I'm setting up a Mac laptop for my wife. Mine has a ridiculously strong password, but she finds this annoying.

If I give her a (relatively) weak password for convenience, what risks am I taking?

A couple I can think of:

  • An attacker in person guessing or brute forcing it (unlikely)
  • An attacker brute forcing and getting an SSH connection (unlikely if we're behind a firewall?)

What else?

  • 5
    If you are not encrypting the hard drive, anyone with physical access would be able to read the whole drive without any effort at all. – NuTTyX Aug 23 '14 at 11:22
  • 2
    This scenario requires Threat Modeling. You need to determine what exactly in your wife's computer are you trying to protect and against what kind of attackers (to determine complexity of possible attacks). This scenario, in particular, requires an Attacker-centric threat modeling. – Rahil Arora Aug 23 '14 at 16:41
  • I would note that your wife doesn't need a random set of letters and numbers for a "strong" password. See XKCD's "correct horse battery staple" – KnightOfNi Aug 24 '14 at 2:13
  • Also, if you're willing to blow $20, you can get a decent fingerprint reader, which is faster and easier than even the shortest passwords. – KnightOfNi Aug 24 '14 at 2:19
  • @KnightOfNi - fair point, but that's still a lot harder to type than just "horse", for example. :) Also, my understanding is that fingerprints are usernames, not passwords: blog.dustinkirkland.com/2013/10/… – Nathan Long Aug 25 '14 at 20:11

The risk posed by a weak user password is generally rather low, unless you're being attacked by someone really determined to get in to your wife's system (perhaps to gain access to other computers on the network?). This is for two primary reasons:

It's easy to defend against the password's use over a network: While I don't generally work with Macs, it is my experience with PC's (as Linux doesn't, to my knowledge, have a comparable pre-installed service) that any and all services allowing remote access to anything (more recent versions have different services for remote registry, remote shutdown, remote desktop assistance, etc.) with an admin's password can be shut down/disabled without too much trouble (if you know what you're doing, locating the services takes MAYBE 5 minutes, and if you're prepared you can simply import a new security policy). The only reason I could think of to want someone's user password is to escalate your malicious program, which can be done easily enough without the user's consent.

It's difficult to GET the password in the first place: Brute-forcing over a network is VERY time consuming and very easy to defend against. To my knowledge, all realistic brute force attacks need to be performed against a hash (or encrypted data). Therefore, to even start trying to brute force her user password, your theoretical attacker first needs to access the aforementioned hash (obviously stored on her hard drive) first. If he has that, we can only assume that he could easily be doing something more efficient with his access (whether remote or physical) than looking for her user password (installing keyloggers comes to mind).

NOTE: The one reason I can think of to access someone's user password is a password-reuse attack, in which the attacker uses a sniffer to determine what accounts the victim has (sadly, this data usually not difficult to gather) and then attacks the weakest hash/encryption of their password, hoping that they use the same password on other accounts.

| improve this answer | |
  • 1
    In addition, with physical access to the machine, there's no need to go after the password, as you could simply pull the HDD and read it in another machine. – Chris Murray Aug 26 '14 at 13:56
  • @ChrisMurray Right. I was keeping that in mind as well in the last sentence of the third paragraph, but in hindsight it's not very clear. I'll edit to reflect this. – KnightOfNi Aug 26 '14 at 20:53

TL;DR - Not that much risk, there's more important things to prioritize from a security standpoint.

First off, what kind of data will be stored on this device? What kinds of accounts will be logged into? Banks? Work data? Financial data? Medical data? etc...How important is your dataset. This is a key question when trying to decide how much effort to put into securing it.

There are really 2 types of attacks when it comes to trying to steal data off a computer:

  1. Physical - Physical theft of computer/device
  2. Virtual - Remote (or local) exploitation of a vulnerability on a given machine

For physical theft, drive encryption software is the smartest way to protect yourself. When the hard drive is encrypted, an attacker who stole a laptop cannot take out the hard disk and attempt to read the data on another computer because the data is still encrypted.

Data encryption is a very strong protection against data theft via physical loss and is your best bet to keep your data safe from theft. Without encryption, an attacker can easily read all your content off the disk.

Virtual attacks have a lot more variety and obviously don't require physical access. The most common virtual attacks don't typically need your local user account password.

For example, a spear fishing email where a user opens a malicious PDF that exploit will already be executing as the user context, so the user password doesn't apply... once you run it you're done as the process is already running as your logged in account. This is a prime reason why to never run as root or Administrator, to try and limit the impact of getting exploited. Imagine Notepad++ asking to install updates for example, turns out those updates can be spoofed.

Really important to keep software and your system up to date. "Exploit kits" are used attackers to quickly scan computers for a variety of vulnerabilities that have exploits and all they need to find is one. This doesn't require a local admin password either.

If an attacker was attempting to brute force credentials, there are modern defenses against this including time out mechanisms to discourage and disrupt this type of attack on things like RDP and SSH. Using the same password for multiple accounts is a really bad idea as well. Attackers have tools to auto login to hundreds of sites using the same user name and password so they will find out if you share them. All it takes is one site to get hacked where you have a shared password... boom your Groupon account just got hacked and because it was the same password as your paypal account you got to deal with 7k in fraudulent charges.

Use LastPass to protect yourself by generating unique passwords for all your sites. No one expects you to remember all unique passwords and this service is the best option we have today.

Bottom line is, there are typically a lot of easier ways to exploit a user than needing their local account password.

So my recommendation is:

  1. Use disk encryption
  2. Don't reuse passwords for other sites / computers. Use lastpass.com to help maintain unique, secure passwords.
  3. Keep your systems and software patched
  4. Always be skeptical of emails and attachments unless you are expecting them.

If do all that then you can use an easy password for her local user account and still be pretty damn safe.

| improve this answer | |

I see most of the scenarios were already discussed. I would like to add another major point.

Whatif the attacker exploits a highly valuable zero day browser vulnerability or another native application vulnerability and thereby gain a remote shell on this machine?? This is fairly possible in today's world considering the sheer amount of browser exploits being discovered daily (Google chrome had to correct almost 50 vulnerabilities for its next release version 37.0).

Yup, the attacker would still get a limited shell but that does not stop him from escalating the privilleges (possibly brute-forcing)if a weak password is used (Trust me, I tried it out before writing this and it works).

I accept that this seems too much paranoid but its really happening out there..

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.