QotW: If a password is compromised, are any similar ones?

This Question of the Week raises some interesting security implications. With many high-profile sites compromised recently, it’s worth taking a moment to consider the security of your passwords. Michael McGowan asked:

If a password is compromised, is a “similar” password also compromised?

Suppose a user uses a secure password at site A and a different but similar secure password at site B. Maybe something like mySecure12#PasswordA on site A and mySecure12#PasswordB on site B (feel free to use a different definition of “similarity” if it makes sense). Suppose then that the password for site A is somehow compromised…maybe a malicious employee of site A or a security leak. Does this mean that site B’s password has effectively been compromised as well, or is there no such thing as “password similarity” in this context? Does it make any difference whether the compromise on site A was a plain-text leak or a hashed version?

There are a lot of variables in answering this question, but first let’s talk briefly about how passwords are stored. In order for a website to know if you entered the correct password, it needs to somehow store the information to verify that. Poorly designed websites may store passwords in plain, readable text: if your password is hunter2, then it stores the password as “hunter2” in the database. This is a problem: if an attacker gains access to the database, the the list of passwords is sitting right in front of them.

The solution to this is called password hashing. A hash function is essentially a complex mathematical formula that is not reversable on practical timescales. If the password hash is stored in the database, then an attacker would not know your password, because they would be unable to reverse the hash, assuming a secure hash was used.

There are databases, called rainbow tables, containing the hashes for commonly used passwords, so a leaked hash could still be insecure. This is why password salts are used: a salt is a random bit of information added to the password before the hash, to make it less likely that the hash would exist in a rainbow table.

So how does this relate to your password being leaked? If you have similar but subtly different passwords, the hashes will be completely different. So if just the hash is leaked, then as long as the password isn’t discovered either by long, slow brute forcing, or by rainbow tables, then your other passwords are probably safe.

hunter2: f3bbbd66a63d4bf1747940578ec3d0103530e21d
hunter3: 71544f76730f65cdb71a68877b02d015feb51ab1

As soon as the actual content of your password is revealed though, you’re playing a whole new game. It all depends on how “similar” the similar passwords are. If the part which is different is random and unpredictable, and only you know how that different part varies, your passwords might be safe. But let’s suppose that you accidentally click a malicious link in an email, and are taken to a page which sniffs your Facebook password: fb!hunter2. In this case, the pattern is very obvious, and it would be trivial for the attacker to go check other popular web services, and try variations: gmail!hunter2, paypal!hunter2, and so forth, until something works. This also depends on how targeted the attack is: if you’re one victim in thousands, where all of the attacking is being done by scripts, small differences may protect you. If an attacker is targeting you specifically though, then any bit of information they can glean from your password could be used, and the more the attacker knows about you, the easier it will be for them to exploit that.

When it comes to passwords, it’s always a balancing act between being able to remember your password, and how secure it is. Reusing a similar password is only safe if the pattern is not easy to discern. If you can remember a random string associated with each site, you drastically increase the difficulty at guessing the “different” part of the password, although with enough patience, an attacker would still have a much higher chance at compromising your account than if they didn’t know any info at all.

The fact of the matter is that if your password is compromised, the safest course of action is to change any similar passwords. Email passwords are particularly important: your email is the key to your online identity, because almost every site offers a password reset option through your email.