I am no fan of “security through obscurity”. Peer review and open discourse on security have proven essential in development of network protocols and cryptographic algorithms. Regardless, that does not mean I choose to disclose everything. I may disclose protocols and approach, but certain details I choose to remit.
Case in point: if I were Twitter, and wanted to reduce account hijacking by ridding myself of weak passwords which can be easily guessed, I would not disclose my list of weak passwords to the user community. As noted by TechCrunch:
If you’re on Twitter, that means you registered an account with a password that isn’t terribly easy to guess. As you may know, Twitter prevents people from doing just that by indicating that certain passwords such as ‘password’ (cough cough) and ‘123456’ are too obvious to be picked. It just so happens that Twitter has hard-coded all banned passwords on the sign-up page. All you need to do to retrieve the full list of unwelcome passwords is take a look at the source code of that page. Do a simple search for ‘twttr.BANNED_PASSWORDS’ and voila, there they are, all 370 of them.
The common attack vector is to perform a dictionary attack on known accounts. A good dictionary is an important factor for success. It is much easier to create a good dictionary if you know for certain many common passwords will not be present. Making the list easy to discover makes it much easier for someone to tune their dictionary. I applaud Twitter for trying to improve passwords and thereby making them tougher to guess, but targeted attacks just got better as well. Because here’s a list of 370 passwords I don’t have to test.
Reader interactions
11 Replies to “Password Policy Disclosure”
@Adrian – Points taken.
* I had mistakenly thought Twitter announced it. My mistake. I don’t, however, think it was a bass-ackwards implementation. It was an implementation and there is no concrete right or wrong way to do it. Better security may be a marketing opportunity, but that wasn’t one that was provable (especially not to the security community) and had they promoted it you and I both know it would have been shit all over.
* Twitter does have a script that tests password strength with visual feedback. Not sure when it was implemented, but go check it out. When you enter something in the “list” the JS reports “Too obvious” and will not let you complete (although I’ll say they don’t do a good job of making that apparent in the process as I just tested it out). So, Twitter has both — the indicator and the ban. I still think it’s good.
* I agree that it won’t make Twitter accounts any more secure. After all “123456789” is acceptable, although it’s stated as “Weak”. Twitter still has a CAPTCHA that pops up after multiple bad logins which, isn’t foolproof, but doesn’t hurt either. Either way not really much better or worse than any run-of-the-mill social site. I’ll still say that pointing out to users a downright bad password and not allowing them to use it is a good thing.