Lorrie Faith Cranor: What's wrong with your pa$$w0rd?

Prevoditelj: Izidora Zganjer Recezent: Ivan Stamenković

I am a computer science and engineering professor here at Carnegie Mellon,

Ja sam profesorica računalne znanosti i inženjerstva, ovdje, na Carnegie Mellonu.

and my research focuses on usable privacy and security,

Moje istraživanje se bavi primjenjivim pravilima privatnosti i sigurnosti.

and so my friends like to give me examples

Prijatelji mi vole davati primjere

of their frustrations with computing systems,

njihove frustriranosti računalnim sustavima,

especially frustrations related to

posebno kada frustriranost ima veze

unusable privacy and security.

s neprimjenjivim pravilima privatnosti i sigurnosti.

So passwords are something that I hear a lot about.

Tako su lozinke česta tema.

A lot of people are frustrated with passwords,

Puno ljudi je frustrirano s lozinkama,

and it's bad enough

i dovoljno je zlo

when you have to have one really good password

imati jednu zbilja dobru lozinku

that you can remember

koju možeš zapamtiti,

but nobody else is going to be able to guess.

a da je nitko neće pogoditi.

But what do you do when you have accounts

Ali što napraviti kada imaš nekoliko korisničkih računa,

on a hundred different systems

na stotinu različitih sustava

and you're supposed to have a unique password

i trebao bi imati unikatnu lozinku

for each of these systems?

za svaki od tih sustava?

It's tough.

To je teško.

At Carnegie Mellon, they used to make it

Na Carnegie Mellonu,

actually pretty easy for us

su nam olakšavali, zapravo

to remember our passwords.

pamćenje naših lozinki.

The password requirement up through 2009

Uvjet za prihvaćenu lozinku do 2009.

was just that you had to have a password

je bio da lozinka sadrži

with at least one character.

barem jedan znak.

Pretty easy. But then they changed things,

Jednostavno. Ali onda su se pravila promijenila.

and at the end of 2009, they announced

Krajem 2009. najavljena je

that we were going to have a new policy,

nova politika.

and this new policy required

Ta nova politika je zahtijevala

passwords that were at least eight characters long,

lozinke duge minimalno osam znakova,

with an uppercase letter, lowercase letter,

s velikim slovima, malim slovima

a digit, a symbol,

brojem, simbolom,

you couldn't use the same character more than three times,

isti znak se ne smije koristiti više od tri puta,

and it wasn't allowed to be in a dictionary.

i riječ nije smjela biti iz rječnika.

Now, when they implemented this new policy,

Kada su implementirali tu novu politiku,

a lot of people, my colleagues and friends,

puno ljudi, mojih kolega i prijatelja,

came up to me and they said, "Wow,

me je pitalo:

now that's really unusable.

"Ovo je zbilja neprimjenjivo.

Why are they doing this to us,

Zašto nam to rade

and why didn't you stop them?"

i zašto ih ti nisi zaustavila?"

And I said, "Well, you know what?

A ja sam rekla: "Znaš što?

They didn't ask me."

Nisu me niti pitali."

But I got curious, and I decided to go talk

Ali sam postala znatiželjna i odlučila sam razgovarati

to the people in charge of our computer systems

s ljudima zaduženim za računalne sustave

and find out what led them to introduce

i otkriti što ih je navelo da uvedu

this new policy,

ovu novu politiku.

and they said that the university

Rekli su mi da se sveučilište

had joined a consortium of universities,

pridružilo konzorciju sveučilišta,

and one of the requirements of membership

a jedan od uvjeta za članstvo je

was that we had to have stronger passwords

da članovi imaju jake lozinke.

that complied with some new requirements,

Te lozinke su morale odgovarati novim pravilima,

and these requirements were that our passwords

ta pravila su zahtijevala da naše lozinke

had to have a lot of entropy.

budu poprilično entropične.

Now entropy is a complicated term,

Entropija je kompliciran termin,

but basically it measures the strength of passwords.

ali u pravilu, mjeri jačinu lozinki.

But the thing is, there isn't actually

Ali, stvar je u tome što ne postoji

a standard measure of entropy.

standardna mjera entropije.

Now, the National Institute of Standards and Technology

Nacionalni institut za standarde i tehnologije

has a set of guidelines

ima skup smjernica

which have some rules of thumb

koje sadrže nekoliko odokativnih pravila

for measuring entropy,

za mjerenje entropije,

but they don't have anything too specific,

ali nemaju nikakva specifična pravila.

and the reason they only have rules of thumb

Razlog za to je taj

is it turns out they don't actually have any good data

što nemaju nikakvih pravih podataka

on passwords.

o lozinkama.

In fact, their report states,

U njihovom izvještaju stoji:

"Unfortunately, we do not have much data

"Nažalost, nemamo mnogo podataka

on the passwords users choose under particular rules.

o lozinkama koje korisnici odabiru pri određenim pravilima.

NIST would like to obtain more data

NIST bi želio prikupiti više podataka

on the passwords users actually choose,

o lozinkama koje korisnici odabiru,

but system administrators are understandably reluctant

ali sistemski administratori, su razumljivo, nevoljni

to reveal password data to others."

otkriti podatke o lozinkama trećim stranama."

So this is a problem, but our research group

Ovo je problem, ali naša istraživačka skupina

looked at it as an opportunity.

je to vidjela kao mogućnost.

We said, "Well, there's a need for good password data.

Rekli smo: "Postoji potreba za dobrim podacima o lozinkama.

Maybe we can collect some good password data

Možda mi možemo prikupiti te podatke.

and actually advance the state of the art here.

I unaprijediti vrhunsku tehnologiju.

So the first thing we did is,

Prva stvar koju smo napravili je

we got a bag of candy bars

da smo nabavili vreću čokoladica,

and we walked around campus

s kojim smo hodali po kampusu,

and talked to students, faculty and staff,

i razgovarali sa studentima, profesorima i osobljem

and asked them for information

i tražili ih informacije

about their passwords.

o njihovim lozinkama.

Now we didn't say, "Give us your password."

Nismo ih tražili da nam daju svoje lozinke.

No, we just asked them about their password.

Ne, mi smo ih samo pitali o njima.

How long is it? Does it have a digit?

Koliko su duge? Imaju li broj?

Does it have a symbol?

Imaju li simbol?

And were you annoyed at having to create

Smeta li vam što ste morali kreirati

a new one last week?

novu prošli tjedan?

So we got results from 470 students,

Dobili smo rezultate 470 studenata

faculty and staff,

profesora i osoblja,

and indeed we confirmed that the new policy

i zaista se potvrdilo da im je ova nova politika

was very annoying,

jako zasmetala.

but we also found that people said

Također smo otkrili da

they felt more secure with these new passwords.

su se ljudi osjećali sigurnije s novim lozinkama.

We found that most people knew

Otkrili smo da većina ljudi zna

they were not supposed to write their password down,

da ne bi smjeli zapisivati lozinke,

and only 13 percent of them did,

i samo 13 posto njih to radi,

but disturbingly, 80 percent of people

ali ono što je uznemirujuće 80 posto

said they were reusing their password.

njih koristi stare lozinke.

Now, this is actually more dangerous

To je puno opasnije od

than writing your password down,

zapisivanja lozinke

because it makes you much more susceptible to attackers.

jer vas čini podložnijim napadima.

So if you have to, write your passwords down,

Dakle, ako baš morate, zapišite svoju lozinku,

but don't reuse them.

ali, nemojte ponovno koristiti staru.

We also found some interesting things

Otkrili smo i neke zanimljivih stvari

about the symbols people use in passwords.

o simbolima koji se koriste.

So CMU allows 32 possible symbols,

CMU dopušta korištenje 32 moguća znaka,

but as you can see, there's only a small number

ali kao što vidite, mali broj

that most people are using,

njih se koristi.

so we're not actually getting very much strength

Tako da lozinka ne dobiva puno

from the symbols in our passwords.

na snazi korištenjem simbola.

So this was a really interesting study,

Ovo je bila jako zanimljiva studija,

and now we had data from 470 people,

i dobili smo podatke od 470 ispitanika,

but in the scheme of things,

ali generalno,

that's really not very much password data,

ne radi se o puno podataka.

and so we looked around to see

Zato smo istraživali

where could we find additional password data?

gdje možemo pronaći još podataka.

So it turns out there are a lot of people

Tako smo pronašli da postoji hrpa ljudi

going around stealing passwords,

koji kradu lozinke,

and they often go and post these passwords

a onda ih često objavljuju

on the Internet.

na Internetu.

So we were able to get access

Uspjeli smo pristupiti

to some of these stolen password sets.

nekima od tih ukradenih lozinki.

This is still not really ideal for research, though,

To nije baš idealna situacija kada se radi o istraživanju

because it's not entirely clear

jer nije posve jasno

where all of these passwords came from,

odakle potječu te lozinke

or exactly what policies were in effect

i pod kojim pravilima

when people created these passwords.

su ih kreirali korisnici.

So we wanted to find some better source of data.

Zbog toga smo željeli pronaći bolji izvor podataka.

So we decided that one thing we could do

Odlučili smo se je najbolji način

is we could do a study and have people

da napravimo studiju i zamolimo ljude

actually create passwords for our study.

da kreiraju lozinke za našu studiju.

So we used a service called Amazon Mechanical Turk,

Koristili smo servis koji se zove Amazon Mechanical Turk.

and this is a service where you can post

To je servis na kojem se objavljuju

a small job online that takes a minute,

jednostavni poslovi koji traju minutu,

a few minutes, an hour,

nekoliko minuta ili sat,

and pay people, a penny, ten cents, a few dollars,

i plaćaju peni, 10 centi ili nekoliko dolara,

to do a task for you,

ljudima nakon što izvrše zadatak.

and then you pay them through Amazon.com.

Plaćanje se odvija preko Amazona.

So we paid people about 50 cents

Mi smo ljudima plaćali oko 50 centi

to create a password following our rules

za stvaranje lozinki pod određenim pravilima

and answering a survey,

i sudjelovanje u anketi.

and then we paid them again to come back

Ponovno smo im platili da se vrate

two days later and log in

za dva dana i ulogiraju

using their password and answering another survey.

koristeći lozinke i odgovore na drugi upitnik.

So we did this, and we collected 5,000 passwords,

Tako smo prikupili 5.000 lozinki

and we gave people a bunch of different policies

uz hrpu različitih politika i pravila

to create passwords with.

za stvaranje lozinki.

So some people had a pretty easy policy,

Neki ispitanicu su imali jednostavna pravila,

we call it Basic8,

nazvali smo ih Basic8,

and here the only rule was that your password

gdje je jedino pravilo bilo da lozinka

had to have at least eight characters.

ima najmanje osam znakova.

Then some people had a much harder policy,

Drugi su morali poštovati kompliciranije politike,

and this was very similar to the CMU policy,

slične onima na CMU-u,

that it had to have eight characters

gdje je moralo biti osam znakova

including uppercase, lowercase, digit, symbol,

uključujući velika i mala slova, broj i simbol,

and pass a dictionary check.

i proći provjeru rječnika.

And one of the other policies we tried,

Testirali smo još jednu politiku,

and there were a whole bunch more,

a bilo ih je puno više,

but one of the ones we tried was called Basic16,

bila je Basic16,

and the only requirement here

s pravilom da

was that your password had to have at least 16 characters.

lozinka mora imati najmanje 16 znakova.

All right, so now we had 5,000 passwords,

Dakle, skupili smo 5.000 lozinki,

and so we had much more detailed information.

imali smo detaljne informacije.

Again we see that there's only a small number

Ponovno smo uvidjeli da postoji mali

of symbols that people are actually using

broj simbola koje korisnici koriste

in their passwords.

u svojim lozinkama.

We also wanted to get an idea of how strong

Isto tako, željeli smo dobiti ideju

the passwords were that people were creating,

koliko jake lozinke korisnici kreiraju.

but as you may recall, there isn't a good measure

Ali, ako se sjećate, ne postoji

of password strength.

pouzdana mjera jačine lozinke.

So what we decided to do was to see

Zato smo odlučili otkriti

how long it would take to crack these passwords

koliko vremena treba za razbijanje lozinke,

using the best cracking tools

koristeći najbolje alate za razbijanje lozinki,

that the bad guys are using,

a koje koriste loši momci.

or that we could find information about

I one o kojima smo mogli pronaći informacije

in the research literature.

u literaturi.

So to give you an idea of how bad guys

Kako loši momci

go about cracking passwords,

razbijaju lozinke?

they will steal a password file

Oni kradu datoteke s lozinkama

that will have all of the passwords

koje sadrže sve lozinke

in kind of a scrambled form, called a hash,

u šifriranom, haširanom obliku.

and so what they'll do is they'll make a guess

Tada pogađaju

as to what a password is,

koja je lozinka,

run it through a hashing function,

dešifriraju je pomoću hash funkcije

and see whether it matches

kako bi vidjeli poklapa li se

the passwords they have on their stolen password list.

s lozinkama koje su prije ukradene.

So a dumb attacker will try every password in order.

Tako će glup napadač probavati svaku lozinku po redu.

They'll start with AAAAA and move on to AAAAB,

Početi će s AAAAA, pa nastavit s AAAAB,

and this is going to take a really long time

i tako će proći puno vremena

before they get any passwords

prije nego uspije otkriti lozinku.

that people are really likely to actually have.

za koju je izgledno da ju ljudi koriste.

A smart attacker, on the other hand,

Pametan napadač,

does something much more clever.

je puno mudriji.

They look at the passwords

On provjerava nalaze li se

that are known to be popular

popularne lozinke

from these stolen password sets,

među ukradenim setovima lozinki.

and they guess those first.

Njih će prve pogađati.

So they're going to start by guessing "password,"

Krenuti će s "password" (eng. lozinka),

and then they'll guess "I love you," and "monkey,"

nakon toga s "Volim te", "majmun"

and "12345678,"

i "12345678".

because these are the passwords

Jer su ovo lozinke koje

that are most likely for people to have.

će koristiti najviše ljudi.

In fact, some of you probably have these passwords.

Zapravo, vjerojatno netko od vas ih vjerojatno ima.

So what we found

Što smo otkrili

by running all of these 5,000 passwords we collected

testirajući tih 5000 lozinki koje smo prikupili,

through these tests to see how strong they were,

kako bismo otkrili koliko su jake,

we found that the long passwords

jest to da su duge lozinke

were actually pretty strong,

poprilično jake,

and the complex passwords were pretty strong too.

isto kao i kompleksne.

However, when we looked at the survey data,

Međutim, kada smo proučavali podatke iz anketa,

we saw that people were really frustrated

otkrili smo frustriranost ljudi

by the very complex passwords,

kompleksnim lozinkama,

and the long passwords were a lot more usable,

i duge lozinke su puno više primjenjive,

and in some cases, they were actually

a u nekim slučajevima,

even stronger than the complex passwords.

su i jače nego kompleksne.

So this suggests that,

Zaključak koji se nameće je da

instead of telling people that they need

umjesto zahtijevanja da

to put all these symbols and numbers

lozinke moraju sadržavati

and crazy things into their passwords,

sve te simbole, brojeve i lude stvari,

we might be better off just telling people

bolje bi bilo da zahtijevamo da

to have long passwords.

imaju duge lozinke.

Now here's the problem, though:

Ali, u ovome je problem:

Some people had long passwords

Neki ljudi su imali duge lozinke

that actually weren't very strong.

koje zapravo i nisu baš jake.

You can make long passwords

Možeš kreirati dugu lozinku

that are still the sort of thing

koju će napadač svejedno

that an attacker could easily guess.

vrlo lako pogoditi.

So we need to do more than just say long passwords.

Tako da trebamo puno više od samo duge lozinke.

There has to be some additional requirements,

Moraju postojati još neki uvjeti

and some of our ongoing research is looking at

i istraživanje koje trenutno provodimo promatra

what additional requirements we should add

koji su to dodatni uvjeti koje moramo dodati

to make for stronger passwords

za jake lozinke,

that also are going to be easy for people

koje će bit lako pamtljive

to remember and type.

i koje će biti lako upisivati.

Another approach to getting people to have

Jedan od pristupa je

stronger passwords is to use a password meter.

korištenje lozinkomjera.

Here are some examples.

Evo nekih primjera.

You may have seen these on the Internet

Možda ste to vidjeli na Internetu

when you were creating passwords.

kada kreirate lozinke.

We decided to do a study to find out

Istraživali smo

whether these password meters actually work.

funkcioniraju li ti lozinkomjeri.

Do they actually help people

Pomažu li korisnicima

have stronger passwords,

pri kreiranju jačih lozinki,

and if so, which ones are better?

i ako da, koje su bolje?

So we tested password meters that were

Testirali smo te lozinkomjere

different sizes, shapes, colors,

različitih veličina, oblika, boja

different words next to them,

s različitim riječima,

and we even tested one that was a dancing bunny.

čak smo i testirali onog koji je u obliku zečića koji pleše.

As you type a better password,

Što je lozinka bolja

the bunny dances faster and faster.

zeko pleše brže i brže.

So this was pretty fun.

Ovo je bilo zabavno.

What we found

Otkrili smo da

was that password meters do work.

lozinkomjeri zbilja funkcioniraju.

(Laughter)

(Smijeh)

Most of the password meters were actually effective,

Većina njih je zapravo vrlo učinkovita,

and the dancing bunny was very effective too,

čak i zeko koji pleše je učinkovit,

but the password meters that were the most effective

ali oni koji su najučinkovitiji

were the ones that made you work harder

su oni koji te natjeraju na razmišljanje

before they gave you that thumbs up and said

prije nego ti daju odobrenje

you were doing a good job,

i pohvale te.

and in fact we found that most

Saznali smo da je većina

of the password meters on the Internet today

lozinkomjera na Internetu danas

are too soft.

They tell you you're doing a good job too early,

previše popustljiva.

Prerano će te pohvaliti,

and if they would just wait a little bit

a da pričekaju samo malo

before giving you that positive feedback,

s pozitivnom povratnom informacijom,

you probably would have better passwords.

vjerojatno biste imali bolje lozinke.

Now another approach to better passwords, perhaps,

Drugi pristup za kreiranje boljih lozinki, je možda,

is to use pass phrases instead of passwords.

korištenje frazi umjesto lozinki.

So this was an xkcd cartoon from a couple of years ago,

Ovo je xkcd strip star nekoliko godina

and the cartoonist suggests

gdje crtač predlaže

that we should all use pass phrases,

da bismo trebali koristiti fraze kao lozinke,

and if you look at the second row of this cartoon,

i ako pogledate drugi red crteža,

you can see the cartoonist is suggesting

vidjeti ćete crtačevu ideju

that the pass phrase "correct horse battery staple"

da bi fraza "ispravan konj baterija spajalica"

would be a very strong pass phrase

bila vrlo jaka fraza-lozinka

and something really easy to remember.

i lako pamtljiva.

He says, in fact, you've already remembered it.

On kaže, zapravo, da ste je već zapamtili.

And so we decided to do a research study

Tako smo se odlučili za istraživanje

to find out whether this was true or not.

kako bismo otkrili je li to istina.

In fact, everybody who I talk to,

Zapravo, svi s kojima sam razgovarala,

who I mention I'm doing password research,

a spomenula sam im istraživanje

they point out this cartoon.

su spomenuli taj strip.

"Oh, have you seen it? That xkcd.

"Vidjela si ga? Taj xkcd.

Correct horse battery staple."

Ispravan konj baterija spajalica."

So we did the research study to see

Proveli smo istraživanje

what would actually happen.

kako bismo vidjeli što bi se dogodilo.

So in our study, we used Mechanical Turk again,

Ponovno smo koristili Mechanical Turk,

and we had the computer pick the random words

a računalo je nasumice izabiralo riječi

in the pass phrase.

za frazu-lozinku.

Now the reason we did this

Razlog za to je taj

is that humans are not very good

što ljudi nisu osobito dobri

at picking random words.

u odabiru slučajnih i nasumičnih riječi.

If we asked a human to do it,

Da smo ljude pitali da ih sami odaberu,

they would pick things that were not very random.

oni bi odabrali riječi koje nisu nimalo nasumične.

So we tried a few different conditions.

Koristili smo nekoliko uvjetovanja.

In one condition, the computer picked

U jednom je računalo odabiralo

from a dictionary of the very common words

iz rječnika vrlo čestih riječi

in the English language,

u engleskom jeziku,

and so you'd get pass phrases like

pa smo dobili fraze-lozinke kao što je

"try there three come."

"probati ondje tri dolaze".

And we looked at that, and we said,

Kada smo to vidjeli, pomislili smo

"Well, that doesn't really seem very memorable."

da se to ne čini baš jako pamtljivo.

So then we tried picking words

Nakon toga smo odabirali riječi

that came from specific parts of speech,

koje dolaze iz specifičnih dijelova govora,

so how about noun-verb-adjective-noun.

i formu imenica-glagol-pridjev-imenica.

That comes up with something that's sort of sentence-like.

To je sada već izgledalo kao rečenica.

So you can get a pass phrase like

Fraze-lozinke su zvučale kao

"plan builds sure power"

"plan gradi sigurnu energiju"

or "end determines red drug."

ili "kraj određuje crveni lijek".

And these seemed a little bit more memorable,

Ove su se činile više pamtljive,

and maybe people would like those a little bit better.

možda će se ispitanicima više svidjeti.

We wanted to compare them with passwords,

Željeli smo ih usporediti s lozinkama,

and so we had the computer pick random passwords,

imali smo računalo koje generira lozinke

and these were nice and short, but as you can see,

koje, iako su bile kratke i drage,

they don't really look very memorable.

nisu izgledale jako pamtljive.

And then we decided to try something called

Odlučili smo probati nešto što se zove

a pronounceable password.

izgovorljiva lozinka.

So here the computer picks random syllables

Računalo odabire slučajne slogove

and puts them together

i slaže ih zajedno

so you have something sort of pronounceable,

tako da se dobije nešto što je donekle izgovorljivo

like "tufritvi" and "vadasabi."

kao "tufritvi" i "vadasabi".

That one kind of rolls off your tongue.

Na tome se zbilja lomi jezik.

So these were random passwords that were

To su bile nasumične lozinke koje

generated by our computer.

je generiralo računalo.

So what we found in this study was that, surprisingly,

Ono što smo otkrili bilo je iznenađujuće

pass phrases were not actually all that good.

fraze-lozinke nisu se iskazale.

People were not really better at remembering

Ispitanici nisu bolje pamtili

the pass phrases than these random passwords,

fraze-lozinke od onih nasumičnih lozinki.

and because the pass phrases are longer,

A kako su bile i duže,

they took longer to type

bilo je potrebno puno više vremena za njihovo upisivanje

and people made more errors while typing them in.

i ispitanici su radili više greški dok su ih upisivali.

So it's not really a clear win for pass phrases.

Tako da fraze-lozinke nisu pobijedile.

Sorry, all of you xkcd fans.

Žao mi je, xkcd fanovi.

On the other hand, we did find

S druge strane, otkrili smo

that pronounceable passwords

da su izgovorljive lozinke

worked surprisingly well,

funkcionirale jako dobro

and so we actually are doing some more research

tako da radimo još jedno istraživanje

to see if we can make that approach work even better.

kako bismo otkrili možemo li tako riješiti bolje problem.

So one of the problems

Jedan od problema

with some of the studies that we've done

s tim istraživanjima je

is that because they're all done

taj što su rezultati dobiveni

using Mechanical Turk,

pomoću Mechanical Turka,

these are not people's real passwords.

odnosno, to nisu prave lozinke.

They're the passwords that they created

To su lozinke koje koje su korisnici kreirali

or the computer created for them for our study.

ili je računalo generiralo za potrebe istraživanja.

And we wanted to know whether people

Mi smo željeli znati bi li se

would actually behave the same way

ispitanici jednako ponašali

with their real passwords.

kada bi morali kreirati prave lozinke.

So we talked to the information security office at Carnegie Mellon

Zato smo razgovarali s Uredom za informacijsku sigurnost na CMU-u

and asked them if we could have everybody's real passwords.

i pitali ih možemo li dobiti prave lozinke korisnika.

Not surprisingly, they were a little bit reluctant

Nije iznenađenje da nisu

to share them with us,

željeli podijeliti ih s nama,

but we were actually able to work out

ali smo uspjeli smisliti

a system with them

sustav s njima

where they put all of the real passwords

u kojem su sve prave lozinke

for 25,000 CMU students, faculty and staff,

25.000 studenata, profesora i osoblja,

into a locked computer in a locked room,

pohranili u zaključano računalo, u zaključanu sobu,

not connected to the Internet,

koja nije povezana na Internet,

and they ran code on it that we wrote

i provukli kroz kod koji smo mi napisali

to analyze these passwords.

za analizu lozinki.

They audited our code.

Oni su provjerili naš kod.

They ran the code.

Oni su ubacili kod.

And so we never actually saw

Tako da mi zapravo nismo vidjeli

anybody's password.

ničiju lozinku.

We got some interesting results,

Dobili smo zanimljive rezultate.

and those of you Tepper students in the back

Studentima na Tepperu, koji sjede iza

will be very interested in this.

će ovo biti jako zanimljivo.

So we found that the passwords created

Dakle, otkrili smo da su lozinke koje su kreirali

by people affiliated with the school of computer science

studenti informatike

were actually 1.8 times stronger

1,8 puta jače

than those affiliated with the business school.

od onih koje su kreirali studenti ekonomije.

We have lots of other really interesting

Također smo dobili puno zanimljivih

demographic information as well.

demografskih informacija.

The other interesting thing that we found

Zanimljivo je otkriće da

is that when we compared the Carnegie Mellon passwords

kada smo usporedili lozinke sveučilišta

to the Mechanical Turk-generated passwords,

s onima s Mechanical Turka,

there was actually a lot of similarities,

pronašli smo puno sličnosti.

and so this helped validate our research method

To je potvrdilo naše istraživačke metode

and show that actually, collecting passwords

i pokazalo da je prikupljanje lozinki

using these Mechanical Turk studies

za istraživanje koristeći Mechanical Turk

is actually a valid way to study passwords.

dobar način za proučavanje lozinki.

So that was good news.

To su bile dobre vijesti.

Okay, I want to close by talking about

U redu, željela bih zaključiti

some insights I gained while on sabbatical

s nekoliko stvari koje sam uvidjela dok sam bila prošle godine

last year in the Carnegie Mellon art school.

na slobodnoj godini na umjetničkom odsjeku Carnegie Mellon-a.

One of the things that I did

Jedna od stvari koje sam napravila

is I made a number of quilts,

je da sam napravila nekoliko popluna.

and I made this quilt here.

I ovaj ovdje.

It's called "Security Blanket."

Zove se "Sigurnosna dekica".

(Laughter)

(Smijeh)

And this quilt has the 1,000

Taj poplun ima 1.000

most frequent passwords stolen

lozinki koje se najčešće ukradu,

from the RockYou website.

a nalaze se na stranici RockYou.

And the size of the passwords is proportional

Veličina lozinke je proporcionalna

to how frequently they appeared

učestalosti njezina pojavljivanja

in the stolen dataset.

u setovima ukradenih lozinki.

And what I did is I created this word cloud,

Stvorila sam ovaj oblak riječi,

and I went through all 1,000 words,

proučila svih tih 1.000 riječi,

and I categorized them into

i kategorizirala ih

loose thematic categories.

u okvirne tematske kategorije.

And it was, in some cases,

U nekim slučajevima

it was kind of difficult to figure out

je bilo teško odrediti

what category they should be in,

kojoj bi kategoriji trebali pripadati.

and then I color-coded them.

Isto tako sam im pridružila boju.

So here are some examples of the difficulty.

Ovo je nekoliko primjera onih teških.

So "justin."

Na primjer "justin".

Is that the name of the user,

Je li to ime korisnika,

their boyfriend, their son?

korisnikova dečka ili sina?

Maybe they're a Justin Bieber fan.

Možda je korisnik samo fan Justina Bibera.

Or "princess."

Ili "princess".

Is that a nickname?

Je li to nadimak?

Are they Disney princess fans?

Ili se radi o fanu princeza iz Disneyjevih bajki.

Or maybe that's the name of their cat.

Može biti i ime mačke.

"Iloveyou" appears many times

"Volimte" se često pojavljuje

in many different languages.

na različitim jezicima.

There's a lot of love in these passwords.

Puno je ljubavi u lozinkama.

If you look carefully, you'll see there's also

Ako pažljivo promatrate,

some profanity,

vidjeti ćete i vulgarnosti.

but it was really interesting to me to see

Ali mi je zanimljivo vidjeti

that there's a lot more love than hate

da je puno više ljubavi nego mržnje

in these passwords.

u lozinkama.

And there are animals,

Također, tu su i životinje,

a lot of animals,

puno je životinja,

and "monkey" is the most common animal

"majmun" je najčešća životinja

and the 14th most popular password overall.

i 14. najpopularnija lozinka ukupno.

And this was really curious to me,

A to mi je bilo jako zanimljivo,

and I wondered, "Why are monkeys so popular?"

pitala sam se zašto su majmuni toliko popularni.

And so in our last password study,

Zato smo u zadnjem istraživanju,

any time we detected somebody

svaki put kada bismo detektirali

creating a password with the word "monkey" in it,

kreiranje lozinke s riječi "majmun",

we asked them why they had a monkey in their password.

pitali ispitanika zašto njihova lozinka ima majmuna u sebi.

And what we found out --

i otkrili smo,

we found 17 people so far, I think,

mislim da zasada imamo 17-tero njih,

who have the word "monkey" --

s riječi "majmun" u lozinki.

We found out about a third of them said

Otkrili smo da trećina njih

they have a pet named "monkey"

ima ljubimca koji se zove "majmun",

or a friend whose nickname is "monkey,"

ili prijatelja čiji je nadimak "majmun".

and about a third of them said

Trećina njih je rekla

that they just like monkeys

da vole majmune

and monkeys are really cute.

i da su im oni baš slatki.

And that guy is really cute.

Ovaj stvarno je sladak.

So it seems that at the end of the day,

Tako, sve u svemu, čini se da

when we make passwords,

kada kreiramo lozinke,

we either make something that's really easy

mi ili smislimo nešto što je vrlo jednostavno

to type, a common pattern,

za napisati, nekakav poznati uzorak,

or things that remind us of the word password

ili nešto na što nas podsjeća riječ lozinka,

or the account that we've created the password for,

ili račun za koji stvaramo lozinku.

or whatever.

ili kakogod.

Or we think about things that make us happy,

Ili razmišljamo o stvarima koje nas čine sretnima

and we create our password

pa kreiramo lozinke

based on things that make us happy.

bazirane na stvarima koje nas čine sretnima.

And while this makes typing

Iako je time upisivanje

and remembering your password more fun,

i prisjećanje lozinke, zabavnije,

it also makes it a lot easier

također je i jednostavnije

to guess your password.

tako pogoditi vašu lozinku.

So I know a lot of these TED Talks

Znam da je smisao TEDTalk-a

are inspirational

da vas inspiriraju

and they make you think about nice, happy things,

i da mislite o lijepim, stvarima koje vas čine sretnim,

but when you're creating your password,

ali kada kreirate lozinku,

try to think about something else.

pokušajte razmišljati o nečemu drugome.

Thank you.

Hvala.

(Applause)

(Pljesak)