36:03This recording is not available yet.
Hackers get your data through weak passwords practices: Understanding why and how to improve password protection
Download resourcesCategories
Identity & AccessAuthentication & MFAThreats & Threat IntelligenceCybercrime EconomyPeople, Culture & CareersSecurity AwarenessWellbeing & Human Factors
Vendors and tools discussed
About this session
Andréanne Bergeron, a criminologist and cybersecurity researcher at GoSecure, gives a non-technical crash course on passwords aimed at end users. She frames recommendations around three threats: people with physical access, remote attackers holding stolen credentials, and the human behaviour that policies such as monthly rotation make worse. She explains hashing, dictionary attacks, keyboard walks and rule-based brute force, using the Hive Systems cracking table to show why length matters most and mixed character sets help. A GoSecure experiment compares anonymised passwords cracked during client pentests with a leaked Gmail list: clients use slightly longer, more varied and less profane passwords, but the differences are about one percent and not significant. She weighs password managers (poorly adopted, third-party trust, single point of failure), shows that leetspeak substitutions crack in under three minutes, and recommends random word lists or invented long sentences, warning against famous quotes. She closes on FIDO and passwordless futures. A lively Q&A covers Bitwarden, security questions, a challenge to the cracking table, rotation policies under MFA and one company that cracks its own users' passwords.
Using authentication to secure data and accounts has grown to be a natural part of using computers. Even if several authentication methods exist, using passwords remains the most common type of authentication. People usually have a multitude of different passwords and when they create their passwords, they often use a strategy to make the password easy to remember (Pfleeger, et al., 2015; Stobert & Biddle, 2014; Ur, et al., 2015). This behavior limits the protection of users. Even if awareness of the importance of strong password increased among clients, entropy-based and complexity-based password strength is not the only aspect that should be considered (Microsoft, 2022). Password policies must understand human behavior by avoiding useless requirement like monthly change which result in reinforcing bad behaviors from users more than protecting them. The third aspect is following good password practices by avoiding, for example, password reuse across different sites. The presentation aims to explain good password practices and how organizations can increase employees’ protection with adequate structure. Anonymized data from GoSecure’s cybersecurity tests are used to evaluate the prevalence of good practices in comparison with data from other organizations’ leaks. The analysis helps reveal different types of passwords strategies and the similarity between actors. Results show that GoSecure’s clients have a better performance in terms of password creation strategies compared with passwords found in leaks. However, efforts should be put towards other aspects of password good practices as we will demonstrate that modern behavior-based password cracking techniques still achieve a high degree of success against complexity-based policies.
Key takeaways
- Length is the single biggest factor in cracking time; mixed character types help, but a short random password still falls to brute force.
- Drop forced periodic rotation: it pushes users to append a month or number, which cracking rules already anticipate, and NIST no longer recommends it.
- Common substitutions such as digits for letters are in every cracking rule set; a leetspeak word cracked in under three minutes on a GoSecure rig.
- Prefer a random list of several words or an invented long sentence; avoid movie quotes and other passphrases already in attacker dictionaries.
- Never put personal information, the site name or anything from the username in a password, and never reuse a password across sites.
Speakers
Andréanne Bergeron
Andréanne Bergeron, Ph.D., is the director of research at GoSecure, specializing in online attackers' behaviors. Her expertise delves into the intersection of criminology and cybersecurity. In addition, Andréanne holds an esteemed position as an… Read moreRead less
Andréanne Bergeron, Ph.D., is the director of research at GoSecure, specializing in online attackers' behaviors. Her expertise delves into the intersection of criminology and cybersecurity. In addition, Andréanne holds an esteemed position as an affiliated professor in the Department of Criminology of Montreal University, bridging academia and industry. Involved in the cybersecurity community, she is a board member of the Canadian Cybersecurity Network and the co-VP of engagement and outreach for Northsec.
