An attacker who wants to break into one of your accounts manually might first try likely passwords such as your pet's name, your anniversary, or other terms that are significant to you. If that doesn't produce results quickly, a hacker might turn to a program that rapidly tries each of the thousands or even millions of words in a big list--a procedure known as a dictionary attack. Some dictionary attacks are quite clever, checking not only common English terms but also foreign words, common misspellings, words in which letters have been replaced by numbers or symbols (such as @ppl3 for Apple), and easy-to-type sequences of characters, such as poiuytre.
NEWSLETTERS
SUBSCRIBE TO CIO
Are you involved in setting the direction for your company's IT budget or strategy?
Apply today for a FREE subscription to CIO Magazine!
» Subscription Services
» Reprints
Reader Feedback
Create Stronger Passwords
READER FEEDBACK
Anonymous Mon, 2009-07-06 14:19
A non-dictionary password is as far as I would go, at least in the real world with real people. What good is a super-strong password that people leave on a Post-It note on their desk, or hitting the password reset tool that asks tough questions like their mother's maiden name?
In my opinion the security industry is doing this backwards. As a general architectural principle, I want to put the most complexity at the most central point possible, and keep it as simple as possible the farther it distributes and gets out of my direct control. So making it hard for the user seems backwards.
The problem appears to me best solved by preventing brute force attacks by eliminating the mistakes that allow them to occur. The biggest one of these is the ability to relentlessly try passwords over and over as fast as possible. Lotus Notes has an elegant way of preventing this. Type in a bad password, the prompt reappears instantly. Do it again and the prompt returns a little slower. And so on. After five or six tries the prompt takes a minute or so to come back.
There are a variety of other issues besides the one above, however, each should be addressed first at the system or application level before hoisting the burden on the user.
Post new comment
RELATED SOLUTIONS
There's a lot of buzz about Windows 7 out there. Each month in our webcast series, listen to analysts and customers discuss how Windows 7 and the Windows Optimized Desktop is impacting large companies around the world. Learn how they evaluated Windows 7, including the cost of deployment, deployment strategies, and tangible benefits.
Sponsored by Microsoft
Listen to on-demand Recordings »
Service Level Management Best Practices Life Cycle Overview - Improve Service Levels
Best practices for Service Level Management (SLM) is a process for consistently meeting customer requirements and delivering on IT's promises. See the steps required to ensure high-quality SLM.
Sponsored by Compuware
Read this White Paper »
Keeping Your Members Safe from Online Scams and Predators
In order to keep fraudsters out, romance sites must deploy effective solutions that look at information independent of what is supplied by users. A device fingerprinting solution such as iovation ReputationManager™ provides unique insight into the computers being used to create multiple accounts and exposes hidden device-account relationships that identity-based fraud solutions often miss.
Sponsored by iovation
Read this White Paper »
Resource Alerts
Get instant email notifications by topic when white papers, webcasts, and case studies are added to our library.
Global Warming Research Exposed After Hack
Silicon Valley Abuzz About Tech Video That Lets You Command a Computer With Gestures
Two Approaches to NFC Battle for French Hearts and Mobiles
Palm Pixi Smartphones Now Just $25
FCC: Internet Program for Deaf Cheated Out of Millions
Judge Sets Schedule for Google Book Search Case
Twitter Geotagging: What You Need to Know
Twitter Turns on Geolocation Functionality
Some Nook E-Readers Won't Make it for the Holidays Either
Google's Chrome OS Hits BitTorrent
WHITE PAPERS
FEATURED SPONSORS
SPONSORED LINKS
| CIO MARKETPLACE | buy a link |
Software License control, Windows XP/2000 Upgrades
Use your Intranet to manage Software Licenses, plan for Windows XP/2000 upgrades, do Security Audits and more. Click to try and ask for our white paper - PC Management for the Internet Age.
UNIX and Linux Performance Tuning SimplifiedSarCheck is a performance analysis and tuning tool for most UNIX & Linux operating systems. It produces recommendations with full explanations, and both supporting graphs and tables. Get the most from your hardware by keeping your systems tuned.
.NET Developer Wanted - Boston - Local CandidatesAIR provides sophisticated analytical tools and software systems to help companies manage that risk. We are seeking a Sr .NET Developer with 8-10 yrs exp in .Net & OO development. ASP.NET, VB.NET skills required. Annual bonus - Apply Now
Get More from Your Oracle DatabaseDBAs are constantly challenged to increase performance and keep costs down. This paper discusses the industry best-practice Wait-Event analysis and how Confio has combined this with their Resource Mapping Methodology to optimize DB performance.
THE IDG NETWORK
© 1994 - 2009 CXO Media Inc.