Contraseñas en Linux

En Arabesque estuvieron escribiendo una interesante serie sobre diversos aspectos de seguridad para el usuario en Linux (el índice en http://blog.sanctum.geek.nz/linux-crypto-introduction/”).

Tal vez volvamos sobre ella pero hoy me gustaría traer aquí el tema de las contraseñas: Linux Crypto: Passwords donde nos habla de pass como utilidad para gestionar las claves que utilizamos habitualmente.

Para los aficionados a los programas con interfaz textual puede ser una buena alternativa a otros métodos publicitados frecuentemente.

Anuncios

¿Deberían informar los sitios web sobre sus mecanismos internos?

La pregunta la hace Troy Hunt en Should websites be required to publicly disclose their password storage strategy?: hemos olvidado nuestra clave en un sitio y pedimos recuperarla; nos llega un correo electrónico con nuestra clave; un sudor frío empieza a recorrer nuestra espalda.

O vale, no nos la manda, porque dicen que no pueden/no quieren, ¿lo estarán haciendo suficientemente bien? ¿Me importa? ¿Le importa a los usuarios?

Sobre el recordatorio de contraseñas:

Another reason this doesn’t make much sense is that many websites leak information about the password storage mechanism anyway. Ever used a “forgot password feature” and been emailed your password? There’s disclosure that they’re not hashing it so it’s either immediately accessible once the database is disclosed or accessible once the key is obtained and once a box is popped, this is very, very frequently a trivial task. There’s an entire site dedicated to naming these purveyors of poor password management over at plaintextoffenders.com so certainly there is voluminous public data on them already.

Y tampoco es tan sencillo:

Password storage isn’t always just as simple as “we use this hashing algorithm with this salt” and indeed the protections offered by, say, symmetric encryption may be as good as null and void if the key management strategy is bad. So how much information should be disclosed? Where do you draw the line between a simple statement as seen in the badges above and a more comprehensive – and perhaps revealing – statement of a website’s security position?

Vale la pena, en todo caso, darle un par de vueltas al tema antes de tomar decisiones en nuestros propios desarrollos.

Almacenamiento seguro de contraseñas

En Storing
Passwords Securely
un texto interesante.

Cuidado con los hash que utilizamos para almacenar las claves:

Typically, system designers choose one of two ways to store their users’ passwords: 1. in their original format, as plain text, or 2. as the digest (output) of a one-way hash function. It probably goes without saying that the first option is a bad idea considering that any kind of compromise of the users/password database immediately exposes login credentials clients may be using on many other sites—but would it surprise you that the latter, as implemented in the majority of web systems, only provides marginally stronger security?

El consejo sería:

If you create a digest of a password, then create a digest of the digest, and a digest of that digest, and a digest of that digest, you’ve made a digest that is the result of four iterations of the hash function. You can no longer create a digest from the password and compare it to the iterated digest, since that is the digest of the third digest, and the third digest is the digest of the second digest. To compare passwords, you have to run the same number of iterations, then compare against the fourth digest. This is called stretching.

A good password storage system takes so long to process a single input, e.g. 0.2 seconds on a modern computer, that guessing a password using a brute force will take significantly longer. (With a hash algorithm like SHA-256, this might be 100,000 iterations or more.) Where, previously, one might have been able to compare digests 5,6 billion times per second, it might now be 5 times per second on the same computer without parallelization; more, maybe a few hundred or thousand attempts per second using hardware like GPUs—but still significantly less than 5,600,000,000!

En realidad, ¿qué habría que hacer?

Adaptive key derivation functions are exactly what we’ve discussed above: Functions that generate digests from passwords whilst applying salting and stretching. They implement all of the above features, and often in a way that would be difficult to achieve using just a programming language’s standard library. For instance, they might work such that the digest computation can’t easily be parallellized—something that is very doable with plain MD5 and all members of the SHA family. In effect, attackers can’t easily apply specialized hardware like GPUs or FPGAs to greatly improve the speed at which passwords can be guessed using a brute force approach.

Y, a modo de conclusiones:

Here is my view:

– MD5, SHA-1, SHA-256, SHA-512, et al, are not “password hashes.” By all means use them for message authentication and integrity checking, but not for password authentication.
– If you are a government contractor, want to be compliant with security certifications or regulations like ISO 27001 or FIPS 140-2, or don’t want to depend on third-party or less-scrutinized libraries, use PBKDF2-HMAC-SHA-256/SHA-512 with a large number of iterations to generate digests of your users’ passwords. (Ideally it should take a second or more to generate a single digest.)
– If you want very strong password digests, and a system that is very easy to use, use bcrypt. Simple, easy-to-use libraries exist for nearly every programming language. (Just google “bcrypt “, and chances are you’ll find a solid implementation.)
– If you are designing a new system which either relies on encryption to store very sensitive information using a weak secret (user passwords), or where it is imperative that nobody guesses any of the passwords in any reasonable amount of time, you should investigate if there is a solid implementation of scrypt for the language or framework you’re using.

Cada vez se sabe más sobre estas cosas, y cada vez hay que estar atento a más cuestiones.

Ya habíamos hablado de Elegir un hash.

También es muy interesante echarle un vistazo a The History of Password Security aunque como sólo es una presentación algunos detalles no se pillan del todo (al menos yo).

Almacenamiento seguro de contraseñas

Cuando leí Storing Passwords Securely me pareció una lectura recomendable sobre el tema:

Time and time again you hear about a company having all of their users’ passwords, or “password hashes”, compromised, and often there’s a press response including one or more prominent security researchers demonstrating how 1,000 users had the password “batman”, and so on. It’s surprising how often this happens considering we’ve had ways to do password authentication that don’t expose users’ passwords, or at least makes it significantly harder to crack them, for several decades.

Personally, I think it boils down to a fundamental misunderstanding about what cryptographic hash functions are and what they are—or should be—used for, and a failure on the part of security researchers and advocates, myself included, to properly explain and emphasize the differences. So here’s an attempt to explain why “SHA 256-bits enterprise-grade password encryption” is only slightly better than storing passwords in plain text.

Se habla de los hash y otras cuestiones que hay que tener en cuenta. Además tiene The History of Password Security como ‘bola extra’.

Gestores de contraseñas y XSS

En Abusing
Password Managers with XSS
que se refiere a una forma de engañar al
gestor de contraseñas del navegador.

An issue with both in-browser as well as third-party password managers that gets hardly any attention is how these can be abused by XSS. Because many of these password managers automatically fill login forms, an attacker can use JavaScript to read the contents of the form once it has been filled. The lack of attention this topic receives made me curious to see how exploitable it actually would be. For the purpose of testing, I built a simple PHP application with a functional login page aswell as a second page that is vulnerable to XSS (find them here). I then proceded to experiment with different JavaScript, attempting to steal user credentials with XSS from the following password managers:

LastPass (Current version as of April 2012)
Chrome (version 17)
Firefox (version 11)
Internet Explorer (version 9)

I first visited my login page and entered my password. If the password manager asked me if I wanted it to be remembered, I said yes. I then went to the XSS vulnerable page in my application and experimented with different JavaScript, attempting to access the credentials stored by the browser or password manager.

Soy muy partidario de utilizar un gestor de contraseñas, pero no me siento confortable con que esté en el propio navegador porque pueden pasar cosas como estas.

Más datos sobre claves

En The science of password selection un (otro) informe sobre las claves que se obtienen de diversas maneras de usuarios reales en la red.

De mis notas.

¿Cómo eligen las claves los usuarios?

En este caso los datos vienen de varias fuentes:

The data I’m going to analyse comes from a variety of sources including the Sony and Gawker breaches I referenced in the previous post as well as other LulzSec releases including pron.com and a collection of their random logins.

Se usan nombres (un 14% de claves, derivadas de nombres):

I also suspect they feature heavily when someone reaches into the recesses of their mind to come up with a password. Now of course the name is not necessarily the name of the account holder; it could be a spouse, the kids or even the family dog. Furthermore, it could be a first name, a middle name or a last name.

Un 25% son palabras del diccionario (incluyendo la palabra ‘password’)

A huge 25% of passwords are derived directly from dictionary words. In
reality, it’s probably somewhat higher than this as my dictionary had less
than a couple of hundred thousand words. And they’re all only English
language.

Top among the dictionary favourites are:

password (oh dear)
monkey
dragon

Las claves numéricas tienen en su mayoría (83%) cuatro, seis u ocho dígitos, pero hay un buen número de longitud uno, por ejemplo.

Why is this interesting? Well firstly, within a spread of numeric password lengths which range from 1 (yes, 1, and there’s a heap of ‘em) to 21, 83% of the passwords are either four, six or eight digits long. Is this a propensity for even numbered password lengths or something else?

Los de cuatro podrían corresponder al PIN del cajero automático.
Los de seis serían fechas donde el año tiene dos cifras.
Los de ocho serían fechas con el año completo.

Las claves con dos palabras repetidas (blabla) serían menos del 3%, pero es un patrón que utiliza la gente.

También hay quien utiliza frases cortas del estilo de: ‘dejameentrar’ o similares.

Naturalmente, he hecho una selección según mis gustos y sesgos, pero vale la pena leerlo todo para hacerse una idea.

Otro estudio sobre claves

No creo que el título sea apropiado, sobre todo teniendo en cuenta que ya nos hemos preguntado si el sistema de usuario/clave es el más adecuado para estas cosas pero me gusta guardar estos datos, que nunca se sabe: Survey Reveals How Stupid People are With Their Passwords.

• 4 in 10 respondents shared passwords with at least one person in the past year.

• Nearly as many people use the same password to log into multiple Web sites, which could expose their information on each of the sites if one of them becomes compromised. (A separate recent study revealed that 75% of people use the same password for Social Networking Sites and their email accounts)

• Almost half of all users never use special characters (e.g. ! ? & #) in their passwords, a simple technique that makes it more difficult for criminals to guess passwords. (Yet not all sites support this option of special characters!)

• 2 in 10 have used a significant date, such as a birth date, or a pet’s name as a password – information that’s often publicly visible on social networks.

Además,

Younger people are especially likely to take online security risks. Webroot found that among 18 to 29 year-olds:

• 12 percent have shared a password in a text message (vs. 4 percent overall)

• 30 percent logged into a site requiring a password over public WiFi (vs. 21 percent overall) (Note: This is typically only dangerous when you logon not using SSL — aka HTTPS in your browser)

• Over half (54 percent) have shared passwords with one or more people in the past year (vs. 41 percent of people overall)

The number of Web sites that require an extra layer of security has proliferated, driving careless habits:

• Three quarters (77 percent) of consumers have five or more accounts with online services that require passwords.

• One-third (35 percent) have 10 or more password-protected accounts. Only 10 percent ensure they never use the same password on different accounts.

• Passwords are forgotten occasionally, often or always by over half of consumers (51 percent).

Despite these disturbing figures, consumers still think they are safe, with 50 percent of people saying they feel their passwords are very or extremely secure. That being said, according to the survey:

• 86 percent do not check for a secure connection when accessing sensitive information when using unfamiliar computers.

• 14 percent never change their banking password.

• And 30 percent remember their passwords by writing them down and hiding them somewhere like a desk drawer.

• 41 percent use the same password for multiple accounts.

• Only 16 percent create passwords with more than 10 characters in length.

• Almost half of Facebook users (47 percent) use their Facebook password on other accounts and 62 percent of Facebook users never change their password.

Claves y usabilidad

Dos disciplinas se están abriendo paso en todo lo que se refiere a la seguridad: una aproximación desde una perspectiva económica (¿cuánto cuesta, cuánto vale lo que se protege, es mejor perder un poco y hacer más negocio o estar muy protegido?) como vimos, por ejemplo, en La economía de la seguridad y uno de cuyos principales representantes sería Ross Anderson (Economics and Security Resource Page). La otra es la usabilidad (la seguridad tiene que ver con que las operaciones de seguridad sean, además, las fáciles y sencillas de obtener). Hemos comentado sobre ello en Sobre claves y control de acceso en sitios web, Contraseñas, usabilidad y uso, Redes sociales, interfaces y usabilidad y algún otro.

Por eso me gustó el otro día ver la aproximación inversa: desde el punto de vista de la usabilidad, la aproximación a la reinicialización de claves (cuando se nos olvidan, por ejemplo), en The password reset experience y The truth about passwords. Cualquier practicante de estos temas debería tener muy presentes los consejos (de acuerdo, siempre, al bien protegido) y no sobrecargar a los usuarios con nuestras preocupaciones sobre su seguridad.