Simple Passphrase Conundrum
August 4th, 2012My sympathies go out to Mat Honan who, as he puts it, “was hacked. Hard.” After exploiting his iCloud account, the attackers took over his Gmail account, and proceeded to remote-wipe the contents of his iPhone, iPad and Mac. He states in his recollection of the tragedy that the compromised Apple ID had a 7-character passphrase, and had remained the same for many years. The relative weakness of the passphrase, combined with the long period of time, presumably gave hackers the opportunity to guess the passphrase by brute-force. I hope we will learn more about the specific details of the attack, because it will help inform how the rest of us can better protect ourselves.
Assuming the weak passphrase was indeed the root of the exploit, the obvious way Mat could have protected himself is by choosing a more sophisticated one. But as Michael Rose of TUAW points out, the increased security brings with it significant costs in day-to-day frustration: the Apple ID passphrase is demanded for many user actions involving Apple’s store and syncing services. The particular difficulty of typing complicated phrases on the iPhone has led some folks to intentionally choose simpler passphrases.
Apple and other tech powerhouses such as Google, Facebook, and Twitter, hold increasingly large amounts of power over not only the information we store on their servers, but on other services, to the extent we’ve granted them the privilege of authenticating our identities. An issue in Mat’s case was that once the hacker had his iCloud email, he or she was able to compromise Gmail by following the “forgotten passphrase” for Gmail. Services such as Twitter that don’t host email face similar vulnerabilities: many services, including but not limited to games, offer to use Twitter authentication to log in. In this situation a compromised Twitter account means all the services you’ve entrusted to Twitter are compromised as well.
One way to protect yourself is by declining to delegate authentication to third parties. When enrolling in a new service that offers Twitter or Facebook authentication, I usually go through the nuisance of creating a new account instead. That way I can choose a unique passphrase, and store that in my keychain. I prefer this to allowing numerous items to be implicitly added to my Twitter or Facebook “keychain.” Don’t put all your eggs in one basket, as they say. (Well, that’s what I’m doing with my keychain, but I am empowered to personally protect it and to back it up as I see fit.)
On my iPhone, I chose an exceedingly difficult passphrase after reading about how relatively easy it is for hackers to brute-force the code in hardware when they possess the device. I also chose a very short, 1 minute lockout period, and opted to let it wipe my data clean after 10 failures. These steps minimize the chances that a thief will be able to access my data. But this is a royal pain in the ass in practice, as I’m constantly required to fumble with my phone, keying in this monstrous phrase.
Apple, and other companies who hold the “keys to the castles,” can help by developing technologies that empower us to apply increasingly strong protections while at also minimizing the day-to-day hassles of a complicated passphrase. For example, I would be happy to use a simple 4-digit passcode that unlocked my phone, if a longer passphrase was demanded after an hour of inactivity. This would allow me to use my phone in confidence that it would be fairly hard to unlock quickly without the passcode, and that a thief would only have an hour to make that happen before the phone entered “strong lockdown” mode.
Apple seems interested in evolving their authentication strategies: they recently acquired AuthenTec, a fingerprint-sensor manufacturer. Will future iPhones allow us to unlock our phones with a simple finger-touch? It would be a nice step forward in usability, but I’m not familiar enough with the technology to know if it’s a step forward in security. Other companies are looking forward, as well. Tim Bray at Google recently announced he’d be pouring his energies into identity technologies. A commonly cited approach is two-factor authentication, which is perhaps a way Apple could apply the fingerprinting technology, combining it with a relatively simple-to-type pin code.
Culturally and technologically, we have certainly come a long way from plain-text passphrases stored in a file, but it’s clear there is a lot more to be done. In the mean time, I’ll just be here fumbling with my phone every other minute, cursing Apple as I bask in a moderate sense of security for having jumped through all these hoops.
