Lorrie Faith Cranor: What's wrong with your pa$$w0rd?

Translator: Lucia Lichá Reviewer: Petra Aquamarine

I am a computer science and engineering professor here at Carnegie Mellon,

Na Univerzite Carnegie Mellon (CMU) vyučujem informatiku

and my research focuses on usable privacy and security,

a skúmam hlavne použiteľnosť ochrany súkromia a bezpečnosti.

Známi mi preto hovoria o prípadoch, keď im počítače idú na nervy,

and so my friends like to give me examples

of their frustrations with computing systems,

especially frustrations related to

hlavne, ak sa ich znechutenie týka

unusable privacy and security.

nepoužiteľnej ochrany súkromia a bezpečnosti.

So passwords are something that I hear a lot about.

Veľa toho počujem práve o heslách.

A lot of people are frustrated with passwords,

Mnohých ľudí heslá otravujú.

and it's bad enough

Nie je to jednoduché, keď máte mať 1 skutočne dobré heslo,

when you have to have one really good password

that you can remember

ktoré si vy zapamätáte, ale nikto iný ho nedokáže uhádnuť.

but nobody else is going to be able to guess.

Čo však máte robiť, keď máte stovky rôznych účtov

But what do you do when you have accounts

on a hundred different systems

and you're supposed to have a unique password

a pre každý z nich máte mať skutočne jedinečné heslo?

for each of these systems?

To je už ťažšie.

It's tough.

At Carnegie Mellon, they used to make it

V minulosti sa heslo na CMU dalo zapamätať celkom ľahko.

actually pretty easy for us

to remember our passwords.

The password requirement up through 2009

Až do konca roku 2009 existovala len jedna požiadavka na heslo.

was just that you had to have a password

with at least one character.

Muselo mať aspoň 1 znak.

To bolo ľahké. Potom sa veci zmenili.

Pretty easy. But then they changed things,

and at the end of 2009, they announced

Koncom toho roku nám oznámili, že začína platiť nové nariadenie,

that we were going to have a new policy,

and this new policy required

podľa ktorého bude heslo musieť mať dĺžku aspoň 8 znakov,

passwords that were at least eight characters long,

with an uppercase letter, lowercase letter,

veľké a malé písmená, číslicu a symbol.

a digit, a symbol,

you couldn't use the same character more than three times,

Znak sa nesmel opakovať viac ako trikrát a slovo nesmelo byť v slovníku.

and it wasn't allowed to be in a dictionary.

Now, when they implemented this new policy,

Keď s tým prvýkrát prišli,

a lot of people, my colleagues and friends,

veľa ľudí, kolegov a priateľov, za mnou prišlo so slovami:

came up to me and they said, "Wow,

now that's really unusable.

„To je nepoužiteľné.

Why are they doing this to us,

Prečo nám to robia a prečo si ich nezastavila?“

and why didn't you stop them?"

And I said, "Well, you know what?

Odpovedala som, že mňa sa neopýtali.

They didn't ask me."

But I got curious, and I decided to go talk

Zo zvedavosti som sa však rozhodla, že sa pôjdem zodpovedných opýtať,

to the people in charge of our computer systems

and find out what led them to introduce

prečo to zaviedli.

this new policy,

Odpovedali, že univerzita sa stala členom konzorcia univerzít

and they said that the university

had joined a consortium of universities,

and one of the requirements of membership

a jedna z podmienok členstva bola,

was that we had to have stronger passwords

že musíme mať silnejšie heslá, ktoré budú spĺňať nové požiadavky.

that complied with some new requirements,

and these requirements were that our passwords

Jednou z požiadaviek bola vysoká entropia hesiel.

had to have a lot of entropy.

Now entropy is a complicated term,

Entropia síce znie zložito, ale v podstate meria silu hesla.

but basically it measures the strength of passwords.

But the thing is, there isn't actually

Problémom je, že neexistuje štandard pre meranie entropie.

a standard measure of entropy.

Now, the National Institute of Standards and Technology

Národný inštitút štandardov a technológií má určité pokyny,

has a set of guidelines

which have some rules of thumb

ktoré obsahujú všeobecné odporúčania na meranie entropie,

for measuring entropy,

but they don't have anything too specific,

ale nemá žiadne presné pravidlá.

Môžu ponúknuť len odporúčania,

and the reason they only have rules of thumb

is it turns out they don't actually have any good data

pretože nemajú skutočne hodnotné údaje o heslách.

on passwords.

In fact, their report states,

V ich správe je uvedené:

"Unfortunately, we do not have much data

„Nemáme veľa údajov o heslách

on the passwords users choose under particular rules.

vytvorených používateľmi podľa určitých pravidiel.

NIST would like to obtain more data

Radi by sme získali viac údajov o skutočných heslách používateľov,

on the passwords users actually choose,

but system administrators are understandably reluctant

ale je pochopiteľné, že administrátori nie sú ochotní takéto údaje prezradiť.“

to reveal password data to others."

So this is a problem, but our research group

Je to problém, ktorý sme sa rozhodli vnímať ako príležitosť.

looked at it as an opportunity.

We said, "Well, there's a need for good password data.

Povedali sme si:

„Ak sú potrebné hodnotné údaje, možno by sme ich mohli získať

Maybe we can collect some good password data

and actually advance the state of the art here.

a prispieť k pokroku v tejto oblasti.“

So the first thing we did is,

Ako prvé sme zobrali za tašku tyčiniek

we got a bag of candy bars

and we walked around campus

a v areáli univerzity sme si od študentov a zamestnancov

and talked to students, faculty and staff,

and asked them for information

pýtali informácie o ich heslách.

about their passwords.

Now we didn't say, "Give us your password."

Nechceli sme od nich konkrétne heslá.

Chceli sme len všeobecné informácie.

No, we just asked them about their password.

How long is it? Does it have a digit?

Aké sú dlhé? Majú číslicu alebo symbol?

Does it have a symbol?

And were you annoyed at having to create

Nahnevalo vás, že ste si museli vytvoriť nové?

a new one last week?

So we got results from 470 students,

Získali sme údaje od 470 študentov a zamestnancov

faculty and staff,

a potvrdilo sa nám, že nové nariadenie išlo ľuďom na nervy,

and indeed we confirmed that the new policy

was very annoying,

ale zistili sme aj to,

but we also found that people said

že vďaka nových heslám sa cítili bezpečnejšie.

they felt more secure with these new passwords.

Zistili sme, že väčšina ľudí vedela, že si nemajú heslá zapisovať

We found that most people knew

they were not supposed to write their password down,

and only 13 percent of them did,

a len 13 % si ich zapisovalo.

Znepokojujúce však bolo, že 80 % ľudí používalo to isté heslo viackrát,

but disturbingly, 80 percent of people

said they were reusing their password.

Now, this is actually more dangerous

čo je ešte nebezpečnejšie ako si ho niekde zapísať,

than writing your password down,

because it makes you much more susceptible to attackers.

pretože tak ste náchylnejší podľahnúť útokom.

So if you have to, write your passwords down,

Ak musíte, heslo si radšej zapíšte, ale nepoužívajte ho viackrát.

but don't reuse them.

We also found some interesting things

Zistili sme aj zaujímavé veci o symboloch, ktoré ľudia používajú.

about the symbols people use in passwords.

So CMU allows 32 possible symbols,

CMU dáva na výber z 32 symbolov,

but as you can see, there's only a small number

ale ako vidíte, väčšina ľudí používa len niektoré z nich,

that most people are using,

so we're not actually getting very much strength

takže to, že je v hesle symbol, neznamená, že heslo je silnejšie.

from the symbols in our passwords.

So this was a really interesting study,

Bola to skutočne zaujímavá štúdia a získali sme údaje od 470 ľudí,

and now we had data from 470 people,

but in the scheme of things,

čo však vo všeobecnosti nie je až také veľké množstvo.

that's really not very much password data,

and so we looked around to see

Hľadali sme spôsob, ako získať ďalšie údaje o heslách.

where could we find additional password data?

So it turns out there are a lot of people

Ukázalo sa, že existuje veľa ľudí, ktorí kradnú heslá iných ľudí

going around stealing passwords,

and they often go and post these passwords

a často ich aj zverejnia na internete.

on the Internet.

Získali sme prístup

So we were able to get access

to some of these stolen password sets.

k niekoľkým súborom s ukradnutými heslami.

Neboli však pre náš výskum ideálne, pretože ich pôvod nebol úplne jasný

This is still not really ideal for research, though,

because it's not entirely clear

where all of these passwords came from,

a nepoznali sme ani nariadenia, podľa ktorých ich ľudia vytvorili.

or exactly what policies were in effect

when people created these passwords.

So we wanted to find some better source of data.

Chceli sme teda nájsť lepší zdroj údajov.

So we decided that one thing we could do

Rozhodli sme sa pre štúdiu,

is we could do a study and have people

počas ktorej by ľudia pre nás heslá skutočne vytvárali.

actually create passwords for our study.

Využili sme internetový trh Amazon MTurk,

So we used a service called Amazon Mechanical Turk,

kde môžete online zverejniť jednoduchú úlohu,

and this is a service where you can post

a small job online that takes a minute,

ktorá bude trvať minútu, pár minút, či hodinu

a few minutes, an hour,

and pay people, a penny, ten cents, a few dollars,

a ľuďom za jej vykonanie zaplatíte cent, 10 centov, či pár dolárov

to do a task for you,

and then you pay them through Amazon.com.

prostredníctvom Amazonu.

So we paid people about 50 cents

Zaplatili sme ľuďom 50 centov,

to create a password following our rules

aby podľa našich pravidiel vytvorili heslá a vyplnili dotazník

and answering a survey,

and then we paid them again to come back

a potom ešte raz,

aby sa o 2 dni neskôr tým heslom prihlásili a vyplnili ďalší dotazník.

two days later and log in

using their password and answering another survey.

So we did this, and we collected 5,000 passwords,

Týmto spôsobom sme získali 5000 hesiel,

pričom sme ľuďom dali rôzne pravidlá, ako vytvoriť heslá.

and we gave people a bunch of different policies

to create passwords with.

So some people had a pretty easy policy,

Niektorí to mali celkom ľahké,

we call it Basic8,

napríklad pri Basic 8 bola jediná požiadavka,

and here the only rule was that your password

že heslo muselo mať aspoň 8 znakov.

had to have at least eight characters.

Iní to mali oveľa ťažšie a museli dodržať pravidlá ako na CMU,

Then some people had a much harder policy,

and this was very similar to the CMU policy,

teda heslo muselo mať 8 znakov,

that it had to have eight characters

vrátane malých a veľkých písmen, číslice, symbolu

including uppercase, lowercase, digit, symbol,

and pass a dictionary check.

a nesmelo byť v slovníku.

And one of the other policies we tried,

Jedno z pravidiel, ktoré sme skúsili, sa volalo Basic16

and there were a whole bunch more,

but one of the ones we tried was called Basic16,

and the only requirement here

a tu bola jediná podmienka, že heslo muselo mať aspoň 16 znakov.

was that your password had to have at least 16 characters.

All right, so now we had 5,000 passwords,

Takže takto sme získali 5000 hesiel a detailné informácie o ich vzniku.

and so we had much more detailed information.

Again we see that there's only a small number

Potvrdilo sa nám,

že ľudia väčšinou v heslách používajú len určité symboly.

of symbols that people are actually using

in their passwords.

Chceli sme vedieť aj to, aké silné heslá si ľudia vytvorili,

We also wanted to get an idea of how strong

the passwords were that people were creating,

but as you may recall, there isn't a good measure

ale neexistuje skutočne dobrý spôsob, ako merať silu hesla.

of password strength.

So what we decided to do was to see

Rozhodli sme sa zistiť, ako dlho by trvalo prelomiť tieto heslá

how long it would take to crack these passwords

using the best cracking tools

pomocou nástrojov, ktoré používajú hekeri,

that the bad guys are using,

or that we could find information about

alebo o ktorých sme našli informácie v literatúre.

in the research literature.

So to give you an idea of how bad guys

Stručne vysvetlím, ako hekeri prelamujú heslá.

go about cracking passwords,

they will steal a password file

Ukradnú súbor s heslami v šifrovanej podobe, tzv. hash,

that will have all of the passwords

in kind of a scrambled form, called a hash,

tipnú si heslo, ktoré by tam mohlo byť, použijú naň hašovaciu funkciu

and so what they'll do is they'll make a guess

as to what a password is,

run it through a hashing function,

and see whether it matches

a uvidia, či sa výsledok zhoduje s niektorým šifrovaným heslom v súbore.

the passwords they have on their stolen password list.

Tí hlúpejší skúsia všetky heslá zaradom.

So a dumb attacker will try every password in order.

They'll start with AAAAA and move on to AAAAB,

Začnú s AAAAA, potom skúsia AAAAB

and this is going to take a really long time

a bude im asi trvať dosť dlho,

before they get any passwords

kým nájdu heslo, ktoré ľudia skutočne používajú.

that people are really likely to actually have.

A smart attacker, on the other hand,

Tí múdrejší na to však pôjdu inak.

does something much more clever.

They look at the passwords

Najprv skúsia uhádnuť populárne heslá, ktoré by sa v súbore mohli nachádzať.

that are known to be popular

from these stolen password sets,

and they guess those first.

So they're going to start by guessing "password,"

Začnú teda slovom „heslo“,

and then they'll guess "I love you," and "monkey,"

potom skúsia „milujemta“, „opicka“ a „12345678“,

and "12345678,"

because these are the passwords

pretože práve to sú heslá, ktoré ľudia asi najviac používajú.

that are most likely for people to have.

In fact, some of you probably have these passwords.

Možno také heslo má aj niekto z vás.

So what we found

Otestovali sme silu všetkých 5000 hesiel

by running all of these 5,000 passwords we collected

through these tests to see how strong they were,

a zistili sme, že dlhé heslá sú dosť silné,

we found that the long passwords

were actually pretty strong,

and the complex passwords were pretty strong too.

takisto ako aj heslá zložité.

However, when we looked at the survey data,

Keď sme sa však pozreli na údaje z dotazníkov,

we saw that people were really frustrated

zistili sme, že veľmi zložité heslá išli ľuďom na nervy

by the very complex passwords,

a že dlhé boli nielen použiteľnejšie,

and the long passwords were a lot more usable,

and in some cases, they were actually

ale v niektorých prípadoch dokonca aj silnejšie.

even stronger than the complex passwords.

So this suggests that,

Z toho vyplýva, že by asi bolo lepšie ľuďom hovoriť,

instead of telling people that they need

to put all these symbols and numbers

and crazy things into their passwords,

aby namiesto symbolov, číslic a iných šialeností,

we might be better off just telling people

radšej používali dlhé heslá.

to have long passwords.

Now here's the problem, though:

Vyskytol sa však problém.

Some people had long passwords

Niektorí ľudia mali heslá dlhé, ale nie veľmi silné.

that actually weren't very strong.

You can make long passwords

Môžete mať dlhé heslo,

that are still the sort of thing

ale stále to môže byť niečo, čo útočník ľahko uhádne.

that an attacker could easily guess.

So we need to do more than just say long passwords.

Samotná dĺžka teda nestačí.

Potrebujeme nejaké dodatočné požiadavky.

There has to be some additional requirements,

and some of our ongoing research is looking at

V súčasnosti sa snažíme zistiť,

aké požiadavky by ľuďom pomohli vytvoriť si silnejšie heslá,

what additional requirements we should add

to make for stronger passwords

that also are going to be easy for people

ktoré by si ľahko zapamätali a ktoré by sa dali ľahko napísať.

to remember and type.

Another approach to getting people to have

Merač sily hesla tiež môže pomôcť vytvoriť silnejšie heslo.

stronger passwords is to use a password meter.

Here are some examples.

Tu sú niektoré internetové, s ktorými ste sa mohli stretnúť.

You may have seen these on the Internet

when you were creating passwords.

We decided to do a study to find out

Rozhodli sme sa zistiť, či tieto merače skutočne fungujú.

whether these password meters actually work.

Do they actually help people

Pomáhajú naozaj ľuďom vytvoriť silnejšie heslá

have stronger passwords,

and if so, which ones are better?

a ak áno, ktoré sú lepšie?

So we tested password meters that were

Otestovali sme merače rôznych veľkostí, tvarov, farieb, s rôznymi popismi

different sizes, shapes, colors,

different words next to them,

and we even tested one that was a dancing bunny.

a dokonca aj s tancujúcim zajačikom.

As you type a better password,

Čím lepšie heslo napíšete, tým rýchlejšie tancuje.

the bunny dances faster and faster.

So this was pretty fun.

Bolo to celkom zábavné.

What we found

Zistili sme, že merače fungujú.

was that password meters do work.

(smiech)

(Laughter)

Most of the password meters were actually effective,

Väčšina z nich bola skutočne efektívna,

aj ten tancujúci zajačik.

and the dancing bunny was very effective too,

but the password meters that were the most effective

Tie najefektívnejšie vás prinútia na hesle čo najviac pracovať,

were the ones that made you work harder

before they gave you that thumbs up and said

predtým, ako vám dajú zelenú a pochvália vás.

you were doing a good job,

and in fact we found that most

Zistili sme však, že väčšina z nich je príliš mierna.

of the password meters on the Internet today

are too soft.

They tell you you're doing a good job too early,

Vaše heslo pochvália príliš skoro

and if they would just wait a little bit

a keby s kladným hodnotením počkali o chvíľu dlhšie,

before giving you that positive feedback,

you probably would have better passwords.

mali by ste pravdepodobne lepšie heslo.

Now another approach to better passwords, perhaps,

Ďalšou možnosťou, ako zlepšiť heslá, by mohlo byť použitie prístupových fráz.

is to use pass phrases instead of passwords.

So this was an xkcd cartoon from a couple of years ago,

Tu vidíte internetový komiks xkcd,

v ktorom pred niekoľkými rokmi autor navrhol používanie fráz.

and the cartoonist suggests

that we should all use pass phrases,

and if you look at the second row of this cartoon,

V druhom riadku navrhuje frázu „spravne kon spinka na baterke“,

you can see the cartoonist is suggesting

that the pass phrase "correct horse battery staple"

ktorá by bola nielen silná, ale aj ľahko zapamätateľná.

would be a very strong pass phrase

and something really easy to remember.

He says, in fact, you've already remembered it.

Podľa neho ste si ju už aj zapamätali.

Rozhodli sme sa, že zistíme, či má pravdu, alebo nie.

And so we decided to do a research study

to find out whether this was true or not.

In fact, everybody who I talk to,

Vlastne každý, komu poviem, že skúmam heslá,

who I mention I'm doing password research,

they point out this cartoon.

sa ma opýta, či poznám xkcd komiks s tou frázou.

"Oh, have you seen it? That xkcd.

Correct horse battery staple."

So we did the research study to see

Chceli sme teda zistiť, ako to funguje v realite.

what would actually happen.

Znovu sme využili MTurk

So in our study, we used Mechanical Turk again,

and we had the computer pick the random words

a náhodné slová vo fráze vybral počítač.

in the pass phrase.

Now the reason we did this

Na výber slov sme použili počítač, lebo ľuďom to veľmi nejde.

is that humans are not very good

at picking random words.

If we asked a human to do it,

Slová, ktoré by vybral človek, by neboli naozaj náhodné.

they would pick things that were not very random.

Skúsili sme zadať rôzne požiadavky.

So we tried a few different conditions.

In one condition, the computer picked

V jednom prípade počítač vybral slová zo slovníka často používaných slov

from a dictionary of the very common words

in the English language,

and so you'd get pass phrases like

a získali sme asi takéto frázy:

"try there three come."

„skusit tam tri prist“.

And we looked at that, and we said,

Keď sme to zbadali, povedali sme si, že to nevyzerá zapamätateľne.

"Well, that doesn't really seem very memorable."

So then we tried picking words

Rozhodli sme sa použiť slovosled,

that came from specific parts of speech,

ktorý je v reči prirodzený, napríklad podstatné meno pred a za slovesom.

so how about noun-verb-adjective-noun.

That comes up with something that's sort of sentence-like.

Vtedy sa už výsledok podobal na vetu.

So you can get a pass phrase like

Získali sme frázy ako

"plan builds sure power"

„plan vytvori istu energiu“

or "end determines red drug."

alebo „koniec urci cerveny liek“.

And these seemed a little bit more memorable,

Tie už vyzerali zapamätateľnejšie a ľuďom by sa mohli viac páčiť.

and maybe people would like those a little bit better.

We wanted to compare them with passwords,

Chceli sme ich porovnať s heslami.

and so we had the computer pick random passwords,

Počítač nám vybral náhodné heslá, ktoré boli síce krátke,

and these were nice and short, but as you can see,

ale nevyzerali ľahko zapamätateľné.

they don't really look very memorable.

And then we decided to try something called

Potom sme sa rozhodli skúsiť tzv. vysloviteľné heslá.

a pronounceable password.

So here the computer picks random syllables

Počítač náhodne vybral slabiky

and puts them together

a spojil ich tak, že vzniklo niečo vysloviteľné,

so you have something sort of pronounceable,

like "tufritvi" and "vadasabi."

napríklad „tufritvi“ alebo „vadasabi“.

That one kind of rolls off your tongue.

To je ľahko vysloviteľné.

So these were random passwords that were

Takto vyzerali náhodné heslá, ktoré vygeneroval náš počítač.

generated by our computer.

So what we found in this study was that, surprisingly,

Prekvapujúco sme však zistili, že frázy vlastne neboli až také dobré.

pass phrases were not actually all that good.

Ľudia si ich nepamätali oveľa lepšie ako náhodné heslá

People were not really better at remembering

the pass phrases than these random passwords,

and because the pass phrases are longer,

a keďže boli dlhšie,

they took longer to type

ľuďom dlhšie trvalo ich napísať a robili pri tom viac chýb.

and people made more errors while typing them in.

So it's not really a clear win for pass phrases.

Nebola to teda jasná výhra pre frázy.

Sorry, all of you xkcd fans.

Ospravedlňujem sa fanúšikom xkcd.

On the other hand, we did find

Na druhú stranu sme zistili,

that pronounceable passwords

že vysloviteľné heslá fungovali až prekvapivo dobre.

worked surprisingly well,

and so we actually are doing some more research

Teraz skúmame, či ich nemôžeme ešte nejako vylepšiť.

to see if we can make that approach work even better.

So one of the problems

Počas práce sme narazili na niekoľko problémov.

with some of the studies that we've done

is that because they're all done

Jeden z nich bol, že heslá získané pomocou MTurk

using Mechanical Turk,

neboli skutočné heslá.

these are not people's real passwords.

They're the passwords that they created

Tieto heslá vytvorili ľudia alebo počítač pre náš výskum.

or the computer created for them for our study.

Chceli sme však vedieť,

And we wanted to know whether people

či by sa ľudia správali rovnako aj pri svojich skutočných heslách.

would actually behave the same way

with their real passwords.

So we talked to the information security office at Carnegie Mellon

Opýtali sme sa správcov systémov na CMU, či by nám mohli dať skutočné heslá ľudí.

and asked them if we could have everybody's real passwords.

Neprekvapilo nás, že sa trochu zdráhali.

Not surprisingly, they were a little bit reluctant

to share them with us,

but we were actually able to work out

Nakoniec sme sa dohodli,

a system with them

where they put all of the real passwords

že 25 000 skutočných hesiel bude uložených v uzamknutom počítači

for 25,000 CMU students, faculty and staff,

into a locked computer in a locked room,

v uzavretej miestnosti bez prístupu na internet

not connected to the Internet,

and they ran code on it that we wrote

a oni spustia kód, ktorý sme vytvorili na analýzu hesiel.

to analyze these passwords.

They audited our code.

Oni kód preverili. Oni ho spustili.

They ran the code.

And so we never actually saw

My sme skutočné heslá nikdy nevideli.

anybody's password.

Výsledky boli celkom zaujímavé.

We got some interesting results,

and those of you Tepper students in the back

Určite zaujmú aj študentov ekonómie tam vzadu.

will be very interested in this.

Zistili sme, že heslá ľudí, ktorí sa zaoberajú informatikou,

So we found that the passwords created

by people affiliated with the school of computer science

were actually 1.8 times stronger

sú 1,8-krát silnejšie ako heslá ľudí, ktorí sa venujú ekonómii.

than those affiliated with the business school.

We have lots of other really interesting

Získali sme aj zaujímavé demografické informácie.

demographic information as well.

The other interesting thing that we found

Zaujímavé bolo aj to,

is that when we compared the Carnegie Mellon passwords

že keď sme porovnali heslá z CMU s heslami z MTurk,

to the Mechanical Turk-generated passwords,

there was actually a lot of similarities,

mali toho veľa spoločného,

and so this helped validate our research method

čo nám pomohlo potvrdiť výskumnú metódu

and show that actually, collecting passwords

a preukázať, že získavanie hesiel pomocou MTurk

using these Mechanical Turk studies

is actually a valid way to study passwords.

je skutočne vhodný spôsob, ako skúmať heslá.

Bola to dobrá správa.

So that was good news.

Okay, I want to close by talking about

Na záver by som chcela spomenúť niečo,

some insights I gained while on sabbatical

čo som si uvedomila počas vedeckej dovolenky na umeleckej škole.

last year in the Carnegie Mellon art school.

Okrem iného som ušila niekoľko prešívaných diek

One of the things that I did

is I made a number of quilts,

and I made this quilt here.

vrátane tejto.

It's called "Security Blanket."

Volám ju „Deka plná bezpečnosti“.

(Laughter)

(smiech)

And this quilt has the 1,000

Je na nej 1000 najčastejších hesiel,

most frequent passwords stolen

ktoré boli ukradnuté zo stránky RockYou.

from the RockYou website.

Veľkosť ich plochy na deke je priamo úmerná tomu,

And the size of the passwords is proportional

to how frequently they appeared

ako často sa heslá nachádzali v ukradnutých súboroch.

in the stolen dataset.

And what I did is I created this word cloud,

Vytvorila som si ich zoznam, všetky som prešla

and I went through all 1,000 words,

and I categorized them into

a rozdelila do približných tematických kategórií.

loose thematic categories.

And it was, in some cases,

V niektorých prípadoch bolo ťažké nájsť tú správnu kategóriu.

it was kind of difficult to figure out

what category they should be in,

and then I color-coded them.

Potom som ich farebne rozlíšila.

So here are some examples of the difficulty.

Uvediem príklady problémových hesiel:

So "justin."

„justin“

Is that the name of the user,

Ide o meno používateľa, meno priateľa alebo syna?

their boyfriend, their son?

Maybe they're a Justin Bieber fan.

Možno ide o fanúšika Justina Biebera.

Or "princess."

Alebo „princezna“.

Is that a nickname?

Je to prezývka? Páčia sa im princezné?

Are they Disney princess fans?

Or maybe that's the name of their cat.

Možno sa tak volá mačka.

"Iloveyou" appears many times

Často sa vyskytuje aj „milujemta“ a to v rôznych jazykoch.

in many different languages.

There's a lot of love in these passwords.

Tie heslá sú plné lásky.

If you look carefully, you'll see there's also

Keď sa však pozorne pozriete, nájdete aj vulgarizmy,

some profanity,

but it was really interesting to me to see

ale zaujalo ma, že v heslách bolo viac lásky ako nenávisti.

that there's a lot more love than hate

in these passwords.

And there are animals,

Ďalej tu máme zvieratá, veľa zvierat,

a lot of animals,

and "monkey" is the most common animal

pričom najčastejšia je „opicka“,

ktorá je zároveň 14. najpopulárnejším heslom.

and the 14th most popular password overall.

And this was really curious to me,

Zaujalo ma to a chcela som zistiť, prečo sú opičky také obľúbené.

and I wondered, "Why are monkeys so popular?"

And so in our last password study,

V najnovšej štúdii sa pýtame každého, kto v hesle použije slovo opička,

any time we detected somebody

creating a password with the word "monkey" in it,

we asked them why they had a monkey in their password.

prečo to slovo použili.

Zatiaľ ho použilo 17 ľudí a zistili sme, že...

And what we found out --

we found 17 people so far, I think,

who have the word "monkey" --

Približne tretina povedala,

We found out about a third of them said

they have a pet named "monkey"

že ich domáci miláčik sa volá Opička, alebo, že je to prezývka priateľa.

or a friend whose nickname is "monkey,"

and about a third of them said

Ďalšia tretina povedala,

that they just like monkeys

že sa im opice páčia, pretože sú skutočne roztomilé.

and monkeys are really cute.

And that guy is really cute.

Tento je fakt roztomilý.

So it seems that at the end of the day,

Vyzerá to, že pri tvorbe hesla myslíme buď na niečo,

when we make passwords,

we either make something that's really easy

čo sa jednoducho napíše na klávesnici,

to type, a common pattern,

or things that remind us of the word password

alebo na veci, ktoré nám pripomínajú slovo „heslo“,

or the account that we've created the password for,

alebo účet, pre ktorý sme si ho vytvorili a tak.

or whatever.

Možno myslíme na veci, vďaka ktorým sme šťastní,

Or we think about things that make us happy,

and we create our password

a na ich základe vytvoríme heslo.

based on things that make us happy.

And while this makes typing

Vďaka tomu si heslá lepšie zapamätáme a lepšie sa píšu,

and remembering your password more fun,

it also makes it a lot easier

ale dajú sa aj ľahšie uhádnuť.

to guess your password.

So I know a lot of these TED Talks

Viem, že prednášky TED ľudí často inšpirujú

are inspirational

and they make you think about nice, happy things,

a ľudia vďaka nim myslia na pekné veci,

but when you're creating your password,

ale keď si tvoríte heslo, skúste myslieť na niečo iné.

try to think about something else.

Thank you.

Ďakujem.

(Applause)

(potlesk)