Does Microsoft's "Password Ban" list insecurely store user passwords?

Question

According to SecurityWeek, Microsoft is banning common passwords, and they will dynamically update their list:

Microsoft says it is dynamically banning common passwords from Microsoft Account and Azure AD system. […] Microsoft is seeing more than 10 million accounts being attacked each day, and that this data is used to dynamically update the list of banned passwords.

Is this list based on actual passwords for other people's accounts or just passwords used in brute force attempts?

Could a secure system be built that checked password updates against other people's existing passwords and rejected the update if the password was too common?

Answer 1

We, at Microsoft, are banning the passwords most commonly used in the attacks and nearby variants. We aren't basing this on our user populations, who (because of the system) don't share these passwords unless the attacks change.

The attack lists generally derive from studying breaches. Attackers are smart enough to look at lists to figure out high probability passwords, then do their brute force, etc. around those high frequency words. We look at the same lists plus the attack patterns to determine our ban lists.

Hope this helps.

Answer 2

A system that checks existing account passwords before deciding to block a new user's password as "too common" would, in fact, be self-defeating. You would not only be letting a user or attacker know that in fact the password is valid for some accounts, but that's it's valid for a lot of accounts. Specifically, the commonality threshold value - 1 of them.

So, the approach described in the article is in fact the approach that Microsoft is using to ban common passwords for Microsoft Accounts and Azure AD. It's a combination of known common and/or weak passwords, passwords that are commonly used in brute-force access attempts, and variations on those passwords that are determined to be too similar.

Answer 3

Could a secure system be built that checked password updates against other people's passwords and rejected them if a password was too common?

There are reasons not to do so, but if I were tasked with preventing passwords from being overused, I'd receive the password, Hash it, Store the hash in a table with no connection to any user nor even the text that was used to create the hash, or update the count if it already exists. If the count exceeds some limit, advise the user to choose another password. Once an acceptable password is given, salt it and store the salted hash for the user.

So, you're not checking against other user's passwords directly, just against their unsalted hashes.

Answer 4

The best thing to do is just checking for password weakness on server side. This can be an expensive operation (for example lookup from dictionaries). Also, passwords commonly used or checked for attacks are a good bet.

It is possible Microsoft hashes the password and compares it to a list of insecure passwords, not actually used by any real user. If the hash fails, then they could check password strength with another heuristic. Finally the system can either refuse or accept the password and discard its unhashed version. If the password is refused it is likely it is added to insecure hash list.

Password weakness check can also keep into account common used attacks, so it has to be a evolving algorithm.

This has either 2 advantages:

1. You do not need to store all insecure passwords' hashes.
2. You can ban collisions in hashes altogether (e.g. a strong password with the same hash as a weak password).

Of course those are just speculations. We cannot know password security measures taken by such a big corporation like Microsoft unless they tell us.

As final measure, I would just use a different hash for weak passwords compared to real user passwords.

Edit: Why should weak passwords be hashed? There's no need for strong hashing, but hashing weak passwords would allow at least to "secure" valuable data. It is no cost do some simple hashing, but if any database data leak, you know at least competitors won't be able to easily reverse weak passwords, which may still be a security concern for services that do not use the ban list or at least may just cause a minor economical advantage.

So to answer GroundZero's comment: No, not even weak passwords should stored in plain text. A simple hash would benefit the corporation anyway. This is because there are passwords that are culture specific, gathering that information would require massive investment, so why should you store valuable info in an easy to retrieve way?