{"id":258,"date":"2011-02-15T16:51:47","date_gmt":"2011-02-15T16:51:47","guid":{"rendered":"http:\/\/www.slyman.org\/blog\/?p=258"},"modified":"2012-06-22T08:45:44","modified_gmt":"2012-06-22T08:45:44","slug":"preventing-password-reuse","status":"publish","type":"post","link":"https:\/\/slyman.org\/blog\/2011\/02\/preventing-password-reuse\/","title":{"rendered":"Preventing reuse of passwords"},"content":{"rendered":"

Passwords are traditionally chosen by users themselves.  This presents a challenge for security engineers, since regardless of the minimum password length enforced, creative users might still choose cryptographically weak passwords that break security design assumptions.  Best-practices such as password hashing and hash salting are industrially well known but frequently ignored by software developers.  Password reuse<\/strong> further threatens security, either by giving attackers a greater opportunity to break in<\/strong> using old passwords that are more vulnerable to brute-force attack, or by enabling attackers to break in to a high-value computer system using password data stolen from a less secure system.<\/p>\n

Preventing<\/strong> the reuse of historical passwords may be accomplished within a closed system by maintaining a history of password hashes (to prevent the user from choosing a password that would result in a similar hash to one generated previously); however, where systems are designed to prevent even their administrators from knowing users’ passwords, it’s hard to gauge directly how frequently identical passwords have been used across software systems run by different organisations.<\/p>\n

Researchers have studied the prevalence of password reuse and the impact of this practice on system security<\/a>.<\/p>\n

Here I present a method of strongly discouraging password reuse across systems:<\/h2>\n
    \n
  1. Statistically evaluate the strength of new passwords<\/strong>: when users change their password, check the strength of the new password by using information theory to evaluate its unpredictability<\/a>.<\/li>\n
  2. If password strength is poor, or if the password hash is identical to a previous hash for a password used by the same user, prompt the user to try again<\/strong> Otherwise, amend the password and record the hash in a table of historical password hashes (I call this \u201chash caching<\/em>\u201d.)<\/li>\n
  3. Enforce password validity periods  Ln<\/sub> for a user’s nth<\/sup> password<\/strong> where
    \nLn<\/sub> = p \u00d7 an<\/sup>;  Ln<\/sub> < LMAX<\/sub>;  where<\/p>\n