Microsoft tells users to stop using strong passwords everywhere

Weak passwords have their place, argues new research from Microsoft, and they help users conserve brainpower for where it is needed Users should use and reuse weak passwords for websites which don't hold valuable information, say researchers from Microsoft, overturning decades of accumulated wisdom on internet security. By not having to worry about remembering complex unique passwords for every individual website, users can focus their efforts on recalling secure passwords for high-value sites like banking or e-commerce.


What's more, the researchers, Dinei Florêncio and Cormac Herley from the Redmond-based software company and Paul C van Oorschot from Carelton University in Canada, argue that password managers introduce more problems than they solve. While they allow the use of fully random, completely unique passwords, they also introduce a single point of failure: users can lose or forget the password to their password manager, or the cloud service that hosts their passwords could be hacked.


"Strategies to cope with the human impossibility of using strong passwords everywhere without re-use include single-sign-on, use of email-based password reset mechanisms, and password managers,"they write. If the password manager stores passwords on a users' machine, "the main risk is still … attacks like client-side malware [but] the cost … is that portability across different client devices is lost as the passwords (if they are unique and random) are effectively anchored to the client on which they are stored."


Once users start storing passwords in the cloud, though, they trade "one set of risks for another". On the one hand, any single password being stolen is less dangerous. But "it introduces severe new risks: if the master password is guessed or used on any malware-infected client, or the cloud store is compromised, then all credentials are lost."


So what should users do instead? The study argues that users should pick and re-use easy-to-remember passwords for "low-risk" sites, in order to maximise their ability to recall complex unique passwords for high-risk ones. "Optimally, marginal return on effort is inversely proportional to account values … Far from optimal outcomes will result if accounts are grouped arbitrarily." In other words, free up space in your brain to make your banking password as complex as you can recall by using your pets' name for all the things you don't care about losing.


It's enough to make users want to give up on passwords entirely, as the Wall Street Journal's Christian Mims did when he shared his Twitter password in his weekly column. Mims relied on the power of two-factor authentication, which sends a text message to his phone with a special login code, to keep his account safe, writing that "it might seem foolish to replace an authentication token that you keep in your head (a password) with one you keep in your pocket (like a phone) but consider: The former can be obtained by hackers, and the latter you can shut down the moment it goes missing."


Hundreds of attempts later, and his account was still secure – although Twitter had revealed his mobile number to every user who attempted to log in. But yet more research from Herley and van Oorschot, in conjunction with Cambridge's Joseph Bonneau and Frank Stajano, shows that even if Twitter hadn't made that error, the quest to replace passwords is far from complete.


Only one possible password replacement – the chip and pin readers common on banking websites – scored full marks on the researchers' security test, and nothing was as easy-to-deploy as passwords. No single system beats passwords on every metric the researchers looked at, although most were more secure. "Marginal gains," they conclude, "are often not sufficient to reach the activation energy necessary to overcome significant transition costs, which may provide the best explanation of why we are likely to live considerably longer before seeing the funeral procession for passwords arrive at the cemetery."