The Password Problem has been spoken on many times, but most places I've seen offer terrible solutions such as modifying a dictionary word, changing your password requirements to include special characters (or using dumb password complexity requirements at all), etc.

I'm thinking the temporary solution to the password problem from the user side will be to use an OSS, securely encrypted (community-checked) password manager such as KeePass, etc. (which exactly is another question), but is there a good article that recommends this to users and cites scholarly articles? I'm thinking something along the lines of:

  1. Install a password manager (here's how link) (Ref. to Academic paper with rationale)
  2. machine- (or better yet dice-) generate your master password. (ref. to penetration testing of diceware-generated passwords)
  3. setup 3 security levels in the generation profiles in your password manager, use the strongest (longest, highest entropy (Ref. to what entropy is)) when allowed.
  4. For each site, check password against dics, turn on two-factor wherever possible, don't use "security" questions. (Refs)

note: for the above, blogs, wikis, and other user-contributed sites are considered invalid citations. Actual academic journals are preferred, but official documentation sites are acceptable as well. The article I'm seeking can be a blog (but not Wikipedia), but the scholarly references it cites cannot.

I'm primarily looking for an end-user-side article or post, though one that also includes a section educating website owners on the server-side of this problem (citing, for instance, The NIST) would be even better.

An article or page that is already written is preferred, but iff none exists, we will have to make an answer to this question the first one.

closed as off-topic by schroeder Aug 30 '17 at 18:49

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Passwords are a threat mitigation control. There can be no single approach to counter all threats, and certainly not that also maintains a consistently high level of 'user friendliness'. You are trying to tackle too many problems at once and looking for a single authoritative source to provide a solution to it all. None exist. – schroeder Aug 29 '17 at 8:20
  • @schroeder no, I'm not looking for a single, invulnerable approach, I'm looking for research-based recommendations that provide a smarter alternative to the stupid things people do with passwords. This alternative will of course not be enforced or anything, but at least I can point people to it and hope they listen. – NH. Aug 29 '17 at 13:34
  • Then, if not a single approach, then how do all the existing guidance fail to meet your needs? You say that you want an 'academic' paper, but what are you hoping to find? On one side, academics will explore the maths (not user-friendly) and on the other, they will explore the habits of people (not applicable as guidance). You are not going to find an 'academic' paper stating to do something specific. – schroeder Aug 29 '17 at 15:58
  • Several national agencies have tons of documents, like: stopthinkconnect.org/resources/preview/… You won't find a more authoritative opinion then Per's. – schroeder Aug 29 '17 at 15:58
  • 1
    I agree a password manager is the pragmatic solution that you can do now. You won't find many people officially recommending them though, because of their one flaw: putting all your eggs in one basket. Malware on the computer that holds the password store means all your passwords are compromised (encryption provides no protection in that scenario). It's better than using the same password everywhere. But no-one wants to be the one to advise it, when it could potentially lead to your compromise. – paj28 Aug 30 '17 at 15:57

The password problem is multi-faceted. For this answer, I won't duplicate what others will tell you (your process looks fairly good, yet complex).

I will tell you this - the algorithm is the most important piece.

You can use a password of 81OTl*8tlxI+VqTZI7%wK however, if the place you have this password just stores plain text, ROT13, DES crypt, or MD2, MD4, MD5, NTLM, with or without a little salt, then oclHashcat can crack it in no time flat. However, even Password1! with script and 100,000 rounds is more secure than 81OTl*8tlxI+VqTZI7%wK on crypt()...

Reference: https://en.wikipedia.org/wiki/Scrypt
(or for you "Wikipedia is not a reference" folks: https://www.tarsnap.com/scrypt/scrypt.pdf)
https://medium.com/@mpreziuso/password-hashing-pbkdf2-scrypt-bcrypt-1ef4bb9c19b3 https://medium.com/@mpreziuso/password-hashing-pbkdf2-scrypt-bcrypt-and-argon2-e25aaf41598e (2019 revision)

This isn't an "end-user article" however, this can be used for "educating website owners on the server-side problem".

  • Forgot to mention: Wikipedia is considered invalid for purposes of citations related to this question. I'll add a note to my question as well. – NH. Aug 28 '17 at 22:26
  • Also, I'm assuming Password1! on crypt is very insecure as well? It seems like none of what you said applies unless a list of passwords (or hashes) is stolen off of the server (which happens, but shouldn't be what the user is concerned about, because in that case, they simply change their password and store the new one in the password manager). – NH. Aug 28 '17 at 22:36
  • 1
    Lastly, if you ask 12 security professionals what to do about passwords, you will get 13 different answers. None are right, none are wrong. They tend to be based on the current risks, threats, and users. For example, don't ask my 80-year old grandmother to use a password manager. A notebook works better... – MikeP Aug 28 '17 at 22:52
  • 1
    @nh you are trying to find a technological way to get people to choose to make a specific choice that is outside of your control? I think you will find that this is impossible. – schroeder Aug 29 '17 at 8:16
  • 2
    "How do I herd cats?" How do I get ducks in a row? "How do I get people to change their minds and behavior?" These are not security questions. :) – MikeP Aug 29 '17 at 19:45

Not the answer you're looking for? Browse other questions tagged or ask your own question.