By now, most readers know the advice cold. Use long, randomly generated passwords to lock down your digital assets. Never use the same password across two or more accounts. In abstract terms, the dictates are some of the best ways to protect against breaches suffered by one site—say, the one that hit Gawker in 2010 that exposed poorly cryptographically scrambled passwords for 1.3 million users—that spread like wildfire. Once hackers cracked weak passwords found in the Gawker database, they were able to compromise accounts across a variety of other websites when victims used the same passcode.
A team of researchers says the widely repeated advice isn't feasible in practice, and they've provided the math they say proves it. The burden stems from the two foundations of password security that (A1) passwords should be random and strong and (A2) passwords shouldn't be reused across multiple accounts. Those principles are sound when protecting a handful of accounts, particularly those such as bank accounts, where the value of the assets being protected is considered extremely high. Where things break down is when the dictates are applied across a large body of passwords that protect multiple accounts, some of which store extremely low-value data, such as the ability to post comments on a single website.
Employing even relatively weak, 40-bit passwords (say, one with eight lower-case characters) across 100 accounts is equivalent to recalling 1,362 randomly chosen digits or 170 random eight-digit PINs, something that's well beyond the capabilities of most people. Reducing the number of bits by choosing more memorable passwords such as "password123" and "123456" helps ease the burden. But even then, users must have under their control 525 bits just to remember which weak password goes with which account. That's more than double what's required to memorize the order of a shuffled deck of cards. Yes, people can use password managers, but those available in the cloud may be susceptible to online attacks, and those that aren't Web-based lose one of the major advantages of passwords, which is their ability to be entered across any client device.
"So the two staples A1, A2 of password advice appear impossible to meet individually, let alone simultaneously," the researchers wrote in a paper titled Password Portfolios and the Finite-Effort User: Sustainably Managing Large Numbers of Accounts. "How do users proceed? They 'cheat' on A1 by choosing passwords far weaker than advised. But this isn't enough—no matter how weak the passwords, a user must still remember lg(N!) [that is, which password corresponds to each of N accounts in their account portfolio] random bits for password assignment. A further coping strategy is needed."
The researchers propose managing passwords based on unique attributes of each account, rather than following a one-size-fits-all approach. Using an elaborate system of mathematical formulas, the researchers propose assigning each account with a value P based on the probability a given account password will be compromised and a value L assessing the loss that would be incurred in such a compromise. Those cases where P and L are sufficiently low aren't deserving of rules that take time and energy away from more productive security endeavors. In other words, for a significant percentage of accounts, "snoopy2" may be perfectly adequate.
"While the optimal strategy involves selective re-use and weaker passwords, benefits accrue only if the effort saved is re-deployed elsewhere for better returns," the researchers wrote. "Users must not arbitrarily weaken and re-use passwords. The empirical studies are needed to determine if our guidelines can be followed by users."
The researchers, from Microsoft and Carleton University in Ottawa, Canada, don't provide any definitive advice. Rather, they suggest people group together accounts with high value and low probability of compromise and those with low value and high compromise probability.
The paper provides mathematical support for a practice some people have long employed—that is, foregoing a strict password regimen across the board. There's little return on the investment of choosing a strong, unique password to lock down a free New York Times account that does nothing more than let website operators track which stories a visitor is reading. The effort saved is much better put into picking a good password to protect online banking and e-commerce accounts.