Why do I need a strong password for my home computer? What kind of attack is it trying to thwart?

Question

I can understand why a website password needs to be strong as it needs to be able to withstand an offline attack against stolen password files by a password cracker capable of potentially 350 billion guesses per second and using rainbow tables containing many millions of pre-computed password hashes. And so I appreciate the need to use a password manager and for it to have a very strong master password.

But do these considerations apply to the password for my home computer? (i.e. mac/pc desktop/laptop) If my computer were to be stolen I understand that it is possible to break into it without knowing my password. If the attack uses the Internet then I guess it involves malware. A number of related questions occur to me...

1. Can malware launch the kind of attack used against stolen database password files?
2. How securely is my computer password stored?
3. Would the malware need to know my password anyway, as presumably it would have my logon authority?
4. So what function does the password then serve? What is there left to protect?
5. Does this depend on the operating system?
6. Do I need the same strength of password for a limited account as an administrative one?

Another way of phrasing the question is to ask how strong my home computer password needs to be, given the difficulty of creating a memorable password that would thwart an attack by a password cracker (see Schneier on Security and this Carnegie Mellon University research). I need such a password for my password manager and also my Apple Id (I think), but do I need to remember a third super-strong password for my home computer?

I don't have a technical background, but would I be correct in thinking that an encrypted hard drive is protected by my admin password and that if my home computer is stolen this password could be subjected to a brute-force attack? Does its vulnerability then depend on both its strength and the hashing algorithm used to store it?

Answer 1

The primary reason to have a strong password is to defend against people who have physical access to your machine, but are not tech-savvy. If you do not encrypt your drive, anyone could mount - and read, delete, or change - your data easily if they have access, and thus also gain control of your system.

But how many people who have physical access to your computer can actually do that? There is also a psychological barrier. "Just checking out" if you use your birthday as password may not feel as big a violation - and is easier done than - other attacks.

If you use a weak or no password for a more privileged account, malware could also possibly do more damage.

1. Can malware launch the kind of attack used against stolen database password files?

You do not generally allow remote access to your personal computer via system users, so online bruteforcing is out of the question. If someone has physical access and the drive is not encrypted, there are easier ways than bruteforcing.

2. How securely is my computer password stored?

That depends on the system. In many linux systems, it is stored in the /etc/shadow file, which is only readable by root users.

3. Would the malware need to know my password anyway, as presumably it would have my logon authority?

The malware will most likely first run under the permissions it was installed with, which is likely your primary account. It doesn't need your password to do this. It may then try to gain more privileges via exploits against the system. Theoretically, it may also try to brute-force passwords for more privileged accounts, or use a keylogger to read the passwords when you enter them.

4. So what function does the password then serve? What is there left to protect?

As mentioned above, having a reasonably strong passwords prevents people with pysical access to easily access your system without the need to perform any actual attack.

Answer 2

TL;DR;

What kind of attack is it trying to thwart?

It protects against people close to you. They might be just curious or may have a malicious intent (e.g., the case of an abusive partner).

Why do I need a strong password for my home computer?

You do not necessarily need a strong password. You could use an authentication system with a PIN with a maximum number of attempts (it is available on Windows 10).

---

Let us consider three different threat models. You mentioned the case of a random theft and the case of a random malware.

I think you forgot an important threat model: the abusive partner or noisy relatives. I will discuss this one at the end.

1. Random theft

You can be the victim of an unfortunate, not targeted, robbery. In our case your computer.

I understand that it is possible to break into it without knowing my password.

It depends.

For example, if you used encryption, you can probably consider your data to be safe (confidentiality non violated). A common thief will not be interested in your data, but the money she/he can get in exchange of your computer. Thus, no attempt to recover the data (e.g., via brute forcing the password) will be made.

If you did not encrypt your data, even an unskilled attacker can easily access your data without your password. However, you do not know what will happen to it. Probably nothing, again, just looking for the money. But you can never be sure. Maybe the thief found some interesting data to sell or to blackmail with?

So regarding your questions:

Would I be correct in thinking that an encrypted hard drive is protected by my admin password

It depends on the technology used for the encryption.

and that if my home computer is stolen this password could be subjected to a brute-force attack?

This is highly unlikely. Unless you are victim of a targeted robbery, which is unlikely.

2. Random malware

You can be the victim of an unfortunate, not targeted, malware infecting your computer. For example, you opened a malicious e-mail or downloaded from the Internet an infected application.

Can malware launch the kind of attack used against stolen database password files? How securely is my computer password stored? Would the malware need to know my password anyway, as presumably it would have my logon authority?

If any malware already infected you, you are right, it already has your privileges, hence it does not need to find your password.

3. Abusive partner or noisy relatives

The third threat model is about persons close to you or relatives that can have access to your computer from time to time.

Many couples, families or friends trust each other to not violate the privacy of another member of one of the group. That's why it is common to see families share the same account on the computer or to know the e-mail password of their spouse.

However, such choice could be dangerous. The relationship can evolve. For example, a spouse is suspicious about the fidelity of the other, or parents do not trust their children anymore after some event. There is cases of abusive partners that installed spyware on their (ex-)partner phone/computer to monitor their live. Even cases of domestic violence.

Hence, even if you use separate accounts, having a weak password (e.g., a birthday or the name of your dog) could be an issue. It can be guessed by a family member or a friend. This person does not need to have any knowledge regarding computer security.

A strong password or more generally, a strong authentication mechanism is recommended. As pointed by @eckes in the comments, you can use short PINs, instead of strong password, on Windows 10. It is a good trade-off, since you have to remember a small number (but do not choose any date) and if there is too many attempts it asks another authentication method (more complex).

---

So what function does the password then serve? What is there left to protect?

In summary, in the case of a classic desktop home users, it serves to protect against untrustworthy relatives that may have access to your computer/account. If your threat model involves more skilled attackers, you still need a strong authentication method, but you will need to worry about other attack surfaces.

Does this depend on the operating system?

No

Does this only apply to admin authority logons?

Not sure what the "this" apply to, so I would say: You need a strong password for the admin account.

Answer 3

Most of the time your password is compromised by you. They don't hack it. They trick you into giving up you super complex password. Phishing emails and such.

Answer 4

There is the possibility of an attacker gaining access to your local network through an insecure router/other device either directly within your wireless network or exploiting your router to gain VPN access and then brute forcing your computer through your own network. This way, they do not need physical access to your computer, only network access.

Also if you are using Windows 8.1 or higher, it defaults to sign in with a Microsoft account, in which case the default local user is also your online user. Which means they can compromise your Microsoft account if they gain access to your weak password. This is especially problematic if you use things like OneDrive.

The real reason really comes down to that it doesn't really hurt to have a strong password as long as your can remember it.

Answer 5

I feel some serious points have been missed here, and hope to bring them to light.

Can malware launch the kind of attack used against stolen database password files?

I am not aware of current malware which intentionally seeks out, and attempts to access password databases such as those used by Keepass and others. The reason tends to be one of ease and time.

Most novice users will store their passwords in a plain text file, or use something easy to guess. Those users that have password databases, tend to use much stronger passwords. In addition, they tend to regularly update passwords in the database, and the database password it self. Why case after something that is likely to change anyways?

Further more, graphical interfaces are used to access these files. Malware becomes very complex when it has to integrate abilities to access GUI programs. Malware could directly access the file, but again could prove quite a trick as a whole understanding of the database format would have to be programmed in.

Keepass has a "two way obfuscation" method, which attempts to break keylogger attempts to sniff passwords as they are being entered automatically. It does this by randomizing which parts of the password are entered by the clipboard (copy & paste) and that by direct virtual key presses.

Moving or exporting a database off a computer system would draw attention, but would likely be much more common. This however, could result in stale credentials, as the passwords in the database have likely been updated since exfiltration.

EDIT: I should probably make a note here that malware routinely targets the insecure storage of passwords in internet browsers, games, and such. Unless you use a "master password" in such scenarios, malware can just access the stored credentials from a file or such.

How securely is my computer password stored?

This largely depends on the Operating System (OS) your computer has. Pre-NT Microsoft Windows versions (95/98/etc.) used a very poor scheme that allowed for reversing of the stored passwords. A later upgrade stored user's passwords via a mathematical hashing function. You can read the details elsewhere, but it is intended such that it's one way. You can predictably and reliably take a password to this hashed form, but not the other way. Verification is done by taking user input, passing it through a hashing function, and comparing it to the stored result.

Windows XP and later used a method called NTLanManv2 (NTLanMan version 2, or NTLMv2 for short) by default. This is considered to be much more secure, as unlike previous versions of windows, allowed for case sensitivity, a longer user input, and upgraded storage and retrieval mechanisms. NTLMv2 is still used in Windows, including the very new Windows 10.

The critical flaw in this system is that it does not include salting. This is something Linux/Unix based systems have included for sometime.

Just as each individual salts their own food to their own particular preference, a salt for a hash does the same thing. It provides uniqueness to the hash to a particular computer system. Attackers may use something called a Rainbow Table in a way to decrease the time required to figure out someone's password.

A Rainbow Table works by calculating hashes for passwords in advance. It works on the concept of "time-space trade off". By taking space, you can gain an advantage of time, as you are now just comparing the stored hash of a password against a list or table of hashes. The easy way to think of this, is looking up a phone number in your contact book for a name, a rainbow table does the same thing but with passwords.

Salting prevents this preemptive attack because the passwords are unique to that particular system. A rainbow table would have to be generated for each system, effectively removing the usefulness of such tables.

Linux/Unix also uses much more secure hashing algorithms. Where as NTLMv2 is based off a MD4 hashing algorithm, modern versions of Linux/Unix use SHA1, and SHA2 derivatives (such as SHA-256). The computing time required to generate these hashes can prove slow if done over and over, effectively slowing down attackers.

Under both systems, only administrative/root users can access the stored user credentials. Under Windows, an administrator can not directly access the credential store, but find ways around to access it (such as a backup).

There are specialized pieces of hardware or "computers" that excel at generating hashes of passwords. Using FPGAs (Field Programmable Gate Arrays), time taken to generate passwords is greatly decreased.

Would the malware need to know my password anyway, as presumably it would have my logon authority?

Not in all cases does malware share the user's privileges. Windows Visa introduced the concept of UAC (or User Account Control). By default, a program will work at the lowest level of privileges. It may require or request administrative privileges. Whether it does this for legitimate reasons is hard to determine. Administrative privileges are required to install software, drivers, modify registry keys, add a program to start up, and so on.

UAC was introduced because many users under Windows XP used an Administrative account for day to day use.

Red Hat Enterprise Linux, and it's down stream CentOS provide a warning when signing into a Root account that it's not recommend to use root for anything besides what absolutely requires root privileges.

Ubuntu does not allow you to directly sign into root as part of their philosophies (and probably quite silly). Users must use sudo to run something as root. This requires to be a account that is able to "sudo" (called a sudo-er), and knowledge of root's password.

This is where problems can arise. With a weak password, malware could gain access to system privileges in theory. I have only heard of this by word of mouth, and never in practice. It would require guessing the password repeatedly, and generate "noise", or attention that a attack is in progress. There are also a multitude of defences to prevent repeated password guessing.

In many cases, it's much more common for malware to dump passwords from system/computer memory. In the case of Windows 7, it is certainly possible under systems that cache passwords in certain ways, to access a "clear text" or plain text version of passwords stored in memory.

Malware doesn't even need to know a user's password, as they use vulnerabilities in the OS, and other pieces of software to escalate their privileges to that of an administrator, or system/root level.

So what function does the password then serve? What is there left to protect?

For home systems, passwords serve as a deterrent to unauthorized access by those in the same household. You likely wouldn't want your son or daughter to have administrative access to install things that could contain malware, or change system settings resulting in the system no longer working.

It's not uncommon for thieves to simply access files on a Windows computer by plugging the drive into their own system, or by running another OS instead. This is why it's recommended to physically destroy, utilize a degausser, or wipe hard drives by writing schemes when recycling a computer. There's more about securing a "live" system with EFS below.

In an enterprise environment, because credentials are not stored on the local system, it allows the enterprise to prove that only someone with knowledge of the password could login to that account. That allows the corporation to blame and legally justify termination or prosecution of an employee (either with wrong or right justification). Accounts also allow enterprises to delegate access to certain files/shares, and select appropriate access to network resources on a per-user level.

In a portable system, most passwords prove to be "security theatre" or the appearance of security. Windows based systems are susceptible to password wiping, where one can boot into another operating system, and simply "blank", "wipe" or remove the password of an account. This is done via modifications to the SAM file.

Newer Android and iOS systems feature hardware encryption, which uses the user's password (or some form of a password) potentially combined with a unique hardware key to ensure data stored at rest is unreadable to other parties.

Windows is capable of such a system as well, with EFS or Encrypting File System. It is available on the professional versions of Windows (ex. Windows 7 Pro). It works at a file system level, and prevents other users (even with administrative levels) reading data encrypted with a certificate. An advantage of this is that it is tied to a user's account, and can allow multiple users to access the same files. In addition, it also nulls or puts in jeopardy by attackers who blank or remove a user's password under Windows because the key to access EFS certificates is also removed, effectively removing access to encrypted files. Other operating systems can not read the encrypted files because they do not have the keys to decrypt them.

Does this depend on the operating system?

As demonstrated in other previous questions, yes, it very much depends on the operating system.

Do I need the same strength of password for a limited account as an administrative one?

EDIT: To reflect the change of the last question, here are some relevant details.

If you visit the 2nd last question, I mentioned the fact that division of accounts allows for easy tracking of who did what in a corporate environment. In a home or home office, this is probably an insignificant thing. If allows people their own "space".

For home use, the administrative password should be hard to guess, and different from other online accounts you may use. Here you are many concerned about local people guessing your password.

If you run a mobile home office, or are part of an enterprise, you will want secure passwords for all accounts, as it's part of access control for email, and others. If an attacker gains access to the account, they don't have administrative privileges, but they can:

• Impersonate another user, and abuse a trust (phishing)
• Launch an attack, shifting blame to this user
• Explore other targets, as they now have "inside" access.

These again aren't such a worry in a home environment.