Lorrie Faith Cranor: What's wrong with your pa$$w0rd?

譯者: Hsinju Chen 審譯者: Justine Bai

I am a computer science and engineering professor here at Carnegie Mellon,

我是卡內基美隆大學(Carnegie Mellon) 電腦科學及工程的教授

and my research focuses on usable privacy and security,

我研究的專長是有用的隱私權和安全性

and so my friends like to give me examples

所以我的朋友們喜歡提供我一些例子

of their frustrations with computing systems,

使用電腦系統時遇到的挫折

especially frustrations related to

尤其是

unusable privacy and security.

碰到不能用的隱私權和安全性

So passwords are something that I hear a lot about.

密碼就是常見的例子

A lot of people are frustrated with passwords,

很多人對密碼設定感到挫折

and it's bad enough

尤其是

when you have to have one really good password

當你需要一組很好用的密碼

that you can remember

你自己記得住

but nobody else is going to be able to guess.

但沒人猜的到

But what do you do when you have accounts

但當你好幾個帳戶

on a hundred different systems

都在不同的系統環境上

and you're supposed to have a unique password

而每個帳戶都要有個獨特的密碼

for each of these systems?

你要怎麼辦呢？

It's tough.

那不容易

At Carnegie Mellon, they used to make it

卡內基美隆大學

actually pretty easy for us

過去設定密碼很簡單

to remember our passwords.

我們很容易記住

The password requirement up through 2009

到2009年以前

was just that you had to have a password

密碼設定只要求

with at least one character.

至少一個字元

Pretty easy. But then they changed things,

非常簡單 但後來他們改變了規則

and at the end of 2009, they announced

到了2009年底

that we were going to have a new policy,

他們公布了一項新規定

and this new policy required

新規定要求

passwords that were at least eight characters long,

密碼至少要有八個字元

with an uppercase letter, lowercase letter,

包括一個大寫字母 一個小寫字母

a digit, a symbol,

一個數字 一個符號

you couldn't use the same character more than three times,

相同字元不能超過三次

and it wasn't allowed to be in a dictionary.

不可是字典查得到的

Now, when they implemented this new policy,

現在他們實施新規定

a lot of people, my colleagues and friends,

我的同事 朋友 還有很多人

came up to me and they said, "Wow,

告訴我 說: 哇

now that's really unusable.

現在真的變得好難用

Why are they doing this to us,

他們為何這麼做

and why didn't you stop them?"

妳怎麼不阻止他們？

And I said, "Well, you know what?

我說: 你知道嗎？

They didn't ask me."

他們沒問我

But I got curious, and I decided to go talk

可我也很好奇 所以決定要跟那些

to the people in charge of our computer systems

管理我們電腦系統的人談談

and find out what led them to introduce

了解到底什麼原因

this new policy,

讓他們導入這新政策

and they said that the university

他們說卡內基美隆大學

had joined a consortium of universities,

加入了大學聯盟

and one of the requirements of membership

成為會員的條件包括

was that we had to have stronger passwords

提高密碼的安全性

that complied with some new requirements,

好符合新的規定

and these requirements were that our passwords

新規定要求密碼

had to have a lot of entropy.

必須要有很多熵值

Now entropy is a complicated term,

現在這熵值是個很複雜的名詞

but basically it measures the strength of passwords.

基本上它可衡量密碼的強度

But the thing is, there isn't actually

可事實上

a standard measure of entropy.

熵值沒有衡量的標準

Now, the National Institute of Standards and Technology

現在 國家標準與技術研究所

has a set of guidelines

有整套指引

which have some rules of thumb

指引裡有一些經驗法則

for measuring entropy,

用於測量熵值

but they don't have anything too specific,

但他們沒有什麼太具體的東西

and the reason they only have rules of thumb

他們會只有經驗法則

is it turns out they don't actually have any good data

因為他們其實沒有很精確的

on passwords.

密碼數據

In fact, their report states,

實際上他們的報告指出：

"Unfortunately, we do not have much data

不幸的是我們數據不多

on the passwords users choose under particular rules.

特別是 密碼使用者在特定規則下選擇密碼

NIST would like to obtain more data

NIST想獲得更多

on the passwords users actually choose,

使用者選擇密碼的資料

but system administrators are understandably reluctant

但系統管理員當然不願意

to reveal password data to others."

透露密碼資料給其他人

So this is a problem, but our research group

所以這是個問題 但我們的研究小組

looked at it as an opportunity.

視它作為一個機會

We said, "Well, there's a need for good password data.

我們說 好的密碼資料是有必要的

Maybe we can collect some good password data

也許我們可以收集一些好的密碼資料

and actually advance the state of the art here.

有助於提昇技術現況

So the first thing we did is,

所以 我們做的第一件事是

we got a bag of candy bars

我們拿了一包糖果

and we walked around campus

在校園裡

and talked to students, faculty and staff,

跟學生 教師和工作人員解釋

and asked them for information

並跟他們要求取得

about their passwords.

關於他們設定密碼的資訊

Now we didn't say, "Give us your password."

我們並不是說 請給我們您的密碼

No, we just asked them about their password.

我們只是詢問

How long is it? Does it have a digit?

他們的密碼多長？有一個數字嗎？

Does it have a symbol?

有一個符號嗎？

And were you annoyed at having to create

上星期要重設的新密碼

a new one last week?

會不會讓你覺得很煩？

So we got results from 470 students,

因此 我們得到了來自470位

faculty and staff,

學生 教師和工作人員的回饋

and indeed we confirmed that the new policy

事實上我們也證實了新的政策

was very annoying,

實在令人討厭

but we also found that people said

但我們也發現 有人說

they felt more secure with these new passwords.

他們認為這些新密碼更安全

We found that most people knew

我們發現大多數人都知道

they were not supposed to write their password down,

不應該把密碼寫下來

and only 13 percent of them did,

而其中只有13％的人有把密碼寫下來

but disturbingly, 80 percent of people

但令人不安的是

said they were reusing their password.

80％的人表示他們重複使用他們的密碼

Now, this is actually more dangerous

這其實比寫下密碼

than writing your password down,

來得更危險

because it makes you much more susceptible to attackers.

因為你更容易受到駭客攻擊

So if you have to, write your passwords down,

所以 必要時寫下密碼

but don't reuse them.

但不要重複使用

We also found some interesting things

我們還發現了一些有趣的事情

about the symbols people use in passwords.

關於密碼中的符號

So CMU allows 32 possible symbols,

CMU允許使用的符號有32個

but as you can see, there's only a small number

但正如你所見 只有少數符號

that most people are using,

常常被使用

so we're not actually getting very much strength

所以實際上 我們密碼也沒有變得更強

from the symbols in our passwords.

因為密碼裡有了符號

So this was a really interesting study,

這是一個非常有趣的研究

and now we had data from 470 people,

現在我們有470人的資料

but in the scheme of things,

但對這項計劃而言

that's really not very much password data,

這些數據不算多

and so we looked around to see

所以我們想周圍

where could we find additional password data?

那裡可以找到更多密碼資料？

So it turns out there are a lot of people

後來我們發現 原來有很多人

going around stealing passwords,

到處去竊取密碼

and they often go and post these passwords

然後在網路上

on the Internet.

發佈這些密碼

So we were able to get access

我們取得

to some of these stolen password sets.

其中一些被盜的密碼

This is still not really ideal for research, though,

雖然這對研究來說不是很理想

because it's not entirely clear

因為我們不清楚

where all of these passwords came from,

這些密碼從哪裡來

or exactly what policies were in effect

還是他們設密碼時

when people created these passwords.

採取了什麼樣的策略

So we wanted to find some better source of data.

因此 我們希望找到 較好的資料來源

So we decided that one thing we could do

所以我們發現可以做一件事

is we could do a study and have people

我們打算展開研究計畫

actually create passwords for our study.

讓人們實際來設定密碼

So we used a service called Amazon Mechanical Turk,

我們使用了"亞馬遜機器游牧民族"提供的服務

and this is a service where you can post

這是一種群眾外包服務平台

a small job online that takes a minute,

在那裡 你可以張貼微型線上工作資訊

a few minutes, an hour,

只需要幾分種 一小時就能完成

and pay people, a penny, ten cents, a few dollars,

然後付些錢

to do a task for you,

給幫你完成工作的人

and then you pay them through Amazon.com.

然後透過Amazon.com付費給他們

So we paid people about 50 cents

我們一共付了約50分美元

to create a password following our rules

讓人根據我們的規則 設立密碼

and answering a survey,

並回答問卷

and then we paid them again to come back

然後 再付給他們一筆錢 請他們兩天後回來

two days later and log in

用他們的密碼登錄

using their password and answering another survey.

再回答另一份問卷

So we did this, and we collected 5,000 passwords,

就這樣我們收集了5,000個密碼

and we gave people a bunch of different policies

要求他們依不同規則

to create passwords with.

設立密碼

So some people had a pretty easy policy,

有些人的規則很簡單

we call it Basic8,

我們叫它Basic8

and here the only rule was that your password

它只要求

had to have at least eight characters.

密碼至少有八個字元

Then some people had a much harder policy,

有些人的規則就比較困難

and this was very similar to the CMU policy,

跟卡內基美隆大學的作法很像

that it had to have eight characters

它必須有8個字元

including uppercase, lowercase, digit, symbol,

包括大寫 小寫 數字 符號

and pass a dictionary check.

並通過字典檢查

And one of the other policies we tried,

我們試過其中的規則之一

and there were a whole bunch more,

並還有更多

but one of the ones we tried was called Basic16,

但其中一種稱為Basic16

and the only requirement here

唯一的要求是

was that your password had to have at least 16 characters.

密碼至少有16個字元

All right, so now we had 5,000 passwords,

所以現在我們有5,000個密碼

and so we had much more detailed information.

還有詳細的資訊

Again we see that there's only a small number

我們又看到

of symbols that people are actually using

只有少數的符號

in their passwords.

被使用在密碼中

We also wanted to get an idea of how strong

我們也希望知道

the passwords were that people were creating,

人們設立的密碼的強度

but as you may recall, there isn't a good measure

但你可能還記得 還沒有一個很好的

of password strength.

衡量密碼強度的方法

So what we decided to do was to see

所以我們決定要看看

how long it would take to crack these passwords

使用駭客用的破解工具

using the best cracking tools

或是使用

that the bad guys are using,

我們在文獻可以找的到的資訊

or that we could find information about

需要多長時間

in the research literature.

來破解這些密碼

So to give you an idea of how bad guys

因此 讓你們來看看駭客

go about cracking passwords,

如何破解密碼

they will steal a password file

他們竊取密碼檔案

that will have all of the passwords

這檔案中的密碼

in kind of a scrambled form, called a hash,

呈現混亂形式 稱為散列

and so what they'll do is they'll make a guess

他們會用猜測的方式

as to what a password is,

來猜測密碼

run it through a hashing function,

再用散列函數程式跑過

and see whether it matches

看是否能在他們偷來的密碼中

the passwords they have on their stolen password list.

找到相同密碼

So a dumb attacker will try every password in order.

所以 一個愚蠢駭客會將密碼一個一個順序試

They'll start with AAAAA and move on to AAAAB,

從AAAAA開始 到AAAAB

and this is going to take a really long time

這要花很長的時間

before they get any passwords

才能得到有可能

that people are really likely to actually have.

人們真正設置的密碼

A smart attacker, on the other hand,

另一方面 一個聰明的駭客

does something much more clever.

作法就聰明些

They look at the passwords

他們猜測密碼時

that are known to be popular

先試

from these stolen password sets,

從這些偷來的密碼組中

and they guess those first.

常用的密碼

So they're going to start by guessing "password,"

因此 他們要開始猜測“密碼”時

and then they'll guess "I love you," and "monkey,"

他們會先猜 “我愛你” 和 “猴子”

and "12345678,"

和“12345678”

because these are the passwords

因為這些密碼

that are most likely for people to have.

是最多人用

In fact, some of you probably have these passwords.

事實上 你們可能也有這些密碼

So what we found

所以 我們發現

by running all of these 5,000 passwords we collected

用我們收集的5,000個密碼

through these tests to see how strong they were,

用這些測試 看看他們的強度是如何

we found that the long passwords

我們發現

were actually pretty strong,

長密碼通常強度很高

and the complex passwords were pretty strong too.

而複雜的密碼也相當強

However, when we looked at the survey data,

然而 當我們看到這調查數據

we saw that people were really frustrated

我們看到人們對非常複雜的密碼

by the very complex passwords,

很有挫折感

and the long passwords were a lot more usable,

長的密碼會實用很多

and in some cases, they were actually

在某些情況下

even stronger than the complex passwords.

他們比複雜密碼更強

So this suggests that,

這告訴我們

instead of telling people that they need

比較好是告訴人們使用長密碼

to put all these symbols and numbers

而不是告訴人們

and crazy things into their passwords,

他們要把這些符號和數字

we might be better off just telling people

和瘋狂的東西

to have long passwords.

放進自己的密碼中

Now here's the problem, though:

現在 有個問題：

Some people had long passwords

有些人有長密碼

that actually weren't very strong.

但其實並不是很強

You can make long passwords

你可以有長的密碼

that are still the sort of thing

仍是那些

that an attacker could easily guess.

駭客可以很容易地猜到的密碼

So we need to do more than just say long passwords.

所以我們需要的不只是長密碼

There has to be some additional requirements,

還有一些其他的要求

and some of our ongoing research is looking at

我們正在進行的一些研究

what additional requirements we should add

是在尋找應該加入什麼樣的要求

to make for stronger passwords

讓密碼強度更高

that also are going to be easy for people

並且很容易

to remember and type.

讓人記住和輸入

Another approach to getting people to have

讓人們設置強度高密碼的另一種方法

stronger passwords is to use a password meter.

是使用一個密碼強度測量表

Here are some examples.

下面是一些例子

You may have seen these on the Internet

當你在網路上設立密碼時

when you were creating passwords.

你可能已經看過這些

We decided to do a study to find out

我們決定做研究找出

whether these password meters actually work.

這些密碼強度測量表是否真的有用

Do they actually help people

它們是否真的

have stronger passwords,

有助於設立強的密碼

and if so, which ones are better?

若有的話 哪個更好？

So we tested password meters that were

所以我們在密碼旁

different sizes, shapes, colors,

加入不同的大小 形狀 顏色的

different words next to them,

密碼強度測量表

and we even tested one that was a dancing bunny.

我們甚至用一個跳舞的兔子

As you type a better password,

當你輸入一個較好的密碼

the bunny dances faster and faster.

兔子會跳舞跳得越來越快

So this was pretty fun.

這很有趣

What we found

我們發現

was that password meters do work.

密碼強度測量表真的有用

(Laughter)

(笑聲)

Most of the password meters were actually effective,

大部分的密碼測量表都真的有效

and the dancing bunny was very effective too,

跳舞的兔子也很有效

but the password meters that were the most effective

最有效的密碼測量表

were the ones that made you work harder

再給你大拇指讚之前

before they gave you that thumbs up and said

告訴你做的好之前

you were doing a good job,

你已做了很多工做

and in fact we found that most

而事實上 我們發現

of the password meters on the Internet today

目前網路上大部分的

are too soft.

They tell you you're doing a good job too early,

測量表都太弱

他們都太早告訴你 你做的好

and if they would just wait a little bit

在給你的正面回饋之前

before giving you that positive feedback,

他們只要再等久一點點

you probably would have better passwords.

你可能就會有更好的密碼

Now another approach to better passwords, perhaps,

另一種更好地設密碼的方法

is to use pass phrases instead of passwords.

就是使用密語 而不是密碼

So this was an xkcd cartoon from a couple of years ago,

所以這是一個幾年前的XKCD卡通

and the cartoonist suggests

漫畫家建議我

that we should all use pass phrases,

們都應該使用密語

and if you look at the second row of this cartoon,

如果你看這部動畫片的第二行

you can see the cartoonist is suggesting

可以看到漫畫家建議

that the pass phrase "correct horse battery staple"

密語 “正確的馬電池主食”

would be a very strong pass phrase

是一個非常強密語

and something really easy to remember.

也很容易記住

He says, in fact, you've already remembered it.

他說 事實上 你已經記住了

And so we decided to do a research study

所以我們決定做一個研究

to find out whether this was true or not.

看這是真還是假

In fact, everybody who I talk to,

事實上 我們訪問的對象

who I mention I'm doing password research,

當我們提到是做密碼的研究

they point out this cartoon.

他們提到這部動畫片

"Oh, have you seen it? That xkcd.

“你看過那XKCD嗎？

Correct horse battery staple."

正確的馬電池主食"

So we did the research study to see

所以我們做了調查研究

what would actually happen.

看看到底會發生什麼

So in our study, we used Mechanical Turk again,

研究中 我們再次使用群眾外包平台

and we had the computer pick the random words

我們讓電腦隨機

in the pass phrase.

在密語中選字

Now the reason we did this

我們這樣做的原因是

is that humans are not very good

人類不是很會

at picking random words.

If we asked a human to do it,

隨機選字

如果我們找人來做

they would pick things that were not very random.

他們挑的都不是很隨機

So we tried a few different conditions.

因此 我們嘗試了一些不同的情況

In one condition, the computer picked

在其中一種情況下

from a dictionary of the very common words

電腦從字典選出

英文很常見的字

in the English language,

and so you'd get pass phrases like

所以你可能會有

"try there three come."

“試那兒三來” 的密語

And we looked at that, and we said,

我們看了說

"Well, that doesn't really seem very memorable."

這似乎不是很好記

So then we tried picking words

於是當我們嘗試

在演說中的特定部分來選字

that came from specific parts of speech,

so how about noun-verb-adjective-noun.

就像名詞 動詞 形容詞 名詞

That comes up with something that's sort of sentence-like.

我們得到像句子的東西

So you can get a pass phrase like

這樣你就可以得到一個密語 像是

"plan builds sure power"

"計畫建造肯定力量"

or "end determines red drug."

或是 "結束決定紅色藥"

And these seemed a little bit more memorable,

而這些似乎比較容易記住

and maybe people would like those a little bit better.

也許人們會比較喜歡一點

We wanted to compare them with passwords,

我們希望將它們與密碼進行比較

and so we had the computer pick random passwords,

所以我們用電腦挑隨機密碼

and these were nice and short, but as you can see,

這些都是又短又好 但你會發現

他們看起來不好記

they don't really look very memorable.

And then we decided to try something called

後我們決定嘗試一種叫做

a pronounceable password.

可發音密碼

So here the computer picks random syllables

這是電腦隨機挑選的音節

and puts them together

並把它們放在一起

so you have something sort of pronounceable,

你得到這樣好像讀得出來的東西

like "tufritvi" and "vadasabi."

“tufritvi”和“vadasabi”

That one kind of rolls off your tongue.

又有點讓舌頭打結

So these were random passwords that were

這些都是電腦產生的

generated by our computer.

隨機密碼

我們在這項研究發現是

So what we found in this study was that, surprisingly,

驚訝的是 密語實際上不是那麼好

pass phrases were not actually all that good.

People were not really better at remembering

人們記密語

the pass phrases than these random passwords,

并不比隨機密碼記得更好

and because the pass phrases are longer,

並且因為密語較長

they took longer to type

需要較長的時間來輸入

and people made more errors while typing them in.

輸入時容易出錯

所以密語不會比較好

So it's not really a clear win for pass phrases.

Sorry, all of you xkcd fans.

xkcd的粉絲們 抱歉了

在另一方面 我們確實發現

On the other hand, we did find

that pronounceable passwords

那可發音密碼

worked surprisingly well,

出奇地好用

and so we actually are doing some more research

所以我們正在做一些調查研究

to see if we can make that approach work even better.

看看我們是否可以讓這方法做得更好

So one of the problems

我們已經做的一些研究中

with some of the studies that we've done

is that because they're all done

有一個問題就是

因為這些研究

using Mechanical Turk,

都是在群眾外包平台上執行

these are not people's real passwords.

這些都不是人們的真正密碼

They're the passwords that they created

這些是為研究而創造的密碼

or the computer created for them for our study.

或者為電腦產生的密碼

And we wanted to know whether people

而我們想知道

would actually behave the same way

是否實際上人們具有相同的行為方式

with their real passwords.

來設定他們的真實密碼

So we talked to the information security office at Carnegie Mellon

因此 我們請卡內積梅隆的 資訊安全辦公室

and asked them if we could have everybody's real passwords.

為我們提供大家的真實密碼

不出意外 他們是有點不願意

Not surprisingly, they were a little bit reluctant

to share them with us,

與我們分享

but we were actually able to work out

但是我們共同想出

a system with them

一個辦法

where they put all of the real passwords

他們用來儲存

for 25,000 CMU students, faculty and staff,

CMU25,000個學生，教師，和員工 真實密碼的系統

into a locked computer in a locked room,

放在一台鎖碼的電腦里 鎖在教室

not connected to the Internet,

沒有網路連線

and they ran code on it that we wrote

他們操作我們所寫的代碼

to analyze these passwords.

來分析密碼

They audited our code.

他們審核我們的代碼

They ran the code.

And so we never actually saw

他們跑這些代碼

anybody's password.

所以我們並沒真正看到

任何人的密碼

We got some interesting results,

我們得到了一些有趣的結果

and those of you Tepper students in the back

那些在後面的太普學生

will be very interested in this.

都會對此很感興趣

So we found that the passwords created

我們發現

電腦科學學院學生密碼

by people affiliated with the school of computer science

were actually 1.8 times stronger

比那些商學院學生的密碼

than those affiliated with the business school.

要強1.8倍

We have lots of other really interesting

我們有很多其他的真的很有趣

demographic information as well.

人口統計資訊

The other interesting thing that we found

另一個有趣的事情

is that when we compared the Carnegie Mellon passwords

當我們比較

卡內基梅隆和群眾外包平台生成的密碼

to the Mechanical Turk-generated passwords,

there was actually a lot of similarities,

實際上存在很多的相似之處

and so this helped validate our research method

所以這有助於驗證我們的研究方法

and show that actually, collecting passwords

並顯示 實際上

群眾外包平台收集的密碼

using these Mechanical Turk studies

is actually a valid way to study passwords.

對我們的研究很有效

所以這是個好消息

So that was good news.

Okay, I want to close by talking about

好吧 我想用下面所說的來做總結

some insights I gained while on sabbatical

一些我去年在卡內基·梅隆藝術學校

last year in the Carnegie Mellon art school.

公休時獲得的啟發

其中一個我做的事就是

One of the things that I did

is I made a number of quilts,

我做了一些拼布棉被

and I made this quilt here.

這是我在這裡做的

It's called "Security Blanket."

叫做 "安全性毯子"

(Laughter)

(笑聲)

And this quilt has the 1,000

這棉被上有RockYou網站上公布的

most frequent passwords stolen

1000個

最常被偷的密碼

from the RockYou website.

And the size of the passwords is proportional

密碼的大小顯示

to how frequently they appeared

他們再被盜資料庫中

in the stolen dataset.

出現頻率成正比

And what I did is I created this word cloud,

而我創造了這個字雲

and I went through all 1,000 words,

我把 1000個字

and I categorized them into

歸類成

loose thematic categories.

幾個大項

And it was, in some cases,

並且在某些情況下

it was kind of difficult to figure out

很難將他們

what category they should be in,

歸類

and then I color-coded them.

然後我就用顏色碼來分

So here are some examples of the difficulty.

這裡是一些有難度的例子

So "justin."

譬如"賈斯汀"

Is that the name of the user,

是用戶的名字

their boyfriend, their son?

男友 兒子?

Maybe they're a Justin Bieber fan.

或許是賈斯汀·比伯的粉絲

Or "princess."

又或是"公主"

Is that a nickname?

是個暱稱

Are they Disney princess fans?

他們是迪士尼公主的粉絲嗎?

Or maybe that's the name of their cat.

又或是是他們貓咪的名字

"我愛你" 用很多不同語言

"Iloveyou" appears many times

出現很多次

in many different languages.

There's a lot of love in these passwords.

在這些密碼中 很多愛字

如果你仔細看

If you look carefully, you'll see there's also

你會發現也有些褻瀆

some profanity,

but it was really interesting to me to see

很有趣 我看到了

that there's a lot more love than hate

這些密碼中

in these passwords.

愛比恨多

And there are animals,

還有動物

a lot of animals,

很多的動物

and "monkey" is the most common animal

而“猴子”是最常見的動物

and the 14th most popular password overall.

第14個最受歡迎的密碼

我對此很好奇 也很納悶

And this was really curious to me,

and I wondered, "Why are monkeys so popular?"

“為什麼是猴子如此受歡迎？”

And so in our last password study,

所以在我們最後一個密碼研究

any time we detected somebody

當我們發現有人

creating a password with the word "monkey" in it,

在設定密碼中出現"猴子"

we asked them why they had a monkey in their password.

我們問他們原因

我們發現---

And what we found out --

目前有17個人

we found 17 people so far, I think,

who have the word "monkey" --

密碼設置為猴子

We found out about a third of them said

有三分之一的人說

they have a pet named "monkey"

or a friend whose nickname is "monkey,"

他們有叫"猴子 "的寵物

或有朋友暱稱"猴子"

and about a third of them said

而有三分之一的說

that they just like monkeys

他們就是喜歡猴子

and monkeys are really cute.

猴子很可愛

And that guy is really cute.

而那人真的很可愛

So it seems that at the end of the day,

最終這似乎表明

when we make passwords,

當我們選密碼時

we either make something that's really easy

並不選擇那些很容易輸入的東西

to type, a common pattern,

or things that remind us of the word password

常見的模式 或是

提醒我們有關密碼的東西

or the account that we've created the password for,

或提醒有關帳號

or whatever.

或是其他的

Or we think about things that make us happy,

或是想到讓我們感到快樂的事

and we create our password

based on things that make us happy.

然後我們基於

And while this makes typing

讓我們快樂的事來設置密碼

and remembering your password more fun,

雖然這使我們輸入密碼及記憶密碼的

時候變得有趣

it also makes it a lot easier

但也更容易猜測你所設立的密碼

to guess your password.

So I know a lot of these TED Talks

我知道TED的很多演講

are inspirational

and they make you think about nice, happy things,

都很有啓發性

並常常是可愛快樂的主題

but when you're creating your password,

但當你設立密碼時

try to think about something else.

試著用其他的心態去創造你的密碼

Thank you.

謝謝大家

(Applause)

（掌聲）