add random data and that re-hash outputs multiple times.
Just a matter of keeping up
Moore's Law, the computing rule of thumb that processor power is always increasing, does indeed make it easier to "crack" the outputs of many older algorithms.
The problem is that many websites don't bother to upgrade to newer, tougher algorithms. More complex algorithms slow computers down, and time is money, especially when milliseconds matter.
The common, fairly simple encryption algorithm "MD5 was launched over 20 years ago and is still the most common implementation I see in the wild, though it’s gone from being relatively expensive to evaluate to extremely cheap," Bonneau wrote. "No serious application should still use it."
"This is a classic arms race and keeping pace simply requires regularly increasing the number of iterations in a password hash," making it more tedious to both encrypt and decrypt passwords, he said.
In other words, the way to make sure password encryption always works is to make sure it's a pain in the butt, no matter how fast computers get.
"Hashing a password must be as slow and costly in real terms 20 years from now, or else security will be lower," Bonneau said.