A Primer on Passwords

Please note: This article was adapted from a blog posting in Karen N. Johnson’s blog on July 24, 2007.

Introduction

The password field is one data entry field that needs special attention when testing an application. The password field can be important (since accessing someone’s account can start a security leak), testers should spend more time on this essential field. Following is a brief discussion of different types of passwords.

Passwords: Salted, Mixed, Plain, and Cracked

A password field has to be strong enough to provide security. Following are several different types of password fields:

Salted Passwords

Salted passwords are passwords where random characters are added to the user’s passwords to improve security. These pseudo-random values are added to a password before the password is hashed and stored. From the point of view of an end-user there is no difference in creating or using the password field. The value of the salted password is the added protection it provides to the user and the system. A salted password is a stronger password that is much less vulnerable to brute-force and dictionary attacks.

Mixed Passwords

Mixed passwords are passwords requiring a mix of both alpha and numeric characters. The requirement might include mixed upper and lower case alpha characters as well as special characters. The rule-of-thumb is simple, the more characters in the password field and the more varied the mix, the stronger the password. For information on how long it takes to break a password see: Password Recovery Speeds.

The downside is, however, obvious. Better, longer, and more complex passwords are simply hard to remember. There are, however, tools that can help (see the sidebar about Password Safe).

Need Help Remembering Passwords?

Password Safe is a free utility for storing passwords. The “safe” itself is password protected with a very strong password helping to keep all of your stored passwords safe.

Plain Passwords

Plain passwords are passwords that contain none of the variety outlined above that makes a password harder to crack. These are, of course, the easiest passwords to remember. They are also among the least secure. Because of this, many websites and applications do not allow plain passwords anymore.

Conclusion

Understanding passwords, their strength, and how they can be broken, is an essential skill for anyone who is going to be testing this field and functionality. Testing of passwords should be incorporated into the test plan for any application or website.

Good Password Resources

Karen N. Johnson

Karen N. Johnson is an independent software test consultant. She is a frequent speaker at software testing conferences and is an active participant in several software testing workshops. She serves as a Director on the Board for the Association for Software Testing and is a panel expert on Tech Target’s web site www.searchsoftwarequality.com. For more information about Karen, visit http://www.karennjohnson.com/.

Karen N.Johnson
Karen N. Johnson is a longtime active contributor to the software testing community. Her work is often centered on helping organizations at an enterprise level. Her professional activities include speaking at conferences both in the US and internationally. Karen is a contributing author to the book, Beautiful Testing by O’Reilly publishers. She is the co-founder of the WREST workshop, the Workshop for Regulated Software Testing. She has published numerous articles; she blogs and tweets about her experiences. Find her on Twitter as @karennjohnson (note the two n’s) and her website: http://www.karennicolejohnson.com. Karen is Director Jamf Now, Development & Delivery at Jamf. See: https://www.jamf.com

The Related Post

This article was developed from concepts in the book Global Software Test Automation: Discussion of Software Testing for Executives. Introduction When thinking of the types of Software Testing, many mistakenly equate the mechanism by which the testing is performed with types of Software Testing. The mechanism simply refers to whether you are using Manual or ...
LogiGear Magazine – July 2011 – The Test Methods & Strategies Issue
  Explore It! is one of the very best software testing books ever written. It is packed with great ideas and Elisabeth Hendrickson’s writing style makes it very enjoyable to read. Hendrickson has a well-deserved reputation in the global software testing community as someone who has the enviable ability to clearly communicate highly-practical, well-thought-out ideas. ...
In software testing, we need to devise an approach that features a gradual progression from the simplest criteria of testing to more sophisticated criteria. We do this via many planned and structured steps, each of which brings incremental benefits to the project as a whole. By this means, as a tester masters each skill or area ...
Introduction Software Testing 3.0 is a strategic end-to-end framework for change based upon a strategy to drive testing activities, tool selection, and people development that finally delivers on the promise of software testing. For more details on the evolution of software testing and Software Testing 3.0 see: Software Testing 3.0: Delivering on the Promise of ...
David S. Janzen – Associate Professor of Computer Science Department California Polytechnic State University, San Luis Obispo – homepage LogiGear: How did you get into software testing and what do you find interesting about it? Professor Janzen: The thing I enjoy most about computing is creating something that helps people. Since my first real job ...
Internet-based per-use service models are turning things upside down in the software development industry, prompting rapid expansion in the development of some products and measurable reduction in others. (Gartner, August 2008) This global transition toward computing “in the Cloud” introduces a whole new level of challenge when it comes to software testing.
The 12 Do’s and Don’ts of Test Automation When I started my career as a Software Tester a decade ago, Test Automation was viewed with some skepticism.
LogiGear Magazine – May 2011 – The Test Process Improvement Issue
With this edition of LogiGear Magazine, we introduce a new feature, Mind Map. A mind map is a diagram, usually devoted to a single concept, used to visually organize related information, often in a hierarchical or interconnected, web-like fashion. This edition’s mind map, created by Sudhamshu Rao, focuses on tools that are available to help ...
Creative Director at the Software Testing Club, Rob Lambert always has something to say about testing. Lambert regularly blogs at TheSocialTester where he engages his readers with test cases, perspectives and trends. “Because It’s Always Been Done This Way” Study the following (badly drawn) image and see if there is anything obvious popping in to ...
One of the most dreaded kinds of bugs are the ones caused by fixes of other bugs or by code changes due to feature requests. I like to call these the ‘bonus bugs,’ since they come on top on the bug load you already have to deal with. Bonus bugs are the major rationale for ...

Leave a Reply

Your email address will not be published.

Stay in the loop with the lastest
software testing news

Subscribe