Alex - while on the surface what you are saying makes sense, as one who has looked at a lot of keylogger data, I can tell you that identifying passwords is fairly trivial, even when the passwords are simple english words like "house" or "dog" (let alone "scrambled words" like "zydkgel" that basically _scream _password. Two things make it straightforward.
* The word is out of context.
* There is usually a time delay on each side of the word.
Also, you usually have them typing in their username/account number near the password, another dead giveaway
So, even requiring that the user make it a straight forward english word provides little (no) defense against keyloggers. On the flip side, when the vendor's hash files (we are presuming at the _very_ least the passwords aren't stored in plaintext, or, the marginally better, "encrypted file") are compromised, having a broad keyspace makes cracking the passwords by brute force more difficult.
If you read the Amex email, they actually require _only letters_ - And, it's not even clear they require capitalization.
I'd love to see how quickly that hash file would fall apart. :-)
Ironically if they made their password the same as their username it might actually make it harder to spot in a keylogger context. (But trivially easy to guess.)
And, ironically, not allowed by Amex. :-)
(BTW - you are correct, even _knowing_ that the password folllows the user account - a password that is a URL would be an incredibly effective way of defeating keyloggers. At least the ones who are trying to pull data in from thousands of people. Once you are focussed on the keylog data from a _single_ stream, it's basically game over.
Can alternating mouse input help? E.g. click over to your google-search box, type in p455w0rd, then click back over to your password box and type in your password, facebook.
Could you reduce the utility of a keylogger by allowing 64 chars, say, in which to embed your password and not allowing repetition of the same keyphrase within a given period? I'm guessing most would just enter the password as the first chars and then add a different digit at the end.
Comments
Alex - while on the surface what you are saying makes sense, as one who has looked at a lot of keylogger data, I can tell you that identifying passwords is fairly trivial, even when the passwords are simple english words like "house" or "dog" (let alone "scrambled words" like "zydkgel" that basically _scream _password. Two things make it straightforward.
Also, you usually have them typing in their username/account number near the password, another dead giveawaySo, even requiring that the user make it a straight forward english word provides little (no) defense against keyloggers. On the flip side, when the vendor's hash files (we are presuming at the _very_ least the passwords aren't stored in plaintext, or, the marginally better, "encrypted file") are compromised, having a broad keyspace makes cracking the passwords by brute force more difficult.
If you read the Amex email, they actually require _only letters_ - And, it's not even clear they require capitalization.
I'd love to see how quickly that hash file would fall apart. :-)
Ironically if they made their password the same as their username it might actually make it harder to spot in a keylogger context. (But trivially easy to guess.)
Making your password:
would be pretty sneaky.And, ironically, not allowed by Amex. :-) (BTW - you are correct, even _knowing_ that the password folllows the user account - a password that is a URL would be an incredibly effective way of defeating keyloggers. At least the ones who are trying to pull data in from thousands of people. Once you are focussed on the keylog data from a _single_ stream, it's basically game over.
Can alternating mouse input help? E.g. click over to your google-search box, type in p455w0rd, then click back over to your password box and type in your password, facebook.
Could you reduce the utility of a keylogger by allowing 64 chars, say, in which to embed your password and not allowing repetition of the same keyphrase within a given period? I'm guessing most would just enter the password as the first chars and then add a different digit at the end.