« Off to Banff for WWW2007 | Main | Launching Book IT! »
Overdoing Security
I was registering for the FAA Medxpress program today. This program allows pilots to submit their flight physicals online. Once you’ve registered, the FAA requires that you change your password. Here’s the requirements for the new password:
You have accessed the FAA MedXPress site using a temporary password. You must change your password in order to continue.
Passwords must contain between 8 and 12 characters and include at least three of the following four character groups: English upper case characters (A through Z); English lower case characters (a through z); Numerals (0 through 9); Non-alphabetic characters (such as !, $, #, %). Passwords are case sensitive.From FAA MedXPress Change Password
Referenced Mon May 07 2007 15:14:16 GMT-0600 (MDT)
This seems a little heavy. To be sure, there’s some very personal data stored on that form, but should I be allowed to know how secure I make it. I know…most people can’t make that determination well. But Google and others seem to have hit on a strategy to rate a password and tell you how good a password you’ve chosen. I’m curious how often people change bad passwords based on that feedback.
The problem with overdoing it here is that I’m not able to choose a password I’ll remember or even use the password generator bookmarklet. So, I’ll write it down and that makes it less secure.
Posted by windley on May 7, 2007 3:19 PM
Comment from Eric Norman at May 7, 2007 5:08 PM
Steganography to the rescue!
Instead of writing it down, use something that's already written down. In this case, your pilot's license might be appropriate. Just come up with an easy to remember way of extracting password material from it. For instance, if you read the first letters of each word vertically, then the second letters, and so forth, you often come up with a sequence that appears random and also satisfies the password character set rules.
You might want to be a little more creative than that since the bad guys might read this comment.
Comment from William at May 8, 2007 11:14 AM
- this actually helps narrow the space required for password guessing algorithms
- channels an honest person's thoughts into tricks to generate passwords (using dictionary words but replacing the letter 'o' with the number '0' or throwing a single nonalphabetic character before or after said dictionary word)
- many people will write it down somewhere
- because of the complexity many people will decide to use the same password they use at another site (introducing a security dependency over which the FAA site has no control over)
- with an increased likelihood that someone will forget the password - it makes a password reset scheme a necessity. The password reset scheme then becomes the weakest link, as it is potentially susceptible to social engineering (phone call/fax auth letter on 'letterhead'/etc) , further reduces the guess space (what is your birth date, mother's maiden name, high school, etc.), opens up susceptibility to email sniffing or compromised email account weaknesses depending on the process used to send the new password or reset link, etc.
Comment from Phil Windey at May 8, 2007 12:25 PM
Yeah, I forgot to mention that they asked m for four, count 'em, FOUR! security questions and answers to go with them.
I think the password reset process involves a complete physical. :-)
Leave a comment
I encourage you to leave a comment below. Your email address will not be displayed on Technometria, but allows me to communicate with you directly. Your email address won't be displayed, but will be used to compute a MicroID for your comment.