Changing Our Password Policy
July 19, 2012 at 11:48 am
(This post was last modified: July 31, 2013 at 6:17 am by Tiberius.)
When I first started these forums nearly 4 years ago, password security was the last thing on my mind. These days, I think about it on a regular basis. Over the last couple of years, various websites have been hacked into, and passwords exposed or cracked.
We've had a very lax password policy so far, with a minimum password length of 8, and absolutely no requirement for complexity. A password of "password" is allowed, for example.
A few days ago, I decided to test how secure our passwords really were, and simulated an attack. I downloaded the password hashes and salts (a value that adds security to a password) from the database, in an anonymized fashion (that is, I did not know which hash corresponded to which user). I then used a cracking program on them with a large password dictionary (over 16 million common passwords) and let it run.
A few hours later, 1,336 out of the 3,670 I'd downloaded were cracked. That means that 36.4% of the passwords were found in a commonly used password dictionary. A brute-force attack on the others was not carried out, but I predict it would have cracked more.
I informed the staff, and we've agreed that due to these results, our password policy needs to change, and we're going to enforce the change on all of our current users. In a few days, I will change the password policy such that all passwords will require complex characters (upper / lower case letters and numbers,) and must be over 12 characters in length. We will then force users to change their passwords before they can use the site again.
We are giving this advanced warning so that our active users are not caught out and confused by the change. If you want to create a complex and memorable password, I suggest using a passphrase (see my article on the subject). I would also recommend using an online password manager like LastPass and using a different password on each website.
Feel free to ask any questions you might have.
- Atheist Forums Staff
Update: Due to a large number of complaints, this no longer applies. If your account get's hacked, it is your own fault.
Update #2: Ignore that last update. If you don't care about other people's security, kindly fuck off.
We've had a very lax password policy so far, with a minimum password length of 8, and absolutely no requirement for complexity. A password of "password" is allowed, for example.
A few days ago, I decided to test how secure our passwords really were, and simulated an attack. I downloaded the password hashes and salts (a value that adds security to a password) from the database, in an anonymized fashion (that is, I did not know which hash corresponded to which user). I then used a cracking program on them with a large password dictionary (over 16 million common passwords) and let it run.
A few hours later, 1,336 out of the 3,670 I'd downloaded were cracked. That means that 36.4% of the passwords were found in a commonly used password dictionary. A brute-force attack on the others was not carried out, but I predict it would have cracked more.
I informed the staff, and we've agreed that due to these results, our password policy needs to change, and we're going to enforce the change on all of our current users. In a few days, I will change the password policy such that all passwords will require complex characters (upper / lower case letters and numbers,) and must be over 12 characters in length. We will then force users to change their passwords before they can use the site again.
We are giving this advanced warning so that our active users are not caught out and confused by the change. If you want to create a complex and memorable password, I suggest using a passphrase (see my article on the subject). I would also recommend using an online password manager like LastPass and using a different password on each website.
Feel free to ask any questions you might have.
- Atheist Forums Staff
Update: Due to a large number of complaints, this no longer applies. If your account get's hacked, it is your own fault.
Update #2: Ignore that last update. If you don't care about other people's security, kindly fuck off.
