Thursday, April 28, 2011

A Little About Passwords

This article was originally published in the newsletter of the MacinTech Users Group, a Mac user group in Denver. This is not intended to be a comprehensive coverage of passwords, let alone computer security. This simply contains some hints about using good passwords, and discusses an article circulating on the web that gives some potentially bad advice.


Passwords are always a concern for people. Passwords are the most obvious factor in maintaining computer security, and can be the most important. Especially when you use bad passwords.

Other aspects of security are out of your control. We have all heard of large banks allowing employees to carry and subsequently lose laptops carrying unencrypted data for thousands of customers. Passwords become even more important; if you ever have an indication that some institution has handled your password poorly, change the password!

So, how should we select good passwords? A user group member recently sent me this URL http://www.baekdal.com/tips/password-security-usability, an article purporting to tell you how to select good passwords. Unfortunately, the analysis is wrong. I won't go into all the details, but the author claims you can use easy to remember pass phrases (a password containing more than one word) almost impossible to break simply because it uses multiple words. The author also seems to think bad guys will try just one of the "proven ways" to crack your password. He even seems to think dictionary attacks only use words found in Webster's Dictionary.

He is wrong on all counts. Adding spaces to a pass phrase isn't a big deal to a computer; a space is just one more character, even though it may seem to add complexity according to the human eye. It's a little like saying "hey, my password is now unbreakable, because I put a bunch of z's or !'s in it."

Bad guys use all of the mentioned attack methods, combined using "heuristics." Heuristic rules are created based on analysis of millions of passwords taken from stolen bank laptops. The bad guys are much more sophisticated than they used to be. Those dictionary attacks are powered by dictionaries containing all of those stolen passwords and phrases. When large groups of people are analyzed, patterns emerge.

Commenters to the referenced article think their passwords are hard to break because they spell their words backwards, and use leeting (substituting "3" for "e", and so on). Sorry, all of these methods of disguising a password are now part of the cracker's dictionary.

To cap it all off, the article's author is wrong about how many passwords can be tested per second. The author says 100 passwords can be tested per second. Well, this is generous if we assume the attack is being performed by amateurs we call "script kiddies." But, there are many more ways to break into accounts than with brute-force attacks on a single web page. The professional attackers have many ways to attack that effectively raises the tests from 100 passwords per second to orders of magnitude more.

So, how do you protect your accounts? First, never use the same password for each critical account. I don't care what password you use to protect your Twitter account; I am talking about accounts connecting you to your money. Your bank, iTunes Store account, and so on. Never use passwords similar to each other.

Next, use a series of random letters and numbers. Use both upper and lower case. Go crazy and use additional characters, such as ! or spaces if allowed. Make the passwords at least 11 or 12 characters long. In time, we will need even longer passwords.

Yes, those random character passwords cannot be remembered. But, they are much, much safer than any password you can remember. It's much better to have some passwords written down at home, than have a password that can be broken online. Thieves will try to break into your online accounts at some time. The odds of them breaking into your house are much less. If you don't want someone else in your home to know those passwords, obfuscate them; that is, disguise them by leaving the first character off or changing certain characters.

Should you put your passwords in a file on your computer? Hmmm…. That's much more difficult to determine. Older Windows systems can be hacked. As for Macs or Windows 7, we have been hearing more and more ways to hack into computers using exploits in Adobe Flash, and so on. And, if you travel with your computer, it could always be stolen.

And, I should point out that those passwords used to log into your computer are very easy to break, no matter how long or random they may be. If someone steals your computer, they will break in. You can completely encrypt your drive, but the rules for good passwords remain, and encrypting entire hard drives can cause loss of data

So, time for the blatant plug. All of the above ideas for passwords led to my creation of an app for the iPhone, iPod touch and iPad called Power Passwords, using a technique I created for the Feds back in the 80s. It allows you input an easy to remember password or key, and the program hashes or generates unique and hard to break passwords. Those are the passwords you use for your bank account, and they are never saved. Next time you need the same password, you just input the same key in Power Passwords. Power Passwords allows you to input notes, so you can remember which password you used for each account. So, Power Passwords is both a password generator and manager, all in one.

You can check out Power Passwords at http://itunes.apple.com/WebObjects/MZStore.woa/wa/viewSoftware?id=302952997&mt=8. Or just search on the App Store using the term "Azarhi".

If you want to read more about passwords, a pretty good rebuttal to the original article is at http://www.troyhunt.com/2011/04/bad-passwords-are-not-fun-and-good.html.

A Little About Passwords

This article was originally published in the newsletter of the MacinTech Users Group, a Mac user group in Denver. This is not intended to be a comprehensive coverage of passwords, let alone computer security. This simply contains some hints about using good passwords.


Passwords are always a concern for people. Passwords are the most obvious factor in maintaining computer security, and can be the most important. Especially when you use bad passwords.

Other aspects of security are out of your control. We have all heard of large banks allowing employees to carry and subsequently lose laptops carrying unencrypted data for thousands of customers. Passwords become even more important; if you ever have an indication that some institution has handled your password poorly, change the password!

So, how should we select good passwords? A user group member recently sent me this URL http://www.baekdal.com/tips/password-security-usability, an article purporting to tell you how to select good passwords. Unfortunately, the analysis is wrong. I won't go into all the details, but the author claims you can use easy to remember pass phrases (a password containing more than one word) almost impossible to break simply because it uses multiple words. The author also seems to think bad guys will try just one of the "proven ways" to crack your password. He even seems to think dictionary attacks only use words found in Webster's Dictionary.

He is wrong on all counts. Adding spaces to a pass phrase isn't a big deal to a computer; a space is just one more character, even though it may seem to add complexity according to the human eye. It's a little like saying "hey, my password is now unbreakable, because I put a bunch of z's or !'s in it."

Bad guys use all of the mentioned attack methods, combined using "heuristics." Heuristic rules are created based on analysis of millions of passwords taken from stolen bank laptops. The bad guys are much more sophisticated than they used to be. Those dictionary attacks are powered by dictionaries containing all of those stolen passwords and phrases. When large groups of people are analyzed, patterns emerge.

Commenters to the referenced article think their passwords are hard to break because they spell their words backwards, and use leeting (substituting "3" for "e", and so on). Sorry, all of these methods of disguising a password are now part of the cracker's dictionary.

To cap it all off, the article's author is wrong about how many passwords can be tested per second. Off by orders of magnitude. And, there are many more ways to break into accounts than with brute-force as the final step.

So, how do you protect your accounts? First, never use the same password for each critical account. I don't care what password you use to protect your Twitter account; I am talking about accounts connecting you to your money. Your bank, iTunes Store account, and so on. Never use passwords similar to each other.

Next, use a series of random letters and numbers. Use both upper and lower case. Go crazy and use additional characters, such as ! or spaces if allowed. Make the passwords at least 11 or 12 characters long. In time, we will need even longer passwords.

Yes, those random character passwords cannot be remembered. But, they are much, much safer than any password you can remember. It's much better to have some passwords written down at home, than have a password that can be broken online. Thieves will try to break into your online accounts at some time. The odds of them breaking into your house are much less. If you don't want someone else in your home to see those passwords, hide them.

Should you put your passwords in a file on your computer? Hmmm…. That's much more difficult to determine. Older Windows systems can be hacked. As for Macs or Windows 7, we have been hearing more and more ways to hack into computers using exploits in Adobe Flash, and so on. And, if you travel with your computer, it could always be stolen.

And, I should point out that those passwords used to log into your computer are very easy to break, no matter how long or random they may be. If someone steals your computer, they will break in. You can completely encrypt your drive, but the rules for good passwords remain.

So, time for the blatant plug. All of the above ideas for passwords led to my creation of an app for the iPhone, iPod touch and iPad called Power Passwords, using a technique I created for the Feds back in the 80s. It allows you input an easy to remember password or key, and the program hashes or generates unique and hard to break passwords. Those are the passwords you use for your bank account, and they are never saved. Next time you need the same password, you just input the same key in Power Passwords. You can control the length of passwords, and the length becomes part of the hash; this means when you change the length, the passwords themselves change, they don't just grow in length. Power Passwords allows you to input notes, so you can remember which password you used for each account. So, Power Passwords is both a password generator and manager all in one.

You can check out Power Passwords at http://itunes.apple.com/WebObjects/MZStore.woa/wa/viewSoftware?id=302952997&mt=8. Or just search on the App Store under "Azarhi".

If you want to read more about passwords, a pretty good rebuttal to the original article is at http://www.troyhunt.com/2011/04/bad-passwords-are-not-fun-and-good.html.

Tuesday, April 5, 2011

All About Adam Engst

Adam Engst is visiting with the MacinTech Users Group of Denver on April 12, 2011. So, I wanted to give you some background on Adam.

You know Adam as the publisher of TidBITS, the Internet magazine and the Take Control series of ebooks. You may not know Adam as Internet innovator, and as someone who enjoys understanding and explaining technology to others.

Adam grew up in Richford, New York, a small community southeast of Ithaca, and attended Newark Valley High School, where he was a varsity cross country runner and class valedictorian.

Adam reports he has always been interested in writing and publishing, starting with a short-lived pet newsletter he published when he was 12. When he gained access to computers, Adam developed an interest in understanding technology, and helping others by explaining technology using his writing skills.

Adam attended Cornell University, graduating Magna Cum Laude. Adam designed his own major in Hypertextual Fiction, while double-majoring in Classics.

Adam met his wife Tonya during their freshman semester at Cornell at a mixer. It wasn't long after they were inseparable. Adam and Tonya, a Communications major were the editors of a campus literary magazine called the Risley Revue.

Adam and Tonya graduated from Cornell in 1989, and started TidBITS in April of 1990 at Tonya's suggestion. In fact, Adam is celebrating the coming-of-age anniversary with MacinTech!

In 1991, Adam and Tonya got married, and shortly thereafter moved to the Seattle area, so Tonya could work at Microsoft providing support for Word 5.1. While they lived in Redmond, Renton and Issaquah, Adam focused on the business side of TidBITS. In 1992, he created the first advertising program on the Internet, predating Google and the many other companies that are making billions with Internet advertising. This effect allowed TidBITS to become a full-time effort for Adam.

Adam also wrote many print magazine articles and books in addition to publishing TidBITS. These efforts developed into Contributing Editor positions at MacUser, MacWEEK, and Macworld magazines. In 1993, Adam released the "Internet Starter Kit", which sold over 600,000 copies in multiple versions between 1993 and 1996, and has helped countless people to figure out this "Internet thing." Adam wrote many other books for O'Reilly Media and Peachpit Press.

Tonya left Microsoft in 1994, becoming more heavily involved with the day-to-day publishing of TidBITS, and became a published author with the release of the "Word 6 Starter Kit." TidBITS continued to grow, drawing thousands of readers.

In 1999, Adam and Tonya welcomed a son named Tristan. In 2001, they decided to move back to upstate New York, closer to family.

Continuing to publish TidBITS and books such as "iPhoto for Mac OS X: Visual QuickStart Guide", Adam and Tonya started the Take Control series of ebooks in 2003. They envisioned this series would cover many aspects of computers and the Internet, readable on computers and the growing category of mobile electronic devices. The Take Control books are a big part of Adam's business with Tonya serving as Editor-In-Chief. They now have 87 book titles, available at .

Adam has always been a big supporter of the Macintosh community, visiting user groups, and contributing many free copies of the Take Control books to MacinTech for our meeting give aways.

Adam has also supported the entire computer industry, serving for six years as President of the Info-Mac Network which publishes the Info-Mac Digest, and the Info-Mac Archive, which was for many years the pre-eminent site for freely distributable Macintosh software.

He used his hypertext background serving for three years as Chairman of XNSORG, a non-profit aimed at promoting the XNS (eXtensible Name System) technology, renamed XRI. XRI is a protocol compatible with URLs and other standards for identifying information not a part of those standards, such as the ISBN of a publication or a person's name, phone number or location.

Since high school, Adam has continued to run, training 25 to 40 miles per week with the High Noon Athletic Club at Cornell. He also races year-round in road and trail races, track events, and cross country. He maintains good times at in the masters category with a mile personal record of 4:47, two mile PR of 10:20, and a 5K PR of 16:36.

Adam has developed TidBITS into the largest email based Macintosh magazine with over 30,000 readers, translated into Japanese and Dutch each week. In the annual MDJ Power 25 survey of industry insiders, Adam has ranked among the top five most influential people in the Mac industry year after year. He has also been included on the MacTech 25 list of influential people in the Macintosh technical community for 2006, 2007, and 2010 and he was named one of MacDirectory's top ten visionaries.

Adam, Tonya and TidBITs have garnered many other awards and lists. For several years, the Best of the Mac Web Survey run by Low End Mac has included TidBITS for its importance in in the Macintosh community. Seattle Magazine has named Adam as one of its 25 Cyberstars, and WorldHot.com included TidBITS among their list of the World Hottest 100 Mac Web Sites.

Many other awards and lists for adam, Tonya and TidBITS can be found at .

If you haven't subscribed to the TidBITS e-magazine, you should. Go to to subscribe or read an issue.

All About Adam Engst

Adam Engst is coming to visit with the MacinTech Users Group of Denver on April 12, 2011. So, I wanted to give you some background on Adam.

You know Adam as the publisher of TidBITS, the Internet magazine and the Take Control series of ebooks. You may not know Adam as Internet innovator, and as someone who enjoys understanding and explaining technology to others.

Adam grew up in Richford, New York, a small community southeast of Ithaca, and attended Newark Valley High School, where he was a varsity cross country runner and class valedictorian.

Adam reports he has always been interested in writing and publishing, starting with a short-lived pet newsletter he published when he was 12. When he gained access to computers, Adam developed an interest in understanding technology, and helping others by explaining technology using his writing skills.

Adam attended Cornell University, graduating Magna Cum Laude. Adam designed his own major in Hypertextual Fiction, while double-majoring in Classics.

Adam met his wife Tonya during their freshman semester at Cornell at a mixer. It wasn't long after they were inseparable. Adam and Tonya, a Communications major were the editors of a campus literary magazine called the Risley Revue.

Adam and Tonya graduated from Cornell in 1989, and started TidBITS in April of 1990 at Tonya's suggestion. In fact, Adam is celebrating the coming-of-age anniversary with MacinTech!

In 1991, Adam and Tonya got married, and shortly thereafter moved to the Seattle area, so Tonya could work at Microsoft providing support for Word 5.1. While they lived in Redmond, Renton and Issaquah, Adam focused on the business side of TidBITS. In 1992, he created the first advertising program on the Internet, predating Google and the many other companies that are making billions with Internet advertising. This effect allowed TidBITS to become a full-time effort for Adam.

Adam also wrote many print magazine articles and books in addition to publishing TidBITS. These efforts developed into Contributing Editor positions at MacUser, MacWEEK, and Macworld magazines. In 1993, Adam released the "Internet Starter Kit", which sold over 600,000 copies in multiple versions between 1993 and 1996, and has helped countless people to figure out this "Internet thing." Adam wrote many other books for O'Reilly Media and Peachpit Press.

Tonya left Microsoft in 1994, becoming more heavily involved with the day-to-day publishing of TidBITS, and became a published author with the release of the "Word 6 Starter Kit." TidBITS continued to grow, drawing thousands of readers.

In 1999, Adam and Tonya welcomed a son named Tristan. In 2001, they decided to move back to upstate New York, closer to family.

Continuing to publish TidBITS and books such as "iPhoto for Mac OS X: Visual QuickStart Guide", Adam and Tonya started the Take Control series of ebooks in 2003. They envisioned this series would cover many aspects of computers and the Internet, readable on computers and the growing category of mobile electronic devices. The Take Control books are a big part of Adam's business with Tonya serving as Editor-In-Chief. They now have 87 book titles, available at .

Adam has always been a big supporter of the Macintosh community, visiting user groups, and contributing many free copies of the Take Control books to MacinTech for our meeting give aways.

Adam has also supported the entire computer industry, serving for six years as President of the Info-Mac Network which publishes the Info-Mac Digest, and the Info-Mac Archive, which was for many years the pre-eminent site for freely distributable Macintosh software.

He used his hypertext background serving for three years as Chairman of XNSORG, a non-profit aimed at promoting the XNS (eXtensible Name System) technology, renamed XRI. XRI is a protocol compatible with URLs and other standards for identifying information not a part of those standards, such as the ISBN of a publication or a person's name, phone number or location.

Since high school, Adam has continued to run, training 25 to 40 miles per week with the High Noon Athletic Club at Cornell. He also races year-round in road and trail races, track events, and cross country. He maintains good times at in the masters category with a mile personal record of 4:47, two mile PR of 10:20, and a 5K PR of 16:36.

Adam has developed TidBITS into the largest email based Macintosh magazine with over 30,000 readers, translated into Japanese and Dutch each week. In the annual MDJ Power 25 survey of industry insiders, Adam has ranked among the top five most influential people in the Mac industry year after year. He has also been included on the MacTech 25 list of influential people in the Macintosh technical community for 2006, 2007, and 2010 and he was named one of MacDirectory's top ten visionaries.

Adam, Tonya and TidBITs have garnered many other awards and lists. For several years, the Best of the Mac Web Survey run by Low End Mac has included TidBITS for its importance in in the Macintosh community. Seattle Magazine has named Adam as one of its 25 Cyberstars, and WorldHot.com included TidBITS among their list of the World Hottest 100 Mac Web Sites.

Many other awards and lists for adam, Tonya and TidBITS can be found at .

If you haven't subscribed to the TidBITS e-magazine, you should. Go to to subscribe or read an issue.