September 13, 2010
#792: Password Reuse explain
[Black Hat is standing to the left behind Cueball, who is sitting in an office chair at his desk working on his computer. A message from the computer is indicated with a zigzag line from the screen.]
Black Hat: Password entropy is rarely relevant. The real modern danger is password reuse.
Cueball: How so?
Computer: Password too weak
[Zoom in on Black Hat’s upper part as he holds a hand up with the palm up.]
Black Hat: Set up a Web service to do something simple, like image hosting or tweet syndication, so a few million people set up free accounts.
[Zoom out to Black Hat standing in front of Cueball who has turned in the chair facing Black Hat, the desk is not shown in the panel.]
Black Hat: Bam, you’ve got a few million emails, default usernames, and passwords.
[Only Black Hat is shown as he holds out his arms.]
Black Hat: Tons of people use one password, strong or not, for most accounts.
[The next panel is only half the height of the other panels. Above the panel is the text that Black Hat narrates. In the left part of the panel, there is a piece of paper that seems to have been torn off at the bottom resulting in a jagged edge, which could also indicate that it continues further down than shown. On the paper, there are three labeled columns, and below each of them about 18 lines of unreadable sentences (mostly just one word). The @ in the e-mail addresses may be indicated with a larger unreadable sign. To the right a broad line goes right from the paper and splits up in five lines that go up or down ending in five arrows to the right, pointing at five labels.]
Black Hat (narrating): Use the list and some proxies to try automated logins to the 20 or 30 most popular sites, plus banks and PayPal and such.
Labels on paper: Email User Pass
Labels at arrows:
Banks
Gmail
PayPal
[Same setting as panel 3 but Cueball has taken a hand to his chin.]
Black Hat: You’ve now got a few hundred thousand real identities on a few dozen services, and nobody suspects a thing.
Cueball: And then what?
[Same setting in a larger panel with more white space to the left, Cueball has his hand down again.]
Black Hat: Well, that’s where I got stuck.
Cueball: You did this?
Black Hat: Why do you think I hosted so many unprofitable web services?
[Zoom in on Black Hat’s head now turned towards left.]
Black Hat: I could probably net in a lot of money, one way or another, if I did things carefully. But research shows more money doesn’t make people happier, once they make enough to avoid day-to-day financial stress.
[Zooming a bit out, but still only showing Black Hat’s head in the bottom right corner, again facing right.]
Black Hat: I could mess with people endlessly, but I do that already. I could get a political or religious idea out to most of the world, but since March of 1997 I don’t really believe in anything.
[This panel is the last in this row, but it does not reach the end of the row above, an indication that this does not directly belong to the panels below. The same setting as panel 3 but Black Hat has his arms out.]
Black Hat: So, here I sit, a puppetmaster who wants nothing from his puppets.
Black Hat: It’s the same problem Google has.
Cueball: Oh?
[This panel is the first in the last row. It does not begin to the left, but has been shifted a bit to the right, just as the last panel above to the right, ended before reaching the right edge of the row above (and this one below). This is to indicate that this is row has a different story. A Cueball-like executive at Google is standing up leaning his arms on a table with Google’s logo on the side. His office chair has been pushed to the left behind him and it is partly off-panel. He addresses the other executives at the table, two of which are shown. The first is Hairbun with glasses holding her head with both hands, elbows resting on the table. The other executive is also a Cueball-like guy, his head is partly outside the right edge of the panel. At the top of the panel to the left, there is a small frame breaking the panel’s frame, inside which is a caption:]
Google…
Cueball executive: Okay, everyone, we control the world’s information. Now it’s time to turn evil. What’s the plan?
Hairbun: Make boatloads of money?
Table: Google
[Only the Cueball-like executive standing at the end of the table is shown, the table is left out. He is face-palming. One of the executives at the table is speaking off-panel. Could be either of the two above or someone not shown before]
Cueball executive: We already do!
Executive (off-panel): Set up a companywide CoD4: Modern Warfare tournament each week?
Cueball executive: That’s not evil!
Executive (off-panel): Ooh, Dibs on the lobby TV!
Cueball executive: Okay, we suck at this.