Almost every website and app relies on a username and password combination to authenticate users. And that system, which the Internet is built on, is crumbling. There are several factors that together are diminishing the effectiveness of passwords. First, computing power is increasing exponentially; the computing power needed to compromise a password through a brute-force attack is increasingly available to cyber criminals. As a result, users are recommended to use long, complex passwords that take longer to crack. But with passwords routinely stolen in large cyber attacks, like the Adobe breach that compromised 38 million passwords, experts recommend that you change your passwords frequently.
But most people find long, complex passwords difficult to remember and annoying to type in each time they sign in to a website or app. So they fall back on using shorter, easier to remember (i.e. easier to compromise passwords). Even security experts are not immune to the siren call of using simple, unsecure passwords. Hacking Team, a company based in Italy that specializes in creating surveillance software used by governments, was recently the victim of an attack that resulted in 400 GB of valuable data stolen. Included in that data was the Firefox password vault of Christian Pozzi, a Senior System and Security Engineer for the company.
One of the major headlines following the attack was that Pozzi, like many users, employed passwords so devastatingly simple that they could easily be guessed. He used the password “P4ssword” for many important accounts, including not just social media sites but also banking websites. Of course, most hackers know that people often substitute numbers for letters (like 4 for “A”) and incorporate this knowledge when they attempt to compromise accounts, making these types of passwords very unsecure.
The other reason users haven’t adopted complex passwords is that they simply aren’t required to do so. A recent analysis of over 12,000 different cloud services found that 79.9% of cloud services allow for the use of weak passwords. This leaves only 20.1% requiring strong or moderate passwords with a combination of upper-case letters, lower-case letters, numbers, and symbols.
More people are recognizing the situation with passwords is a catch-22 and passwords alone are not enough. More protection is needed to keep valuable information secure, and a second security protocol may be the next step. To protect users and their information following the breach, LastPass enabled multi-factor authentication for all users. In one variation of multi-factor authentication, after signing in with a username and password the users receives a text message with a code they must enter before gaining access, proving their identity. This additional form of authentication significantly improves the security of accounts. However, only 15.4% of cloud services offer multi-factor authentication.
Changing the way data is encrypted could also make data in cloud services more secure, since it would require more than just a password to access the data. In a recent study of 12,000 cloud services it was discovered that 81.8% of cloud service providers encrypt data as it moves between end users to cloud. Which is a great way to protect data as it is in transit. However, only 9.4% of cloud services encrypt at rest. It may surprise you that some of the biggest names in the industry don’t encrypt data at rest. PayPal, for example, is a one of the largest cloud services with access to sensitive financial data that does not encrypt data at rest.
A preferable approach would be to encrypt data using encryption that you control, before data is ever stored in the cloud. Only 1.1% of cloud providers offer this capability today as part of their service. But you can also use a third-party encryption solution in cases where the cloud provider doesn’t offer this type of encryption. This is an increasingly attractive option for many users. On the consumer side, there are many free offerings that allow you to encrypt data you upload to services like Dropbox, and detailed guides on how to do this.
Authentication that relies on passwords alone is quickly becoming extinct. We’re now living in a post-password era that requires the use of a multi-layered security to prevent unauthorized access to information online.[su_box title=”About Harold Byun” style=”noise” box_color=”#336588″]
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.