Password Security

Many of you have encountered the dreadful rules placed on password security.  Some sites just go too far with constraints.  Take this one for example: 

• Letters and numbers only
• Nothing may repeat
• 8 characters minimum
• 1 number minimum

Although there are some tough constraints here, some extra security preventions are not allowed.  Also, the 8 character minimum constraint makes this especially harder.  Most people keep with a common set of passwords … or “keys”.  Upon further investigation, many of these keys are similar – such as changing a number, adding an extra word to the original password, and so on.  When a user is not allowed to use one of there keys, or craft one that is similar, then a little anger begins to stew.  You may have seen the type emails my clients had received in the past from individuals in this predicament.

My approach to the situation is to allow the user to enter their password, but also be able to see how it holds up.  I can adjust the percentage of security must be met.  Chances are, your visitors may even know that it isn’t all that great and are not worried about security – but on the ability to login alone.

The system that I have created gives a rating from 0 to 100 percent.  I recommend requiring users to obtain at least 50% if you are concerned with accounts being hacked by brute-force and dictionary attacks.

The system is simple.  Each rule gets a maximum of 20% of the overall score.  Here are the rules:

• The length of the password should be around 8 characters or more.  Password gets 2.5% for each character.
• Numbers should be present in the password.  2 recommended, 3 for best results.  Each number gets 6.67%
• There should be at least 8 characters that do not repeat next to each other. 2.86% for each letter.
• User should use mixed case.  2 pairs minimum gets 10% for each pair.
• 2 Special characters should be present – getting 10% for each character.

As far as the length goes, 8 characters are recommended at most sites.  However, this was a common constraint created back in the days of bulletin board systems and is out dated.  This alone cannot prevent attacks.  However, it appears that as you add more characters, your security is greatly increased.  I choose to cap this at eight.  You can cap it off at a greater number of characters by lowering the percentage assigned for each character.

Numbers … This is a bit of a problem.  Many users – when required to use numbers, will place them at the end of the password, in the middle of a compound word, or at the beginning.  This script does not handle this, but it is a concern.  The next level of a dictionary attack would be to append numbers at the end of each word.  I request 3 numbers (20 / 3 = 6.7%) as to keep people on their toes if they want to increase security to the max.

The number of characters repeating is at eight.  I divide by seven because the seventh character checks against the eighth.  A lot of sites that don’t like repeating characters will not even let one character to repeat.  I believe this is the equivalent of sticking your nose in the air away from your visitors.   To think that this hinders security is bad.  This rule was originally meant to thwart the famous “AAAAAAAA” passwords that people tend to submit just to ignore the whole theory of protecting your account.  Imaging being denied to use these passwords “7ddT82-?!!”, “U[]}}opW#”.  Experts would tell you the passwords would appear cryptic and hard to crack, however – you would have some sites telling you they are easily cracked just for the fact that one character repeats after another.

A fair amount of mixed case is recommended.  Most users would type all in lower-case letters.  Those that would use uppercase usually capitalize the first letter.  Those who have compound words (such as doghouse) may also capitalize the first letter of the second word (House).  Although it may prove beneficial to check for these specific variations, most web browsers lack a dictionary to compare against for compound words.

The last of the rules is the special characters.  These are all characters except letters and numbers.  Some people may go as far as say that they exclude periods, dashes, and spaces.  However, these characters are counted as special characters in my script.

In all, to get a 100% score the following is the minimum requirements:

• 9-character password
• 3 numbers
• 4 letters (2 lower, 2 upper)
• 2 special characters

It is important to remember that you shouldn’t state that 100% isn’t an absolute necessity.  Around 75% is a good start – however, most passwords that people will try would fit around the 50% to 60% range.  Consider the following as 100% secure.  Remember, although there may be patterns, brute force is not likely to get them due to the complexity.

• {a1A1A1a}
• Abcd123+-
• 2}{loCK34

Now, here are some examples of how my password script matches up with some common passwords that people may use.

• jbsesp – 29%
• password – 47%
• Cassandra – 50%
• BillGates – 60%
• lewis@moten.com - 60%
• Lewis283 – 70%

I invite you to also try your luck and see how secure you can build a password.  Tweak the code if rules don’t appear to your taste.  If you want to see more code or just find some information about me, then visit my website at http://www.lewismoten.com