Length beats complexity
On complex passwords, stair trucks, and the mistake in ignoring the physical world when planning cybersecurity
It’s pretty easy to point and laugh at the sheer laziness of using “Louvre” as the password to access the security cameras at the Louvre. But the daring robbery at the world’s most famous museum of art raises two cybersecurity issues that ought to get more public attention.
■ First, the common misconception that a password like “m0mA!” would have been adequately secure. Sure, it might have been slightly more secure than “Louvre”, but the fact is that password requirements built on complexity (e.g., one capital letter, one lowercase letter, one numeral, one symbol) end up leading people to make short and somewhat predictable choices (turning the letter “O” into a zero is about as obvious as it gets).
■ Predictability is what gets you hacked. Much better are long passwords, even without the weird symbolic requirements. By sheer math alone, “You will not break into the camera system at the Louvre” would have been a superior choice of passphrase -- length beats complexity.
■ Second, the Louvre incident is a cautionary reminder that cybersecurity and physical security are inseparable from one another. A cybersecurity compromise can enable a physical-world attack. A breach in the physical environment can lead to a cyberattack.
■ Too often, we think of digital attacks as though they exist on a separate plane from the tangible world, but in reality, defensive thinking in either realm must go beyond preconcieved boundaries and account for applicability to the other. No amount of password management will stop an oversized stair car backed up to an unlocked window.
