Lorrie Faith Cranor: What's wrong with your pa$$w0rd?

翻译人员: FBC GLOBAL 校对人员: XINHUI WANG

I am a computer science and engineering professor here at Carnegie Mellon,

我是卡内基梅隆大学计算机科学与工程专业的教授，

and my research focuses on usable privacy and security,

我的研究兴趣是隐私与安全保护。

and so my friends like to give me examples

因此，我那些朋友喜欢跟我吐槽，

of their frustrations with computing systems,

说他们使用计算机时受到的种种挫折，

especially frustrations related to

特别是

跟不可用隐私和安全有关的挫折

unusable privacy and security.

So passwords are something that I hear a lot about.

密码就是我经常听到抱怨的一个问题

A lot of people are frustrated with passwords,

很多人因为密码的问题感到沮丧

and it's bad enough

when you have to have one really good password

这真的很令人头疼

当你不得不有一个很好的密码

that you can remember

一个你自己可以记住

but nobody else is going to be able to guess.

但是其他人都猜不到的密码

But what do you do when you have accounts

但你会怎么做呢？

on a hundred different systems

当你在一百个不同的系统里有不同的账户

and you're supposed to have a unique password

你是不是

该给每个系统都设立一个独立的密码呢？

for each of these systems?

It's tough.

这是非常困难的

At Carnegie Mellon, they used to make it

在卡内基梅隆，

actually pretty easy for us

曾经对于我们来说很容易

to remember our passwords.

去记住我们的密码

The password requirement up through 2009

在2009年以前，对于密码的要求

was just that you had to have a password

仅仅是你的密码中

with at least one character.

最少需要一个字母

非常容易，但是他们改变了规则

Pretty easy. But then they changed things,

and at the end of 2009, they announced

在2009年末，他们宣布

that we were going to have a new policy,

我们将会有新的规则

and this new policy required

这个新的规则要求

passwords that were at least eight characters long,

密码至少有8位数长

with an uppercase letter, lowercase letter,

至少有一个大写字母，一个小写字母

a digit, a symbol,

一个数字，一个符号

you couldn't use the same character more than three times,

你不能用重复使用同一个字符三次

and it wasn't allowed to be in a dictionary.

并且密码不能是字典里的一个单词

Now, when they implemented this new policy,

现在，当这个新的规则被使用后

a lot of people, my colleagues and friends,

很多人，我的同学，朋友，都跑来找我

came up to me and they said, "Wow,

now that's really unusable.

他们说：“天哪“

”这个新的规则真的很难被使用“

Why are they doing this to us,

and why didn't you stop them?"

“他们为什么要对我们这么做”

“你为什么不阻止他们呢？”

And I said, "Well, you know what?

They didn't ask me."

我说：“你知道吗”

”他们做出这些调整的时候并没有问我“

But I got curious, and I decided to go talk

但是我对此产生了兴趣

to the people in charge of our computer systems

所以我决定去找掌管我们计算机系统的同事聊聊

and find out what led them to introduce

并且知道了他们为什么要引进

this new policy,

这个新的规则

and they said that the university

他们说我们学校

had joined a consortium of universities,

加入了一个大学联盟

and one of the requirements of membership

加入这个大学联盟的一个要求

was that we had to have stronger passwords

就是我们要有更安全的密码

that complied with some new requirements,

这个密码需要符合最新的要求

and these requirements were that our passwords

而这个最新的标准就是

had to have a lot of entropy.

我们的密码需要是一个无序的组合

Now entropy is a complicated term,

无序状态是一个很复杂的名词

but basically it measures the strength of passwords.

但是基本上来说，他是用来衡量密码安全性的标准

But the thing is, there isn't actually

但是问题是

并没有一个标准的方法来测量无序性

a standard measure of entropy.

Now, the National Institute of Standards and Technology

现在，国家标准技术局

has a set of guidelines

有一系列的标准

which have some rules of thumb

这些标准中有一些粗略的方法

for measuring entropy,

用来测量无序性

but they don't have anything too specific,

但是他们并没有很详细的方法

and the reason they only have rules of thumb

他们只有粗略的方法的原因是

is it turns out they don't actually have any good data

他们事实上并没有很多好的的数据

on passwords.

来研究密码

In fact, their report states,

事实上，他们在工作报告中说

"Unfortunately, we do not have much data

”很不幸的是，我们并没有很多关于

on the passwords users choose under particular rules.

用户在一种规则下如何选择密码的数据“

NIST would like to obtain more data

on the passwords users actually choose,

国家标准技术局想要获得更多

关于用户如何选择密码的数据

but system administrators are understandably reluctant

但是系统管理员合情合理的拒绝

to reveal password data to others."

把密码信息透露给其他人

So this is a problem, but our research group

所以这是一个问题

looked at it as an opportunity.

但我们的研究小组认为这是一个机会

We said, "Well, there's a need for good password data.

我们认为：”这表明很需要有一个好的密码数据库。”

Maybe we can collect some good password data

也许我们可以收集一些好的密码数据

and actually advance the state of the art here.

并且推进这方面的研究

So the first thing we did is,

因此，我们要做的第一件事是：

we got a bag of candy bars

我们买了一袋糖

and we walked around campus

走在校园里

and talked to students, faculty and staff,

并且跟同学，教师，员工对话

and asked them for information

所要他们

about their passwords.

密码的信息

Now we didn't say, "Give us your password."

我们并没有说：“把你的密码给我们吧”

No, we just asked them about their password.

我们只是问关于他们密码的信息

How long is it? Does it have a digit?

密码有多长？包含有数字吗？

Does it have a symbol?

有符号吗？

And were you annoyed at having to create

你有没有感到恼怒？

a new one last week?

因为上周要重新拟定一个密码

So we got results from 470 students,

我们得到了结果从470个学生

faculty and staff,

老师跟员工

and indeed we confirmed that the new policy

事实上我们证实了这个新的规则

was very annoying,

很让人讨厌

but we also found that people said

但与此同时，人们也表示

they felt more secure with these new passwords.

这个这个新的密码更加的安全

We found that most people knew

我们发现大部分人知道

they were not supposed to write their password down,

他们不应该把他们的密码写下来

and only 13 percent of them did,

并且只有13%的人会把密码写下来

but disturbingly, 80 percent of people

但是与之矛盾的是

有80%的人会重复使用同一个密码

said they were reusing their password.

Now, this is actually more dangerous

这事实上

比把密码记下来更加的危险

than writing your password down,

because it makes you much more susceptible to attackers.

因为这让你更容易被黑客攻击

So if you have to, write your passwords down,

如果没有别的选择，那么请把你的密码记下来

but don't reuse them.

而不要重读使用一个密码

We also found some interesting things

我们还有一些很有趣的发现

about the symbols people use in passwords.

这些发现跟人们在密码中使用符号有关

So CMU allows 32 possible symbols,

卡内基梅隆大学允许使用32个符号，

but as you can see, there's only a small number

但事实上只有少数几个符号

that most people are using,

被大多数人使用

so we're not actually getting very much strength

因此，事实上

使用符号并没有让我们的密码变得更加安全

from the symbols in our passwords.

So this was a really interesting study,

因此，这真的是一项很有趣的研究

and now we had data from 470 people,

现在，我们已经有从470个人那里拿到的数据

but in the scheme of things,

但整体来说

that's really not very much password data,

这些数据并不是确切的密码的数据

and so we looked around to see

因此我们还得通过其他方式

where could we find additional password data?

来获取更多的密码数据

So it turns out there are a lot of people

生活中有很多人

going around stealing passwords,

窃取他人的密码

and they often go and post these passwords

他们经常会把这些密码公布

on the Internet.

在网上

So we were able to get access

因此，我们可以获得一些

to some of these stolen password sets.

这种偷来的密码

This is still not really ideal for research, though,

这些数据对于我们的研究来书还不是很完美

because it's not entirely clear

因为我们并不知道

where all of these passwords came from,

这些密码的来源

or exactly what policies were in effect

以及这些密码是在什么样的规则下

when people created these passwords.

制定出来的

So we wanted to find some better source of data.

因此我们需要找到一些更好的数据来源

So we decided that one thing we could do

所以我们觉得我们可以做的是

is we could do a study and have people

我们可以做一个研究

并且让人们为我们的实验设置密码

actually create passwords for our study.

So we used a service called Amazon Mechanical Turk,

所以我们就通过使用一个叫做亚马逊机器土耳其人的服务

and this is a service where you can post

这个服务可以让你在网上公布一些小任务，

a small job online that takes a minute,

a few minutes, an hour,

这些任务可能好使一分钟

几分钟，一个小时

and pay people, a penny, ten cents, a few dollars,

我们支付人们一美分，几美分，几美元

to do a task for you,

来帮助我们完成任务

and then you pay them through Amazon.com.

之后你可以通过亚马逊来支付这些参与者

So we paid people about 50 cents

我们付大约50美分让

to create a password following our rules

参与者在我们的规则下制定密码

and answering a survey,

并且完成调查问卷

and then we paid them again to come back

然后当我们会支付他们第二笔钱

two days later and log in

当他们两天后

用这个密码登录并完成另一份调查问卷

using their password and answering another survey.

So we did this, and we collected 5,000 passwords,

我们通过这种方式拿到了5000个密码

and we gave people a bunch of different policies

我们给人么不同的规则

to create passwords with.

来制定密码

So some people had a pretty easy policy,

一些人的规则比较简单

we call it Basic8,

and here the only rule was that your password

我们称它为基础8

只有一个规则，就是你的密码

had to have at least eight characters.

必须包含8个字符

Then some people had a much harder policy,

有些人则会有更难的规则

and this was very similar to the CMU policy,

这些规则跟卡内基梅隆大学的规则跟相似

that it had to have eight characters

密码必须由八位数组成

including uppercase, lowercase, digit, symbol,

包含有大写字母，小写字母，数字跟符号

and pass a dictionary check.

并且可以通过字典检查

And one of the other policies we tried,

我们也试了另外一种规则

and there were a whole bunch more,

but one of the ones we tried was called Basic16,

以及许多别的规则

其中有一种规则我们称之为基础16

and the only requirement here

唯一的要求就是

was that your password had to have at least 16 characters.

你的密码必须至少由16个字符组成

All right, so now we had 5,000 passwords,

那么，现在我们已经有5000个密码了

and so we had much more detailed information.

并且我们有了更加具体的信息

Again we see that there's only a small number

我们再次发现

只有很少数的符号

of symbols that people are actually using

被人们在设定密码的过程中使用

in their passwords.

We also wanted to get an idea of how strong

我们也很想知道

the passwords were that people were creating,

人们设定的密码安全性有多高

but as you may recall, there isn't a good measure

但也许你还记的

of password strength.

并没有很好的方法可以用来衡量密码的安全性

So what we decided to do was to see

因此，我们决定通过

破解密码的时间

how long it would take to crack these passwords

using the best cracking tools

that the bad guys are using,

使用最好的解密软件

那些正在被坏人使用的

or that we could find information about

或者我们也可以

in the research literature.

通过查阅文献来获取相应的信息

So to give you an idea of how bad guys

为了让大家更好的了解坏人

go about cracking passwords,

是如何破解密码的

they will steal a password file

他们会偷一个密码文件

that will have all of the passwords

这个文件有所有的密码

in kind of a scrambled form, called a hash,

无序排列，称为散表

and so what they'll do is they'll make a guess

然后他们开始猜测

as to what a password is,

run it through a hashing function,

密码会是什么

通过运行哈希函数

and see whether it matches

来看这个密码

跟密码清单上的密码能否相对应

the passwords they have on their stolen password list.

So a dumb attacker will try every password in order.

一个笨的黑客会按照顺序试每一种密码

They'll start with AAAAA and move on to AAAAB,

他们会从AAAAA开始，然后AAAAB

and this is going to take a really long time

这种方法会消耗很长的时间

before they get any passwords

直到他们找到

that people are really likely to actually have.

那些人们真正会使用的密码

A smart attacker, on the other hand,

然而，一个聪明的黑客

does something much more clever.

会使用更加明智的方法

They look at the passwords

他们观察这些密码

that are known to be popular

找出那些最受欢迎的组合

from these stolen password sets,

从偷来的密码清单上

and they guess those first.

他们会先试这些受欢迎的密码

So they're going to start by guessing "password,"

所以他们会先猜 “密码",

and then they'll guess "I love you," and "monkey,"

然后 ”我爱你" ，然后”猴子”

and "12345678,"

"12345678"

because these are the passwords

因为这些密码

that are most likely for people to have.

是最常被人们使用的

In fact, some of you probably have these passwords.

事实上，很有可能在座的各位中也有人使用这样的密码

So what we found

因此我们发现

by running all of these 5,000 passwords we collected

通过破解我们在这个试验中收集到的5000个密码

through these tests to see how strong they were,

来判断这些密码的安全性

we found that the long passwords

我们发现长密码

were actually pretty strong,

的安全性很高

and the complex passwords were pretty strong too.

并且那些复杂组合密码的安全性也很高

However, when we looked at the survey data,

然而，当我们分析调查问卷的数据

we saw that people were really frustrated

我们发现人们

对于复杂组合的密码感到沮丧

by the very complex passwords,

and the long passwords were a lot more usable,

而那些长的密码反而实用性更高

and in some cases, they were actually

在某种情况下，长密码

even stronger than the complex passwords.

比复杂组合密码的安全性反而更高

So this suggests that,

由此我们得出结论

instead of telling people that they need

与其让人们把

to put all these symbols and numbers

各种符号，数字

and crazy things into their passwords,

以及各种疯狂的元素加入他们的密码

we might be better off just telling people

还不如就让他们

to have long passwords.

制定更长的密码

Now here's the problem, though:

然后问题出现了：

Some people had long passwords

有一些人的长密码

that actually weren't very strong.

并不是很安全

You can make long passwords

你可以制定很长的密码，

that are still the sort of thing

但是这些密码

that an attacker could easily guess.

还是很容易被黑客猜到

So we need to do more than just say long passwords.

因此紧紧要求密码的长度是不够的

There has to be some additional requirements,

我们还需要一些其它的要求

and some of our ongoing research is looking at

一些我们目前正在做的研究

就是想要找出这些额外的要求

what additional requirements we should add

to make for stronger passwords

让密码更加安全

that also are going to be easy for people

并且这些要求得让人们

to remember and type.

觉得很容易记忆跟输入

Another approach to getting people to have

另一个让人们有

stronger passwords is to use a password meter.

更安全的密码的方法就是用密码尺

Here are some examples.

这里有一些例子

You may have seen these on the Internet

你也许在网上已经见过了

when you were creating passwords.

当你设定密码的时候

We decided to do a study to find out

我们决定通过一个实验来判断

whether these password meters actually work.

这些密码尺是否有效

Do they actually help people

他能不能真正的帮助人们

have stronger passwords,

设定更为安全的密码

and if so, which ones are better?

如果可以的话，哪一种密码尺更为有效

So we tested password meters that were

因此，我们检测了

different sizes, shapes, colors,

不同尺寸，形状，颜色

different words next to them,

不同描述语言的密码尺

and we even tested one that was a dancing bunny.

我们甚至还检测了一种像跳舞的兔子的密码尺

As you type a better password,

当你输入一个很好的密码的时候

the bunny dances faster and faster.

兔子会跳的越来越快

So this was pretty fun.

所以这种密码尺很有趣

What we found

我们发现

was that password meters do work.

这些密码尺确实有用

(Laughter)

（笑声）

Most of the password meters were actually effective,

大多数的密码尺是有效的

跳舞的兔子尤其的有效

and the dancing bunny was very effective too,

but the password meters that were the most effective

但最有效的密码尺

were the ones that made you work harder

是让你更努力的工作

before they gave you that thumbs up and said

直到他竖起大拇指跟你说

you were doing a good job,

你做的很棒

and in fact we found that most

但事实上，我们发现

of the password meters on the Internet today

目前网络上现有的密码尺

are too soft.

They tell you you're doing a good job too early,

都太温柔了

他们都太早告诉你，你做的很好

and if they would just wait a little bit

如果他们可以晚一些

before giving you that positive feedback,

给你正面的回应

you probably would have better passwords.

你很有可能可以设定更安全的密码

Now another approach to better passwords, perhaps,

设立更好的密码的另一种方法

也许是使用词汇密码而不是密码

is to use pass phrases instead of passwords.

So this was an xkcd cartoon from a couple of years ago,

这是很多年前的一个xkcd动画

and the cartoonist suggests

动漫家们暗示

that we should all use pass phrases,

我们都应该使用词汇密码

and if you look at the second row of this cartoon,

如果你看这个卡通的第二排

you can see the cartoonist is suggesting

你会发现这些动漫家建议

that the pass phrase "correct horse battery staple"

词汇密码“正确马电池枫叶"

would be a very strong pass phrase

的安全性很高

and something really easy to remember.

并且很容易被记住

He says, in fact, you've already remembered it.

他们认为，事实上你已经记住了

And so we decided to do a research study

因此我们决定做一项研究

to find out whether this was true or not.

来证明这是不是真的

In fact, everybody who I talk to,

事实上，跟我对话的每一个人

who I mention I'm doing password research,

那些我告诉他们我是做密码研究的人

they point out this cartoon.

"Oh, have you seen it? That xkcd.

他们都提到了这个动画

”你看过那个动画吗?那个xkcd“

Correct horse battery staple."

“正确马电池枫叶”

So we did the research study to see

因此我们做了一项研究看

what would actually happen.

到底会发生什么

So in our study, we used Mechanical Turk again,

我们使用亚马逊机器土耳其人来做这个研究

and we had the computer pick the random words

我们让电脑随机挑选一些

in the pass phrase.

过去式的单词

Now the reason we did this

我们这样做的原因是

is that humans are not very good

人们并不擅长

at picking random words.

随机挑选单词

If we asked a human to do it,

如果我让一个人去选单词

they would pick things that were not very random.

他们选出的单词不会是随机的

So we tried a few different conditions.

因此我们试了不同的条件。

In one condition, the computer picked

在一种条件下，

from a dictionary of the very common words

电脑从一本字典中选出一些非常常用的

in the English language,

and so you'd get pass phrases like

英文单词

因此你会得到密码词汇像

"try there three come."

“试那里三来"

And we looked at that, and we said,

我们看着这些词汇说，

"Well, that doesn't really seem very memorable."

‘这看上去并不是很容易被记住。”

So then we tried picking words

然后我们尝试

that came from specific parts of speech,

从日常对话中挑选词汇

so how about noun-verb-adjective-noun.

像名词-动词-形容词-名词的组合。

That comes up with something that's sort of sentence-like.

这会让出现的单词更像句子

So you can get a pass phrase like

这样你会得到像这样的词汇密码

"plan builds sure power"

“计划建设肯定的权利"

or "end determines red drug."

或者 ”结局决定红色的药。“

And these seemed a little bit more memorable,

这些组合看上去更容易被记住

and maybe people would like those a little bit better.

人们也许会更喜欢这样的密码

We wanted to compare them with passwords,

我们想把这样的密码词汇更普通的密码做比较

and so we had the computer pick random passwords,

因此我们让电脑随机挑选密码

and these were nice and short, but as you can see,

这些密码都很好很短

they don't really look very memorable.

但你会发现他们并不好记忆

And then we decided to try something called

然后我们决定尝试一种叫做

a pronounceable password.

So here the computer picks random syllables

可以发声的密码

电脑挑选随机的音节

and puts them together

把他们组合在一起

so you have something sort of pronounceable,

这样你就有了一些可以发声的密码

like "tufritvi" and "vadasabi."

像”tufritvi" 和“vadasabi.’

That one kind of rolls off your tongue.

这些密码像是在挑战你的舌头

So these were random passwords that were

因此这些密码

generated by our computer.

是计算机为我们设定的

So what we found in this study was that, surprisingly,

很惊讶的是，我们从这项试验中发现

pass phrases were not actually all that good.

密码词汇并没有想象中那么好

People were not really better at remembering

跟普通密码相比，人们并没有更好的记住

the pass phrases than these random passwords,

这些词汇密码

and because the pass phrases are longer,

并且由于词汇密码更长

they took longer to type

会花更长的时间来输入

and people made more errors while typing them in.

这会让人们打字的时候犯更多的错误

So it's not really a clear win for pass phrases.

因此词汇密码并没有明显的优势

Sorry, all of you xkcd fans.

对于那些xkcd粉丝来说，这项结果真的很遗憾

On the other hand, we did find

另一方面，我们发现

that pronounceable passwords

那些可发声密码

worked surprisingly well,

and so we actually are doing some more research

非常的有效

因此，我们做了更多的研究

to see if we can make that approach work even better.

是的这种方法可以更好的运作

So one of the problems

有一个问题

with some of the studies that we've done

存在于我们做的一些实验中

is that because they're all done

那就是这些实验都

using Mechanical Turk,

是通过机器土耳其人做的

these are not people's real passwords.

这些密码不是人们日常生活中会用的密码

They're the passwords that they created

这些密码是人们

or the computer created for them for our study.

或者是计算机为了我们的实验而设立的

And we wanted to know whether people

而我们很想知道

人们会不会用同样的方式来制定密码

would actually behave the same way

with their real passwords.

在日常生活中

So we talked to the information security office at Carnegie Mellon

因此我们跟卡内基梅隆大学信息安全中心的人对话

and asked them if we could have everybody's real passwords.

问他们我们能不能拿到所有人的真实密码

Not surprisingly, they were a little bit reluctant

不出意外，他们不愿意

to share them with us,

把这些信息跟我们分享

but we were actually able to work out

但我们事实上找到了一种

a system with them

跟他们合作的方法

where they put all of the real passwords

他们把

for 25,000 CMU students, faculty and staff,

学校25000名学生，老师，员工的密码

into a locked computer in a locked room,

放进一台带锁的电脑，在一个带锁的房间里

not connected to the Internet,

没有网络

and they ran code on it that we wrote

他们在那台电脑上运行我们所写的程序

to analyze these passwords.

来分析这些密码

They audited our code.

他们审查了我们的代码

They ran the code.

And so we never actually saw

并且运行它

因此，我们事实上并没有

anybody's password.

看见任何人的密码

We got some interesting results,

我们得到了一些有趣的结果

and those of you Tepper students in the back

那些坐在后排的Tepper的同学们

will be very interested in this.

会对这个结果很感兴趣

So we found that the passwords created

我们发现

计算机专业的同学所设立的密码

by people affiliated with the school of computer science

were actually 1.8 times stronger

要安全1.8倍

than those affiliated with the business school.

比商学院的同学

We have lots of other really interesting

我们有很多其它非常有趣的

demographic information as well.

地域性发现

The other interesting thing that we found

另一项有趣的发现是

is that when we compared the Carnegie Mellon passwords

通过对比卡内基梅隆的密码

to the Mechanical Turk-generated passwords,

跟机器土耳其人产生的密码

there was actually a lot of similarities,

他们有很多的相似性

and so this helped validate our research method

因此这可以验证我们的实验方法

and show that actually, collecting passwords

证实事实上

using these Mechanical Turk studies

通过土耳其机器人

收集密码的方法是有效的

is actually a valid way to study passwords.

So that was good news.

这是一个好消息

Okay, I want to close by talking about

最后，我想谈一谈

some insights I gained while on sabbatical

我的一些感想，来源于

last year in the Carnegie Mellon art school.

去年在卡内基梅隆艺术学院休假

当时我做的一件事情就是

One of the things that I did

is I made a number of quilts,

and I made this quilt here.

我做了很多的被子

我也在这里做了很多被子

It's called "Security Blanket."

这些被子叫做”安全毯“

(Laughter)

（笑声）

And this quilt has the 1,000

这条被子由1000个

most frequent passwords stolen

最常被盗的密码组成

这些密码来自于RockYou网站

from the RockYou website.

And the size of the passwords is proportional

密码的大小跟

to how frequently they appeared

他被盗的平率成正比

in the stolen dataset.

在被盗密码数据库中

And what I did is I created this word cloud,

我创建了这个单词库

and I went through all 1,000 words,

然后我给这1000个单词

and I categorized them into

进行分进

loose thematic categories.

不是很严格的主题类别中

And it was, in some cases,

一些情况下

it was kind of difficult to figure out

很难判断

what category they should be in,

一些单词应该被分入哪个类别中

and then I color-coded them.

然后我用不同的颜色标记他们

So here are some examples of the difficulty.

这里是一些很难被分类的单词的列子

So "justin."

比如说 “贾斯丁"

Is that the name of the user,

是用户的名字？

their boyfriend, their son?

男朋友的名字？还是儿子的名字？

Maybe they're a Justin Bieber fan.

也有可能他是贾斯丁比伯的粉丝

Or "princess."

或者说 ”公主“

Is that a nickname?

是一个外号？

Are they Disney princess fans?

还是用户是迪斯尼公主的粉丝？

Or maybe that's the name of their cat.

也有可能是他们猫的名字

"Iloveyou" appears many times

”我爱你"经常会被用到

in many different languages.

不同的语言

There's a lot of love in these passwords.

在密码中会有很多“爱”

If you look carefully, you'll see there's also

如果你仔细观察，你还会发现

some profanity,

密码中有很多的脏话

but it was really interesting to me to see

但是有一个发现很有趣

that there's a lot more love than hate

爱比恨要多很多

in these passwords.

在密码中

And there are animals,

密码中还会有动物

a lot of animals,

很多的动物

and "monkey" is the most common animal

猴子是最常见的动物

and the 14th most popular password overall.

是第14个最受欢饮的密码

And this was really curious to me,

我对这个发现非常的好奇

and I wondered, "Why are monkeys so popular?"

我好奇为什么猴子会那么的受欢迎？

And so in our last password study,

因此，在我们最近的一项密码研究中

any time we detected somebody

每次我们发现有人

creating a password with the word "monkey" in it,

在他们的密码中用到猴子的时候

we asked them why they had a monkey in their password.

我们会问他们为什么他会用猴子

And what we found out --

结果我们发现

we found 17 people so far, I think,

在我们目前发现的17个

who have the word "monkey" --

用猴子做密码的人中

We found out about a third of them said

有三分之一的人说

they have a pet named "monkey"

他们有一个宠物叫猴子

or a friend whose nickname is "monkey,"

有一个朋友的外号叫猴子

and about a third of them said

另外三分之一的人说

that they just like monkeys

他们只是很喜欢猴子

and monkeys are really cute.

他们觉得猴子很可爱

And that guy is really cute.

或者那个朋友很可爱

So it seems that at the end of the day,

所以看来，在一天的最后

在我们制定密码的时候

when we make passwords,

we either make something that's really easy

我们要么会用一些容易

to type, a common pattern,

输入的东西，一些常用组合

or things that remind us of the word password

或者是一些可以让我想起密码的事物

or the account that we've created the password for,

或者是我们制定密码的账户

or whatever.

或者是任何事

Or we think about things that make us happy,

或者是那些会让我们想起来开心的事物

and we create our password

我们设定密码

based on things that make us happy.

基于那些让我们开心的事物

And while this makes typing

这让我们输入

and remembering your password more fun,

跟记忆密码变得更为有趣

it also makes it a lot easier

这也使得窃取密码的人更容易

to guess your password.

猜到你的密码

So I know a lot of these TED Talks

我知道跟多TED谈话的内容

are inspirational

都非常的激发人们的灵感

and they make you think about nice, happy things,

他们让你们想到美好开心的事

but when you're creating your password,

但是当你设定你密码的时候

try to think about something else.

试着想一些别的事情

Thank you.

谢谢

(Applause)