University of Hertfordshire, profile picture
Uploaded byUniversity of Hertfordshire
PDF, PPTX221 views

How to Design Passwords

The document offers extensive advice on password security, emphasizing the need for strong passwords of at least 12 characters that include a mix of letters, numbers, and symbols, while avoiding common pitfalls such as using obvious substitutions or shared passwords. It critiques the current security practices and emphasizes the importance of diverse methods, including using password managers to manage complexity and enhance security defenses against various threats like social engineering. Additionally, it discusses password entropy and cracking vulnerabilities, illustrating the necessity for heightened protection measures in our increasingly digital landscape.

Embed presentation

Download as PDF, PPTX
H o w To D e s i g n pA55w0rDs:-)petercochrane.com ABC12345def Prof Peter Cochrane OBE Sentient Systems
THE nIGHTMARE! *A different password for each account *Change your passwords regularly *Don’t keep a documented record *Don’t embed them in a browser *Don’t write them down *Don’t tell anyone *Don’t share Guidelines and lots of useful advice that is often impractical and/or impossible:- Make them > 11 characters that include a mix of alpha numerics - upper & lower case plus punctuation marks and special characters…
Public Reality! A fundamental incapability to deal & cope with the complexities and many challenges of IT… Industry needs to produce, deliver and maintain inherently secure products - to get the users out of the Realm of Risk management, including password hell!
OMG - Really ! YES, people are indeed silly We need to do much better than this!
THE Threat Omnipresent Highly motivated Growing by the day Smart Adaptive Resourceful Well organised Global 24 x 7 People Machines Networks AI, Apps, Clouds +++ “Never underestimate the enemy - and never . assume you are smarter than they are”
Passwords in ‘diaries’ Passwords in ‘eMails’ Passwords on ‘post its’ Passwords in ‘open docs’ Passwords on ‘white boards’ Passwords shared ‘between apps’ Passwords shared ‘between peoples’ Passwords shared ‘between web sites’ Passwords used on spoof web sites/services +++++ The Gullibility Threat Social engineering - persuasion - observation - bribes ++ Passwords extracted by ‘smart’ conversationalists, friends, family, associates, colleagues, co-workers ++++
Welcome to password & two factor hell! We need to do much better than this! What do you do when there is no mobile signal or there’s a loooong delay or network fault? You need at least: a net sync’d app embedded on your machine, but ensure it does it imply more risk?
12 Characters, Minimum: There’s no minimum or standardised password length; but in general go for >12 to 14 characters Mix Numbers: Letters, Symbols, Upper & Lower-Case: Many different types makes passwords harder to crack Dictionary Words/Combination: To be avoided as much as possible - any isolated word is bad, and word combinations are also high risk Avoid Obvious Substitutions: Eg, replacing an ‘o’ with ‘0’ is obvious - a 3 for e or E, 2 for z or Z only slightly better - and DO use “, ; -} ] ) et al Number Strings: at the end, beginning or in the middle are also ‘obvious’ Industry Advice For a strong password you ‘at least’ need..
12 Characters, Minimum: There’s no minimum or standardised password length; but in general go for >12 to 14 characters Mix Numbers: Letters, Symbols, Upper & Lower-Case: Many different types makes passwords harder to crack Dictionary Words/Combination: To be avoided as much as possible - any isolated word is bad, and word combinations are also high risk Avoid Obvious Substitutions: Eg, replacing an ‘o’ with ‘0’ is obvious - a 3 for e or E, 2 for z or Z only slightly better - and DO use “, ; -} ] ) et al Number Strings: at the end, beginning or in the middle are also ‘obvious’ Industry Advice For a strong password you ‘at least’ need.. Machines are fast intelligent exhaustive with extensive libraries One size does not fit all people and machines present different risks people are slow and get exhausted and use different methods
For a strong password you ‘at least’ need.. The snag is you are one click away from losing everything! And so another much bigger security fail/fail pops up and kills you stone dead! “The secret to good security is to design (in) ‘fail-safe’ and ‘fail-gracefully’ with ‘layered’ protection and multiple routes to recovery “All your ‘eggs’ in one basket is the dumbest and riskiest solution of all “ Strong Advice A password generator and management system
Password Managers D e l e g a t i n g t h e n i g h t m a r e t o m a c h i n e s Mostly Software embedded in browser plugins/web services to automatically manage user credentials They auto-paste (names/ID/email addresses) passwords into login forms, or simulate typing them, and generally support: •Printable characters •Passwords >64 characters •Pasting username and password
Password Managers D e l e g a t i n g t h e n i g h t m a r e t o m a c h i n e s Mostly Software embedded in browser plugins/web services to automatically manage user credentials They auto-paste (names/ID/email addresses) passwords into login forms, or simulate typing them, and generally support: •Printable characters •Passwords >64 characters •Pasting username and password don’t rely on one app alone m ake sure you engage a degree of diversity
Password Managers D e l e g a t i n g t h e c o m p l e x i t y t o m a c h i n e s Also, choose embedded password generators with many user choices:- Length Upper Case Lower Case Numbers Symbols Special Characters Similar Characters Generate on Device Generate on Server Auto-Select New Password https://digital.com/blog/best-strong-password-generators/
Password Managers W h y y o u n e e d / s h o u l d a l w a y s u s e o n e ! W h a t c o u l d p o s s i b l y g o w r o n g ? •Yo u r d e v i c e / m a c h i n e i s s t o l e n / b r o k e n / f a i l s / d i e s •A s o f t w a r e u p g r a d e s c r a m b l e s e v e r y t h i n g •Yo u r b a c k u p / r e c o v e r y p r o c e s s f a i l s •M a l w a r e f r e e z e s e v e r y t h i n g •T h e A p p / B r o w s e r f a i l s ………………..
REALITY CHECK Diversity-essential to survival Confounding the enemy by the reduction of habituality - and the introduction of the new, unexpected, surprises, and a reduction of discernible patterns… At best you will prevent a break in, and at worst you should slow and impede the Dark Side to cost them time and $$$$ Vary your methods and measures as much/frequently as is reasonably possible. Maximise the total Entropy of your defences
REALITY CHECK Diversity-essential to survival Beware of ‘Common Mode Failures’ due to an over reliance on one technology choice/route, or by being blind sided and/or overconfident in you choices, products, and engineering solutions. “Fortresses tend to remain relatively static whilst methods of attack always evolve” Get someone to attack and test your defences and solution(s)…never be so sure that you got it all right first time around…or indeed that it all exhibits longevity!
Use a password and/or document/ file/folder encryption… Strongest Advice For protected documents that may be accessed The concatenation by layers can add exponential difficulty for any attacker Obscuration by volume and location is also an effective mode of protection Password protect at every layer
Strongest Advice Use every weapon of defence you have available Do not rely on any one technique Respond rapidly to surprises Be prepared to be adaptive Use all available options Keep on top of new attack technologies - adapt and evolve on the fly…
CrEating your own Making life very difficult for The Dark Side IcannaTellythee Thi5i5th3b35tIcand0 Non-standard/Novel solutions can be hard/expensive to defeat
Degrees of Freedom Exploiting as many as possible @ the same time 26 Letters - Lower Case 26 Letters - Upper Case 10 Digits 36 Other } 96 Options per password character
Password Entropy The more disorder the harder it is to crack Password Entropy = log2(Nn ) = n log2(N) Where N = Number of character options (ie ~96 for standard QWERTY keyboard) And n = Number of characters in the password Recognisable words and phrases + repeated characters + similar characters represent degrees of order that increase the likelihood that a password will be cracked. The bigger the Entropy/Disorder the stronger the password!
Dominant Component T h e e n t r o p y o r d e r / d i s o r d e r b r e a k p o i n t Password Entropy = n log2(N) The ‘breakpoint’ is at n = log2(N) ie the password length ’n’ overtakes the number of possible character states ’N’ as the dominant factor All ‘viable’ passwords lie in the range n >> log2(N)
viable length F o r a g i v e n a p p / p r o t e c t i o n In the proximity of the break point: N = 10 then   n > 3 = 104 symbol states <<< 1s (n = 4) N = 26 n > 4 = 1.2 x 107 << 1s (n = 5) N = 52 n > 5 = 1.2 x 1010 < 1s (n = 6) N = 62 n > 5 = 5.7 x1010 < 1m (n = 6) N = 98 n > 6 = 8.7 x1013 < 10m (n = 7) Relative Computing Time to Crack
Ball Park Guide The entropy order/disorder breakpoint Password Length/Strength experience to 2019: 4 = Very Weak - puts you at risk 5 = Weak - just about OK for device password 8 = Fairly Strong for secure network access passwords 10 = Strong for secure access to company websites and data 16 = Very Strong for securing commercial and financial data access 22+ = Hyper Secure for encryption While a password with ~50 bits may be deemed ‘semi-safe’ in 2019, it is only a matter of time until more powerful GPUs, will see password cracking accelerate!
E n t r o p y G u i d e The entropy growth linearity… Length: 15, 16, 17, 18, 19 Strength: Strong (>16) - Safeguards sensitive information like financial records Entropy: 92.6 bits, 100 bits, 106.7 bits, 113.9 bits, 121.9 Empirical Security Threshold ~ 100 bits
T H I N K F U T U R E The ‘clicks/nulls’ are easy to find Beware of the dummy clicks on some of the later models - they can throw you off the track to eventual success ! It is easy to teach a child to crack locks of this kind!
No Feel or sound Owners have the upper hand at this point But the enemy only needs a weak or silly password to b r e a k i n a n d a s s u m e full control…and t h e n t h e f u n really starts! M o s t b r e a k - i n s a t t h i s l e ve l a r e d o w n t o t h e o w n e r / u s e r n a i v e t y, l a x i t y, a n d / o r i n f o r m a t i o n g a i n e d f r o m s o m e e x t e r n a l s o u r c e …
cracking Challenge Access limited to the keyboard and screen only Human typing speed What can be guessed Try all common passwords Brute Force Trial and Error Phishing/Spear-Phishing Social Engineering Prior Observation WiFi Break-in BlueTooth Break-in Identical browser data ? Same password for all ? Similar format for all ? Common key storage ? All BlueTooth Linked ? Public Data ? Social Nets ? Family Data? Publications? Hobbies? Likes ? Finger Face Print Spoof One device hit/ stolen: then all c a n b e l o c k e d d o w n w h e n o n line + location & pics of thief can be tracked /recorded Additions include 3 s t r i ke f re e ze - outs for 5, 15, 60 min, followed by p ro v i d e r g e n e ra l security alert
I n v i s i b l e t o u s ! Network, site, service and app attacks Wa y b e y o n d h u m a n s c a l e a n d m e n t a l a b i l i t i e s , b u t w e m u s t s t a r t w i t h a level of fundamental security based on a s t r o n g p a s s w o r d p ro t e c t e d c o re a n d connected devices Concatenated complexity can be employed to confound the e n e m y…ve r y h a rd f o r t h e m a n d ve r y e a s y f o r u s !
cracking TASK A prime driver of Password design Secure Comms Encrypted Vault Encrypted File Private Key Public Key E-Commerce Bank Account Financial Apps Network Apps Websites Documents E-Mail Personal Computer Work Station Mobile Device Bicycle Lock STRENGTH Password Name/ID Factors Very-Low Medium-High Optional Low-Medium Optional Extreme No Exceptions Very-Strong No Exceptions Extremely Dynamic Static Mechanically Set Dynamic Choice Discipline Changed Occasionally Regularly Randomly NEED Risk Exposure Driven Centuries Millenia Decades Years Minutes Time to Crack
Making it Safer C o n c a t e n a t i o n o f t h e s i m p l e C u s t o m e r N u m b e r, P a s s w o rd + invisible biome tri cs and ID/app checks+++ T h r e e f a i l e d t r i e s w i t h a n y i n c o r re c t o r s u s p i c i o u s e n t r i e s / information and the u s er is th e frozen out for a period. The ‘ f r e e z e o u t ’ p e r i o d i s t h e n progressively extended on every repeated log-in attempt: security d e p a r t m e n t i s a l e r t e d a n d c u s t o m e r s a r e a s k e d t o s t a r t from a new log on process
Password Libraries! Extensive collections built from successful hacks There are organisations collecting & marketing Passwords, PINs, ID and Card info on a business basis across the internet…and ‘The Dark Side’ is a prime mover and key player… Libraries are now a key component of the leading edge password attack engines/machines The Dark Side are not the only ones using such libraries ! Criminal Hackers Rogue States State Security Services
Always use A Checker T h e y g i ve ‘ B r u t e F o rc e’ c ra c k i n g t i m e e s t i m a t e s B e w a r e t h a t t h e y a r e based on computing power t o d a y, a n d n o t t h e f u t u re ! NOTE : ‘Brut e F orce’ im pli es e x h a u s t i v e s e a r c h i n g w i t h no a priori sophistication…. ie, t he use of lib rari es i s not the norm here! Dozens available: and it is worth testing a range…
For M o dest Security C h o o s e s o m e t h i n g e a s y t o re m e m b e r & m o d i f y VerseProseDatesPlacesNames ++++++
I wandered lonely as a cloud That floats o’er vales and hills, When all at once I saw a crowd I w l a a c Wa a o I s a c I w 1 a A c Wa 1 2 D a y s I w 1 a A c Wa A o 4 Ye a r s I w 1 a A c Wa A o I 5 4 C I w 1 a A c Wa A o I 5 a C 3 2 7 C I w 1 a A c Wa A o I 5 a C £ $ 1 0 K C + Wordsworth F a v o u r i t e P r o s e / P o e m s T h e t r i c k i s t o d e s t r o y / d i s g u i s e / o b s c u r e l e t t e r p a t t e r n s t h a t m i g h t h j e l p m a c h i n e s i d e n t i f y s e n t e n c e s a n d v e r s e s U s i n g o n l y t h e f i r s t o r l a s t l e t t e r i s a s t a r t , b u t u s i n g e v e r y o t h e r l e t t e r p l u s s y m b o l o b s c u r a t i o n i s b e t t e r !
Do not go qentle into that good night o t o e o t d t o t o e o t d t 1 2 D a y s O To e 0 t d 7 4 M o n t h O To e 0 7 d t ! 4 Ye a r s O To e 0 7 d t ! 6 9 3 3 Ye a r s £ O To e 0 7 d t ! 6 9 4 C P a s s w o r d g e n e r a t i o n b y a n a l g o r i t h m o f y o u r f a v o u r i t e v e r s e a n d o n e m e m o r a b l e y e a r s DYLAN THOMAS
M o s t s m a r t a t t a c k e n g i n e s w i l l e v e n t u a l l y d e c o d e p a s s w o r d s b a s e d o n p ro s e a n d v e r s e f o r a l l c o m m o n l y re a d t e x t … b e s t c h o o s e s o m e t h i n g r a r e / o b s c u r e … s p e c i a l t o y o u a n d y o u r l i f e r e m e m b r a n c e s … S m a r t m a c h i n e s Awa re o f Wo rd s wo r t h & T h o m a s e t a l
E n h a n c i n g S e c u r i t y S t a r t f ro m a c a t a l o g u e o f t h i n g s o n l y y o u k n o w Layering algorithmic complexity to increase the Entropy
All about you Known by you and you alone WHO WE: Are; Know; Met; Loved; Married; +++ H O W W E : L e a r n e d t o D r i v e ; We re E d u c a t e d ; + + + W H Y W E : D e c i d e d ( Y ) ; P u r c h a s e d ( Z ) ; + + + WHAT WE: D o ; D i d ; L i k e ; B e l i e v e ; Re a d ; + + + WHERE WE: L i v e d ; V i s i t ; P ro p o s e d ; M a r r i e d ; + + +
algorithmic vectors Carpenter Space Shuttle Constructing; not remembering passwords Something you: - Do - Did - Saw - Are - Said - Were - Know - Admire - Possess - Possessed - Remember - Understand Hillman Imp Drill C r S e D l H n I p C r 5 3 D 4 H n 1 p ! ! 4C to Crack login vectors Constructing - not remembering Carpenter Space Shuttle Algorithmic construction by the concatenation of elements only known by you…
Enhancing login vectors Perhaps a line from a song: “Its a kind of magic” 15akd0fmc! <4 Years to Crack Plenty strong enough for a laptop log-in or document password Perhaps a line from a book: “It was the best of times” 1tw573bt0fts <4 C to Crack Something you like to sing and/or listen to… Algorithmic construction by the concatenation of elements only known by you…
Enhancing login vectors Something between lovers or parent and child: I will always be here for you no matter How I love thee more than life itself H w 1 4 3 7 e m 3 t n 4 e i f ! ! 1 w 1 a s b 3 h e f r y u n 0 m r ! >10kC to Crack >10kC to Crack Something unique you said or promised within your family Algorithmic construction by the concatenation of elements only known by you…
Concatenating numerous very low cost biometrics is extremely powerful… - Eye 10 -3 @ < $5 - Face 10 -2 @ < $2 - Hand 10 -3 @ < $2 - Voice 10 -3 @ < $2 - Typing 10 -3 @ < $2 - Habits 10 -2 @ < $1 - Devices 10 -1 @ < $1 - Locations 10 -2 @ < $1 - ++++ Password ++ The typing rhythm at an ATM is unique and very cheap to recognise… Morse Code experience was the pre-cursor to this solution… Error Probability <10 -8 @ < $6 Obscuration by ’n' layers
Automate the process Choose a (or >1) reputable password generator Ensure that it is fit for purpose and that you choose sensible settings by application and by need
Overview A proportional view Device > 6…defeats humans Web Site >10…concatenate Document >12 - 16 Encryption >14 - 32 Membership >14…concatenate Social Networks >14…concatenate Financial Services >16 - 32…concatenate Concatenate = May Include: ID/PIN,Password/Questions/3 Try Limit/ BioMetrics/Random CheckBack/ 2/3 Factor Authentication/++
l a y e r e d S e c u r i t y Ex p onent ially increasing the entropy challenge 6 Digit PIN > 8 Character Password Name/ID > 10 Character Password Name/ID > 14 Character Password Name/ID + PIN >16 Character Password BackEnd BIOMetrics Up Front BIOMetrics
T h e r e i s a l w a y s a t h r e a t R E M E M B E R I t i s s m a r t : S h a r i n g R u t h l e s s D y n a m i c L e a r n i n g A d a p t i n g C o n s t a n t M o t i v a t e d N e t w o r ke d + + + B e yo n d T h e L a w F o r M o r e G OTO : https://bit.ly/2F0y6in https://bit.ly/2SuwVzL https://bit.ly/2FcCtqR https://bit.ly/2SxHsKv https://bit.ly/2QsmBWb https://bit.ly/2MBED7v https://bit.ly/39mJNxB
Thank You 57Ay5af3K33p53CuR3 Make it very hard for the enemy - everything is at stake! petercochrane.com

More Related Content

PDF
Biometrics of ID and Security
byUniversity of Hertfordshire
 
PDF
Voip Cyber Security
byUniversity of Hertfordshire
 
PDF
CYBER DEFENCE SCENARIOS - Part 2: Building The Blue Team
byUniversity of Hertfordshire
 
PDF
Voip realities and realisations
byUniversity of Hertfordshire
 
PDF
CYBER ATTACK SCENARIOS - Part 1: Building The Red Team
byUniversity of Hertfordshire
 
PDF
Wireless Past Present Future
byUniversity of Hertfordshire
 
PDF
QUANTUM COMPUTING REALITY CHECK
byUniversity of Hertfordshire
 
PDF
Cyber Security in a Fully Mobile World
byUniversity of Hertfordshire
 
Biometrics of ID and Security
byUniversity of Hertfordshire
 
Voip Cyber Security
byUniversity of Hertfordshire
 
CYBER DEFENCE SCENARIOS - Part 2: Building The Blue Team
byUniversity of Hertfordshire
 
Voip realities and realisations
byUniversity of Hertfordshire
 
CYBER ATTACK SCENARIOS - Part 1: Building The Red Team
byUniversity of Hertfordshire
 
Wireless Past Present Future
byUniversity of Hertfordshire
 
QUANTUM COMPUTING REALITY CHECK
byUniversity of Hertfordshire
 
Cyber Security in a Fully Mobile World
byUniversity of Hertfordshire
 

What's hot

PDF
Surveillance society
byUniversity of Hertfordshire
 
PDF
Cyber Security - Becoming Evil
byUniversity of Hertfordshire
 
PDF
Demystifying Information Theory
byUniversity of Hertfordshire
 
PDF
TRUTH, SITUATION, & CONTEXT AWARENESS
byUniversity of Hertfordshire
 
PDF
Cyber Security - Thinking Like The Enemy
byUniversity of Hertfordshire
 
PDF
The Scientific Method
byUniversity of Hertfordshire
 
PDF
Its My Data Not Yours!
byUniversity of Hertfordshire
 
PPT
Working With Parliamentarians On Srh In Ghana
byIDS
 
PPTX
Managing a Crisis in the New World of Social Media
byali Bullock
 
PDF
Futuretronium Book 100.0 (The Revolution II)! By Andres Agostini at http://li...
byAndres Agostini, Future Knowledgist
 
PDF
AUA Data Science Meetup
byDavid Gevorkyan
 
PDF
In pursuit of messaging broker(s)
byDavid Gevorkyan
 
PDF
DATA FLOWS & NATIONAL SECURITY
byMartina F. Ferracane
 
PPTX
Will 3D printing change everything?
byMartina F. Ferracane
 
PDF
Futuretronium Book 100.0 (The Revolution II)! By Andres Agostini at http://li...
byAndres Agostini, Polymath Futurist
 
PDF
Pintrace: Distributed tracing @Pinterest
bySuman Karumuri
 
PDF
Pintrace: Distributed tracing@Pinterest
bySuman Karumuri
 
PDF
Ninja Correlation of APT Binaries
byCODE BLUE
 
PDF
Consequences of an Insightful Algorithm
byCarina C. Zona
 
Surveillance society
byUniversity of Hertfordshire
 
Cyber Security - Becoming Evil
byUniversity of Hertfordshire
 
Demystifying Information Theory
byUniversity of Hertfordshire
 
TRUTH, SITUATION, & CONTEXT AWARENESS
byUniversity of Hertfordshire
 
Cyber Security - Thinking Like The Enemy
byUniversity of Hertfordshire
 
The Scientific Method
byUniversity of Hertfordshire
 
Its My Data Not Yours!
byUniversity of Hertfordshire
 
Working With Parliamentarians On Srh In Ghana
byIDS
 
Managing a Crisis in the New World of Social Media
byali Bullock
 
Futuretronium Book 100.0 (The Revolution II)! By Andres Agostini at http://li...
byAndres Agostini, Future Knowledgist
 
AUA Data Science Meetup
byDavid Gevorkyan
 
In pursuit of messaging broker(s)
byDavid Gevorkyan
 
DATA FLOWS & NATIONAL SECURITY
byMartina F. Ferracane
 
Will 3D printing change everything?
byMartina F. Ferracane
 
Futuretronium Book 100.0 (The Revolution II)! By Andres Agostini at http://li...
byAndres Agostini, Polymath Futurist
 
Pintrace: Distributed tracing @Pinterest
bySuman Karumuri
 
Pintrace: Distributed tracing@Pinterest
bySuman Karumuri
 
Ninja Correlation of APT Binaries
byCODE BLUE
 
Consequences of an Insightful Algorithm
byCarina C. Zona
 

Similar to How to Design Passwords

PDF
User Authentication: Passwords and Beyond
byJim Fenton
 
PDF
Password Strength Policy Query
byGloria Stoilova
 
DOC
Password Policies
byallengalvan
 
PPTX
Improving Password Based Security
byRare Input
 
PDF
Password Management
byRick Chin
 
PDF
Why is password protection a fallacy a point of view
bySTO STRATEGY
 
PDF
Password Security
byCSCJournals
 
PDF
English presentation for English class
byYuto Shoji
 
ODP
Passwords
byKevin OBrien
 
PDF
PASSWORD BEST PRACTICES
byRazorpoint Security
 
PPTX
2 Laymans Course - LAMP V2.pptx
byssuser2f0fb0
 
PPTX
P@ssw0rds
byWill Alexander
 
PPTX
Personal Internet Security System
byMatthew Bricker
 
PPTX
Password management
byWilmington University
 
PDF
The strategies of password
byAlimasmali3
 
PDF
Authetication ppt
byPranav Doshi
 
PPTX
Brute force-attack presentation
byMahmoud Ibra
 
PDF
8 passwordsecurity
byricharddxd
 
PDF
SBA Live Academy - Passwords: Policy and Storage with NIST SP800-63b by Jim M...
bySBA Research
 
PPTX
The strategies of password
byMohammedAlhamoodi
 
User Authentication: Passwords and Beyond
byJim Fenton
 
Password Strength Policy Query
byGloria Stoilova
 
Password Policies
byallengalvan
 
Improving Password Based Security
byRare Input
 
Password Management
byRick Chin
 
Why is password protection a fallacy a point of view
bySTO STRATEGY
 
Password Security
byCSCJournals
 
English presentation for English class
byYuto Shoji
 
Passwords
byKevin OBrien
 
PASSWORD BEST PRACTICES
byRazorpoint Security
 
2 Laymans Course - LAMP V2.pptx
byssuser2f0fb0
 
P@ssw0rds
byWill Alexander
 
Personal Internet Security System
byMatthew Bricker
 
Password management
byWilmington University
 
The strategies of password
byAlimasmali3
 
Authetication ppt
byPranav Doshi
 
Brute force-attack presentation
byMahmoud Ibra
 
8 passwordsecurity
byricharddxd
 
SBA Live Academy - Passwords: Policy and Storage with NIST SP800-63b by Jim M...
bySBA Research
 
The strategies of password
byMohammedAlhamoodi
 

More from University of Hertfordshire

PDF
Mission Critical Mission Critical Science & Engineering November 2025.pdf
byUniversity of Hertfordshire
 
PDF
Research Methodologies in Business, Society, Engineering and Science
byUniversity of Hertfordshire
 
PDF
Advanced Soft Computing BINUS July 2025.pdf
byUniversity of Hertfordshire
 
PDF
Advanced IT Governance
byUniversity of Hertfordshire
 
PDF
Why AI is Needed Procurement and Supply Chains
byUniversity of Hertfordshire
 
PDF
Future Networking v Energy Limits ICTON 2024 Bari Italy
byUniversity of Hertfordshire
 
PDF
Applied Science: Thermodynamics, Laws & Methodology.pdf
byUniversity of Hertfordshire
 
PDF
Quantifying Artificial Intelligence and What Comes Next!
byUniversity of Hertfordshire
 
PDF
The Philosophy of Science
byUniversity of Hertfordshire
 
PDF
Future Telecoms Challenges & Opportunities
byUniversity of Hertfordshire
 
PDF
Thermodynamics - Laws Embracing Our Universe
byUniversity of Hertfordshire
 
PDF
Applied Science - Engineering Systems
byUniversity of Hertfordshire
 
PDF
IoT Yet to Come
byUniversity of Hertfordshire
 
PDF
The Scientific Meme
byUniversity of Hertfordshire
 
PDF
Uncanny Valley and Human Destiny
byUniversity of Hertfordshire
 
PDF
Resurgence of Technology Driven Change
byUniversity of Hertfordshire
 
PDF
Society 5.0: A Vital Symbiosis
byUniversity of Hertfordshire
 
PDF
Cyber Portents and Precursors
byUniversity of Hertfordshire
 
PDF
Technology Overlords Or A Symbiosis ?
byUniversity of Hertfordshire
 
PDF
THE FUTURE OF MOBILE NETWORKS
byUniversity of Hertfordshire
 
Mission Critical Mission Critical Science & Engineering November 2025.pdf
byUniversity of Hertfordshire
 
Research Methodologies in Business, Society, Engineering and Science
byUniversity of Hertfordshire
 
Advanced Soft Computing BINUS July 2025.pdf
byUniversity of Hertfordshire
 
Advanced IT Governance
byUniversity of Hertfordshire
 
Why AI is Needed Procurement and Supply Chains
byUniversity of Hertfordshire
 
Future Networking v Energy Limits ICTON 2024 Bari Italy
byUniversity of Hertfordshire
 
Applied Science: Thermodynamics, Laws & Methodology.pdf
byUniversity of Hertfordshire
 
Quantifying Artificial Intelligence and What Comes Next!
byUniversity of Hertfordshire
 
The Philosophy of Science
byUniversity of Hertfordshire
 
Future Telecoms Challenges & Opportunities
byUniversity of Hertfordshire
 
Thermodynamics - Laws Embracing Our Universe
byUniversity of Hertfordshire
 
Applied Science - Engineering Systems
byUniversity of Hertfordshire
 
IoT Yet to Come
byUniversity of Hertfordshire
 
The Scientific Meme
byUniversity of Hertfordshire
 
Uncanny Valley and Human Destiny
byUniversity of Hertfordshire
 
Resurgence of Technology Driven Change
byUniversity of Hertfordshire
 
Society 5.0: A Vital Symbiosis
byUniversity of Hertfordshire
 
Cyber Portents and Precursors
byUniversity of Hertfordshire
 
Technology Overlords Or A Symbiosis ?
byUniversity of Hertfordshire
 
THE FUTURE OF MOBILE NETWORKS
byUniversity of Hertfordshire
 

Recently uploaded

PDF
Unlocking Gen AI Capabilities Within UiPath Document Understanding
byDianaGray10
 
PDF
5G Explained! A High Level Overview [Introduction]
byLuciano Motta
 
PDF
TopMate ES11 3-Wheel Electric Scooter: Comfort, Stability, and Independence f...
byTopmate
 
PDF
MINDCTI Revenue Release Quarter 3 2025 - Financial Presentation
byMIND CTI
 
PPTX
Mastering SQL Server Replication: Types, Setup & Troubleshooting
byGeoPITS Global Pvt Ltd
 
PDF
What ONIX can do: Leveraging metadata to support the discoverability of First...
byBookNet Canada
 
PPTX
API Gateway Architecture - Technical Report 2026
byPowersoft2026
 
PDF
Agentic AI Roadmap 2026: Mastering Autonomous AI Workflows and Systems
byAeafat Ahmed Mubin
 
PPTX
Coded Agents – with UiPath SDK + LlamaIndex.pptx
bysuhanisingh58689
 
PPTX
Storage-and-HCI-Positioning-update-sales.pptx
byhungungphu123
 
PPTX
Advance Computer Architecture Lecture 4.pptx
byBottshikanBottshikan
 
PDF
Azure DevOps Managed Services: Driving Speed, Security, and Business Growth
byjohncarterjn
 
PDF
Ethical AI applied to publishing: Presenting wâsikan kisewâtisiwin, an AI too...
byBookNet Canada
 
PPTX
SOFTWARE DEVELOPMENT PROCESS - INTRODUCTION
byParithi Thamizh
 
PDF
What Is AI LXP and Why Enterprises Are Adopting It.pdf
byneuralminds4
 
PPTX
Robot Vacuums are Cleaning Up. The global robot vacuum segment has high marke...
byRobert March
 
PDF
Presentation of Cybersecurity and data protection
bytarikaityahya2
 
DOCX
Best Web to Learn About Buying Verified Skrill Accounts (Los Angeles).docx
byhttps://topsellerit.com/product/buy-verified-binance-accounts/
 
PPTX
AI Meets DBA Transforming Database Administration with Intelligence
byGeoPITS Global Pvt Ltd
 
PPTX
The Abomination of AI – keynote at ICoSCI 2026
byAlan Dix
 
Unlocking Gen AI Capabilities Within UiPath Document Understanding
byDianaGray10
 
5G Explained! A High Level Overview [Introduction]
byLuciano Motta
 
TopMate ES11 3-Wheel Electric Scooter: Comfort, Stability, and Independence f...
byTopmate
 
MINDCTI Revenue Release Quarter 3 2025 - Financial Presentation
byMIND CTI
 
Mastering SQL Server Replication: Types, Setup & Troubleshooting
byGeoPITS Global Pvt Ltd
 
What ONIX can do: Leveraging metadata to support the discoverability of First...
byBookNet Canada
 
API Gateway Architecture - Technical Report 2026
byPowersoft2026
 
Agentic AI Roadmap 2026: Mastering Autonomous AI Workflows and Systems
byAeafat Ahmed Mubin
 
Coded Agents – with UiPath SDK + LlamaIndex.pptx
bysuhanisingh58689
 
Storage-and-HCI-Positioning-update-sales.pptx
byhungungphu123
 
Advance Computer Architecture Lecture 4.pptx
byBottshikanBottshikan
 
Azure DevOps Managed Services: Driving Speed, Security, and Business Growth
byjohncarterjn
 
Ethical AI applied to publishing: Presenting wâsikan kisewâtisiwin, an AI too...
byBookNet Canada
 
SOFTWARE DEVELOPMENT PROCESS - INTRODUCTION
byParithi Thamizh
 
What Is AI LXP and Why Enterprises Are Adopting It.pdf
byneuralminds4
 
Robot Vacuums are Cleaning Up. The global robot vacuum segment has high marke...
byRobert March
 
Presentation of Cybersecurity and data protection
bytarikaityahya2
 
Best Web to Learn About Buying Verified Skrill Accounts (Los Angeles).docx
byhttps://topsellerit.com/product/buy-verified-binance-accounts/
 
AI Meets DBA Transforming Database Administration with Intelligence
byGeoPITS Global Pvt Ltd
 
The Abomination of AI – keynote at ICoSCI 2026
byAlan Dix
 

How to Design Passwords

  • 1.
    H o wTo D e s i g n pA55w0rDs:-)petercochrane.com ABC12345def Prof Peter Cochrane OBE Sentient Systems
  • 2.
    THE nIGHTMARE! *A differentpassword for each account *Change your passwords regularly *Don’t keep a documented record *Don’t embed them in a browser *Don’t write them down *Don’t tell anyone *Don’t share Guidelines and lots of useful advice that is often impractical and/or impossible:- Make them > 11 characters that include a mix of alpha numerics - upper & lower case plus punctuation marks and special characters…
  • 3.
    Public Reality! A fundamentalincapability to deal & cope with the complexities and many challenges of IT… Industry needs to produce, deliver and maintain inherently secure products - to get the users out of the Realm of Risk management, including password hell!
  • 4.
    OMG - Really! YES, people are indeed silly We need to do much better than this!
  • 5.
    THE Threat Omnipresent Highly motivated Growingby the day Smart Adaptive Resourceful Well organised Global 24 x 7 People Machines Networks AI, Apps, Clouds +++ “Never underestimate the enemy - and never . assume you are smarter than they are”
  • 6.
    Passwords in ‘diaries’ Passwordsin ‘eMails’ Passwords on ‘post its’ Passwords in ‘open docs’ Passwords on ‘white boards’ Passwords shared ‘between apps’ Passwords shared ‘between peoples’ Passwords shared ‘between web sites’ Passwords used on spoof web sites/services +++++ The Gullibility Threat Social engineering - persuasion - observation - bribes ++ Passwords extracted by ‘smart’ conversationalists, friends, family, associates, colleagues, co-workers ++++
  • 7.
    Welcome to password& two factor hell! We need to do much better than this! What do you do when there is no mobile signal or there’s a loooong delay or network fault? You need at least: a net sync’d app embedded on your machine, but ensure it does it imply more risk?
  • 8.
    12 Characters, Minimum:There’s no minimum or standardised password length; but in general go for >12 to 14 characters Mix Numbers: Letters, Symbols, Upper & Lower-Case: Many different types makes passwords harder to crack Dictionary Words/Combination: To be avoided as much as possible - any isolated word is bad, and word combinations are also high risk Avoid Obvious Substitutions: Eg, replacing an ‘o’ with ‘0’ is obvious - a 3 for e or E, 2 for z or Z only slightly better - and DO use “, ; -} ] ) et al Number Strings: at the end, beginning or in the middle are also ‘obvious’ Industry Advice For a strong password you ‘at least’ need..
  • 9.
    12 Characters, Minimum:There’s no minimum or standardised password length; but in general go for >12 to 14 characters Mix Numbers: Letters, Symbols, Upper & Lower-Case: Many different types makes passwords harder to crack Dictionary Words/Combination: To be avoided as much as possible - any isolated word is bad, and word combinations are also high risk Avoid Obvious Substitutions: Eg, replacing an ‘o’ with ‘0’ is obvious - a 3 for e or E, 2 for z or Z only slightly better - and DO use “, ; -} ] ) et al Number Strings: at the end, beginning or in the middle are also ‘obvious’ Industry Advice For a strong password you ‘at least’ need.. Machines are fast intelligent exhaustive with extensive libraries One size does not fit all people and machines present different risks people are slow and get exhausted and use different methods
  • 10.
    For a strongpassword you ‘at least’ need.. The snag is you are one click away from losing everything! And so another much bigger security fail/fail pops up and kills you stone dead! “The secret to good security is to design (in) ‘fail-safe’ and ‘fail-gracefully’ with ‘layered’ protection and multiple routes to recovery “All your ‘eggs’ in one basket is the dumbest and riskiest solution of all “ Strong Advice A password generator and management system
  • 11.
    Password Managers D el e g a t i n g t h e n i g h t m a r e t o m a c h i n e s Mostly Software embedded in browser plugins/web services to automatically manage user credentials They auto-paste (names/ID/email addresses) passwords into login forms, or simulate typing them, and generally support: •Printable characters •Passwords >64 characters •Pasting username and password
  • 12.
    Password Managers D el e g a t i n g t h e n i g h t m a r e t o m a c h i n e s Mostly Software embedded in browser plugins/web services to automatically manage user credentials They auto-paste (names/ID/email addresses) passwords into login forms, or simulate typing them, and generally support: •Printable characters •Passwords >64 characters •Pasting username and password don’t rely on one app alone m ake sure you engage a degree of diversity
  • 13.
    Password Managers D el e g a t i n g t h e c o m p l e x i t y t o m a c h i n e s Also, choose embedded password generators with many user choices:- Length Upper Case Lower Case Numbers Symbols Special Characters Similar Characters Generate on Device Generate on Server Auto-Select New Password https://digital.com/blog/best-strong-password-generators/
  • 14.
    Password Managers W hy y o u n e e d / s h o u l d a l w a y s u s e o n e ! W h a t c o u l d p o s s i b l y g o w r o n g ? •Yo u r d e v i c e / m a c h i n e i s s t o l e n / b r o k e n / f a i l s / d i e s •A s o f t w a r e u p g r a d e s c r a m b l e s e v e r y t h i n g •Yo u r b a c k u p / r e c o v e r y p r o c e s s f a i l s •M a l w a r e f r e e z e s e v e r y t h i n g •T h e A p p / B r o w s e r f a i l s ………………..
  • 15.
    REALITY CHECK Diversity-essential tosurvival Confounding the enemy by the reduction of habituality - and the introduction of the new, unexpected, surprises, and a reduction of discernible patterns… At best you will prevent a break in, and at worst you should slow and impede the Dark Side to cost them time and $$$$ Vary your methods and measures as much/frequently as is reasonably possible. Maximise the total Entropy of your defences
  • 16.
    REALITY CHECK Diversity-essential tosurvival Beware of ‘Common Mode Failures’ due to an over reliance on one technology choice/route, or by being blind sided and/or overconfident in you choices, products, and engineering solutions. “Fortresses tend to remain relatively static whilst methods of attack always evolve” Get someone to attack and test your defences and solution(s)…never be so sure that you got it all right first time around…or indeed that it all exhibits longevity!
  • 17.
    Use a passwordand/or document/ file/folder encryption… Strongest Advice For protected documents that may be accessed The concatenation by layers can add exponential difficulty for any attacker Obscuration by volume and location is also an effective mode of protection Password protect at every layer
  • 18.
    Strongest Advice Use everyweapon of defence you have available Do not rely on any one technique Respond rapidly to surprises Be prepared to be adaptive Use all available options Keep on top of new attack technologies - adapt and evolve on the fly…
  • 19.
    CrEating your own Makinglife very difficult for The Dark Side IcannaTellythee Thi5i5th3b35tIcand0 Non-standard/Novel solutions can be hard/expensive to defeat
  • 20.
    Degrees of Freedom Exploitingas many as possible @ the same time 26 Letters - Lower Case 26 Letters - Upper Case 10 Digits 36 Other } 96 Options per password character
  • 21.
    Password Entropy The moredisorder the harder it is to crack Password Entropy = log2(Nn ) = n log2(N) Where N = Number of character options (ie ~96 for standard QWERTY keyboard) And n = Number of characters in the password Recognisable words and phrases + repeated characters + similar characters represent degrees of order that increase the likelihood that a password will be cracked. The bigger the Entropy/Disorder the stronger the password!
  • 22.
    Dominant Component T he e n t r o p y o r d e r / d i s o r d e r b r e a k p o i n t Password Entropy = n log2(N) The ‘breakpoint’ is at n = log2(N) ie the password length ’n’ overtakes the number of possible character states ’N’ as the dominant factor All ‘viable’ passwords lie in the range n >> log2(N)
  • 23.
    viable length F or a g i v e n a p p / p r o t e c t i o n In the proximity of the break point: N = 10 then   n > 3 = 104 symbol states <<< 1s (n = 4) N = 26 n > 4 = 1.2 x 107 << 1s (n = 5) N = 52 n > 5 = 1.2 x 1010 < 1s (n = 6) N = 62 n > 5 = 5.7 x1010 < 1m (n = 6) N = 98 n > 6 = 8.7 x1013 < 10m (n = 7) Relative Computing Time to Crack
  • 24.
    Ball Park Guide Theentropy order/disorder breakpoint Password Length/Strength experience to 2019: 4 = Very Weak - puts you at risk 5 = Weak - just about OK for device password 8 = Fairly Strong for secure network access passwords 10 = Strong for secure access to company websites and data 16 = Very Strong for securing commercial and financial data access 22+ = Hyper Secure for encryption While a password with ~50 bits may be deemed ‘semi-safe’ in 2019, it is only a matter of time until more powerful GPUs, will see password cracking accelerate!
  • 25.
    E n tr o p y G u i d e The entropy growth linearity… Length: 15, 16, 17, 18, 19 Strength: Strong (>16) - Safeguards sensitive information like financial records Entropy: 92.6 bits, 100 bits, 106.7 bits, 113.9 bits, 121.9 Empirical Security Threshold ~ 100 bits
  • 26.
    T H IN K F U T U R E The ‘clicks/nulls’ are easy to find Beware of the dummy clicks on some of the later models - they can throw you off the track to eventual success ! It is easy to teach a child to crack locks of this kind!
  • 27.
    No Feel orsound Owners have the upper hand at this point But the enemy only needs a weak or silly password to b r e a k i n a n d a s s u m e full control…and t h e n t h e f u n really starts! M o s t b r e a k - i n s a t t h i s l e ve l a r e d o w n t o t h e o w n e r / u s e r n a i v e t y, l a x i t y, a n d / o r i n f o r m a t i o n g a i n e d f r o m s o m e e x t e r n a l s o u r c e …
  • 28.
    cracking Challenge Access limitedto the keyboard and screen only Human typing speed What can be guessed Try all common passwords Brute Force Trial and Error Phishing/Spear-Phishing Social Engineering Prior Observation WiFi Break-in BlueTooth Break-in Identical browser data ? Same password for all ? Similar format for all ? Common key storage ? All BlueTooth Linked ? Public Data ? Social Nets ? Family Data? Publications? Hobbies? Likes ? Finger Face Print Spoof One device hit/ stolen: then all c a n b e l o c k e d d o w n w h e n o n line + location & pics of thief can be tracked /recorded Additions include 3 s t r i ke f re e ze - outs for 5, 15, 60 min, followed by p ro v i d e r g e n e ra l security alert
  • 29.
    I n vi s i b l e t o u s ! Network, site, service and app attacks Wa y b e y o n d h u m a n s c a l e a n d m e n t a l a b i l i t i e s , b u t w e m u s t s t a r t w i t h a level of fundamental security based on a s t r o n g p a s s w o r d p ro t e c t e d c o re a n d connected devices Concatenated complexity can be employed to confound the e n e m y…ve r y h a rd f o r t h e m a n d ve r y e a s y f o r u s !
  • 30.
    cracking TASK A primedriver of Password design Secure Comms Encrypted Vault Encrypted File Private Key Public Key E-Commerce Bank Account Financial Apps Network Apps Websites Documents E-Mail Personal Computer Work Station Mobile Device Bicycle Lock STRENGTH Password Name/ID Factors Very-Low Medium-High Optional Low-Medium Optional Extreme No Exceptions Very-Strong No Exceptions Extremely Dynamic Static Mechanically Set Dynamic Choice Discipline Changed Occasionally Regularly Randomly NEED Risk Exposure Driven Centuries Millenia Decades Years Minutes Time to Crack
  • 31.
    Making it Safer Co n c a t e n a t i o n o f t h e s i m p l e C u s t o m e r N u m b e r, P a s s w o rd + invisible biome tri cs and ID/app checks+++ T h r e e f a i l e d t r i e s w i t h a n y i n c o r re c t o r s u s p i c i o u s e n t r i e s / information and the u s er is th e frozen out for a period. The ‘ f r e e z e o u t ’ p e r i o d i s t h e n progressively extended on every repeated log-in attempt: security d e p a r t m e n t i s a l e r t e d a n d c u s t o m e r s a r e a s k e d t o s t a r t from a new log on process
  • 32.
    Password Libraries! Extensive collectionsbuilt from successful hacks There are organisations collecting & marketing Passwords, PINs, ID and Card info on a business basis across the internet…and ‘The Dark Side’ is a prime mover and key player… Libraries are now a key component of the leading edge password attack engines/machines The Dark Side are not the only ones using such libraries ! Criminal Hackers Rogue States State Security Services
  • 33.
    Always use AChecker T h e y g i ve ‘ B r u t e F o rc e’ c ra c k i n g t i m e e s t i m a t e s B e w a r e t h a t t h e y a r e based on computing power t o d a y, a n d n o t t h e f u t u re ! NOTE : ‘Brut e F orce’ im pli es e x h a u s t i v e s e a r c h i n g w i t h no a priori sophistication…. ie, t he use of lib rari es i s not the norm here! Dozens available: and it is worth testing a range…
  • 34.
    For M odest Security C h o o s e s o m e t h i n g e a s y t o re m e m b e r & m o d i f y VerseProseDatesPlacesNames ++++++
  • 35.
    I wandered lonelyas a cloud That floats o’er vales and hills, When all at once I saw a crowd I w l a a c Wa a o I s a c I w 1 a A c Wa 1 2 D a y s I w 1 a A c Wa A o 4 Ye a r s I w 1 a A c Wa A o I 5 4 C I w 1 a A c Wa A o I 5 a C 3 2 7 C I w 1 a A c Wa A o I 5 a C £ $ 1 0 K C + Wordsworth F a v o u r i t e P r o s e / P o e m s T h e t r i c k i s t o d e s t r o y / d i s g u i s e / o b s c u r e l e t t e r p a t t e r n s t h a t m i g h t h j e l p m a c h i n e s i d e n t i f y s e n t e n c e s a n d v e r s e s U s i n g o n l y t h e f i r s t o r l a s t l e t t e r i s a s t a r t , b u t u s i n g e v e r y o t h e r l e t t e r p l u s s y m b o l o b s c u r a t i o n i s b e t t e r !
  • 36.
    Do not goqentle into that good night o t o e o t d t o t o e o t d t 1 2 D a y s O To e 0 t d 7 4 M o n t h O To e 0 7 d t ! 4 Ye a r s O To e 0 7 d t ! 6 9 3 3 Ye a r s £ O To e 0 7 d t ! 6 9 4 C P a s s w o r d g e n e r a t i o n b y a n a l g o r i t h m o f y o u r f a v o u r i t e v e r s e a n d o n e m e m o r a b l e y e a r s DYLAN THOMAS
  • 37.
    M o st s m a r t a t t a c k e n g i n e s w i l l e v e n t u a l l y d e c o d e p a s s w o r d s b a s e d o n p ro s e a n d v e r s e f o r a l l c o m m o n l y re a d t e x t … b e s t c h o o s e s o m e t h i n g r a r e / o b s c u r e … s p e c i a l t o y o u a n d y o u r l i f e r e m e m b r a n c e s … S m a r t m a c h i n e s Awa re o f Wo rd s wo r t h & T h o m a s e t a l
  • 38.
    E n ha n c i n g S e c u r i t y S t a r t f ro m a c a t a l o g u e o f t h i n g s o n l y y o u k n o w Layering algorithmic complexity to increase the Entropy
  • 39.
    All about you Knownby you and you alone WHO WE: Are; Know; Met; Loved; Married; +++ H O W W E : L e a r n e d t o D r i v e ; We re E d u c a t e d ; + + + W H Y W E : D e c i d e d ( Y ) ; P u r c h a s e d ( Z ) ; + + + WHAT WE: D o ; D i d ; L i k e ; B e l i e v e ; Re a d ; + + + WHERE WE: L i v e d ; V i s i t ; P ro p o s e d ; M a r r i e d ; + + +
  • 40.
    algorithmic vectors Carpenter Space Shuttle Constructing;not remembering passwords Something you: - Do - Did - Saw - Are - Said - Were - Know - Admire - Possess - Possessed - Remember - Understand Hillman Imp Drill C r S e D l H n I p C r 5 3 D 4 H n 1 p ! ! 4C to Crack login vectors Constructing - not remembering Carpenter Space Shuttle Algorithmic construction by the concatenation of elements only known by you…
  • 41.
    Enhancing login vectors Perhapsa line from a song: “Its a kind of magic” 15akd0fmc! <4 Years to Crack Plenty strong enough for a laptop log-in or document password Perhaps a line from a book: “It was the best of times” 1tw573bt0fts <4 C to Crack Something you like to sing and/or listen to… Algorithmic construction by the concatenation of elements only known by you…
  • 42.
    Enhancing login vectors Somethingbetween lovers or parent and child: I will always be here for you no matter How I love thee more than life itself H w 1 4 3 7 e m 3 t n 4 e i f ! ! 1 w 1 a s b 3 h e f r y u n 0 m r ! >10kC to Crack >10kC to Crack Something unique you said or promised within your family Algorithmic construction by the concatenation of elements only known by you…
  • 43.
    Concatenating numerous very lowcost biometrics is extremely powerful… - Eye 10 -3 @ < $5 - Face 10 -2 @ < $2 - Hand 10 -3 @ < $2 - Voice 10 -3 @ < $2 - Typing 10 -3 @ < $2 - Habits 10 -2 @ < $1 - Devices 10 -1 @ < $1 - Locations 10 -2 @ < $1 - ++++ Password ++ The typing rhythm at an ATM is unique and very cheap to recognise… Morse Code experience was the pre-cursor to this solution… Error Probability <10 -8 @ < $6 Obscuration by ’n' layers
  • 44.
    Automate the process Choosea (or >1) reputable password generator Ensure that it is fit for purpose and that you choose sensible settings by application and by need
  • 45.
    Overview A proportional view Device> 6…defeats humans Web Site >10…concatenate Document >12 - 16 Encryption >14 - 32 Membership >14…concatenate Social Networks >14…concatenate Financial Services >16 - 32…concatenate Concatenate = May Include: ID/PIN,Password/Questions/3 Try Limit/ BioMetrics/Random CheckBack/ 2/3 Factor Authentication/++
  • 46.
    l a ye r e d S e c u r i t y Ex p onent ially increasing the entropy challenge 6 Digit PIN > 8 Character Password Name/ID > 10 Character Password Name/ID > 14 Character Password Name/ID + PIN >16 Character Password BackEnd BIOMetrics Up Front BIOMetrics
  • 47.
    T h er e i s a l w a y s a t h r e a t R E M E M B E R I t i s s m a r t : S h a r i n g R u t h l e s s D y n a m i c L e a r n i n g A d a p t i n g C o n s t a n t M o t i v a t e d N e t w o r ke d + + + B e yo n d T h e L a w F o r M o r e G OTO : https://bit.ly/2F0y6in https://bit.ly/2SuwVzL https://bit.ly/2FcCtqR https://bit.ly/2SxHsKv https://bit.ly/2QsmBWb https://bit.ly/2MBED7v https://bit.ly/39mJNxB
  • 48.
    Thank You 57Ay5af3K33p53CuR3 Make itvery hard for the enemy - everything is at stake! petercochrane.com