Passwords In Securing Network Devices

Question

I don't do anything with corporate IT and networking, but I know enough to handle and get networks going. Anyway, something I ran into in my travels when it comes to the occasions of working on individual computers and small networks when I do is the matter of securing devices which have Internet or wireless exposure.

I'm a complete novice in these matters and what is best, so I thought I would do some reading and got some basic ideas of good security practices, but still came up with some questions that weren't really answered solidly:

1. What are the rules for entering WPA-style passwords in most devices? Could you get away with any standard printable character in these devices or are there some restrictions (hex-strings, some characters not allowed)? I really don't find any good documentation on this.

2. Are there any good set rules for what makes a good "strong" password in terms of entropy? I found sites like http://www.passwordmeter.com/ which seem to be a good benchmark, but I really haven't found any good rules which qualify something as an "ideal strong password" in an universal sense. There's the random printable character method and then the xkcd method, too.

3. Since I figure in most cases, all that will happen with these devices after the fact is that people (primarily myself with my own stuff, but others too, think home network stuff) will use the Internet directly or their laptops in order to connect to the Internet, the password doesn't necessarily have to be easy to remember and readily reproduced, so my thought is that any password these devices are set to can be printed out or written down and stored away just in case there is a need to get back into these devices after they are set up. Does this seem smart, or is there something I'm missing?

4. Given that I'm more inclined towards programming than networking overall in my experiences, I came up with a password generator, which currently just does random printable characters of certain lengths with a few rules. Are there any suggestions on what to do to make the output of this program "gold standard"?

I could be overthinking the password issue entirely, but the thing I notice which is common to all these cases is that they are devices which generally won't have any attention paid to them as long as they are working properly (basically home use - as long as it gets me on the Internet I'm happy). In that way, I'm wanting to learn how to make something I deal with relatively bomb-proof when it comes to anyone who might want to access it and am not entirely clear on the password end of it.

Answer 1

To quickly answer these:

1. Mostly no limits, assuming we're talking about WPA2. The password goes through a key-derivation algorithm, so the key is a fixed size regardless of password lengths. Some device vendors may put soft limits on their control panels, but these are usually pretty lax. I'd avoid unicode characters though, since they're not always identical in terms of encoding across different systems.
2. As long as your password is complex enough and long enough, it'll prevent the WPA2 key from being cracked. What "enough" is depends on your security requirements, but for home use I'd say 12 characters a-z A-Z 0-9 (3.22×10²¹ keyspace) should be more than enough, as long as it's reasonably random. You're highly unlikely to come across attackers that use complex statistical analysis to test "likely" human-random passwords first - most aren't going to be doing anything more than a dictionary attack.
3. Standard practice in most corporate environments is to store paper copies of mission-critical credentials in a safe. If you wish to store such backups, invest in physical security. Your desk drawer isn't actually particularly secure, but it's in your house and your house has locks. Are you really worried about attackers that break into your house to steal your wifi password?
4. Don't bother. For a start, there are hundreds of password generators out there that already do this; keepass has a good one. Most importantly, you don't really need to worry about cryptographically strong random passwords - just pick something "random" manually, or use an existing generator if you're paranoid. There's no need to do anything more unless you're protecting mission-critical data.

All in all, it sounds like you're overthinking it. Your main threat is dictionary attacks, which you can thwart by not using any common passwords or dictionary words.

Answer 2

Password meters (like the sites you may find) are not good at measuring password entropy, despite what they claim. Human beings are not good either at producing entropy. Entropy (in this context) is a characteristic of the password generation process, not of the resulting password. What matters for entropy is not what the password value is, but what it could have been, and, by definition, this cannot be deduced from the password alone.

To generate a strong password, use a computer. On any Linux system, this command:

dd if=/dev/urandom bs=9 count=1 | openssl base64 -a -e

will generate passwords with 72 bits of entropy, which is more than enough to thwart attackers (you do not need to keep the final '=' sign). The idea is simple: get 9 random bytes (from /dev/urandom, which is a cryptographically strong random number generator) and then encode them in a format which is suitable for entry on a keyboard (Base64 uses only letters, digits, '/' and '+', with 4 characters per 3 input bytes; since we start with 9 random bytes, we end up with 12-character passwords).

The characters used by Base64-encoding should work "everywhere"; in particular, you can type them on foreign keyboards, or on smartphones, and they will not suffer from the usual encoding issues that you get with accentuated letters (or just any characters which is beyond what Americans use, i.e. ASCII). For WiFi, WPA2 accepts long passwords with arbitrary characters; and if you do not use WPA2 for your WiFi then you are doing it wrong.

Writing down passwords is a trade-off: if written down, then physical security of the paper must be ensured; on the other hand, it allows you to use many more passwords than you could possibly remember, especially passwords that you do not type often (that's typical of WiFi passwords). Just store them somewhere safe, which means, yeah, a safe, or possibly a "portable safe", commonly known as a "wallet". The safe does not need to be much stronger than what it protects.

One option would be to write the password on a paper glued under the access point itself. Whether this is a good idea or not depends on the physical environment of the AP. Basically, whoever has physical access to the AP can do a lot of harm, including just linking his own device to the Ethernet plugs that most AP conveniently feature. Of course, with the password written under the AP, an attacker who has transient access to it can learn the password and you would not notice it. But it is still worth considering, e.g. for a home router (if an evil individual sees the password, then he is in your house, at which point you may have more urgent issues to deal with than just WiFi security).

Most password "rules" (like the famous "xkcd method") are about producing passwords which fit in human brains, or can even be generated in human brains. That's hard. This often results in poor trade-offs between passwords which are weak, very long, hard to remember and/or hard to type. The culprit is the human brain. It is much simpler to just remove it from the equation.

(TODO: write a PowerShell one-line password generator, for the Windows users. That's not hard, but I don't have a Windows machine handy right now.)

Answer 3

One alternative to writing down passwords is to store the password hints instead of the passwords themselves. Yet another technique is to store the passwords on an encrypted UBS drive. These are both mentioned in http://www.nytimes.com/2012/11/08/technology/personaltech/how-to-devise-passwords-that-drive-hackers-away.html?smid=pl-share.

It is also known that password crackers use lists that are now finely tuned and updated to correlate with the way human beings create passwords and the guessing is far more efficient than that previous methods based on standard dictionaries and the associated modifications. The password length is also very important, especially ensuring it is 8 characters or longer. This is discussed at http://arstechnica.com/security/2012/08/passwords-under-assault/4/.