Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I don't do anything with corporate IT and networking, but I know enough to handle and get networks going. Anyway, something I ran into in my travels when it comes to the occasions of working on individual computers and small networks when I do is the matter of securing devices which have Internet or wireless exposure.

I'm a complete novice in these matters and what is best, so I thought I would do some reading and got some basic ideas of good security practices, but still came up with some questions that weren't really answered solidly:

  1. What are the rules for entering WPA-style passwords in most devices? Could you get away with any standard printable character in these devices or are there some restrictions (hex-strings, some characters not allowed)? I really don't find any good documentation on this.

  2. Are there any good set rules for what makes a good "strong" password in terms of entropy? I found sites like http://www.passwordmeter.com/ which seem to be a good benchmark, but I really haven't found any good rules which qualify something as an "ideal strong password" in an universal sense. There's the random printable character method and then the xkcd method, too.

  3. Since I figure in most cases, all that will happen with these devices after the fact is that people (primarily myself with my own stuff, but others too, think home network stuff) will use the Internet directly or their laptops in order to connect to the Internet, the password doesn't necessarily have to be easy to remember and readily reproduced, so my thought is that any password these devices are set to can be printed out or written down and stored away just in case there is a need to get back into these devices after they are set up. Does this seem smart, or is there something I'm missing?

  4. Given that I'm more inclined towards programming than networking overall in my experiences, I came up with a password generator, which currently just does random printable characters of certain lengths with a few rules. Are there any suggestions on what to do to make the output of this program "gold standard"?

I could be overthinking the password issue entirely, but the thing I notice which is common to all these cases is that they are devices which generally won't have any attention paid to them as long as they are working properly (basically home use - as long as it gets me on the Internet I'm happy). In that way, I'm wanting to learn how to make something I deal with relatively bomb-proof when it comes to anyone who might want to access it and am not entirely clear on the password end of it.

share|improve this question
add comment

3 Answers

To quickly answer these:

  1. Mostly no limits, assuming we're talking about WPA2. The password goes through a key-derivation algorithm, so the key is a fixed size regardless of password lengths. Some device vendors may put soft limits on their control panels, but these are usually pretty lax. I'd avoid unicode characters though, since they're not always identical in terms of encoding across different systems.
  2. As long as your password is complex enough and long enough, it'll prevent the WPA2 key from being cracked. What "enough" is depends on your security requirements, but for home use I'd say 12 characters a-z A-Z 0-9 (3.22×1021 keyspace) should be more than enough, as long as it's reasonably random. You're highly unlikely to come across attackers that use complex statistical analysis to test "likely" human-random passwords first - most aren't going to be doing anything more than a dictionary attack.
  3. Standard practice in most corporate environments is to store paper copies of mission-critical credentials in a safe. If you wish to store such backups, invest in physical security. Your desk drawer isn't actually particularly secure, but it's in your house and your house has locks. Are you really worried about attackers that break into your house to steal your wifi password?
  4. Don't bother. For a start, there are hundreds of password generators out there that already do this; keepass has a good one. Most importantly, you don't really need to worry about cryptographically strong random passwords - just pick something "random" manually, or use an existing generator if you're paranoid. There's no need to do anything more unless you're protecting mission-critical data.

All in all, it sounds like you're overthinking it. Your main threat is dictionary attacks, which you can thwart by not using any common passwords or dictionary words.

share|improve this answer
2  
I would add that if the key is entirely hex characters of the right length, the key derivation is bypassed and it just uses that as the pre shared key, also in WPA/WPA2 the PSK is only used for initial connect and verification of client, after that session keys are used for actual data encryption. –  ewanm89 Nov 7 '12 at 10:39
2  
And don't use a common SSID as that is also used as a salt in the key derivation, one does not want to end up with a rainbow table already existing. –  ewanm89 Nov 7 '12 at 10:40
    
1. I ask this because I've encountered situations where certain printable characters are not allowed. For example, a wireless printer that only allows 8 symbol characters in addition to the alphabet and numerals for passwords. I've read in different places that Linux/Unix doesn't play well with spaces in the password as well. So this is why I'm asking. –  Glenn1234 Nov 7 '12 at 16:21
    
@Glenn1234 The spaces thing refers to spaces at the start or end of the password, which Linux/Unix do silly things with. If you're coming across limitations with symbols, these are vendor-specific failures. TKIP fully supports ASCII symbols in passwords. –  Polynomial Nov 7 '12 at 16:22
    
3. So the answer is that I'm thinking okay on this. 4. Already bothered, and might make a storage function someday. Just was asking to see if anyone had any ideas. Overall, though, it seems like this is fine if this is the consensus opinion. –  Glenn1234 Nov 7 '12 at 16:28
add comment

Password meters (like the sites you may find) are not good at measuring password entropy, despite what they claim. Human beings are not good either at producing entropy. Entropy (in this context) is a characteristic of the password generation process, not of the resulting password. What matters for entropy is not what the password value is, but what it could have been, and, by definition, this cannot be deduced from the password alone.

To generate a strong password, use a computer. On any Linux system, this command:

dd if=/dev/urandom bs=9 count=1 | openssl base64 -a -e

will generate passwords with 72 bits of entropy, which is more than enough to thwart attackers (you do not need to keep the final '=' sign). The idea is simple: get 9 random bytes (from /dev/urandom, which is a cryptographically strong random number generator) and then encode them in a format which is suitable for entry on a keyboard (Base64 uses only letters, digits, '/' and '+', with 4 characters per 3 input bytes; since we start with 9 random bytes, we end up with 12-character passwords).

The characters used by Base64-encoding should work "everywhere"; in particular, you can type them on foreign keyboards, or on smartphones, and they will not suffer from the usual encoding issues that you get with accentuated letters (or just any characters which is beyond what Americans use, i.e. ASCII). For WiFi, WPA2 accepts long passwords with arbitrary characters; and if you do not use WPA2 for your WiFi then you are doing it wrong.

Writing down passwords is a trade-off: if written down, then physical security of the paper must be ensured; on the other hand, it allows you to use many more passwords than you could possibly remember, especially passwords that you do not type often (that's typical of WiFi passwords). Just store them somewhere safe, which means, yeah, a safe, or possibly a "portable safe", commonly known as a "wallet". The safe does not need to be much stronger than what it protects.

One option would be to write the password on a paper glued under the access point itself. Whether this is a good idea or not depends on the physical environment of the AP. Basically, whoever has physical access to the AP can do a lot of harm, including just linking his own device to the Ethernet plugs that most AP conveniently feature. Of course, with the password written under the AP, an attacker who has transient access to it can learn the password and you would not notice it. But it is still worth considering, e.g. for a home router (if an evil individual sees the password, then he is in your house, at which point you may have more urgent issues to deal with than just WiFi security).

Most password "rules" (like the famous "xkcd method") are about producing passwords which fit in human brains, or can even be generated in human brains. That's hard. This often results in poor trade-offs between passwords which are weak, very long, hard to remember and/or hard to type. The culprit is the human brain. It is much simpler to just remove it from the equation.

(TODO: write a PowerShell one-line password generator, for the Windows users. That's not hard, but I don't have a Windows machine handy right now.)

share|improve this answer
    
Thanks for the added entropy idea, I might try it with the generator I already have (which works on Windows). As for writing the password down, this is what I had in mind. Short of losing it, something that's set up and done would work to just have the password in a safe. My main concern was it being a home device which isn't necessarily monitored for outside traffic. –  Glenn1234 Nov 11 '12 at 6:18
    
"if you do not use WPA2 for your WiFi then you are doing it wrong." - what if the home devices don't support it? For example, I flashed the ROM of the printer I mentioned above to support WPA instead of just WEP, but I hoped for a WPA2 upgrade and didn't find it. –  Glenn1234 Nov 11 '12 at 6:20
add comment

One alternative to writing down passwords is to store the password hints instead of the passwords themselves. Yet another technique is to store the passwords on an encrypted UBS drive. These are both mentioned in http://www.nytimes.com/2012/11/08/technology/personaltech/how-to-devise-passwords-that-drive-hackers-away.html?smid=pl-share.

It is also known that password crackers use lists that are now finely tuned and updated to correlate with the way human beings create passwords and the guessing is far more efficient than that previous methods based on standard dictionaries and the associated modifications. The password length is also very important, especially ensuring it is 8 characters or longer. This is discussed at http://arstechnica.com/security/2012/08/passwords-under-assault/4/.

share|improve this answer
    
The problem with password hints is, when push comes to shove, will you (or your authorized agent, because you're 10000 miles away) get the hint? And what if the USB drive is fried? Writing the password down is safer. For one thing, it's impervious to remote attackers. Of course, you don't keep the piece of paper tacked to your monitor if you don't want visitors to see it. –  Gilles Nov 10 '12 at 12:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.