3

Among the more security savvy community (very much including security.stackexchange) there is an ongoing discussion about the strength of different password policies. Examples include the Tr0ub4d0r&3 vs correct horse battery staple, Bruce Schneiers scheme, the BBC scheme, among others.

These different approaches have all been examined in-depth, down to entropy-level calculations, how easy certain passwords are to remember, etc. -- and I think we can all agree on the qualities good passwords need.

Also, we all know the stories of password, love, 123456, querty and all the other useless phrases that the average Joe sometimes relies upon and that appear every time a large collection of passwords gets leaked somewhere.

But have there actually been known cases where people invested some thought/effort in picking passwords which in hindsight proved to be too weak? I sometimes get the feel that if an organization/person is aware of the password issue, and has even a basic understanding of security principles, they are already 99.9% safe on that front.

To reformulate the question:

How often has password strength been an actual security problem in a professional context?

With 'professional context' I explicitly mean a context where some informed decision was undertaken to choose decent passwords.

E.g. somebody picked a non-trivial password (maybe Tr0ub4d0r&3-style), and it was actually cracked and exploited in a context where a different scheme would have proven more resilient (and where the reason for the incident was not some other failing part of the security chain).

closed as primarily opinion-based by GdD, Ohnana, Xander, Stephane, Matthew Jan 26 '16 at 15:38

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    "I think we can all agree on the qualities good passwords need." not even close :D I personally think most research on the topic is deeply, deeply bogus. The strength of an individual password from an individual user means absolutely nothing in 2016. – Steve Dodier-Lazaro Jan 26 '16 at 13:02
  • 1
    This is what I meant, really. Is it actually worth our time to still be discussing password policies when an exploit/backdoor/phishing/social engineering/... attack is so much more likely... – fgysin Jan 26 '16 at 13:38
  • 1
    I think another way to answer your question is to look at what has been found in public password dumps, specifically cases where the passwords were hashed and a large percentage were cracked. For example we do sometimes see different password techniques showing up in those large sets of "cracked passwords" which would imply that the users did attempt to do something beyond the basic level of passwords. I think the fact that these too occasionally get cracked means that teaching better password development techniques is in fact still relevant. – Trey Blalock Jan 26 '16 at 15:18
  • 1
    Why the votes for close? Can someone suggest edit that would make this question more eligible? (I'm really asking for specific real world occurrences of failure of decent password policies - this seems answerable to me, if not necessarily obvious.) – fgysin Jan 26 '16 at 15:18
  • 1
    Hey @fgysin this paper may not answer the part of your question about a weakly created password actually being exploited but it does provide insight on what password strengthening measures average people take that may not provide much security benefit. – PwdRsch Jan 26 '16 at 17:29