Lorrie Faith Cranor: What's wrong with your pa$$w0rd?

Prevodilac: Jelena Relic Lektor: Ivana Korom

I am a computer science and engineering professor here at Carnegie Mellon,

Ja sam profesor računarskih nauka i inženjeringa na Univerzitetu Karnegi Melon

and my research focuses on usable privacy and security,

a fokus mog istraživanja je upotrebljivost sistema privatnosti i bezbednosti.

and so my friends like to give me examples

I tako moji prijatelji vole da mi daju primere

of their frustrations with computing systems,

svojih frustracija zbog računarskih sistema,

especially frustrations related to

naročito onih koji se odnose

unusable privacy and security.

na neupotrebljive sisteme privatnosti i bezbednosti.

So passwords are something that I hear a lot about.

Tako da su šifre nešto o čemu mnogo slušam.

A lot of people are frustrated with passwords,

Mnoge ljude frustriraju šifre,

and it's bad enough

i već je dovoljno teško

when you have to have one really good password

kada morate da imate jednu stvarno dobru šifru

that you can remember

koju možete zapamtiti

but nobody else is going to be able to guess.

ali koju niko drugi neće moći da pogodi.

But what do you do when you have accounts

Ali šta radite kada imate naloge

on a hundred different systems

na sto različitih sistema

and you're supposed to have a unique password

i trebalo bi da imate jedinstvenu šifru

for each of these systems?

za svaki od tih sistema?

It's tough.

To je teško.

At Carnegie Mellon, they used to make it

Na Karnegi Melonu su nam

actually pretty easy for us

zapravo prilično olakšali

to remember our passwords.

da upamtimo svoje šifre.

The password requirement up through 2009

Uslov za šifru je sve do 2009. godine

was just that you had to have a password

bio samo da morate da imate šifru

with at least one character.

koja sadrži bar jedan karakter.

Pretty easy. But then they changed things,

Prilično lako. Ali onda su promenili stvari

and at the end of 2009, they announced

i krajem 2009. godine su objavili

that we were going to have a new policy,

da ćemo imati novu politiku,

and this new policy required

a ta nova politika je zahtevala

passwords that were at least eight characters long,

šifre koje se sastoje od najmanje osam karaktera,

with an uppercase letter, lowercase letter,

uključujući veliko slovo, malo slovo,

a digit, a symbol,

cifru, simbol,

you couldn't use the same character more than three times,

niste mogli koristiti isti karakter više od tri puta,

and it wasn't allowed to be in a dictionary.

i nisu smele da se pojavljuju reči iz rečnika.

Now, when they implemented this new policy,

Kada su uveli ovu novu politiku,

a lot of people, my colleagues and friends,

mnogi ljudi, moje kolege i prijatelji,

came up to me and they said, "Wow,

prilazili su mi i govorili:

now that's really unusable.

"Hej, ovo je stvarno neupotrebljivo.

Why are they doing this to us,

Zašto nam ovo rade,

and why didn't you stop them?"

i zašto ih nisi sprečila?"

And I said, "Well, you know what?

A ja sam rekla: "Pa znate šta?

They didn't ask me."

Nisu me ni pitali."

But I got curious, and I decided to go talk

Ali bila sam radoznala i odlučila sam da razgovaram

to the people in charge of our computer systems

sa ljudima zaduženim za naše računarske sisteme

and find out what led them to introduce

i da saznam šta ih je navelo da uvedu

this new policy,

ovu novu politiku.

and they said that the university

A oni su rekli da se Univerzitet

had joined a consortium of universities,

priključio udruženju univerziteta,

and one of the requirements of membership

a jedan od zahteva za članstvo

was that we had to have stronger passwords

bio je da moramo imati jače šifre

that complied with some new requirements,

koje ispunjavaju neke nove uslove,

and these requirements were that our passwords

a ti uslovi su bili da naše šifre

had to have a lot of entropy.

moraju imati mnogo entropije.

Now entropy is a complicated term,

Entropija je složen pojam,

but basically it measures the strength of passwords.

ali u suštini ona meri jačinu šifre.

But the thing is, there isn't actually

Ali stvar je u tome da zapravo ne postoji

a standard measure of entropy.

standardna mera entropije.

Now, the National Institute of Standards and Technology

Nacionalni institut za standarde i tehnologiju

has a set of guidelines

ima niz smernica

which have some rules of thumb

koje daju neka opšta načela

for measuring entropy,

za merenje entropije,

but they don't have anything too specific,

ali nemaju ništa previše određeno,

and the reason they only have rules of thumb

a razlog zašto imaju samo opšta načela

is it turns out they don't actually have any good data

je to što oni zapravo nemaju neke kvalitetne podatke

on passwords.

o šiframa.

In fact, their report states,

Zapravo, u njihovom izveštaju stoji:

"Unfortunately, we do not have much data

"Nažalost, nemamo mnogo podataka

on the passwords users choose under particular rules.

o šiframa koje korisnici biraju pod određenim pravilima.

NIST would like to obtain more data

NIST bi želeo da sakupi više podataka

on the passwords users actually choose,

o šiframa koje korisnici zapravo koriste,

but system administrators are understandably reluctant

ali, razume se, administratori sistema

to reveal password data to others."

nerado otkrivaju podatke o šiframa."

So this is a problem, but our research group

Dakle, ovo je problem, ali naša istraživačka grupa

looked at it as an opportunity.

je videla to kao priliku.

We said, "Well, there's a need for good password data.

Rekli smo: "Pa, postoji potreba za kvalitetnim podacima o šiframa.

Maybe we can collect some good password data

Možda možemo da sakupimo neke dobre podatke

and actually advance the state of the art here.

i zapravo poboljšamo trenutno stanje."

So the first thing we did is,

Prva stvar koju smo uradili bila je

we got a bag of candy bars

da smo uzeli kesu bombona

and we walked around campus

i šetali po kampusu,

and talked to students, faculty and staff,

pričali sa studentima, profesorima i zaposlenima,

and asked them for information

i ispitivali ih

about their passwords.

o njihovim šiframa.

Now we didn't say, "Give us your password."

Nismo govorili: "Daj nam svoju šifru."

No, we just asked them about their password.

Ne, mi smo ih samo pitali o njihovim šiframa.

How long is it? Does it have a digit?

Koliko je duga? Da li sadrži cifre? Da li ima simbola?

Does it have a symbol?

And were you annoyed at having to create

I da li vas je iznerviralo to što ste morali

a new one last week?

da napravite novu prošle nedelje?

So we got results from 470 students,

Dobili smo rezultate od 470 studenata,

profesora i zaposlenih,

faculty and staff,

and indeed we confirmed that the new policy

i zaista smo potvrdili da je nova politika

was very annoying,

prilično nervirala,

but we also found that people said

ali smo takođe saznali da se ljudi

they felt more secure with these new passwords.

osećaju sigurnije sa ovim novim šiframa.

We found that most people knew

Saznali smo da većina ljudi zna

they were not supposed to write their password down,

da ne treba da zapisuju svoje šifre,

and only 13 percent of them did,

i samo 13% njih jeste zapisalo,

but disturbingly, 80 percent of people

ali uznemiravajuće je to da je 80%

said they were reusing their password.

reklo da ponovo koristi svoju staru šifru.

Now, this is actually more dangerous

To je zapravo opasnije

than writing your password down,

od zapisivanja šifre,

because it makes you much more susceptible to attackers.

jer vas čini mnogo ranjivijim za napade.

So if you have to, write your passwords down,

Tako da ako morate, zapišite šifru,

but don't reuse them.

ali nemojte ponovo koristiti istu.

We also found some interesting things

Takođe smo saznali neke zanimljive stvari

about the symbols people use in passwords.

o simbolima koje ljudi koriste u šiframa.

So CMU allows 32 possible symbols,

Dakle, KMU dozvoljava 32 različita simbola,

but as you can see, there's only a small number

ali kao što vidite, mali je broj

that most people are using,

onih koje većina ljudi koristi

so we're not actually getting very much strength

tako da ne dobijamo mnogo na jačini

from the symbols in our passwords.

od simbola u našim šiframa.

So this was a really interesting study,

Ovo je stvarno bilo interesantno ispitivanje,

and now we had data from 470 people,

i sada smo imali podatke 470 osoba,

but in the scheme of things,

ali u suštini,

that's really not very much password data,

to i nije mnogo podataka o šiframa,

and so we looked around to see

pa smo se osvrnuli unaokolo

where could we find additional password data?

da vidimo gde možemo naći još podataka.

So it turns out there are a lot of people

Ispostavilo se da ima mnogo ljudi

going around stealing passwords,

koji idu unaokolo i kradu šifre,

and they often go and post these passwords

i često objavljuju te šifre

on the Internet.

na internetu.

So we were able to get access

Tako da smo mogli da pristupimo

to some of these stolen password sets.

nekim od ovih nizova ukradenih šifri.

This is still not really ideal for research, though,

Ipak, to baš i nije idealno za istraživanje

because it's not entirely clear

zato što nije potpuno jasno

where all of these passwords came from,

odakle te šifre dolaze

or exactly what policies were in effect

niti kakva su tačno pravila važila

when people created these passwords.

kada su ljudi pravili te šifre.

So we wanted to find some better source of data.

Želeli smo da nađemo bolji izvor podataka.

So we decided that one thing we could do

Odlučili smo da bismo mogli

is we could do a study and have people

da sprovedemo istraživanje za koje će ljudi

actually create passwords for our study.

zapravo specijalno praviti svoje šifre.

So we used a service called Amazon Mechanical Turk,

Koristili smo servis pod imenom Amazon Mechanical Turk,

and this is a service where you can post

a to je servis gde možete objaviti

a small job online that takes a minute,

mali posao za koji treba minut,

a few minutes, an hour,

nekoliko minuta, sat,

and pay people, a penny, ten cents, a few dollars,

i platiti ljudima peni, deset centi, nekoliko dolara

to do a task for you,

da urade zadatak za vas,

and then you pay them through Amazon.com.

a onda im platite preko Amazon.com.

So we paid people about 50 cents

Plaćali smo ljudima oko 50 centi

to create a password following our rules

da naprave šifru poštujući naša pravila

and answering a survey,

i odgovarajući na anketu,

and then we paid them again to come back

a onda im ponovo plaćali da se vrate

two days later and log in

dva dana kasnije i uloguju se

using their password and answering another survey.

koristeći svoju šifru i odgovarajući na još jednu anketu.

So we did this, and we collected 5,000 passwords,

To smo uradili i sakupili 5000 šifri,

and we gave people a bunch of different policies

i davali smo ljudima brdo različitih smernica

to create passwords with.

po kojima da naprave šifru.

So some people had a pretty easy policy,

Neki ljudi su imali jednostavne smernice,

we call it Basic8,

mi to zovemo Basic8,

and here the only rule was that your password

a tu je jedino pravilo bilo da šifra

had to have at least eight characters.

mora da sadrži najmanje osam karaktera.

Then some people had a much harder policy,

Od nekih ljudi se tražilo mnogo više,

and this was very similar to the CMU policy,

veoma slično politici KMU-a,

that it had to have eight characters

da šifra mora imati osam karaktera

including uppercase, lowercase, digit, symbol,

uključujući veliko slovo, malo slovo, cifru, simbol

and pass a dictionary check.

i da prolazi rečničku proveru.

And one of the other policies we tried,

Jedna od politika koju smo probali,

and there were a whole bunch more,

a bilo ih je stvarno mnogo,

but one of the ones we tried was called Basic16,

ali jedna od onih koje smo probali se zove Basic16,

and the only requirement here

a ovde je jedini zahtev bio

was that your password had to have at least 16 characters.

da šifra mora imati najmanje 16 karaktera.

All right, so now we had 5,000 passwords,

Dobro, sada smo imali 5000 šifri

and so we had much more detailed information.

i mnogo detaljnije informacije.

Again we see that there's only a small number

Ponovo vidimo da je samo mali broj

of symbols that people are actually using

simbola koje ljudi zapravo koriste

in their passwords.

u svojim šiframa.

We also wanted to get an idea of how strong

Takođe smo želeli da steknemo uvid

the passwords were that people were creating,

u to koliko su jake šifre koje ljudi prave

but as you may recall, there isn't a good measure

ali, ako se sećate, ne postoji prava mera

of password strength.

za jačinu šifre.

So what we decided to do was to see

Odlučili smo da vidimo

how long it would take to crack these passwords

koliko vremena je potrebno da se provale ove šifre

using the best cracking tools

koristeći najbolje alatke

that the bad guys are using,

koje koriste loši momci

or that we could find information about

ili one o kojima se mogu pronaći neki podaci

in the research literature.

u literaturi.

So to give you an idea of how bad guys

A sada da vam dam uvid u to kako loši momci

go about cracking passwords,

otkrivaju šifre.

they will steal a password file

Oni ukradu datoteku

that will have all of the passwords

koja sadrži sve šifre

in kind of a scrambled form, called a hash,

u nekakvom zbrkanom obliku, zvanom heš,

and so what they'll do is they'll make a guess

a onda zapravo nagađaju

as to what a password is,

šta je od toga šifra,

run it through a hashing function,

provuku je kroz heš funkciju

and see whether it matches

i vide da li odgovara

the passwords they have on their stolen password list.

šiframa koje imaju na svom spisku ukradenih šifri.

So a dumb attacker will try every password in order.

Glup napadač će probati svaku šifru po redu.

They'll start with AAAAA and move on to AAAAB,

Počeće sa AAAAA i preći na AAAAB,

and this is going to take a really long time

i to će trajati veoma dugo

before they get any passwords

pre nego što dobije neku šifru

that people are really likely to actually have.

koju je vrlo verovatno da neko zapravo ima.

A smart attacker, on the other hand,

Pametan napadač, sa druge strane,

does something much more clever.

radi nešto mnogo mudrije.

They look at the passwords

On posmatra šifre

that are known to be popular

za koje se zna da su popularne

from these stolen password sets,

i iz ovih nizova ukradenih

and they guess those first.

prvo nagađa te šifre.

So they're going to start by guessing "password,"

Počeće sa nagađanjem reči "šifra"

and then they'll guess "I love you," and "monkey,"

a onda "volimte" i "majmun"

and "12345678,"

i "12345678"

because these are the passwords

zato što su to šifre

that are most likely for people to have.

koje ljudi najverovatnije imaju.

In fact, some of you probably have these passwords.

Zapravo, neki od vas verovatno imaju ove šifre.

So what we found

Ono što smo otkrili

by running all of these 5,000 passwords we collected

stavljajući svih ovih 5000 šifri koje smo sakupili

through these tests to see how strong they were,

na testove da vidimo koliko su jake

we found that the long passwords

bilo je da su duge šifre

were actually pretty strong,

zapravo prilično jake

and the complex passwords were pretty strong too.

kao i da su složene šifre takođe prilično jake.

However, when we looked at the survey data,

Međutim, kada smo pregledali odgovore u anketama

we saw that people were really frustrated

videli smo da ljude zaista frustriraju

by the very complex passwords,

veoma složene šifre

and the long passwords were a lot more usable,

i da su duge šifre mnogo upotrebljivije,

and in some cases, they were actually

a u nekim slučajevima su zapravo

even stronger than the complex passwords.

čak i snažnije nego složene šifre.

So this suggests that,

Dakle, ovo nam pokazuje

instead of telling people that they need

da umesto da govorimo ljudima da treba

to put all these symbols and numbers

da ubace sve ove simbole i brojeve

and crazy things into their passwords,

i svakakve druge stvari u svoje šifre,

we might be better off just telling people

možda bi bilo bolje samo da im kažemo

to have long passwords.

da imaju duge šifre.

Now here's the problem, though:

Ipak, ovde imamo problem:

Some people had long passwords

neki ljudi su imali duge šifre

that actually weren't very strong.

koje zapravo nisu toliko jake.

You can make long passwords

Možete napraviti duge šifre

that are still the sort of thing

koje su i dalje prilično

that an attacker could easily guess.

laka meta za napadače.

So we need to do more than just say long passwords.

Zato moramo uraditi nešto više nego prosto reći "duge šifre".

There has to be some additional requirements,

Moraju postojati neki dodatni zahtevi,

and some of our ongoing research is looking at

a neka od naših istraživanja koja su u toku

what additional requirements we should add

ispituju koje to zahteve treba da uključimo

to make for stronger passwords

da bismo stvorili snažnije šifre

that also are going to be easy for people

koje će ujedno biti jednostavne

to remember and type.

za pamćenje i kucanje.

Another approach to getting people to have

Još jedan način da navedemo ljude da imaju jače šifre

stronger passwords is to use a password meter.

jeste da koristimo merač jačine.

Here are some examples.

Evo nekih primera.

You may have seen these on the Internet

Možda ste videli ove na internetu

when you were creating passwords.

kada ste pravili svoje šifre.

We decided to do a study to find out

Odlučili smo da sprovedemo istraživanje i saznamo

whether these password meters actually work.

da li ovi merači zapravo rade.

Do they actually help people

Da li zaista pomažu ljudima

have stronger passwords,

da imaju jače šifre

and if so, which ones are better?

i ako je tako, koji od njih su bolji?

So we tested password meters that were

Ispitali smo merače jačine koji su

different sizes, shapes, colors,

različitih dimenzija, oblika, boja,

different words next to them,

koji koriste različite reči,

and we even tested one that was a dancing bunny.

čak i jedan koji je u obliku zeca koji pleše.

As you type a better password,

Što je bolja šifra koju ukucate,

the bunny dances faster and faster.

to zec igra brže.

So this was pretty fun.

Ovo je bilo prilično zabavno.

What we found

Ono što smo otkrili je

was that password meters do work.

da merači jačine šifre funkcionišu.

(Laughter)

(Smeh)

Most of the password meters were actually effective,

Većina merača je zapravo korisna

and the dancing bunny was very effective too,

uključujući i zeca koji igra,

but the password meters that were the most effective

ali merači koji su bili najefikasniji

were the ones that made you work harder

su oni koji vas navode da se pomučite

before they gave you that thumbs up and said

pre nego što vam daju zeleno svetlo

you were doing a good job,

i kažu da ste na dobrom putu.

and in fact we found that most

Zapravo, otkrili smo da je većina

of the password meters on the Internet today

merača jačine na internetu

trenutno previše blaga.

are too soft.

They tell you you're doing a good job too early,

Prerano vam kažu da ste dobro obavili posao,

and if they would just wait a little bit

a kada bi samo malo pričekali

before giving you that positive feedback,

pre nego što vam daju taj pozitivan komentar,

you probably would have better passwords.

verovatno biste imali bolje šifre.

Now another approach to better passwords, perhaps,

Drugi pristup pravljenju boljih šifri je možda

is to use pass phrases instead of passwords.

upotreba šifri u obliku fraze umesto reči.

So this was an xkcd cartoon from a couple of years ago,

Ovo je xkcd internet-strip od pre par godina

and the cartoonist suggests

i autor predlaže

that we should all use pass phrases,

da svi koristimo šifre u obliku fraze

and if you look at the second row of this cartoon,

i ako pogledate drugi red ovog stripa,

you can see the cartoonist is suggesting

možete videti da autor predstavlja

that the pass phrase "correct horse battery staple"

frazu "tačno konj baterijska spajalica"

would be a very strong pass phrase

kao frazu koja bi bila veoma jaka šifra.

and something really easy to remember.

i nešto što je jednostavno zapamtiti.

He says, in fact, you've already remembered it.

On kaže da ste je zapravo već zapamtili.

And so we decided to do a research study

Tako smo odlučili da sprovedemo istraživanje

to find out whether this was true or not.

da bismo otkrili da li je ovo tačno.

In fact, everybody who I talk to,

Zapravo, svako sa kim sam razgovarala,

who I mention I'm doing password research,

i kome sam pomenula da radim istraživanje o šiframa

they point out this cartoon.

mi je ukazao na taj strip.

"Oh, have you seen it? That xkcd.

"O, jesi li videla taj strip?

Correct horse battery staple."

Tačno konj baterijska spajalica".

So we did the research study to see

Sproveli smo istraživanje da vidimo

what would actually happen.

šta bi se zaista dogodilo.

So in our study, we used Mechanical Turk again,

Za naše istraživanje smo opet koristili Mechanical Turk,

and we had the computer pick the random words

a računar je nasumično birao reči

za šifru-frazu.

in the pass phrase.

Now the reason we did this

Razlog zašto smo tako uradili

is that humans are not very good

je taj što ljudi nisu baš dobri

at picking random words.

u nasumičnom biranju reči.

If we asked a human to do it,

Kada bi to radio čovek

they would pick things that were not very random.

izabrao bi stvari koje nisu baš nasumične.

So we tried a few different conditions.

Isprobali smo par različitih situacija.

In one condition, the computer picked

U jednoj od njih, računar je birao

from a dictionary of the very common words

iz rečnika veoma čestih reči

in the English language,

u engleskom jeziku,

and so you'd get pass phrases like

pa smo dobijali fraze tipa

"try there three come."

"probati tamo tri doći".

And we looked at that, and we said,

Posmatrali smo to i rekli:

"Well, that doesn't really seem very memorable."

"Pa, to i ne deluje baš tako lako za pamćenje."

So then we tried picking words

Pa smo onda probali da biramo reči

that came from specific parts of speech,

na osnovu vrste reči

so how about noun-verb-adjective-noun.

kao recimo, imenica-glagol-pridev-imenica.

That comes up with something that's sort of sentence-like.

To se čini kao nešto slično rečenici.

So you can get a pass phrase like

Tako da možete dobiti frazu kao na primer,

"plan builds sure power"

"plan gradi sigurnu moć"

or "end determines red drug."

ili "kraj određuje crvenu drogu".

And these seemed a little bit more memorable,

Ove su se činile malo lakše za pamćenje

and maybe people would like those a little bit better.

i možda bi se ljudima malo više svidele.

We wanted to compare them with passwords,

Hteli smo da ih uporedimo sa običnim šiframa,

and so we had the computer pick random passwords,

pa smo pomoću računara nasumično birali reči

koje su bile fine i kratke, ali kao što možete videti,

and these were nice and short, but as you can see,

they don't really look very memorable.

ne deluju baš lake za pamćenje.

And then we decided to try something called

Onda smo odlučili da probamo

a pronounceable password.

šifre koje se mogu izgovoriti.

So here the computer picks random syllables

Ovde računar bira nasumične slogove

and puts them together

i spaja ih tako

so you have something sort of pronounceable,

da se dobije nešto što je moguće izgovoriti

like "tufritvi" and "vadasabi."

kao na primer "tuftitvi" i "vadasabi".

That one kind of rolls off your tongue.

Ovu je prilično lako izgovoriti.

So these were random passwords that were

To su bile nasumične reči

generated by our computer.

koje je sastavio naš računar.

So what we found in this study was that, surprisingly,

Iznenađujuće, ono što smo otkrili u ovom istraživanju bilo je

pass phrases were not actually all that good.

da fraze i nisu toliko dobre kao šifre.

People were not really better at remembering

Ljudi zapravo nisu bolje pamtili

the pass phrases than these random passwords,

fraze od ovih nasumičnih reči,

and because the pass phrases are longer,

a pošto su fraze duže,

they took longer to type

treba više vremena da se ukucaju

and people made more errors while typing them in.

i ljudi su pravili više grešaka dok su ih kucali.

So it's not really a clear win for pass phrases.

Dakle, fraze i nisu baš najbolje kao šifre.

Sorry, all of you xkcd fans.

Žao mi je, svi vi fanovi onog xkcd stripa.

On the other hand, we did find

Sa druge strane, otkrili smo

that pronounceable passwords

da su šifre koje je moguće izgovoriti

worked surprisingly well,

iznenađujuće dobro funkcionisale,

and so we actually are doing some more research

pa zapravo radimo još neka istraživanja

to see if we can make that approach work even better.

da vidimo da li možemo da učinimo taj pristup još efikasnijim.

So one of the problems

Jedan od problema

u nekim od istraživanja koja smo sproveli

with some of the studies that we've done

is that because they're all done

je da zato što su sva sprovedena

using Mechanical Turk,

koristeći Mechanical Turk,

these are not people's real passwords.

ovo nisu prave šifre ljudi.

They're the passwords that they created

To su šifre koje su ljudi napravili

ili ih je umesto njih napravio računar za naše istraživanje.

or the computer created for them for our study.

And we wanted to know whether people

A nas je zanimalo da li bi se ljudi

would actually behave the same way

zaista ponašali na isti način

with their real passwords.

i kada se radi o njihovim pravim šiframa.

So we talked to the information security office at Carnegie Mellon

Razgovarali smo sa službom za bezbednost podataka na Karnegi Melonu

and asked them if we could have everybody's real passwords.

i pitali ih da li bismo mogli da dobijemo svačiju pravu šifru.

Not surprisingly, they were a little bit reluctant

Očekivano, nisu baš bili voljni

to share them with us,

da ih podele sa nama,

but we were actually able to work out

ali smo uspeli da smislimo

sistem da sarađujemo sa njima

a system with them

where they put all of the real passwords

po kom su oni stavili sve prave šifre

for 25,000 CMU students, faculty and staff,

25000 studenata, profesora i zaposlenih

into a locked computer in a locked room,

u zaključan računar u zaključanoj prostoriji

not connected to the Internet,

bez pristupa internetu

and they ran code on it that we wrote

i pokrenuli su kod koji smo mi napisali

to analyze these passwords.

kako bismo analizirali te šifre.

They audited our code.

Oni su kontrolisali naš kod.

They ran the code.

Oni su pokretali kod.

And so we never actually saw

Tako da mi zapravo

anybody's password.

nismo videli ničiju šifru.

We got some interesting results,

Dobili smo zanimljive rezultate,

and those of you Tepper students in the back

a vas studente poslovnih studija tamo pozadi

will be very interested in this.

će ovo posebno zanimati.

So we found that the passwords created

Otkrili smo da su šifre koje su napravili ljudi

by people affiliated with the school of computer science

povezani sa studijama računarstva

were actually 1.8 times stronger

bile zapravo 1,8 puta snažnije

than those affiliated with the business school.

nego one koje su pravili ljudi sa poslovnih studija.

We have lots of other really interesting

Imamo i mnogo drugih zaista interesantnih

demographic information as well.

demografskih podataka.

The other interesting thing that we found

Druga zanimljiva stvar koju smo otkrili

is that when we compared the Carnegie Mellon passwords

je da kada uporedimo šifre sa Karnegi Melona

to the Mechanical Turk-generated passwords,

sa šiframa koje smo sakupili na Mechanical Turku

there was actually a lot of similarities,

zapravo primetimo dosta sličnosti,

and so this helped validate our research method

što nam je pomoglo da utvrdimo valjanost naše metode

and show that actually, collecting passwords

i pokazalo da je sakupljanje šifri

using these Mechanical Turk studies

pomoću Mechanical Turk-a

is actually a valid way to study passwords.

zapravo valjan način proučavanja šifri.

So that was good news.

To su dobre vesti.

Okay, I want to close by talking about

U redu, želim da završim pričajući

some insights I gained while on sabbatical

o nekim uvidima koje sam stekla prošle godine

last year in the Carnegie Mellon art school.

dok sam bila na odsustvu u Karnegi Melon umetničkoj akademiji.

One of the things that I did

Između ostalog,

is I made a number of quilts,

napravila sam brojne "tapiserije"

and I made this quilt here.

i napravila sam ovu ovde.

It's called "Security Blanket."

Zove se "Ćilim sigurnosti".

(Laughter)

(Smeh)

And this quilt has the 1,000

A u sebi sadrži 1000

most frequent passwords stolen

najčešće ukradenih šifri

from the RockYou website.

sa internet sajta RockYou.

And the size of the passwords is proportional

Veličina šifre je proporcionalna

to how frequently they appeared

tome koliko su se često pojavljivale

in the stolen dataset.

među ukradenim podacima.

And what I did is I created this word cloud,

A ja sam napravila ovaj "oblak reči"

and I went through all 1,000 words,

i pregledala svih 1000 reči

and I categorized them into

pa ih svrstala

loose thematic categories.

u opštije tematske celine.

And it was, in some cases,

U nekim slučajevima je bilo

it was kind of difficult to figure out

prilično teško odlučiti

what category they should be in,

kojoj kategoriji treba da pripadaju

and then I color-coded them.

pa sam ih onda obeležila po bojama.

So here are some examples of the difficulty.

Evo nekih takvih primera.

So "justin."

Recimo, "džastin".

Is that the name of the user,

Da li je to ime korisnika,

their boyfriend, their son?

njihovog dečka, sina?

Maybe they're a Justin Bieber fan.

Možda su samo fanovi Džastina Bibera.

Or "princess."

Ili "princeza".

Is that a nickname?

Da li je to nadimak?

Are they Disney princess fans?

Da li vole Dizni princeze?

Or maybe that's the name of their cat.

Ili je to možda ime njihove mačke.

"Iloveyou" appears many times

"Volimte" se pojavljuje mnogo puta

in many different languages.

na mnogo različitih jezika.

There's a lot of love in these passwords.

Ima mnogo ljubavi u ovim šiframa.

Ako pogledate pažljivo, videćete da ima takođe

If you look carefully, you'll see there's also

some profanity,

i nekih vulgarnosti

but it was really interesting to me to see

ali mi je bilo stvarno zanimljivo to

that there's a lot more love than hate

što ima mnogo više ljubavi nego mržnje

in these passwords.

u ovim šiframa.

And there are animals,

I ima životinja,

a lot of animals,

mnogo životinja,

and "monkey" is the most common animal

a majmun je najčešća životinja

and the 14th most popular password overall.

i uopšteno 14. šifra po popularnosti.

And this was really curious to me,

Ovo mi je bilo veoma neobično

and I wondered, "Why are monkeys so popular?"

i upitala sam se: "Zašto su majmuni toliko popularni?"

And so in our last password study,

U našem poslednjem istraživanju o šiframa,

any time we detected somebody

kad god bismo naišli na nekog

creating a password with the word "monkey" in it,

ko pravi šifru koja sadrži reč "majmun",

we asked them why they had a monkey in their password.

pitali smo ga zašto ubacuje reč "majmun" u svoju šifru.

And what we found out --

Ono što smo saznali,

we found 17 people so far, I think,

a našli smo, ja mislim, 17 ljudi do sada

who have the word "monkey" --

koji imaju reč "majmun",

We found out about a third of them said

bilo je da je oko trećina njih rekla

they have a pet named "monkey"

da imaju ljubimca koji se zove "majmun"

or a friend whose nickname is "monkey,"

ili prijatelja čiji je nadimak "majmun",

and about a third of them said

a otprilike trećina ljudi je rekla

that they just like monkeys

da jednostavno vole majmune

and monkeys are really cute.

i da su majmuni jako slatki.

And that guy is really cute.

I ovaj mališa je stvarno sladak.

So it seems that at the end of the day,

Na kraju krajeva, čini se

when we make passwords,

da kada pravimo šifre,

we either make something that's really easy

napravimo ili nešto što je

to type, a common pattern,

veoma lako za iskucati, nešto uobičajeno,

or things that remind us of the word password

ili stvari koje nas podsećaju na reč "šifra"

or the account that we've created the password for,

ili na nalog za koji smo napravili šifru

or whatever.

ili šta god.

Or we think about things that make us happy,

Ili možda pomislimo na stvari koje nas čine srećnim

and we create our password

i pravimo svoju šifru

based on things that make us happy.

na osnovu stvari koje nas čine srećnim.

And while this makes typing

I dok ovo čini kucanje

and remembering your password more fun,

i pamćenje vaše šifre zabavnijim,

it also makes it a lot easier

ujedno čini šifru i mnogo lakšom

to guess your password.

za pogađanje.

So I know a lot of these TED Talks

Znam da su mnogi od ovih TED govora

are inspirational

nadahnjujući

and they make you think about nice, happy things,

i čine da mislite o lepim stvarima,

but when you're creating your password,

ali kada pravite svoju šifru

try to think about something else.

probajte da razmišljate o nečemu drugom.

Thank you.

Hvala. (Aplauz)

(Applause)