content/blog/2019-12-16-password-security.org

  1#+date:        <2019-12-16 Mon 00:00:00>
  2#+title:       Password Security Protocols and Recommended Practices
  3#+description: Compilation of guidelines for password generation, storage, protection, and compliance with established standards such as NIST for maintaining digital security.
  4#+slug:        password-security
  5#+filetags:    :security:passwords:best-practices:
  6
  7* Users
  8
  9** Why Does It Matter?
 10
 11Information security, including passwords and identities, has become one of the
 12most important digital highlights of the last decade. With [[https://www.usatoday.com/story/money/2018/12/28/data-breaches-2018-billions-hit-growing-number-cyberattacks/2413411002/][billions of people
 13affected by data breaches each year]], there's a greater need to introduce strong
 14information security systems. If you think you've been part of a breach, or you
 15want to check and see, you can use [[https://haveibeenpwned.com/][Have I Been Pwned]] to see if your email has
 16been involved in any public breaches. Remember that there's a possibility that a
 17company experienced a breach and did not report it to anyone.
 18
 19** How Do I Protect Myself?
 20
 21The first place to start with any personal security check-up is to gather a list
 22of all the different websites, apps, or programs that require you to have login
 23credentials. Optionally, once you know where your information is being stored,
 24you can sort the list from the most-important items such as banks or government
 25logins to less important items such as your favorite meme site. You will want to
 26ensure that your critical logins are secure before getting to the others.
 27
 28Once you think you have a good idea of all your different authentication
 29methods, I recommend using a password manager such as [[https://bitwarden.com/][Bitwarden]]. Using a
 30password manager allows you to automatically save your logins, create randomized
 31passwords, and transfer passwords across devices. However, you'll need to
 32memorize your "vault password" that allows you to open the password manager.
 33It's important to make this something hard to guess since it would allow anyone
 34who has it to access every password you've stored in there.
 35
 36Personally, I recommend using a [[https://en.wikipedia.org/wiki/Passphrase][passphrase]] instead of a [[https://en.wikipedia.org/wiki/Password][password]] for your vault
 37password. Instead of using a string of characters (whether random or simple),
 38use a phrase and add in symbols and a number. For example, your vault password
 39could be =Racing-Alphabet-Gourd-Parrot3=. Swap the symbols out for whichever
 40symbol you want, move the number around, and fine-tune the passphrase until you
 41are confident that you can remember it whenever necessary.
 42
 43Once you've stored your passwords, make sure you continually check up on your
 44account and make sure you aren't following bad password practices. Krebs on
 45Security has a great [[https://krebsonsecurity.com/password-dos-and-donts/][blog post on password recommendations]]. Any time that a data
 46breach happens, make sure you check to see if you were included, and if you need
 47to reset any account passwords.
 48
 49* Developers
 50
 51** What Are the Basic Requirements?
 52
 53When developing any password-protected application, there are a few basic rules
 54that anyone should follow even if they do not follow any official guidelines
 55such as NIST. The foremost practice is to require users to use passwords that
 56are at least 8 characters and cannot easily be guessed. This sounds extremely
 57simple, but it requires quite a few different strategies. First, the application
 58should check the potential passwords against a dictionary of insecure passwords
 59such =password=, =1234abc=, or =application_name=.
 60
 61Next, the application should offer guidance on the strength of passwords being
 62entered during enrollment. Further, NIST officially recommends *not*
 63implementing any composition rules that make passwords hard to remember (e.g.
 64passwords with letters, numbers, and special characters) and instead encouraging
 65the use of long pass phrases which can include spaces. It should be noted that
 66to be able to keep spaces within passwords, all unicode characters should be
 67supported, and passwords should not be truncated.
 68
 69** What Does NIST Recommend?
 70
 71The National Institute of Standards and Technology ([[https://www.nist.gov][NIST]]) in the US Department
 72of Commerce regularly publishes information around information security and
 73digital identity guidelines. Recently, NIST published [[https://pages.nist.gov/800-63-3/sp800-63b.html][Special Publication
 74800-63b]]: Digital Identity Guidelines and Authentication and Lifecycle
 75Management.
 76
 77#+begin_quote
 78A Memorized Secret authenticator - commonly referred to as a password or, if
 79numeric, a PIN - is a secret value intended to be chosen and memorized by the
 80user. Memorized secrets need to be of sufficient complexity and secrecy that it
 81would be impractical for an attacker to guess or otherwise discover the correct
 82secret value. A memorized secret is something you know.
 83
 84- NIST Special Publication 800-63B
 85#+end_quote
 86
 87NIST offers a lot of guidance on passwords, but I'm going to highlight just a
 88few of the important factors:
 89
 90- Require passwords to be a minimum of 8 characters (6 characters if randomly
 91  generated and be generated using an approved random bit generator).
 92- Compare potential passwords against a list that contains values known to be
 93  commonly-used, expected, or compromised.
 94- Offer guidance on password strength, such as a strength meter.
 95- Implement a rate-limiting mechanism to limit the number of failed
 96  authentication attempts for each user account.
 97- Do not require composition rules for passwords and do not require passwords to
 98  be changed periodically (unless compromised).
 99- Allow pasting of user identification and passwords to facilitate the use of
100  password managers.
101- Allow users to view the password as it is being entered.
102- Use secure forms of communication and storage, including salting and hashing
103  passwords using a one-way key derivation function.
104
105NIST offers further guidance on other devices that require specific security
106policies, querying for passwords, and more. All the information discussed so far
107comes from [[https://pages.nist.gov/800-63-3/sp800-63b.html][NIST SP800-63b]] but NIST offers a lot of information on digital
108identities, enrollment, identity proofing, authentication, lifecycle management,
109federation, and assertions in the total [[https://pages.nist.gov/800-63-3/][NIST SP800-63 Digital Identity
110Guidelines]].