Part 4 of 6
What did a 1979 password study find?
A handful of guessable patterns: names, words, and short strings.
In 1979 Robert Morris and Ken Thompson of Bell Labs, who built the Unix password system, wanted to know what people choose for their passwords when there are no requirements. They gathered 3,289 passwords from many users over a long period of time. 86% of them were six characters or fewer, or could be found in a dictionary or a list of names. A dictionary search took five minutes to match about a third of them.
They saw three possible fixes: push people toward longer passwords, push them toward a wider mix of characters, or have the system choose passwords for them. The paper warns against the last with a story from another installation, which issued every user eight random letters and digits. Trying every such string would have taken a computer of the day about 112 years. But the generator behind them could produce only a tiny fraction of those strings, and someone tested them all in about a minute. No harm was done; he happened to be a friendly user.
Morris and Thompson’s own fix was a nudge. If a password was too short (under six letters in a single case, or under five characters from a larger set), the program asked for a longer one, and it warned users of the risks. It wasn’t a requirement, though: as they wrote, a user “is not prevented from using his spouse’s name if he wants to.”