Slashdot Mirror
Password Security Not Easy
mekkab writes "The Wall Street Journal reports (yet again) that despite knowing better, users do dumb things to compromise security. Is seven different 8 character passwords (with numbers and mixed cases) really too much to ask? Do people need training on how to make well known phrase (to them) into a perfect password acronym, or other memory boosting techniques? Or is it that the entire business culture needs to change from within to take digital security seriously?" If you require unmemorizable passwords, you've effectively changed the security requirement from "something you know" to "something you have", and if the required dongle is a note under your keyboard...
required dongle is a note under your keyboard
There are more advanced security schemas. I know some places I have worked use securids where if you get possession of the key chain and know their userid, then you can become them. This isn't any good.
A little bit better solution is having a securid login with a pin code - still not quite there as I only have to get your login name, secuid key chain and guess what your 4 digit pin is.
The best password schema I have seen so far is where the securid and pin are integrated so that the seed in the random number generator for synced securids is the pin - the securids are just random numbers where the next number is based on some fixed patter and the number is only good for 60 seconds. But this still this has a few holes, I could figure out the pattern in securid and brute force the pin then re-add the pin as the seed. But for nowadays, this is best I have.
2 passwords, none of them are words, easy to remember. anyone else have a few standard passwords?
Asking users to learn to create and manage complex passwords is not realistic; user education and/or "awareness" just isn't all that viable. The way the password problem is going to be solved is very simple - they aren't going to be used anymore.
Using SecureID or another similar solution is the "no-brainer" solution that todays users need. This way they don't have to remember anything other than a simple pin - which, luckily, is just about the limit of most peoples' powers in this arena.
dmiessler.com -- grep understanding knowledge
I hate people that put their password under their keyboard. Like damn people, on the underside of the desk, is that so much to ask.
"I use a Mac because I'm just better than you are."
Didn't ThinkGeek used to sell a little keychain device that was built to keep track of these things? I was looking for this a couple days ago, and couldn't find it for the life of me.
No matter how complex our security systems get, no matter how secure we can encrypt passwords to prevent brute force cracking of them, there will always be that human element of weakness. There will always be that one person who can be easily tricked over the phone to give out a password. There will always be that one person who will use their first name and last initial (ahem...half life 2 forum admin) as their password. So we really can't get top notch security without excellent education to these people on what to do in these situations.
I can't remember how may IT admins thought by requiring a password with special characters and numbers would make the system more secure. Sure it will add an extra 12 hours on a brute force attack, but if you don't notice a 8 hour running brute force attack you really are not a good admin.
... then at least a person has to gain physical access to the machine before they can compromise your account. Of course, we all know that once a person has physical access to the machine, all bets are off anyway.
It isn't as good as memorizing the password, but it's a hell of a lot better than having a weak password that is trivial to guess and compromise via the Internet.
The Future of Human Evolution: Autonomy
Is seven different 8 character passwords (with numbers and mixed cases) really too much to ask?
Absolutely it is. This is one of those examples of culture clash: the tech-inclined, and not. Absolutely it's too much to ask, just like asking mom or dad to "just open the command line.. it's so easy!" Yeah, it is too much.
I almost forgot what a password was
... to 'passphrase'.
Then tell your users to think of a phrase like 'my son's name is Jim', and get them to use it as their password.
Putting in pucntuation makes it harder to crack too. Although it still won't stop social engineering.
My password is weu@$9JKcpw34.
No one has ever guessed it.
The password has to be 8 characters, letter and number combo, not in the dictionary, and no repeating patterns. On the plus side, it doesn't expire.
What? Sticky notes with passwords on them aren't secure? Who would have guessed!
Passwords are always going to be flawed. Biometrics are the wave of the near future/present.
the major advances in civilization are processes which all but wreck the societies in which they occur - A.N. White
Here are some good techniques for picking a strong password. It helped me out. http://www.macosxhints.com/article.php?story=20040 920120520528/
...for biometrics to spread out a bit more. I want a retinal scanner! It protects data, and with any luck, saves my eyesight into the bargain!
Consciousness is a myth. Trust me.
The problem with stupid rules like chars+numbers is that people will still pick something easy to remember.... what movie is out now? "8 characters, needs numbers" oceans11 "8 characteres needs punction and numbers oceans11
Best password/pin ever:
[King Roland has given in to Dark Helmet's threats, and is telling him the combination to the "air shield"]
King Roland: One.
Dark Helmet: One.
Colonel Sandurz: One.
King Roland: Two.
Dark Helmet: Two.
Colonel Sandurz: Two.
King Roland: Three.
Dark Helmet: Three.
Colonel Sandurz: Three.
King Roland: Four.
Dark Helmet: Four.
Colonel Sandurz: Four.
King Roland: Five.
Dark Helmet: Five.
Colonel Sandurz: Five.
Dark Helmet: So the combination is one, two, three, four, five? That's the stupidest combination I've ever heard! That's the kind of combination an idiot would put on his luggage!
Vivin Suresh Paliath
http://vivin.net
I like
(Disclaimer: Please don't play this game!)
1) Take the following five passwords:
- password
- slashdot
- 123456
- password123
- [Username]
2) Attempt to login to as many slashdotters accounts as possible.
3) Post incriminating/stupid/slanderous/troll comments on behalf of users you now 0wn.
4) While the FBI are busy smashing down your door: Take a hammer to your hard-drive's plateaus, and run like a screaming idiot while you think about how stupid you where to follow my instructions.
(Disclaimer: Please don't play this game!)
P.S. If your password was listed above: Change it!
Whether they do or not, the FDIC auditors emphasize this policy strongly. If it's not written in stone yet, it will be.
To be honest, I approve such a measure. It disturbs me to think that our local bank's security policy might be more lax than Yahoo's.
Mercy was given to me by Christ...I must give the same to others.
Yes.
It is hard.
When you work in an organization when you have 5-10 passwords for different applications such as the network domain (email), web apps, etc; each requiring complexe passwords that expire every 3 months it become VERY hard to keep track of all these passwords and think of something else to replace them all with.
Are seven different 8 character passwords (with numbers and mixed cases) really too much to ask?
yes. when you're forced to change them every 30 days, and you can't repeat any of the last five, you quickly run out of things you can easily remember early in the morning.
I have discovered a truly remarkable proof which this margin is too small to contain.
If a company is going to invest in a hardware solution like secureid, what about using a biometric solution like fingerprint scanners instead? I know it probably isn't worthwhile if a lot of people are remote, but are the systems secure enough these days for local security?
form the article:
[...] Mr. Darby says. "I'm thinking that tattoos are the way to go."
nope, but try you could become a password piece of art!
Seriously most uses see computer secuity an IT problem not thears. They just want to get there work done. All the education in the world and all the bickering will not stop them from making stupid easy to guess passwords. Now if IT had the power to fire people who account compimised the corprate system because some hacker guessed there passord and got in. Then maybe it would be different. But IT raily has that power. if 1234 logs them in then they will use it because it is easy to type. If it was up to them they don't even want there login IDs and Many forget theres because they just dont log off there system.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
This goes along with my other pet peeve--password expiration. Here at work, the Windows passwords must be at least 8 characters, with mixed case and numerals. They expire after 90 days, but can't be changed for at least 10 days when new.
My password is written on my whiteboard.
For serious security, passwords shouldn't expire. They shouldn't even have to be that obscure. The security effort should go into making a brute force attempt impractical.
And the IT department needs to recognize that once someone has physicall access to the network, there's not much left to secure, anyway.
The problem isn't just with remembering a strong password that you use on a daily basis. What about those one-time sign-ups that you have to do from time to time, for example to request a secure email certificate?
Two years down the road, you've changed all your other passwords a dozen times, you get a new laptop, and now you can't remember the password to unlock your certificate -- which means you won't be able to read any encrypted emails people send you anymore, until you get a new certificate and they all accept it.
Asking people to remember a few regularly used passwords may or may not be too much... but asking them to remember infrequently used passwords certainly is.
Yes. It is. I'm supposed to remember which password goes with which account/username on which one of 4 systems I may have to access at work, plus root and regular user on the home box? Then there are the user/pass combos for here, k5, husi, tnr, the atlantic, wash post, ny times, salon.com, and a couple of other ones.
That's something like 16-20 user/password combos. Fortunately I can use the same username across multiple sites. But I use different passwords.
Oh, and those passwords are all on different change cycles. Some 3 months, some 6, some never. So not only do I have to remember the old passwords, I have to remember the new ones as well.
Hell yes, I keep a cheat cheet in the wallet.
Best Slashdot Co
What do you think of biometric security? Anyone use M$'s "fingerprint reader" Is it secure at all?? http://www.microsoft.com/hardware/mouseandkeyboard /features/fingerprint.mspx
my ten unique passwords are on my finger tips...you can even make combinations of fingerprint indentification for added security(user specified combination of fingerprints ex. left index finger + right pinky)
PasswordSafe, from Bruce Schneier's outfit Conterpane Security, is a great help. I can have multiple passwords to different things stored in it; I can even have "secure" machine-generated ones, and I don't have to remember any of them. All I have to remember is one good, solid password - the password to PasswordSafe. (If you will, it's my "root" password.)
Low: content sites like slashdot. I don't care if you get this passphrase, I will never change it.
Medium: logins for machine accounts, email and online shopping sites. I care somewhat if this is known, and I will change it yearly.
High: financial sites - bank and brokerage. I care deeply that this phrase is secure, and it is changed once a month no matter what.
I have about 6 different passwords. My longest, 20 chars, is for root on one of the boxes.
All of them are alpha numeric.
I created a random password generator, wrote them down.... memorized them..... then burned the paper.
-- TheMadRedHatter
while(1)
{
}
Ah, the story of life.
Frankly if my work was so dumb - I'd write them down too - or come up with a script that would do all of the logging in after the initial password. This is an IT staff problem, not a user problem... Please, one password is enough
I have mod points and I am not afraid to use them
incredible some slashdot users don't even use password
see this anonymous coward, shame on him
Click here or here.
Just something I thought was interesting. . . .
When things get complex, multiply by the complex conjugate.
That's why only have one account for everyone where I work. Username: admin Password: admin That way, people never forget!
Despite conventional wisdom, I've discovered you can blame a guy for trying. It's called "attempted murder".
...just put them all in an Excel spreadsheet, keep a copy printed out and stored in your filing cabinet under a folder labeled "Passwords" and don't lock the cabinet.
I gave my two weeks' notice and this was the first thing my bosses wanted me to do: write down all the passwords for them so they could keep everything on file.
Fantastic.
I recently started using Keepass, an open source, encrypted database for storing all your login/password information. Keepass uses AES and Twofish for encryption, and also gives you the ability to generate passwords, based on several criteria (upper/lowercase, special characters, extended ascii characters, etc.) All you need to remember is a "master" key that unlocks the DB.
http://keepass.sourceforge.net/features.php/
My Slashdot password (as if it needed much security), is 101 bits, and I couldn't tell you what it was if I wanted to. I just open up keepass, select "copy to clipboard", and paste the password when prompted for login info. Keepass clears the clipboard after 10 seconds, and stops functioning if you haven't used the program in 30 (?) seconds.
I think it's great. Up until now, I had four fairly insecure passwords that I rotated among dozens of accounts/sites. This is much easier, and MUCH more secure.
Breaks down into 3 realms
Something you have, something you know, something you are.
The best systems incorporate a little of each.
For a phone banking application:
A unique transaction number out of a booklet your bank sent you. (something you have)
A voice sample of you saying the numbers (something you are)
Your birthday (something you know)
Even though each of these individually is 95-97% secure at best, the combination is highly secure.
You'll be surprised by how dramatically your capacity to remember passwords will improve once this becomes a regular feature of your workday.
For added effect, construct horribly complex and impossible to remember passwords a few times every day. Over time, basic survival instincts and the urge to avoid the inevitable kick in the balls will overcome the limitations posed by your poor memory.
An Indian-American Hindu committed to non-violent thought/speech/action alarmed by the global explosion of radical Islam
How long before people making brute-force dictionary searchers use the internet to find popular phrases and make acronym brute-force guesses?
Ideally, you have a centralized authentication system like Kerberos, and one password is good for all the network services you need. Also, password storage utilities like Bruce Schneier's Password Safe or Apple's Keychain help a lot, since you can use a single master password to store (in crypted form) all those other passwords you don't want to remember.
nice try
Telling people to not use whole words as passwords because they might be included in dictionary searches seems like it might be a good idea, but the problem is that you usually wind up giving people an algorithm for password generation that might actually yield an even worse password. Where I work at, for example, the suggested practice is to use acronyms followed by numbers. You remember a pet phrase and extract out the acronym. "Eagles Will Beat the Cowboys on Sunday" might become ewbtcos42, some random number after that. Sounds good, but what's to stop an attacker from including acronyms based on common english phrases in an attack dictionary?
This is my sig.
Current security models require passwords to be changed every three months or so. On top of that the password cannot be one last 5 or so used. On top of that it must be different than the last password by x number of characters. On top of that the user must remember x number of passwords of which he/she only uses one on a regular basis. To complicate matters the passwords must contain numbers, letters (upper and lower case), and sometimes special characters (but only certain ones). The expectations placed on the worker are unrealistic and that is what leads to poor password management. Simple password with dongle (smart card, usb device, RFID chip, etc...) is a better solution.
Between Moore's Law and modern cracking techniques (dictionary attacks, hybrid attacks using both dictionary and brute force, and hash precalculation), nearly any 7-8 character password that will be easy for Joe User to remember is crackable in a very short period of time. Rather than blaming the users for security failure, we should be looking to improving the overall system.
There are a number of things that can be done. First, and most importantly, eliminate the use of protocols that pass usable credentials (password, reversable password hashes, etc.) across the network in the clear. This means no longer using telnet and FTP (except for kerberized versions), doing something with/about Microsoft's NTLM/LanMan hashes, and probably using client certificates as well as server certs for encrypted web traffic.
Beyond that, there are proven techniques that aren't too hard for users to understand. Time sequence tokens (i.e. RSA's SecurID) have been around for a long time and have yet to be broken except for when the attacker has access to the critical seed records. There was an article a while back (sorry, can't remember where) about a bank using a short list of PINs that they mail to the customers. Each time the customer logs in, they use one and cross it off. The system keeps track of it and automatically send a new list before the old one is exhausted.
The point here is that unless we get rid of the users, we will never be able to educate all users all the time. The best way to get the security levels that appear to be needed is to take the human element out of the process as much as possible.
I believe people are lazy or can't be bothered. After reading through I've realized that I have more passwords memorized than I care to recognize. All are alpha numeric, some consist of alternate case and a few require the shift + numbers.
1 - domain
2 - email addresses
12 - workstation logins at work
1 - instant messaging
1 - online banking
1 - home pc login
I really see no reason why anyone, through simple repetition of logging in can't remember a password no matter how complex.
I always keep with the same convention; what's so hard?!
...
...
...
1 2 3 4
Q W E R T Y
A S D F G
Research shows that 67% of those who use the term "research shows", are just making shit up.
I think the best approach is something like a Sun Microsystems Sunray environment where you can stick your SmartCard into any Sunray and instantly pull up your session from the server. Instead of having to "log out" you simply pull your SmartCard out of the Sunray, and that's the end of your session (even though it stays going on the server)
I hope this is rhetorical. Seriously.
I'm the sort of person who does this; I have many levels of password for different occassions and situations. But that's not the case for most people, especially in business. They don't want to have to jump through hoops to be able to use their machines. It should just work!
It's not about business culture needing to change to understand the importance of digital security; it's about people implementing digital security systems understanding a little bit about people and how they want to use their machines.
Use stuff that everyone is already familiar with, and that doesn't take brainpower to implement! Build one system for the masses who turn up to work, sit at a terminal all day and then leave, and build another system for people who actually need to access their data from off-site. Make the simple system very, very simple - not insecure, just simple - and 80% of this problem goes away.
It really, honestly shouldn't be a requirement for the vast majority of office workers to remember 7 different passwords. That *is* too much to ask.
That's pretty damn secure! I have been trying own root on your box all morning with "oceans12"....
Click here or here.
Obligatory Spaceballs reference goes here...
I have something in common with Stephen Hawking...
Good human pronouncable (thus easy to remember) passwords can be generated using tools like these it is even a part of debian (apt-get install apg). try it out, the generated password are generally very good, mix of cases, numbers etc.
My mom never taught me to sign.
Back in the day, my understanding was that an ASCII-based password could not be broken, and I believe that I applied l0phtcrack (and other programs) to test that out. Anyone know if brute force crackers are able to break ASCII-based passwords?
The necessity for the strength of the password is not necessarily relative to the importance of the data you are protecting which the user has access to.
In many cases any account can be used to run an exploit which can "root" the user. Once that's done, the attacker can use this as a jumping off point to get into other systems, get a copy of the registry (which may have domain admin password hashes in it) etc.
Unless you use your computer strictly for gaming, and there are no other computers on your network, a strong password is important.
I'd venture to say that if they don't need to write it down, and put it in their wallet, it isn't strong enough, unless they have the rainman's memory and calculation abilities.
difficult to remember with a wide variety of characters arranged in ways that do not spell or sound like an existing word combination = hard to crack
I work for a health conglomerate. Each one of the specialized programs run at the hospitals requires a seperate username/password. While the inital thought was greater security it has actually backfired in that with a simple perusal of a user's office you can generally fine all of their user names and passwords. That is why single sign-on single password is far superior, because chances are they can handle the one username/password.
...of course not. I keep mine under my phone.
qwerty
works everytime. Try to crack THAT one!
...and it should be known by now
One method I like is to pick a simple figure: a wavy line, a j shape, a box, a star or whatever. Then pick a starting character and 'draw' the password on the keyboard. For example, lets use a wavy line and start on e. Our 8 character pasword would be e4rft6yj. Or a box starting on f: fr456yhg. These passwords are hard to guess, easy to remember, easy to make memorable variants of, and quick to type.
- None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
Here we just let users pluck a password out their asses and keep it forever when I started. It had been that way since the dawn of time at this company and nobody wanted to change it. Admittedly we don't have much in the way of truly sensitive information but it was pretty lax.
Finally we said ok, this is going to have to change in some way and we instituted some basic requirements. Minimum number of characters, must contain at least one capital letter and at least one lower case letter. Very simple right? Not much more effective than we had before either. Say a users password had been "austin" before the change. That user simply changed it to "Austin1". I swear I think sometimes every knucklehead working here did that. At one time the support people here (all two of us) knew everyones password by heart. Now when we aren't sure we try the old one with a capital letter at the beginning and the number "1" on the end and it works most of the time. When we get to the point where they have to change it again I'm betting it's going to change to "2".
We've talked about forcing them to get complex but all that's going to do is generate a couple hundred post-it's with passwords written on them at the various desks.
Appended to the end of comments you post. 120 chars.
The whole idea of computer and network security in today's world is fundamentally flawed. Everyone on Slashdot knows that the Internet was not designed to be secure. It was designed to collaborate, share data and to share computing resources.
One cannot turn something into something it was never designed to be. One can only bend and twist the system so far... and the Internet, with all of its on-line commerece and banking, has been bent and twisted to the breaking point. Perhaps a total redesign is in order?
Also, I take issue with all of the "Computer Security Professionals" who attended some week-long (often less) course on network security trying to convince all of their clients they consult with to use 16 char passwords, encrypted file systems, etc. Most Mom-&-Pop businesses do not need CIA-like computer security. They need patches, AV and basic firewalls, nothing more. And all of this frantic, absurd advice only causes lost productivity as it's far to complex and inconvenient for business.
Mail servers used to forward every bit of mail that came their way. It was considered impolite not to. Today, it's considered SPAM to run an open mail realy. What would we all do if routers stopped forwarding packets? See what I mean? The Internet is broken thanks to all of the new "security" threats that used to be considered normal operating procedure.
Of course, we all know that once a person has physical access to the machine, all bets are off anyway.
speak for urself moron i found some sweet stuff on freshmeet so mi laptop is safe no matter what. mb u should try 2 learn about things b4 u talk idoit
Bah, who needs passwords. I make my security out of legos.
Heh.
Them: So what do you want the your password to be? Me: 1
God spoke to me.
Don't forget that onerous password policies actually make your productivity and security go down. Scenario: New password policy requiring a new password every month and a password with 1 special character, 1 capital letter, 1 lower case letter, 1 number, at least 8 characters no duplicated characters, and not more than 75 percent similar to any of your last 10 passwords. Your salesman is out of the office on a regular basis and needs to download the new data sheet before a customer pitch and can't remember the new password he chose 2 weeks ago and hasn't used since. (Lost productivity/sales) Your help desk agents now get 5X the password reset requests as they normally do on a Monday morning. The call wait times have gone up to as much as an hour. The other job functions they perform get neglected, causing incresed system downtime. (Lost productivity) The harried help desk agents no longer ask all of the verification questions they are required to in order to decrease their call times. Callers outside the bank claim to be harried salesmen in order to get access to confidential documents. (Decreased security) Anyone still think more complicated passwords are the answer? Biometrics (Voice for phone, fingerprint for physical access, and either for data are required to allow improve security without destroying productivity)
The fundamental maxim of security:
Security is a process, not a product.
"Destroy science and religion. Science would re-emerge exactly the same; but not religion." - Penn Jillette, paraphrased
There was an interesting blog article by a Microsoft PSS employee about his recommendation for choosing passphrases as opposed to passwords. Worth a read. The main problem is a number of online sites don't allow spaces in passwords or limit the password to a short number of characters. For example, I tried to create an iTunes account with a phrase from a Pavement song but it wouldn't let me go over 32 characters or have any spaces in my password.
I could not justify my existence if I were a turkey farmer. Would I terminate myself? Undoubtably, yes.
My solution to secure passwords is to look around my office, at my bookshelf, at the documents/notes/references on my desk and pick an unusual set of words, hAx0r the spelling, and mix in some special chars *$&% as appropriate and out comes a secure password, with locational mnemonics if I forget it. If someone manages to brute force 3tt3r_4Tran77 then I have got lots of other problems. Fortran77 w/ Numerical Methods by Etter if you're curious, and no... it's not actually a password in use.
Predictably, passwords were scrawled on post-it's and under keyboards. It had become a mess, and the users were frustrated. In open disobedience to corporate policies, we've allowed shared passwords*(nobody can remember 75 passwords!), and relaxed the password change interval. Users are happier, and I see fewer post-its on the monitor.
If corporate would listen to us, we'd relax things further. One thing we have done, that works well, is to monitor the devil out of logins. If you're going to hack a password, you'd better guess it correctly the first few times, or the security goons will be heading for your cubicle with a pink slip in hand. An agressive anti-hacking policy and monitoring seems, to me at least, to be a better solution.
*Actually, we can't officially allow shared accounts, but we can break the scripts that check for such things!
I use the open source PasswordSafe The original was written by Bruce Schneier who worked on an AES finalist and runs CounterPane Security and writes the CryptoGram Newsletter
The program saves all your passwords in an encrypted file, which you then keep on your USB keychain. You only have to remember one password to open the safe, and then you can copy/paste your different username/passwords to the site that needs them. As long as you keep the data file on your keychain (and keep that with you) then you should be fairly secure. You can alse make all your passwords 12 digit random alphanumerics (though some idiotic places limit your password length, never figured that one out...)
The University of Texas at Austin recently implemented an "enhanced" password qualification system for their UTDirect service and required all users to change their passwords. On the surface this looked like a good idea. It required all passwords to include a letter (no requirement for upper/lower case), a number, and a symbol. No part of the password could contain a word from their (very extensive) lexicon.
As I used the system, I discovered that these rules made it almost impossible for me to pick a good password that I can remember. For one, the requirement that no part of the password contain a word meant that the password had to be complete jibberish with symbols. To add to this, the system is not one that someone would use frequently, so by the time I had to use it a second time, I'd have already forgotten my password. In fact, iirc, I've had to reset my password each time I logged into the system. I have already written to the IT department but am still waiting for a response.
As someone who has trouble remember exact phrases, I find that the mnemonic methods that are suggested in the article do not work well for me. I find myself looking around my computer for phrases to use. (The security risk of that is obvious.) In the past, I've always picked a "weak" password and padded it with numbers or characters to make it strong. Can someone tell me why that is a bad thing to do? As a suggestion, I think there should be a password scoring system that rates how long it would take to brute force a user's password using an optimal algorithm, then allow users to incrementally strengthen their passwords until they are acceptable.
This is something I recently thought of (while studying human memory in a psychology course, actually). With some effort you can memorize a gibberish string of characters - perhaps to simplify this task you can make the task phenomically easy to repeat in your head - e.g. h@pabl8x... It would not be too difficult to commit a rather long string to long term memory.
Anyway, once you have a well memorized long string, you could "generate" multiple passwords from it by using different parts of the string. Need a "new" password? Pick a different part of the big string, change your offset, substring length, etc.
While I have several passwords, the main thing turning me away from changing passwords is that I will have to commit a new password to memory. With this technique (which I have not yet tried myself) you wouldn't have to really memorize anything new.
Why don't you have at least an 8 digit password?
It just takes a little effort. I wrote a short HTML page telling users how to create a good password and then
recommended they keep their password in their wallet
That is, until they had it memorized. Should only be a week of use (with daily login). And then I told them to eat the paper.
The issue of hard-to-crack passwords v. ease-of-use depends on the attack vectors, too. A login that's externally accessible and can be brute-attacked with good speed should be complex.
Oh, and I reminded the users that if their account were compromised because of insecure password, that it could devalue their investment in the company stock.
Not necessarily - if you block off the BIOS (so it can't boot from CD), then physical dismemberment may be required. And that's not hard to watch out for, if people are in the office (compared with a "trusted individual" using Knoppix to access Windows' SAM file).
The Signal/Noise ratio can be improved in two ways. Remaining silent is the OTHER way.
Right. Who needs the password under the keyboard. If I'm at the keyboard with a Knoppix disk, I'm in. This is actually a great way to recover data when somebody leaves the company and doesn't pass on knowledge of a computer's usernames/passwords. Get anything valuable off the drive, and reformat.
Nothing to see here. Move along.
The article said (I read it on paper yesterday) that people can't remember lots of good passwords, and can't even remember one if it changes all the time. Therefore, they choose easy to crack passwords, or write down good passwords.
The article has this quote:
and this one:The article doesn't take the silly position that the problem is the user, or say that security isn't being taken seriously. It does say that because of the fallible human memory, constant password changes can actually lessen security.
Maybe it's time to give up on the password idea, and go to something else, like a hardware key. Maybe it's time, also, to put airgaps between the internet and computers with sensitive data.
See what I've been reading.
The problem with open source operating systems is that since everybody has the source, anyone can trace passwords whenever programs access them. Is it a wonder that Linux is the most hacked into operating system in the world? I think not.
Having physical access usually means they can compromise the local machine (though perhaps not without attracting the suspicion of others nearby, if any); it does not necessarily mean they can compromise whatever network account, PGP key, etc. that the post-it under the keyboard might contain a password for.
If passwords absolutely must be written down, a better way might be to keep half of the password at the terminal and the other half in one's wallet, making sure that the password is long enough that neither half is easily guessable. Alternatively, rarely used passwords can be stored someplace that is protected (and preferably encrypted) by passwords which are more commonly used (and thus more easily memorized).
It isn't that difficult to create passwords (for example, by using a pronouncable-password generator, or using the initials of a long-ish phrase (or the phrase itself) that, while not as secure as line-noise-style passwords of equal length, are still substantially more secure than "12345", "letmein", or the name of the company. It helps when the system doesn't impose stupidly low maximum password lengths, of course...
At work they require us to have those unmemorizable passwords, so I just tatooed it on my cock where it's always 'handy'. Had a bit of trouble when they increased the length from 6 to 8 letters. Those last two letters hurt quite a lot.
This last paragraph is pricless. Albeit, a bit too strong for a public forum.
May I suggest that if you ever choose to follow this same approach for your private PGP key, you downgrade your security to 8 bits?
I have about 5-7 different passwords at work. Unix1/Unix2/windows/Notes
and the web based.payroll/timecard/training/
etc...
The problem is they
1. All have different rules (8+ char upper/lower etc).
2. Have different times to expire
3. Have different cycles (ei can't use last 7...)
4. Have different tolerances on how oftern you can get them wrong
Life was good until step 4 was implimented. Unix machines lock you out after 3 bad attempts.
so you have to call a sys admin
Also implimented on the web based timecard system. Again 4x wrong and a phone call is required. Not fun to be locked out of your timecard.
Its very very frustrating, mostly because I used to be able to cycle through my 8 passwords with relative impunity and not complain.
The company has yet to embrace a consistant password policy.
Sure you might say that 8 characters are easy to remember and if you form sentences with them you have some good help remembering them. However this is only true if you have to remember few passwords and use them frequently. As soon as you start to have lots of passwords (remember internet, where each and every webforum wants to have a password of its own), some of which you don't use all that frequently, you are basically lost. For sure you will forget at least some of them, people simply arn't build for long term memorizion of long obscure combinations of letters or sentences, simply doesn't work.
The throuble is really that hardware hasn't catched up, or well it has, but not on the common mans computer. Things like HBCI demonstrate that a relativly easy to use secure way to handle logins is possible. Why not have a smartcard to handle all your logins to all webpages and stuff on the internet? Have the smartcard protected with one passphrase, not a different passphrase for each webpage and people would have much less throuble keeping stuff secure. The card would simply something to be carried arround like a key. Sure, you might need a dedicated reader for them to have it really secure (ie. protected against keyloggers), but if produced for the masses it really shouldn't be that difficult to make it rather cheap, with new PCs it could even be build in.
Technically its really not that difficult to allow people to have a secure way to handle logins, the throuble is only that people would need to agree on a standard, which is as always way more difficult then to build such a thing in the first place.
Why do people continue to have this notion that any password can be cracked in a couple months. Adequate lockout techniques along with monitoring of failures means that it could take much, much longer to guess a password.
"All the education in the world..."
Dude, you need to get a little slice of that education pie.
SPELLCHECK!
I won't even mention the horrid grammar. Okay, I will.
Admit it, you "forget" your password on purpose sometimes, don't you.
You sick bastard.
IMO, it's not an IT problem. It's an information security problem.
The two things are subtly different. It's easy to explain to someone that there may be paper on your desk which has confidential information on it which must be securely disposed of. Failure to keep such information secure can in many businesses lead to disciplinary action. This is something which has been the case for some time, it's why shredders exist.
It's not a great leap to explain that the computer system gives access to equally sensitive information and thus must be similarly protected. The IT department can do some things about this but they can't physically stop you writing down your password on a post-it. Therefore, not only does there need to be a formal security policy, it needs buy-in from management and HR.
To put it another way, if the accounts department thought you were regularly trying to fiddle your expenses, they wouldn't approach you directly. They'd go to your manager, who would speak to HR etc etc. You'd expect management to take such allegations seriously, investigate and take action as appropriate. Similarly, a security policy needs management acceptance so a similar procedure can be followed.
I'm not suggesting you try and get everyone who uses their surname as a password sacked - you'd have nobody left if you did that - but a combination of education together with the ability to back up any statement of company policy regarding secure passwords will help.
I perceive part of the problem to be the fact that everything online today requires a password, trivializing the importance of passwords, and forcing people down a path of selecting weak passwords as a result of over-exposure. I've taken to using two classes of passwords: the important stuff (banking, shopping, network authentication, etc.) where identity counts (because there's something of value at stake) gets a strong, unique, rotating password. Everything else (mailing lists, forums, bogus email accounts, etc.) gets the same shared password - easy to remember, nothing valuable lost if its compromised. Please don't capitalize on this confession by tring to steal my valueless identity.
I couldn't beleive my bank would do such a thing, it was obvious when they asked for my 9 digit account number and then to enter my last four digits of my SSN.
I went in and raised bloody hell, I mentioned every doctor and dentist in town uses SSNs, the Water company wants SSN's it's illegal but they do it anyway because people don't know their rights.
Anyway I told them that no part of a SSN should be used as a account name or password as older folks it's easy to guess based upon where they were born. Plus password crackers can be used to guess people's dumb passwords like Scruffy or 12301978.
So they immediatly made changes and allowed people to change their online account names and passwords at will.
The stupidity of people, especially IT people working at some banks, never ceases to amaze me.
Then they use M$ for their internal banking and ATM machines, just plain STUPID!!
..that seem randomly-generated to the end luser:
Pick a passphrase, take each letter and then substitute the letter/number immediately above and to the right of it.
In other words,
PASSWORD becomes _WEE305R
Slashdot becomes Epweur06
Goatse becomes Y0w6e4
Tubgirl becomes 68hy95p
etc.
If your passphrase already contains a number, just use the extended character for it ("5" is now "%", etc)
Religion is for people afraid of going to hell.
I have the same problem with work, in that they require a password change every few months.
Like most people, I have a few passwords I use for everything. My work password goes through 4 different ones (Windows won't let you reuse any of the previous few passwords, but it forgets after 4 and you can restart)... but those are just simple keyboard variations on one char, so I don't get lost.
E.g., if my work password were 1*euFId I'd just revolve through 1*euFOd, 1*euFPd, 1*euF{d (just shifting that one character right-wards on the keyboard IOP{). Then start over.
That takes the memory issue out of it, and I don't have to write down that password anywhere.
My other suggestion is to learn passwords *on the keyboard*. Unless you switch DVORAK-QUERTY for some reason, you can just memorize where your fingers go, and a few simple words -- skewed -- can make a pretty tough password. Something that's part real-word, part keyboard pattern, and with the shift key held down somewhere in there (which has the benefit of turning any numbers into special characters) can work really well but still be easy to remember.
Hard to guess, easy for me to "remember". If someone gets my paper (say I lose my wallet), it is still not simple to figure out what my passwords are, or even what the heck that little paper is. Shoulder surfing doesn't work too well either, unless you can memorize the whole card and then figure out which word I am using (it would be easier to try to watch me type the password on the keyboard then get it off the paper. Luckily I type fast and get annoyed when people stand over me while I type a password
I Am My Own Worst Enemy
If you are determined to keep a "cheat sheet" on paper, you can enhance your security immensely if you write in a non-Roman character set, as long as most of the people around you aren't familiar with it.
It's easy enough to remember that in your personal code, the Hebrew "aleph" corresponds to "A" and "beth" to "B". And so on. Just don't try using this technique in Tel Aviv.
Monolingual geeks might prefer to use ASCII or EBCDIC codes instead. If a non-geek sees your piece of paper with "656667" written down, he will probably not figure out that you are coding "ABC". For additional obscurity, you could use octal or hexadecimal ASCII codes.
Yes, it's better to keep it all in your head. But when that's not realistic, it's good to know that you can apply your knowledge of Devanagari or Korean or ASCII to a worthwhile pursuit.
I guess my question would be, why worry about passwords? Today, if I wanted to gain access to someone's account, I wouldn't bother trying to crack their password. I can get in faster through social engineering (get them to just tell me what their current password is) or, if I don't want to risk direct contact, infecting their computer with malware that lets them enter the password and then uses their current credentials. Note that the latter is even more effective in environments that have gone heavily to Active Directory and single-sign-on, since once I get my program running under the logged-in user account the system itself will handle most of the authentication for me by design.
All passwords are not created equal but I have yet to find an IT shop that didn't apply the same password policy to everyone. Thus, if I come up with some really hard to guess password that is constructed using typical techniques (e.g., take a phrase, take the first letter from each word in the phrase, substitute numbers and special characters for some of the characters, randomly mix case on the remaining alphabetic characters), I still get my password expired after 30 days the same as some bozo who uses "password" (or their name, or their SO's name, etc.) as their password.
So now multiply that seven different passwords by 12 and then assume that some of the systems won't be accessed as frequently as others ("Now was the mnemonic for the server? 'Mary had a little lamb?' Or was that last month's? Or is that the inventory database? Or was that junior's new password?").
Yes, it is way too much to ask.
They that can give up essential liberty to obtain a little temporary safety deserve neither safety nor liberty.
Ben
What I've noticed lately is that it's stupid policies rather than stupid users that cause the problems.
For example, my current employer requires a monthly password change, minimum of 8 characters, one must be in caps, at least one number and one punctuation mark. 13 months worth of history is also kept.
I have 4 strong passwords that I use regularly (and I come up with new ones every year or so), each consisting of 16-25 random characters, numbers and punctuation (think pound the keyboard and select a bunch of characters from the result). I can't use them because they repeat too often.
The policies also prohibit using the same password multiple services like email, NT Domain logins, *nix servers, web applications and the like. The result is that I have to generate some 20 passwords per month.
What this does is force me to use stuff like "WebApp-01!", "NTLogin-01!" just to be able to remember everything.
I wish we'd switch to RADIUS.
There's so little difference between politics and jihad lately...
If we want to have password security, it would help to have password sanity.
-------
And we also have a cancel button...in case you don't want toast.
In most cases the password aging system is only having a buffer of your five last passwords or so, which means that you can cycle through five dummies and then go back to your pet password again!
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
In Korea, only old people use passwords.
Having physical access to the machine isn't always enough. Sure, given enough time, you could access anything on it. But you might not get that much time.
Also, doing something like stealing the hard drive, or changing the local admin password, doesn't give the attacker access to the file servers, etc that the workstation is connected to. Only being able to log in to the network can do that.
All biometrics do is give people incetive to steal your body parts! I foresee in the future you'll be standing in line at the grocery store and you'll go to pay for it with the retinia scan, only to find out that someone just made off with your eyeball!
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
It would be interesting to mix passwords and biometrics. In medium security settings, you could simply provide the requested information directly using the keyboard.
Linux 2.2 (pts/1)
username: cmdrtaco
cock size: 2inches
Welcome to The Lunix
>
I don't know a hacker in the world who'd touch other people's chewed gum.
UTF-8: There and Back Again
I gave up on password security after working for a health management company that had name/same name as login and password on the SQL servers on real IP's. "they were behind the firewall!" BUT THE FIREWALL IS FORWARDING ALL THE PACKETS TO THE SQL PORTS!
... no, instead the password goes on the monitor.
The best part was after sending a note around on the new policy of 12 digit case sensitive alpha numeric mkpwd (or mkpasswd i forget which one is which) that were FORCED on the user. The 2nd point on the note was that "PASSWORDS ARE NOT TO BE STUCK ONTO MONITORS USING YELLOW STICKIT NOTES."
I found 42 examples of where the note was posted on the bulletin board the password was changed back to flully or dave or whatever typical passwords they usually used, and then that was on the monitor with a message like "Darlene, look at my case files, my password is DAVE" -- even though she can look at them from her user account and thus TRACK CHANGES FOR COURT LIABILITY
The real kicker was that they worked with a major canadian bank and as such had a Lotus Notes over SHIVA connection into the bank core network. The bank was furious that our insecure network was allowed to connect to their with Shiva being run on the same windows 98 or ME (not my idea to install that, believe me) machines that were running with no admin kits, no policies, no proces watchers or anything else resembling security -- and when I arrived no updated antivirus and no patching.
No wonder, especially since the bank used ultra-hard to remember 6 digit capital-letter + numeric passwords. Once again the 50-something women couldn't remember those so they were on the monitor to.
When they finally did get rooted (and massively I might add, the best was the windows NT 4.0 SP2 unpatched server which had a IP in the external range and an internal IP with routing turned on and telnet with a guest account enabled.) it was because of "evil hackers intent on disrupting legitimate commerce"
In reality the problem is consultants who want to get things rolled out as quickly as possible. The next problem are managers who are more worried about the whining of their staff in regards to the ENSLAVEMENT of having to remember 10+ digit alpha numeric passwords (I have trained myself to do it in 8 looks.) and not be able to run their solitaire web games at lunch and things like that.
The next problem is that even with passwords being there there are countless machines where people just go around the password mechanism using exploits.
Personally I dictate anyone using my personal mailserver, etc. use 12-byte alpha-numeric case-sensitive passwords generated with whatever that app is mkpwd or mkpasswd, I usually hae to type it twice to get the one I want. They work really well and take forever to brute force.
I've tried playing with other mechanisms like finger print ID (at a old venture place I worked at they spent 2 years messing with this) and smart cards and the like. Nothign has really been satisfactory especially when you add any degree of road warrior (which is the place where security of IP and passwords is really important) the solutions are generally worthless as it is VERY expensive and inefficient to give authentication validation hardware to even a road warrior to carry with them.
Also in teh end many of the security validation tools work using internally a hash that is effectively a password anyways. Use the scene in star wars return of the jedi as an example when they are breaking into the power station for the shield. Enough blaster will open anything. Inside most fancy locks is a acuator which if given power will open the door. Thus a however expensive panel with fancy computer inputs and strong passwords can just be torn out and a battery with two wires used from k-mart in its place. Keep this in mind.
Additionally, if you've ever seen the output of dsniff running on mirror channel traffic on a master switch in a large IT shop the passwords just scr
--- ask me about nihilism, I will have nothing to tell you.
Is it even possible to crack passwords any more? With shadow passwords, you simply can't get the password string to crack, and you can't just brute force at the login prompt, since it waits five seconds between tries. To get /etc/shadow you have to be root anyway, so what's the big deal with creating "non-guessable" passwords? It's not like any hacker would actually try more than a dozen at the login prompt. If he does, he'll just be locked out and reported. If you look at the descriptions of how computers are hacked these days, it's never by guessing passwords. It's usually done through a poorly written web page, where a buffer overflow can get you in (why don't they run the webserver on a chroot?).
USB thumb-print scanners or voice print is not fool proof but a ton better than user who still use "drowssap"
And it's not like you can leave the caps-lock on. People are stupid, they take lightly computer security, unless there is some IT or IS tyrant around to hound them. The catch is you get to support those that can't keep up. They forget passwords or get them confused. They have to write down login proceedures, or ask their peers. All things that introduce security risks. These sorts of flaws have been here from the start and are the nature of securing access to data.
So how's this for a login proceedure... Put your thumb on the little glass box, get to work.
"When the going gets weird, the weird turn pro" -- HST
Fine. One of us folks who care about security will take your job, then.
One guy I know makes drum beats.. something that, by comination of speed and use of both hands on the keyboard makes a nice beat.
:-)
No way in hell to reproduce it, even if you hear the beat, as you would have no idea which keys he pushed.
No way of sneaking a peak, as the beat is "up beat", too fast and way too long.
No for everybody though
Is that you?
Interested in a Flash-based MAME front end? Visit mame.danzbb.com
oexeo's slashdot password is... 12321?
There you are, staring at me again.
Have people use a credit card for access and you can bet they'll protect it with their lives. Card swipe at your keyboard to log in and youhave instant secruity. Seriously, I visited a company that used badges for data center access. People were constantly losing them, loaning them, or leaving them laying around. They switch to credit cards and all those problems went away.
Sorry..
digital security is no different from physical security. When you feel convinient abought to not lock your door - fine. There have never been break ins in your neighborhood, if there has been, actually nothing except fiew bottles of vodka has never been stolen.
If data is not important enough why should I spend my time or my money to protect it?
Is seven different 8 character passwords (with numbers and mixed cases) really too much to ask?
For the average Joe User at his cubicle, Yes.
The Ubergeek will be able to memorize all of them, front to back. Joe User from the advertising department, cannot. Just because you successully memorized 80,000 different acronyms / alphanumeric passwords doesn't mean everyone else can.
Not everyone has a rock solid memory like most IT people do. I believe that's pretty much 95% of why most of us are employed. - not for our stunning good looks, but because we can remember stuff better than other people. Joe user still may be having difficulty memorizing the steps it takes to check his email. Add a password consisting of "$5i5k3LKmb0j" to the equation, and you have a problem on your hands.
I'm not trying to flame this guy, but he really needs to understand how the brain works, and the sheer amount of things regular users have to remember on a daily basis. It can get a little overwhelming some times.
Even better is to integrate the PIN pad onto the card itself, and use encrypted communication between the card and the authenticating server. The card reader would just see encrypted traffic.
Also works against hostile ATMs.
A solution like this exists, see Cypak PIN-on-Card
I work in a big company and there are so many different systems that require passwords it is beyond a joke. I have twenty different systems providing me with 10 different variations on account name, and numerous limitations on passwords. Some accounts simply have their default password "welcome", some have a random string, some require a new password every month, some remember the last three passwords so you cannot repeat.
:)
So I have given up, I have a big piece of paper taped to the wall with all my accounts and passwords on. Yay!
But the real thing is the cost of wrong guesses. If you get the hash from a conventional /etc/passwd, the cost of a wrong guess is a few dozen CPU cycles (ie, nothing).
If there is a holeproof 3-wrong lockout, then the cost of wrong guesses is extremely high, and weak passwds can be tolerated.
that users are dumb.
Writing down a password and making that password obvious are not the same thing. Just use inconspicuous information to hold passwords.
For example, on my desk are:
- a plastic cartoon character who's name and gesture is a password
- a post it note with my boss's address which with a small transform is a password
- a password in plain text written on a cable tag, attached to an ethernet cable in the wall
Likewise, one of my ex-girlfriends uses a sheet of plain text phone numbers she doesn't want anybody know she has... all backwards with the dashes in the wrong place and the word "part numbers" on the top.
Anybody that can think for a second or two when they make up passwords or when they have to memorize them can easily do this.
Joe Mitnick isn't going to find them, the CIA might, but they'd have to try a bunch first; and the kid hired to vacuum the floor sure isn't going to figure it out.
Users on my network have to change their passwords every 90 days, unless the complain about it in which case I ask them to make one up that has numbers and letters and they don't have to change it anymore.
Point is it doesn't matter if your password is a randomly generated 18 character string of letters numbers punctuation marks two snaps and twirl if the underlying fapplication is teh shit.
Otherwise just get a good PDA app and store the passwords in for as many as you need. I have hundreds and I don't really care how difficult they are.
Users are lusers. Lusers are StupidPeople (tm). StupidPeople are StuplePeopid (tm).
The way I see it, changing a password every month or so isn't too much to ask. Neither is creating a well-chosen password. Neither is remembering it. People don't have such a hard time remembering a locker combination. Nor do they have that much trouble remembering phone numbers, bank account numbers, and all sorts of other stuff. What the hell is so difficult about remembering a password that is a mere several characters long?
You wouldn't hide the key to your house under the doormat just because you might forget your keys somewhere, would you? Or you wouldn't write your home address on your keys, just in case you forget where you live, would you? Why in the phuc would you tape your password under your keyboard, or something stupid like that?
The way I see it, most of the problems in the world stem from the failure of our education system to teach anybody anything. It's not enough to learn reading, writing, and 'rithmetic. You have to learn how to teach yourself things. And schools don't teach anybody how to do that.
My friend is a chef. His employees can't even put food on a plate properly. How many times he has had to explain to them how to put the food on the plate, and they just don't get it.
My other friend works in a machine shop. How many times he has had to explain to his retarded employees that they have to measure and make sure everything is straight before drilling a hole. And they don't get it either.
People are just so stupid because they have gotten by in school, just doing the minimum to barely get by, not learning anything, and allowing their brain to stay dormant. The school system promotes this by allowing students to earn "A" grades for "F" work, and just passing students from one grade to the next, even though they have made NO achievements to show for it.
This continues in the career, where people expect to do shit work, but when June comes around every year, they expect their raise. It's the mentality caused by the failure of the education system.
And this applies to passwords as well. It's not that hard to remember a password. You can decide that certain numbers and symbols mean certain things to you, and then spell a word that only you would understand with those symbols. Then, all you have to do is remember that word. But people are either too dumb, or too lazy, to do even half of that. They'd rather just bitch and moan, because security isn't exactly convenient.
I was contracting for a major services company and popped into another department of the building to visit an old friend who worked their full-time in the IT department. He boasted about how he'd drilled security in the heads of all his users, how they all had secure passwords and how they all locked down their PCs when they stepped away from their desks, etc. So I bet him lunch that I could get into his network in less than five minutes, to which he replied that if I could then he'd be buying lunch all week.
It took me less than sixty seconds to get in. I just walked up to a nearby desk that had a passworded screensaver running, turned to the guy sat at the next desk and said "Hey, I'm from IT and I need to do something on this PC, can you tell me what this guy's password is so I can get it done?", and it was mission accomplished. I wasn't wearing any ID and the guy certainly didn't ask for any either. And that wasn't an average user I was dealing with, that was a security consultant: if those guys can be that sloppy, anyone can.
"Accept that some days you are the pigeon, and some days you are the statue." - David Brent, Wernham Hogg
Perhaps integrate science table codes into your password or other known reference "codes" to known items (such as dates for historic events). What's the number for Einsteinium? Use that in your password...
E SI3NotHill "
For example, the following uses the atomic weight of Einsteinium, year the Human Genome Project completed, traditional formula for Einsteinium (III) iodide, and a hint that the formula both references the III iodide and not II and is not the Hill system formula.
"My252BrainWasMapped2003WithThe3rdColor
Of course, this password is incredibly long, but things like dates, chemical formulas, periodic table mappings, physics formulas, or algebraic formulas, all provide a concise means of generating short passwords that can be looked up if you ever forget them.
Similiar to encryption, you have now encoded your password with keys that are easy to remember, or lookup if you can't remember (Date of Mt. Rushmoore Dedication ceremony + Formula for Benzene).
--I smoked my sig.
One thing that I think a lot of people are missing is the fact that passwords are not a business enhancement. This is not a productivity booster or natural business flow.
A lot of IT time is wasted on password setup, resetting, etc. including the individual user's time.
Ideally, what should happen is that the user should not have to do anything to start a process, but just start the application and bingo, you're securely logged in. (I am talking about internet and LAN activity, not ATMs). Biometrics are a start, but I think we've a long way to go, but our computers are going to have to recognize us as soon as we approach and adjust our security profiles as needed automatically without any user intervention.
if you block off the BIOS (so it can't boot from CD), then physical dismemberment may be required
Until someone puts a little PS2 or USB keystroke grabber on the machine.
rage, rage against the dying of the light
Just implemented SecurID at my job and so far it seems to be quite good. We require a username, password, and the token code. It was a little bit annoying at first, but I think people agree it's a lot less annoying than a overly agressive password policy (10 characters! letters numbers and symbols! change every two weeks! never reuse a password!) -- and probably more secure.
Cheers.
What you need to do if you're the admin at a big company is go around one morning before anyone gets in and have a quick look for post it notes, log in to any account you see and stick a big fat message for them saying "your data has been stolen, you're in deep shit" (oh and take the postit) then sit back and laugh at all the near heart-attacks you create (probably a good idea to clear this with your boss first). Most people will realise what they are doing wrong and stop writing their passwords down. I think in an office environment where people trust eachother and have their own desks you have to accept abit of lax security, aslong as no-one can get into the building its not that big a deal. Passwords for public servers etc should be kept tight though - if someone does get in and steal your customers data you're liable under the Data Protection Act i think..
This comment does not represent the views or opinions of the user.
I give you 3 weeks before you are r00t3d like a dime store hooker.
To quote myself, when I need a password, I use a utility called
/dev/random | mnencode
/etc/shadow is your friend here.)
/dev/random | mnencode
mnencode this way:
$ head -c 4
And get three word long results like:
iris-farmer-benny or person-london-multi or jumbo-joker-basil
Reasonably easy to type and remember, yet a significant 32-bits of
entropy--far better than most passwords. (Enough for circumstances
where you don't have a motivated foe with the opportunity to brute
force it--a non-readable
To find mnencode see . It is really
a carefully crafted word list and two complementary programs, mnencode
which turns binary data into words intended to be pronouncable,
spellable, and unambiguous, and mndecode which turns those words back
into that exact binary data.
To move offtopic, for really paranoid security, you can do:
$ head -c 16
And you get 128-bits worth of entropy as, for example:
algebra-mask-armor--jester-cupid-fossil
secure-detail-barcode--gray-judo-safari
Take out the new line, put in single dashes throughout, and you have a
long passphrase that is really secure. But it turns out that a
passphrase with 128-bits of entropy is pretty unwieldy. It gets hard
to remember (was it jester or joker?, secure or secured?, etc), and it
is suprisingly hard to type blind. I use exactly one such passphrase
(that I don't type on open wires or keyboards I don't control), but I
do use it to encode my other passwords.
-kb
P.S. A passphrase with 128-bits of entropy is enough that even a very
powerful and motivated foe will not be able to bruteforce it any time
soon--if ever--and will instead resort to bugging your keyboard,
hiding a camera over your keyboard, sniffing RF-emissions, rubberhose
cryptanalysis, etc. For example, suppose the NSA really wants your
key and can try a trillion possibilities a second, it would still
take, on average, over 3-months crack a 64-bit passphrase--which is
well within their abilities if they are really interested. However, a
128-bit passphrase is 18,446,744,073,709,551,616 times as difficult as
that, something even the NSA can't accomplish. Note that this is for
a symmetric key, public keys work different and need to be much longer
for equivalent strength. A 4K bit public key can be manipulated
pretty easily by computers these days and is likely extremely
strong--depending upon possible breakthroughs in factoring numbers or
building quantum computers.
Luckily I type fast and get annoyed when people stand over me while I type a password :-) ).
Typing really fast, but poorly, with five or six backspaces per password, while working in a dimly lit room, on a terminal with 9 pt font in green on a black background ...is all the security most of us need.
I thought our help-desk guy might have been the original BOFH, but I was wrong. Even he wouldn't have thought of that. Man, you are harsh.
/users/random_user/*.ppt"]
[Suddenly the phone rings, disturbing the BOFH's game of Half-Life]
[random_user]Hello Help Desk? I forgot my password. I have to print a powerpoint document for a briefing I am giving in 5 minutes so I need my password reset right now!
[BOFH] Oh....let me check...we can only reset passwords once a day between 6AM & 7AM because it affects the user settings and we can do that after the server's been initialized. Otherwise the server might malfunction and several random files could be deleted from your home directory. Are you sure you can't wait until later?
[random_user][pauses]yes, I need it NOW. I'm briefing our department VP in 5 minutes.
[BOFH]ok... you're the boss...I'm resetting it to "12345678"...try loging on in a few minutes [while typing "del
X is a letter of the alphabet. The y or n indicates whether I have done substitution (zero for o, etc) in the password. The letter tells me the first letter of the password, the * tells me the # of characters (almost always forced to 8). So you can get a hint, and it provides a small limit on the number of passwords (can't have two the same length with the same start letter). It's the best I can do to balance security with my inability to remember so many userid/password combinations. If you can guess the password before the system locks you out (the important ones only give you 3 tries), you deserve the reward.
My secure ('high') passwords? Good luck. I've been accused of making passwords where I was accused of "banging my head on the keyboard and using the result."
The scenario is simple and inevitable. A hacker will steal a database full of biometric data and all those passwords will be compromised, forever!
Ordinarily, when a password is compromised, the user just changes the password. But how are users going to change a compromised fingerprint? How will they change a compromised retina pattern? Or with the biometric data planned for new US Passports, how will users change a compromised face?
Another little tidbit biometric security proponents usually overlook is the ease with which many systems can be hacked. $30 worth of drugstore purchases can create false fingerprint overlays able to fool nearly every fingerprint scanner on the market.
Biometric security sounds nice in theory, but like many failed technologies, it doesn't pass the field test. The liabilities it introduces greatly outweigh any advantages.
The only way to prevent biometric identity theft victims from becoming permanent financial outcasts is never to allow biometric security to become the norm. Don't let corporations or governments use your biometric data as routine passwords.
This program was originally devloped by CounterPane Internet Security, where Bruce Schneier is the security expert. It is now an open-source project. The only downside is that it only claims to run on M@cr@$@ft. Someone should port to Linux.
Nice idea. I'm going to use it for services for which I can't control the auth method used. For services that I host on my server I use one time passwords and a PAM module that I wrote (see sig)
Make It Secret . Free JavaScript implementation of AES for your browser
Come on now... what's with the fuss?
rosebud is a great password, nobody will ever guess that!
I don't moderate anymore. Karma penalty for 90% fair mods? Can I mod that unfair?
#136524 :(
/ns ghost nick password
Raven - I tried setting my hotmail password to penis.
Raven - It said my password wasn't long enough.
#10846
Saccy - My password is alpha numeric.
Strife - Well mine's a mixture of numbers ANDletters.
#198764
Death - Hey, Jeff, how do you kill someone when they're on your nick?
Jeff - Oh, easy
Death - Thanks.
Death - Die.
*** Signoff: Jeff (Killed (NickServ (GHOST command used by Death)))
...you'd have to crack the scheme. Harder. A wavy line isn't an obvious thing, especially if you dress it up as, say, art from your kid tacked up in your cube. Draw an appropriate wavy line, then let your kid go nuts with the crayons and such.
-Looking for a job as a materials chemist or multivariat
Bruce Tognazzini (of Macintosh and Nielsen Norman Group fame) has an excellent article where he contrasts *actual* security with perceived security here. Well worth a read, and one the pages I most frequently refer to.
The main reason I think that passwords have a security risk (other than personal ones your don't really care that much about anyway), in the corporate world is stupid low level IT people (Network Help/Admin or High level + managers depending on how decisions get made). Take this example (where I got very pissed off):
First some people in IT get this crazy idea... Our login names fit the pretty much standard firstletter.lastname (which it has been ever since I can remember, all my accounts, we are talking a large number here, that i didn't pick my own user name it always had that format... anyway) format. Anyway in their great univeral wisdom, they decided it would be better if they changed all the login standards to lastname.first_two_letters_of_firstname. So a Bob Lambert formerly BLAMBERT, is now LAMBERTBO. Now do this to a couple thousand employee's most of which are not Tech savvy to begin with... that is the start of our troubles.
Next a month later reset the standards for passwords (as if people are not confused enough trying to login). It was a simple password standard, must be at least 6 (maybe 8 not sure) chara long, and must change password every 30 days. Most people usually had two or three and simply rotated them every 30 days... no big deal. The new standard? How does this sound? Must be 12 Char long. Must have both upper and lower case letters. Must have a number. Must have a special chara (!@#$%^&*, etc...). Must not have a previous password in it (history of 12), and must change every 30 days. (Which means that you can use one of the same passwords in about a year) Does this seem even remotly reasonable to anyway? Am I just ranting for no reason? I can't wait to forget my password and have some IT Help Winnie look up my password to find "DumbestPassWordEver#1".
Personally I think they did it for job security. Can you even imagine how many passwords get forgotten and people have to call IT for their Username and password.
I also wonder if these IT idiots ever had a meeting about this. Did no one speak up and say, 'hey this may not be a good idea' or 'gee this might be counter productive to security as EVERYONE is gonna write it on a sticky note and put it on their computer!'.... Not mention the IT phones ringing off the hook and perhaps it happening so often that they become complacent to the point where they wil give usernames and passwords to any smuck to calls....
I am no network security specialist, but even I can see that simply making more complex passwords does not necessarily make you more secure.
Yeah that is too much to ask for in some scenarios. I have a standard password made up of a bunch of things. This is something I'll use on all the websites and trivial programs. But now a certain website doesn't allow '. Another one doesn't allow !. Each website will have it's own rules of how many non-alpha character should there be. This forces people to use variants. And makes it hard to remember. So most, then, just simply go for "johny" because that's their first pet's name.
That doesn't describe the behavior of all people. Just my opinion on the ones that have good passwords but constantly keep getting rejected at different sites for different reasons.
I love acronym passwords BTW. If it involves a lot of Ws and Qs, you can even tell it to people and most won't remember it a second later. Of course this doesn't mean that you should tell people the password.
For the guitarists in the crowd, think of each row of keys as a guitar string. Pretend you are playing a lick. Left hand fretting and if you want to get fancy, mix in right hand plucking. What you then remember it the lick (and where you place your fingers to start).
HaHa: 09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
...I worked at mainframe datacenter (running cute Sperry+Univac U90/30 and big U90/60). Using a four digit employee number in place of password for terminal login was a duty written in employee contract.
When we got some first IBM XT Personal Computer, our boss was very concerned about not having a proper employee number login. So I wrote my first DOS application, 5 lines of basic code, sticked it at end of autoexec.bat and got some xmass premium for solving "serious security issue".
There you are, staring at me again.
To be truly secure, you'd want to use different usernames and passwords for every single item that requires it, except for those non-important throw-away accounts.
This is where things get messy. I literally have over 50 different logins. Good luck remembering them all!
eTrade SUCKS
I'm serious. I've found randomly mixing and matching different variations on 1337 5p34|< has made it simple to come up with relatively secure passwords that still make sense to me, and hence are mnemonic, and hence are easily remembered.
Hey now this looks cool, I may have to play around with this :-) I always wanted to setup one time passwords on our incoming ssh server.
I Am My Own Worst Enemy
I don't understand why we need to constantly hash the password down to 8 characters. In the old days, when disk space was at a premium, and every byte counted, it was important. Now that I can carry 1GB of disk space on my keychain (jump drives), I think the 8 character limit needs to be lifted. Why? So we can use phrases.
Everyone has movie lines that they remember, and people remember sentences pretty easily. So make phrase-based authentication.
Instead of making me remember:
wRn?m@9m
Let me remember:
It was a dark night.
Or:
Shall I compare thee to a summer's day?
The biggest advantage is that you can get a long password that people can remember. And you can get punctuation.
Make the max length for a password be 256 characters, and give us something we can remember. Brute force attacks, or password dictionaries against something like this would be impractical, because there would be too many combinations to sort through.
A nice side benefit is that people can write it down, and it just looks like a line of text, not something that screams "password here!"
Reeses
To improve security even more I recomment to put the password not under the keyboard but in your wallet. If somebody gets access to your wallet you are screwed quite a bit anyway (money, creditcards, idcards, driverlicense, etc.). Its of course a bit less convinient then under the keyboard, but quite a bit more secure for sure.
It's nice but it still won't win on the hostile ATM. Most ATMs have a camera built in. I think you could be assured a hostile ATM taking cards like these would not have the camera focused in on the user instead of the pin pad... :-D
If you could be told what you can see or read, then it follows that you could be told what to say or think - BoC
Do we even need to RTFA?
Passwords are nothing new. The concept of using longer, stronger passwords(phrases) is not new.
We have Security Policies, Acceptable Use Policies, User training... Where have we gotten? In my 15 years in the IT field, I have tried to remain a proponent of user education, but I've recently thrown up my hands. Users are STUPID! Most of the people to whom I've provided service over the past decade can't remember not to take a bath with their hair dryer, let alone 7 unique, strong passwords (or one good password, for that matter).
There are different kinds of physical access. One is physical access to a desktop box which should, at most, give you access to stuff stored locally on the box. Often this should be roughly nothing, since everything is (or should be) stored on the central server (with backups, etc).
It's the central server that you're probably trying to secure with often-changed passwords, and access to a desktop box is not the same as getting into the server room without anybody noticing.
Free Software: Like love, it grows best when given away.
On one system, I stick a post-it note with my password right on the monitor (plus maybe a copy in an encrypted file sent to gmail). It's a random number which gets changed quite often. Won't do anybody any good though, since it needs to be (pre|post|reverse) appended to a passphrase which I've memorized. The sysadmin can't bust me, because if he/she tries it, it's not the full password.
This is psuedo 2-factor authentication: something I know, plus the number on the post-it which I probably won't memorize before I change have to change it.
Right. Let's assume you don't work for the company (since anyone who worked for the company I work for would be axed for doing what you just did, and wouldn't need to anyway.)
Ok, so let's take of most important corporate apps, our desktop machines, and your Knoppix disk/whatever disk for a test, shall we?
1) You have obtained physical access to the workplace, and ample time.
2) You attempt to use knoppix. Ok, first problem: We don't install or allow CD drives in 99% of our desktops. No problem for you, you have a floppy too, right?
3) You boot the machine from floppy into your OS of choice. DHCP works properly, and gives you an IP, DNS, etc. Too bad that sniffing the network doesn't give you much! Our NIS team designed most of our subnets with zombies and sniffers in mind. Private VLANs, reverse-proxies, multiple firewalls, SSH, SSL, etc. To get anything good, you would need to compromise an actual server floor network, and that would be a bit harder.
4) You look on the local drive. Unfortunately, there is nothing there except for a tiny Win2K NTFS partition. Ok, Second problem: NTFS. No problem for you, since you have an NTFS 5 reader on floppy!
5) Once able to access this disk, you find that there are only a few directories. Windows, Apps, Program Files, Temp. Hmmm. With some smarts, you install a keystroke logger/ICQ bot/VNC/what-have-you (for future use). That is nice, but it won't actually run when the user returns... more on that later. You find our Reflection app (and know what it is and how to use it). Of course, there are no host shortcuts or session logs.
6) You go through the IE cookies and temp info, to learn a little about the habits of this individual. Third problem: nothing older than about 5 days... bummer.
Summary)
To compromise our environment you need a full list of hosts, usernames, passwords, and a pretty good working knowledge of our apps. Our desktops are locked down to the point of being useless, and are designed to be useless if taken. Users are not even allowed to run the executables needed to double-click on a file. If you actually worked here, you would never need to recover data from a person's computer. They can't store anything on it. Laptops here are almost a joke, since for the people outside of IT, they are practically paperweights.
Also, as a final note, we are a host-heavy environment. All data, all apps, all tools are host-centric. This does not make it impossible to breach, just more complicated.
My whole point is that physical access to a machine on modern secured network is not the keys to kingdom it used to be. You need to have a lot more now than just a system and a few minutes.
-WS
An operating system should be like a light switch... simple, effective, easy to use, and designed for everyone.
No. Its asking for a similarly strong kind of password in twent five different websites that eventually becomes the overkill. And people slack out and try to use whatever they can remember easily.
I do security
anyways, I mainly use One Time Passwords when I'm outside home, like in a cybecafe or something like that. In that places encryption (SSL,SSH) prevents password sniffing, but not keylogging at the machine. OTP is a good solution for these situations. And of course, there is the geek factor of taking out your password list in front of everybody else
Make It Secret . Free JavaScript implementation of AES for your browser
One definition of insanity is doing the same thing over and over while expecting a different result. Continuing to pretend passwords are the answer, and that somehow user education is going to finally do the trick this time, is insanity.
We have a known quantity: human beings using computers. We have experimented with passwords on the computer for going on five decades. For any large subset of our known quantity (>25), passwords have failed to remain secure. Over and over and over. People have been threatened, coaxed, fired, and bribed. It still hasn't worked.
To continue to debate this is a huge waste of time. (On the other hand, me saying this to the slashdot community is a huge waste of time. It WILL be debated, over and over and over again.) It is time to move on. Physical security is worth a look. We need to see how that pans out.
BTW, this insecure password thing goes way back before computers. In the fairly recent past, take Feynman's description of how he and a janitor broke into the safes (substitute combination for password) at Los Alamos during WWII, the safes which contained the secrets to the nuclear bomb. Combinations written down on little notes, set to people's birthdays, set to the year it was installed, never changed from the factory default: does this sound familiar?
I used to be on the networks team at a very large corporation, where we implemented SecurID and PIN for offsite dial-in.
We did everything right, got the clock sync working, got all the managers to buy lots of pricey SecurID cards, found and forcibly removed insecure dial-in boxes scattered around, did all the right audit and test of firewalls, etc.
But the sales group had a bunch of pooled laptops, which sales people used to take out to customer sites. So they would store a SecurID card in the bag, along with a yellow PostIt note showing the PIN code for that SecurID.
That way, not only was the SecurID compromised, but since they were effectively using shared SecurIDs and PINs, we wouldn't even know which idjit sales droid had compromised it.
Doooo, ya stupid idjit rabbit!
State-of-the art tech is no match for the apparently limitless stupidity of users.
In the end, we did the only sensible thing, and revoked offsite dial-in for that group.
The basic problem lies with the fact that the normal user is still not going to care about remembering 8 passwords, no matter how much you educate him. What we need to do is find a better way. How about having a program (freeware) that will use a well-known hash-generating technique to generate 8 passwords using the 1 password the user remembers as a key. This is in no-way a complete solution, but for people who have and use exactly 1 PC, they can have this program installed, and then the program can generate 8 passwords and the user will just use the correct one: The program can say: Yahoo Mail - 0nfdsa235wsac Bank of - c3234ea23asa -- -- -- Then of course.. there is a problem of the password used to access this program.. if the user just uses his "the one" password for this program, then again our purpose is defeated. Oh well..
It's the default password on all kinds of home-office routers/firewalls/etc...
The hardest thing with multiple passwords is that it's hardest when you start up into the system. I can probably memorize one or two passwords a month, but forcing me to change 8-19 passwords every month would drive me absolutely nuts.
Free Software: Like love, it grows best when given away.
What my end does is take the phrase, convert all to lower case, and strip out everything but alphanumerics... then run an MD5 on it so in the end I get a clean fixed-length password.
In my case, I wanted 'lost password' recoverability, so I will also allow logon with the direct MD5, as I am willing to take the security hit in exchange for being able to recover. However, in light of recent events of being able to recover colliding MD5 input streams ( strings of alphanumerics that also produce identical MD5 hashes ), I will probably delete that capability, and in the event of lost password, I will run the MD5 through the collision synthesizer and tell them to logon with this "special password", then have them immediately change their passphrase to something more memorable.
The idea is to spare humans from having to memorize whether or not they put spaces in the phrase or capitalized certain letters.
I get the idea that "bob's dog chucked a hairball under my couch", which is just as good as "Bobsdog chucked a hair ball under m ycouch", would still be very hard for anyone to crack, yet very easy for someone to remember. Its those little persnikety things that annoy the living shit out of us humans.
"Prove all things; hold fast that which is good." [KJV: I Thessalonians 5:21]
In my contracting company, I have 2 or 3 separate passwords that access different services that I only use about once every 6 months. So they're inevitably expired or forgotten by the time I have to use them again. Nice going guys, I'm SURE that me calling support to reset the password EVERY time I want to access the service is WAY more secure than letting me use my passphrase there.
So far the most together company I've seen for this is Sun -- they use NIS internally, which means if I set my password somewhere, it gets set everywhere, and all their home directories are on NFS so you can log in to your environment from anywhere in the company. NIS is hella-insecure, but there are more secure directory-based authentication schemes available if I'm not mistaken. So far I've yet to run across a company that has enough of a clue to actually implement those.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
Here are some passwords that I keep finding at different companies.
hockey (don't ask me why)
yousuck (only on Windows machines)
password (which everyone's account had)
One company set up everyone's email account password to be first-intial, last-initial, last-initial, and first-initial (e.g., crrc). They changed that in hurry when one guy got fired on a Monday and used the upper management email accounts to send out email to everyone about how great the sex was that management was having with each other. Those emails were downright funny and everyone was laughing for the rest of the week (except management).
It's a GPL utility for PalmOS that stores your pw list encrypted with 256 bit AES. It's also got a decent password generator, and can do S/Key OTPs. Here's the site.
So, I install a KL on the CFO's machine, grab your acutal SOX docs (not the "doctored" ones you want to release) and send them to the feds. Your key people go to jail for flagrant violations, and then I move in, install my own people into key positions and wait...
Yeah, right.
don't relly on passwords use things like RSA secureid cards.
The basicly generate a new psudo random number every 20 seconds, you login with your id, your 'password' and the random number.
That way users can pick weak passwords, backed up with one that changes every 20 seconds.
thank God the internet isn't a human right.
Oops, probably shouldn't have admitted that.
I use passwords that I do not consciously remember, but manage to do it very easily.
Instead of basing a password on a word, I base passwords on keyboard finger patterns.
For example, one of my passwords might be "pqlsnv" or maybe "ju7ft6la"
Open notepad and type one of them out. Go on, try it.
Note the alternating finger pattern.
You can create very complex passwords with this method that are virtually impervious to dictionary based password crackers.
Definitely a novelty in having a password that my fingers know by heart but my mouth couldn't recite if my life depended on it.
- Cary
Tell the FCC you demand broadband choice!"
Fairfax Underground, where Fairfax County comes out to play
For years, I've obfuscated dictionary words enough that I think they are pretty damn strong passwords. For one, my PWs are never less than 12 characters. I ALWAYS use symbols, upper and lower case letters and numbers... the trick to obfuscating a word so that it can not be cracked with a dictionary is to use two symbols, or a number and a letter or some such to represent a single letter of a word...it doesn't even have to LOOK like the letter being represented, as long as you can associate the letter with the characters you've chosen, you're golden... good luck friends, keep biometrics at bay. (Gattica is not where I'd like to go).
P.S. one more thing, physical memory of a password is really good too. if you're a touch typist, just type your password a whole bunch of times, saying the characters to yourself as you do, and after a while it just kind of flows.
Doesn't matter since the PIN-on-Card scheme uses a challenge/response. You need the physical card and its PIN; you can't swipe the magstripe like today's hostile ATMs and make a copy of the card.
So you need to take the physical card, at which point you might as well take the money instead. The owner will know and will block the card immediately.
I rember a company which had most of their UNIX passwords set to the machines hostname + a secret number.
Unfortunately they had machine names longer than 8 characters und their passwords were only veryfied on the first 8 characters. Go figure.
I once worked for a company where the insane CEO (dotcom era) decided to get serious about security by requiring daily password changes.
The cool thing was that they never implemented any restriction on what the passwords could be.
I think the most common passwords that resulted were Monday, Tuesday, Wednesday etc.
Sometimes my arms bend back.
Getting users to use secure passwords is a serious problem. For classes, I've gotten to the point of giving them my treatise, letting them set their passwords and then using something like John-the-ripper to crack people who choose bad passwords. Doing it in front of them and getting a handfull of passwords in under a minute will generally get the attention of at least some of them.
One thing to note about the 'change the password every few weeks' approach is that it presumes that an intruder has access to the encrypted password file. Given current security systems, it's now rare that you have access to the encrypted password unless you've already gotten admin access -- at that point you can expect that your security is hosed, anyways.
Rather than just not suggesting that sites use the 'change every 6 months' rule, it should be explicitly discouraged unless you have seriously elite users with the cycles to spare for repeated memorization.
Free Software: Like love, it grows best when given away.
my journal: scripts for leaching porn baked fresh daily
IMO the problem is I don't think most people's memories are good at holding something as very important and THE THING to remember, then after 3 months it's something else to remember.
;).
;).
I believe most peoples memories work such that if something is of great interest you remember it for a very long time AND it's usually contextual.
E.g. You press this button to do this, you use this tool for this job, you use this berry to dye stuff this colour, this leaf tastes like this and produces this effect, etc. And human memories work fine if these contexts/links don't change every 3 months.
After changing passwords every 3 months after 5 years even if you can remember those passwords, your memory might be associating ALL those 20 passwords with the "access"/application and you might not know which password is the one out of 20 that's linked to the stuff you want to "unlock" with the password.
If there's a lockout after 3 tries that makes it even more fun. In which case you ALSO have to remember that previous passwords are no longer valid as well, rather than just try all of them
I wonder if it could work if you carry around a coloured pattern (or some other mnemonic/symbol/picture) that you change each time your password has to change. That way you are cued to remember the right password. And you associate the pattern with the password, and not the access/application with the password (which is probably what most people do).
Scents could produce very strong cues since scents can be tied strongly to memories, but you could run out of distinct scents pretty rapidly.
Maybe one could make a software/device that generates and stores passwords.
First you enter the context, it supplies the symbol and/or musical tones AND password. You associate the mnemonic (symbol and/or musical tones) with the password.
When you want to use it, you enter then context or select the context from a list of contexts, then the mnemonic is displayed/played. Hopefully this cues you to remember the right password.
The passwords could be encrypted and stored in the device too. If you use public key encryption then you can have it so that the passwords can only be unlocked with a key/associated device that's stored in a safe place elsewhere.
You could store the password in the secured device, but that means you need to take out the secured device everytime you make a new password.
A good way would be to have the passwords encrypted on the carried device, and copied to the secured device whenever you connect the two together.
Don't think there's big money in this. All that tech and the user's brain still needs to work
I'll wait for auxiliary digital brains. Then you can shove the problem under a different carpet...
One of my biggest gripes is the "exactly" requirement that some places have. Your password must have at least one number, at least one special character, at least one lowercase, at least one uppercase, and be EXACTLY eight characters long.
Lame-O!
So now it isn't "think of something secure" (which I'm ok at), it's "think of a phrase with eight words, or a thing with eight letters, or have something longer and stop typing when you hit eight characters.
Because what I wanted was a poetry contest.
Sheesh.
I mean, let's just see:
At Work:
general network, 1 email, 5 account passwords.
At Home:
1 email, about 3 one's for various online games, and 2 for instant messaging programs.
Online:
About 4 for various online vendors, 1 for a website I commonly goto, and probably another dozen I just got along the line for sites I rarely vist.
Out and about:
Can't forget that pin number
I'm not a school anymore, but when I was:
1 network
3 computer science account passwords
1 library
So, what's that, 20+? I'm not even a heavy online shopper so I could expect many other people to easily break 30+. And again, this doesn't consider that many sites demand some cryptic username too, and stupid security protocals that demand you change your password every other week.
But nooooooo that was not acceptable. It needed a capital letter and a special character. By the time I was done fighting with the password change program, my password was 'Abcdef-1'. Take a wild guess what my password will be when I have to change it next month?
Totally insecure, but at least I can fucking remember it. And if I ever forget, I can just look at my /. comment history!
"Avoid employing unlucky people - throw half of the pile of CVs in the bin without reading them." -- David Brent
to allow 24 or 32 character passPHRASES ?
"I had a doll dressed in blue".
Or, the 1337 version:
"I 0wn3d a d011 dr3553d 1n b1u3".
Try bruteforcing THAT.
Lots easier to work with multiple places (home, work, web, etc.)
PHEM - party like it's 1997-2003!
Dude, why didn't you start out by saying you guys use windows.
In that case, you don't even need to jump through the hoops; a simple email titled anna kornukova nakid will compromise 90% of your systems.
And they requested that all email accounts use 1234 as the password... ;-p
One person said "i don't really need email, you can skip me."
Amazing!
A fool throws a stone into a well and a thousand sages can not remove it.
Come on I mean everyone knows the most common passwords...love, sex, secret, and god
Wait what happened...i blacked out there for a moment...i didn't say anything stupid did i?
I have similar categorizations for passwords, but where a password sits also varies on how secure it is. If it's a site that clearly doesn't hash the password (i.e. they can email your password to you), then I work under the assumption that this password could be compromised by an insider at the website. As painful as it is, these sites get their own passwords, unless the password is my low security, "I don't care if you know" password. I don't want some insider taking this password and from some shopping site and using it to try to use my Amazon account, for example.
The password rules and frequency of needing to have them changed have created a situation where people that should know better, make a deliberate decision to bypass the password rules.. I for one use root to temporarily change my user settings so I can re-use a passed over and over again.
Why can't the security teams in big companies do the smart thing and concentrate on preventing hackers from getting to a login prompt rather then pissing off there employees!!!!!!
I guess they find it easier to make rules and bitch at employees then do anything useful!
I just call the help desk for a new password whenever I have to log onto these damn sites.
:-)
I have a fingerprint reader on my desktop and until they wake the fsck up and get their systems to use that, I deal with the help desk.
I think the reader would be a much better solution and tell them every time I get the chance to, once a month for every damn system
MSBPodcast.com The opinions expressed here are my own. If you don't like 'em... Think up your own stuff.
Keyboard logger, anyone who could get that close to you could put an in-line keyboard logger on you pc and get you password that way.
Failing that I'm sure you can measure inductance in the wiring that makes up a keyboard, every time a key is pressed you'll get a different amount of induction because of the longer and shorter circuits.
thank God the internet isn't a human right.
"Lame-O!"
Error. Password Invalid.
Only seven charaters. Must be 8.
>a E9 b ?p c &m
;-)
>d 6K e aY f eP
>g !S h gn i D=
>j Hd k vw l Cb
>m W5 n 4$ o R3
>p x% q 7M r NF
>s +2 t s* u Ay
>v fL w zG x Zu
>y cX z Qr
So what does the output of that Perl script look like?
-- TheMadRedHatter
while(1)
{
}
Ah, the story of life.
I've got a reader here.
Now if I can just get them to upgrade their systems to friggin' well USE them, that will get rid of one call per month per system...
MSBPodcast.com The opinions expressed here are my own. If you don't like 'em... Think up your own stuff.
My current employer has a very strict password policy in place - minimum 8 characters long, numbers in the middle, no numbers at the beginning or end. Password aging is set for 180 days. At least on their main systems, you get to pick your own password. This is all well and good until...
On their wireless devices, we aren't so lucky. The passwords are system generated and change every 30 days. Yes, of course the passwords here are complete random and are always 6 characters long. When the password changes, you get a total of 60 seconds to memorize it. As with any other security aware company, you are not supposed to write your passwords down anywhere.
Let's see, random non-user generated password, 30 day password life, 60 seconds to commit to memory, can't write it down. I wonder how well this works in real life (wish I had access to the number of password reset calls this policy generates).
Ron Gage - Westland, MI
I've definitely seen this exact post before. I know because I ended up using a similar method to create a lookup table that I keep in my wallet!
That is just 358800 possible 8 character passwords, which is in the realms of being brute forced. Better than having the password actually written down but not secure by any means.
There are password generators available which calculate session passwords against a user name in combination of a password. If you want to login you get a passphrase which has to be put into a session password calculator whithin 30 seconds. Otherwise the session password is denied by the system. On the other hand using a different user administration (like LDAP) than system default in combination to a hardened system (like Trusted Solaris) makes it more secure against hackers. Such a system uses role based access to the system. Even the root user doesn't have rights to access user directories of other users on that system.
The best easily used technique for inventing passwords is "shocking nonsense."
Passphrase FAQ
2 October 1993
'"PGP," warns Dorothy Denning, a Georgetown University professor who has worked closely with the National Security Agency, "could potentially become a widespread problem.' -- (E. Dexheimer)
Comments to: Grady Ward, 1GOTO1@gmail.com
FAQ: How do I choose a good password or phrase? ANS: Shocking nonsense makes the most sense
With the intrinsic strength of some of the modern encryption, authentication, and message digest algorithms such as RSA, MD5, SHS and IDEA the user password or phrase is becoming more and more the focus of vulnerability.
For example, Deputy Ponder with the Los Angeles County Sheriff's Department admitted in early 1993 that both they and the FBI despaired of breaking the PGP 1.0 system except through a successful dictionary attack (trying many possible passwords or phrases from lists of probable choices and their variations) rather than "breaking" the underlying cryptographic algorithm mathematically.
The fundamental reason why attacking or trying to guess the user's password or phrase will increasingly be the focus of cryptanalysis is that the user's choice of password may represent a much simpler cryptographic key than optimal for the encryption algorithm being used. This weakness of the user's password choice provides the potential cryptanalytic wedge.
For example, suppose a user chooses the password 'david.' On the surface the entropy of this key (or the number of different equiprobable key states) appears to be five characters chosen from a set of twenty-six with replacements: 26^5 or 1.188 x 10^7. But since the user is apparently biased toward common given names, which a majority appear in lists numbering only 6,000-7,000 entries, the true entropy is undoubtedly much closer to 6.5 x 10^3, or about four orders of magnitude smaller than the raw length might suggest. (In fact this password probably possesses a much smaller entropy than even this for the very common name "david" would be one of the first names to be checked by an optimized dictionary attack program.)
In other words the "entropy" of a keyspace is not a fixed physical quantity: the cryptanalyst can exploit whole cultural biases and contexts, not just byte frequencies, digraphs, or even whole-word correlations to reduce the key space he or she is trying to explore.
To thwart this avenue of attack we would like to discover a method of selecting passwords or phrases that have at least as many bits of entropy (or "hard-to-guessness") as the entropy of the cryptographic key of the underlying algorithm being used.
To compare, DES (Data Encryption Standard) is believed to have about 54-55 bits (~4 x 10 ^16) of entropy while the IDEA algorithm is believed to have about 128 bits (~3.5 x 10^38) of entropy. The closer the entropy of the user's password or phrase is to the intrinsic entropy of the cryptographic key of the underlying algorithm being used, the more likely an attacker would need to search a substantially larger portion of the algorithm's key space in order to rediscover the key.
Unfortunately many documents suggest choosing passwords or phrases that are distinctly inferior to the latest method. For example, one white paper widely archived on the internet suggests selecting an original password by constructing an acronym from a popular song lyric or from a line of script from, for example, the SF movie "Star Wars". Both of these ideas turn out to be weak because both the entire script to Stars Wars and entire sets of song lyrics to thousands of popular songs are available on-line to everyone and, in some cases, are already embedded into "crack" dictionary attack programs (See ftp.uwp.edu).
However, the conflict between choosing an easy-to-remember key and choosing a key with a high level of entropy is not a hopeless task if we exploit mnemonic devices that have been used for a long time outside the field of c
Schemes like this are easy to defeat: Put the calendar month and year in your passphrase. A password scheme that requires upper and lower case letters, special characters, numbers and must be between 6 and 12 characters, and must be changed every 30 days can be
Dec,04
this month. I'm sure you can guess what it will be next month.
Lousy password, sure, but that just points out how easy rule-based schemes can be thoroughly gamed.
The best part was after sending a note around on the new policy of 12 digit case sensitive alpha numeric mkpwd (or mkpasswd i forget which one is which)
...
and then later
The next problem are managers who are more worried about the whining of their staff in regards to the ENSLAVEMENT of having to remember 10+ digit alpha numeric passwords (I have trained myself to do it in 8 looks.)
So you can memorize 10 digit alpha numeric passwords in 8 looks, but can't remember whether it's mkpwd or mkpasswd? How many tries do you need on those passwords?
What about the password taped to the monitor?
Hey,I have given up. I just make my passwords up as I go long. If I remember them when I need to no problem. If not I just click on the "I forgot my password link"
This has been the best reading in a long time.
My other first post is car post.
I was talking to my co-worker (C++ programmers, good one, high exp point). I told them I wrote a prog for my PDA such that I could generate password (mixed case, numeric only, 6-12 characters, because some site has those un-reasonable restriction) base on a pass phase and the link (beginning part of the URL). Both said I am nuts, and paranoid almost immediately.
I think this is age gap thing (they look older than I am, but in fact, I am not much younger than they are).
No one complains about one password but the security "experts" are being myopic. They are not taking into account the myrid of passwords we have at work and the even great batch outside of work. Constantly having to change all of them given their different requirements (and lets not forget all the usernames y ou have in addition to passwords.)
When systems fail broadly it is not the users, it is the system.
I use two schemes to help me out. First, I use Whisper to store my passwords. It's fairly secure, requiring a password to access, though I suppose it can be opened using various attacks on the MS Access database file password storage. Second, I use the password generator in Whisper to create patterned passwords. My employer requires 10-digit passwords with at least one number and a combination of upper and lower case. From Whisper, I use the pattern cvcvcvcV## ("c"onsonent, "v"owel, capital "V"owel and two numerals). This gives me a password which is easy to remember because it can be pronounced. Alternating consonents and vowels generally makes a pseudo-word, for example: romabuL45. You can "say" this better than qt1l#Gikx at least in my opinion.
So, if someone finds your paper, all they have to do is try guessing simple words like "bank," "ebay," etc., or bruteforce a batch of dictionary words...
At my job as a DoD contractor on an Army post, we recently had to start using DoD's new uber-leet password schema, as seen on the Army webmail site--(at least) two upper, two lower, two numeric, two alpha, two punctuation--and change them every 90 days. Guess how we've been told to do it? Have the two numeric at the end, and increment them. (posting A/C for obvious reasons)
You seem to be taking some offensive tone as if he worked at *your* company. Not everywhere is setup like you are. You do realize that just because what he said wouldn't work on your network doesn't invalidate his claim?
"People who think they know everything are very annoying to those of us who do."-Mark Twain
I just won't tell you the starting offset. :D
I always imagined that Pi or one of the other irrational numbers would be a great encryption hash. Easy to gererate, remember etc, but hard to hack, since we don't know the starting offset.
It could be a nonrepeating hash or even a repeating one. All you would need to know is the starting offset, you could encrypt a very long document, with a singular and easy to remember hash point, ie Pi x 259313 r1024 would mean Pi hash starting at 259313 repeating 1024 numbers.
I am sure that some pointy head math wizard will explain why this will not work.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
It's always bothered me that authentication is the default condition for systems when in so many cases just a simple user name would do. firstame.lastname, hit enter and get in.
Why do you need to demand a password from every user that, say, wants to edit a document on the file server? Why does a VPN need a login as well as a password to see the file servers after that? Why do I need a password to get to the timesheet application on the intranet when I'm ON the network already? What's wrong with just giving it my name? Even worse, why do all these systems require a different pattern of login? Even if I wanted to use my super-secret, 8-character password for the VPN, I can't bacause it wants a 10-character password with at least three numbers in it. So I reach for the stickynotes.
If authenticaion was NOT the norm, perhaps people would THINK about whether there was anything important they wanted to protect, and then ask their admins to protect it with massive encryped highly-authenticted logins.
As it is, the current situation stifles that mentality. It's literally a false sense of security. "It's all passworded up to the eyeballs every whick way you can imagine - everything must be secure!" Then they wonder why users write stuff down on sticky notes...
I realise that if you don't know what's secret then you have no choice to protect it all, but jesus, the current situation is just nuts.
"And the meaning of words; when they cease to function; when will it start worrying you?"
Yeah I actually thought of that, which is why I typically use longer words (say maybe "mybank") for the memory word, or extra "secure bits" that I tack onto any password I care about. I have also thought about modifying this to include control characters for extra secure goodness.
I Am My Own Worst Enemy
what dime store do you go to? I must have been a lot racier than the one in my neigborhood. The dime store is gone, another WalMart victim.
Think global, act loco
Sometimes Slashdotter's aren't acknowledging a very simple fact: Not everyone cares about computers and computing as much as we do. Therefore, the short answer is, yes, it *REALLY IS* difficult to ask people to create a password using a, "...combination of alpha-numeric characters". Most people don't think in the abstract. So it's hard for some people to form an abstract password. And if they DO create an alpha-numeric password, they'll forget it, or fail to write it down, or think they can remember it because they... well, they just will.
So stop treating everyone on Earth like they SHOULD know how to use a computer the right way, or grasps concepts as easily as we do here. Give people credit: Some of them are hard working BLUE collar people with no care for computers. They just want to go to work, be entertained, and go to sleep. That's it.
Actually that is a perl interpreter in obsfucated brainfuck... and if you couldn't tell that then you are *obviously* not a real programmer.
I have a method just as good. The subway map for London is on my wall. The station names make great passwords, and there's plenty of them, and all i have to do is lookup to find the right one. The great thing about is that they're all in plain view for everyone to see. All anyone thinks is "hey that's a cool looking map".
What happens if you lose the paper? That means you lost your password. So how are you supposed to change it?
Yes, people can crack your machine even if you don't flaunt your passwords, but it's much simpler (and hence more likely) when you do.
It's hard to be religious when certain people are never incinerated by bolts of lightning.
Rerun the perl script.
It's hard to be religious when certain people are never incinerated by bolts of lightning.
One of the minor points in the article is that S-O empowers PHBs everywhere to think up even more ridiculous password policies that end up making everyone write their passwords down on paper. A typical post-S-O Domain password policy is to implement changes every three months that reuse no part of the original password. When you have 10+ passwords all with slightly different length and funny-character requirements you are just going to write them down.
Another example of a failed attempt to micro-regulate technology.
If you really wanted to get people's attention: A weekend spent picking up litter on the highway wearing an orange vest with "SOMEBODY GUESSED MY WEAK PASSWORD" on the back.
Give a man a fish and you have fed him for today. Teach a man to fish, and he'll say "WHERE'S MY FISH, YOU IDIOT?"
He said it randomly generates though. If it randomly generates it will not generate the same matrix again.
If we assume that the code sheet is a secret, then this becomes a much stronger way to generate passwords. Lets say I correctly guess that his password is 'bank', but I don't have his cheat sheet. There are (26+26+10+10)^2 = 5184 possible symbols for each letter, assuming that we use only 10 special characters. If we have 4 of these symbols, that gives 5184^4 = 722,204,136,308,736 combinations. This is pretty good.
Am I missing something? Whete did you get 358800?
Think global, act loco
If someone cah crack your password in 45 to 60 days then you probably need better security rather than having your users change the password every month. That guy is full of shit, and i hate "experts" who are full of shit. If the average is 45 to 60 days there is a good chance that the password will be found in the month between password changes.
If its accually possible for their system to be broken in 45 days then the real problem is probalby the people who are allowing the password hashes to be published, or who are allowing the failed password attempt timeouts to be to short. Without the password hash, it should be pretty much impossible with a 30 second bad password delay and a 30 minuite delay if entered 3 times incorrectly to break that password any time in the near future using brute force methods. Especially if the user id list isn't published. Not only that if your system admin doesn't notice the constant failed password attempts then its even worse. I would be far more concerned about home users computers being comprimized with key loggers, plaintext internal protocols, and users who are using the same password for intranet as well as internet sites masked as intranet sites (The company I work for uses a number of internet sites masked as intranet sites).
I don't have a clue where that 45 day number came from, sounds like something that got pulled out of someones ass. I have a friend who has a reverse password hash running on his machine with a few hundred gigs of storage, given a standard unix password file with weak passwords it can generally find a few matches in a matter of seconds. The moral of the story is keep the hashes and the user id's secret, changing passwords every month or so just sounds like its inviting more people to write their passwords down.
My other first post is car post.
I have a method just as good. The subway map for London is on my wall. The station names make great passwords, and there's plenty of them, and all i have to do is lookup to find the right one. The great thing about is that they're all in plain view for everyone to see. All anyone thinks is "hey that's a cool looking map".
Actually that's not a very good idea.
It's pretty much one step away from a note under your keyboard or your mother's maiden name.
Any text readable from your chair is an OBVIOUS password. It's also going to be part of a dictionary atteck, unlike "?pE94$vw".
Life is too short to proofread.
This is actually a great way to recover data when somebody leaves the company and doesn't pass on knowledge of a computer's usernames/passwords.
I actually have a better one than that. I found a floppy distro that will boot and then prompt you to change Admin password on any NT/2000 server or workstation. It will even tell you the Admin name if it has been changed. It has saved my arse a many of time. You can find it here here
Sorry, but your Abcdef-1 password is far more secure than wkxudf1. Nobody brute forces passwords by sitting down and typing in random stuff. They use offline dictionary and brute force attacks on hashes that leak out such as in challenge response network logins.
Abcdef-1 looks like an easy pattern to you, but it's not to a cracking algorithm. A cracking program would have to use the pattern space A-Z,a-z,0-9,and at least 20 or so symbols. so 82^8 = 2 quadrillion possible combinations. wkxudf1 uses the pattern space a-z,0-9 and 7 characters, thus 36^7 = 78 billion combinations. So if it took a program 10 minutes to brute force your original password, it would take the same program 6 months to get your new one.
-Ryan C.
We have this shit at work. My login password for dev environment #1, dev env #2, Q/A, prod, timesheet, human resources, etc. is different and I am forced to change it every 30 days. To keep it easy, I would always use my favorite beers as passwords. They then also added that you can't use the most recent 3 passwords, an if you enter 3 bad passwords, the system locks you out, plus it has to be alphanumeric. So there goes my beer names! I end up writing all of my passwords on a Post-It note stuck of my monitor.
This is yet another example of know-nothing management making an executive decision to fool their shareholders (and themselves) that our systems are now more secure from hackers. In fact, we even had started to share the same user accounts because it makes it simpler to remember passwords instead of each one forgetting it once a week or sooner.
Simple. Keep a copy of the paper under your keyboard.
2 - The third (pick a 'number number') number of your zip code: 90210-1234
r - The second (from the 2) letter of your boss' name: Francis Drake
7 - The third (your 'number number') digit of your cell number: 707-555-1212
o - The seventh (from the 7) letter of your home town: Toronto Ontario
6 - the third (your 'number number') digit of your sister's street address: Apt#666-1234 Yonge Street
y - The third (from the 3) letter of your car: Toyota Echo
4 - the third (your 'number number') digit of your visa: 4444 1234 1234 1234
c - the fourth (from the 4) letter of your father-in-law's name: Bruce Smith
you can generate 7 (666-1234 is the shortest) different effectively random 8 digit passwords from the above.
The other day I was thinking about a dynamic programable password, instead of a plain static password, so you can create a password that would change everyday based on the output of some tasks, for example, you could create a password using the current time, date, temperature, number of apps open, a boolean comparison (whether or not some app is currently running) or stuff like that, people would have to crack the pattern cause even if they sniffed your password, the second they try it, it wouldnt match.
Secure Computing offers tokens that use that "best password schema" mentioned by the parent. They call 'em "SafeWord Tokens".
Or take a picture with their cell phone.
Friends don't help friends install M$ junk.
Pretty funny, but we don't use Outlook, and, like I said, users can't run any executables at all.
-WS
An operating system should be like a light switch... simple, effective, easy to use, and designed for everyone.
I apologize if the tone seemed offensive, it was probably a residual of the DoD bend-over fest we had recently :)
My whole point was that physical access is once again able to be well armored. The world has gone from the VT220 era through the PC and out the other side. The poster's point seemed to be that PCs are a huge vulnerability, while mine was the opposite.
I am arguing that the real vulnerability is the User, not the machine.
-WS
An operating system should be like a light switch... simple, effective, easy to use, and designed for everyone.
I am a very forgetful person.
But I know an excellent method of remembering passwords.
I could tell you,
but I'd have to kill you.
Why is it with all our progress we can't get the convienience side of security right
- it's important... more important than the engineer will acknowledge.
A blog I run for the wealth
Thats why I keep a second copy somewhere else safe (at home, in a safe or whatever).
I Am My Own Worst Enemy
oops,
forgot the link here
Let's take a random, faceless group of people.
It's human nature that if someone can be blamed, instead of taking an inconvenient action, one will try to blame the "other", especially in a group where anonymity is high.
It's rather intuitive that a place with a password policy has "some form" of security officer.
It's also intuitive that this some form of security officer is somehow responsible for security at some degree.
It's seldom happened that the rule "you share your password with someone you're both responsible for whatever happens with that password" was applied.
This a) encourages convenient, insecure, anonymity-fostering "I'm lending you my password while on vacation" and "I forgot to change my password when I came back from vacation"
b) Depending on mental discipline, 3 8 letter passwords might be too much to ask of a person to dedicate to just their job(considering most people will spend about half their "memory budget" on work applications, if that much)
c) The security officer is likely to be blamed, simply because in an anonymous group, whoever shared their passwords just decreased their chances of getting caught, not increased them
d) Two-token authentication and other methods have not gotten enough mindshare yet to be considered "easy"
e) This kind of discussion on slashdot and other places often starts on the premise of "why can't people who don't understand the distinction between authentication and authorization act in a secure manner". It's been my experience that until someone understands the difference between the two, security is very hard to come by. An example:
Marissa is going on vacation next week
Marissa gives her password(authentication) to Joey, so joey can do payroll while Marissa is on vacation
Marissa doesn't understand that she should have called it, and told them to authorize Joey for her tasks, for the duration of the vacation. She may or may not remember to reset her password after. m She might also know that she should call IT, but IT will require she list everything she wants to authorize Joey for, instead of copying her privileges(there might be technical reasons behind this, or they just might not have a trustee system of sufficient power to do it).
This means that for a while, Joey can do things, and safely think the waters are muddled, it's hard to prove Marissa didn't do it. If Joey happens to be a good enough actor, he could say he shared the password with someone else, and that someone else would get the blame. If there is some other security event, involving the outside world, after Marissa's return, so much the better.
Now this will seem like killing baby seals, or something equally cruel, but the only real security response to this, is to punish equally everyone involved in the "password trade" since you can't prove, after the fact, what in fact occured.
Most security policies assume you can outline a procedure to follow, about passwords, without outlining this kind of consequence, and without spending sufficient effort making sure people understand the issues involved.
This makes the environment ripe for anonymity(which is good, when you are in a group with equal responsabilities, like the Internet, but bad, when you're in an environment where someone authorized a money transfer to an employee's spouse's third cousin's bank account in switzerland in an untraceable, anonymous manner).
In the absence of traceability, public opinion will impute blame to the most visible level of responsability. Hence the security officer will be reprimanded(but perhaps not fired), for three employees sharing a password, since firing all three would be inconvenient to the company, and politically unsound in some places as well.
I do NOT have access to a computer YOU Insensitive Clod !
"Doing what i can, with what i have." ~ Burt Gummer
Your station could simply be a dumb X terminal, with the actual computer in a more physically secure location. Security of the computer isn't inherently compromised just because someone has access to a mouse, keyboard, and a monitor.
File under 'M' for 'Manic ranting'
in general, password based identification is an obsolete form of authentication. it doesn't stand a chance, regardless of how perfectly unguessable your *JWe-SP#@)@jiJgl!)@^#..; password is. password generation algorithms are being quietly cracked. passwords are being sniffed, keylogged, obtained through numerous forms of social engineering or being forgotten. all this will change but not too soon.
there are many ongoing approaches to avoid password usage. e.g. key-based authentication, certificate based authentication, eye (retina) or visual heat recognition, fingerprint/voice authentication, magnetic field based identification, etc.
stay tuned.
Selecting four letters from 26 where order is important is 26 permutation 4. Where a nPr is
defined as n!/(n-r!). Clearly you skipped the probablity and statistics classes in your maths leasons!
However you are right there are lot less than this that are valid words, which weakens the method considerably further. I never suggested that an uncompromised code sheet resulted in weak passwords.
I use my M500 with a password vault app to store my logins/passwords. I only have to remember one password to access them (and remember to have my Palm handy ;) )
After all a few years ago, the WSJ used to use crypt() with input == username || server_secret (where || means concatenation) to create a user's cookie (for access to the subscription-only portions of the site).
And crypt() only takes 8 chars of input; so if the username was longer than 8 chars then the server_secret was not used and if two usernames were identical in the first 8 chars (not prohibited by the WSJ system), then the two would have the same hashed value.
And the cookie consisted of: username || output_of_crypt (as above); so one could forge a cookie for any user (and thereby have access to that user's account info... and use that user's credit card info (if stored as part of the user's account)
So the adversary only needs to know a username to log in as a user (and can discover a username by trying to register one and IF registration fails (b/c "that username is not available") -- bam! you've got access).
Anyway, it was pretty easy to recover the server_secret because of this... which by the way was a value that could have been recovered via a dictionary attack anyway (IIRC, it was the original release date of the system).
Want the dets? Look here (*.pdf) -- "Dos and Don'ts of Client Auth on the Web" by Fu/Sit/Smith/Feamster.
A great way to build a strong password is by using a numerical password on your numpad and memorizing the rhythm of you hand movements. Although the password will only be comprised of numbers you can make them MUCH longer than 8 chars and you can type them in plain site with ppl watching and they won't catch on even after several times.
With a 8 char password using 1-10, a-z, and A-Z, you get approx. 48 bit encryption for an 8-12 stroke password that takes approx. 1-2 sec to type across a wide field ppl can easily see.
With a rhythmic password using only the numpad you need about 14 chars for the same, but with the mnemonic of how 3 fingers (i use my thumb, index, and middle fingers) tap around a 3x3+1 box, you can type it in just as quickly. Also, with your hand and fingers obscuring the pad, shoulder surfing is much harder.
The real advantage to rhythmic numpad passwords is that the mnemoni is much more reliable across longer passwords. After some practice, I memorized two 15 char passwords and combined them into one 30 char password. I type one 15 char string, pause, then type the other in 5 sec total. That's approx 100 bit random encryption by hand.
btw:
Regarding approx. bit protection:
2^(log((# possibilities per char)^(password length))/log(2)) = (# possibilities per char)^(password length)
log((# possibilities per char)^(password length))/log(2) = equivalent bit protection
It seems pretty clear cut, but I'd appreciate any input into why I should change my root password.
finally, a sensible comment on passwords.
ONE good password that I can use across all the platforms, change-controlled when I want to, and no silly C3 limit of 11 months before your old passwords drop off the list, and I don't need two sheets of cribs.
besides, I've already used up all the good Cu55w0rd$...
if this is supposed to be a new economy, how come they still want my old fashioned money?
http://shit.slashdot.org/article.pl?sid=04/12/10/1 644233
First of all, nPr = n!/(n-r)!, but I guess that was just a typo, since you got the result right.
Second, you are using the wrong formula. A letter can be used more than once in the same word. Each of the four letters then have 26 possible values, which yields 26*26*26*26 = 26^4, not 26*25*24*23 = 26P4.
This is a pretty neat idea.
From a crypto point of view though, isn't this easily distinguishable? I mean, each pair of characters would maintain the same level of entropy as a standard 1-to-1 character map. Maybe it would require a bit more sophistication than a straight dictionary attack, but isn't this just less secure than a full-on random password?
These are my friends, See how they glisten. See this one shine, how he smiles in the light.
I've never really done anything with Perl before though, just limited php/html, not a programming type.
Would appreciate help/guidance.
All your base are belong to Google.
so, picture the scene... an average joe walking along the street finds a wallet with such a piece of paper in it, and thinks: "aha, this is obviously a password cipher for online passwords - sucker! now i just need to guess where his accounts are, guess his username for each one, and guess his four-letter passphrase! now all your information is belong to me! muahahaha!"
seriously! it ain't gonna happen.
this is just the sort of obtuse thinking that mystifies me - why do you presume someone finding that paper is somehow divinely aware of it's purpose? or any of the related information needed to make use of it? realistically, someone finding that paper would either a) ignore it, and throw it away or b) look at it for 3 seconds, and throw it away.
it's security through misdirection - theoretically it might not be perfect, but in practice it works very well. in fact, just having a paper with a list of 20 passwords on them, and nothing else, would work far better than you might think - as long as it wasn't titled 'my passwords, by bill freeman' and was cross referenced by a list of username and account details. of course, keeping that piece of paper next to a computer would make it more obvious, but then that's hardly what he suggested, is it?
When I'm adding a test account to a network server for short-term use, I might only use a four- or five-character password, since I'll disable the account soon anyway. My own passwords are longer, and several of them were generated by rolling dice. I hope I never work at a place with mandatory monthly password-changes, because those dice get lost all the time...
Where I work, old desktops are being upgraded to laptops, which we're expected to take home. So, if I were to leave a note of my password under my keyboard at work, the system won't be there for anyone to try it on... I can keep an encrypted file on the laptop with all my other passwords.
The DoD is just as bad. Their password policy just to get onto AKO (Army Knowledge Online; has almost nil personal info) is to require a password no longer than 12 and must include 2 caps, 2 lowercase, 2 special symbols (but many are not allowed) and 2 numbers. Also the username is often not in the same syntax for each person, at least 5 different syntaxes that I know of, even more for names like Smith. I never had any problems remembering my password before and it was easy enough for me to remember a relatively complex password (that is no longer allowed due to above restrictions). I changed it and immediately forgot it, despite it being as similar to my last password as I would make it.
hello world
I like my women like my coffee... pale and bitter.
All the password selection schemes described by the power users here are simply variations on security by obscurity. These same power users would never accept a security system based on security by obscurity. So, why suggest that passwords be chosen that way?
A good password is a long string of random letters and numbers. People are not very good at picking random sequences. And, random sequences are hard to remember.
Passwords should be changed periodically. This makes remembering them even harder.
The only realistic password scheme is one based on an automatic password generator for the password and some form of 'keychain' to hold these passwords which can be secured by a simpler combination of user selected pin/password. Higher levels of security can be achieved by making the 'keychain' physically external to the computer.
Security 'experts' need to get their own act together if they want to deliver secure systems. It is their responsibility to make sure that they do not allow their users to become their the weakest link. It is a question of design, not one of education. Or, if it is a question of education, it is the security 'experts' who need educating.
Passphrases make a lot of sense, every new piece of software should subsitute password for passphrase. Even if users only use 4-5 characters, the fact that the word is different perhaps may get them to think of a longer word or set of words to authenticate with which couldn't hurt could it?
Set up a popular web site, requesting users to register with an email address and a password of their own choosing.
...profit!?!
Have 100 000 users or so sign up, and then try to log into all yahoo and hotmail email accounts with the exact same passwd the user submitted.
Sell the info to spammers...
Hm. Judging by your language and sentence construction, I'd say you were in Marketing. Well, I'm sure you'll be out of a job before me, so, ta! Have a nice day!!
You can always spot the Marketing people - 'This is too hard! Wah!' These are same fatuous pinheads who can't come up with clear requirements for projects because they simply have no vision or creativity. Making up a new password every 60 days takes me all of 1 minute. Of course that's one minute that a suit-wearing, frustrated pretty-boy quarterback wannabe could be looking at ESPN or porn. THE HUMANITY!!!!!!! KILL THE IT GEEKS!!!!
Grow up. Use your shriveled little brains for something other than cooking up schemes to screw your coworkers.
You l-users sicken me when you come crawling for help after your pathetic passwords get cracked and you've exposed the company's valuable data.
You're idiots and should simply be 'negatively employed', to use one of -your- phrases.
Don't blame IT because YOU can't think in sentences longer than three words.
"Or is it that the entire business culture needs to change from within to take digital security seriously?"
Yes, corporations need to stop promoting/hiring people because of how pretty they are or who they're related to.
Daily I meet people who obviously lied on their resumes. Questions in an angry tone like 'What's a URL??' are the first clue.
You're instantly obvious and you're not fooling anyone. You don't like technology? RESIGN. NOW.
When possible, I use non printable characters such as #1-27, #255, etc.
I have yet to see a brute force program which takes those into account. 255^8 is quite a number. I say 255 because #0 isn't possible usually.
That way, you can have stupid passwords which are still a beast to get.
Intelligence shared is intelligence squared.
OK, we got a bunch of people here pretty upset that stupid people can't remember their passwords. This is really ridiculous. I can remember my passwords if I choose them. No problem. But do I wanna remember 2 jingillion passwords? Simple answer, no?
Oh the stupid should use their brains to remember the passwords. Well why don't some of the "non-stupid" people use _their_ brains to come up with better security schemes. Plus not everything needs a password.
Chaning password every so often on something where system administration is out of your control is a good thing. But if it's a system admin that requires password changes simply because that's what they read in the latest Dr. Dobb's then that system admin should be taken out back behind the building and giving a good lecture with a baseball bat. Once every six months is fine. If a user is stupid and shares a password, requiring them to change it every 45 days is not going to help you. It's only going to make sure that they bug you with lost password complaints. At the end of the day, they won't get in trouble for not remembering it but you might for not helping if you're the sysadmin/tech support.
At corporate level where we have a dedicated sys admin or a team of them, I expect them to tighten the system instead of blaming the user for petty things. Dude, if they could keep it secure, you wouldn't be there.
Just my $0.02. And I'm a developer not the marketing type. In other words, this is from a geek point of view. You have to fix the user-error. The user won't.
I like to pick a theme every three months, flowers, mythical creatures, LOTR characters, Comic books, States, etc.
Then I use a consistent character replacement system.
No I won't tell you what it is.. but it makes for a reasonably good method both for remembering them and for security.
I do record the theme on a paper calendar at home, I don't change every password I've ever created so I need a clue to jog my memory. It's just vague enough to be both confusing for someone not familiar with the method and precise enough to help me guestimate what I'd used within two tries. Imagine finding a Picasso Calendar with the word 'flowers' written on the second tuesday, the word 'Comicx' written on the first thursday, etc, etc. - it would take some Watson like insight to put the clues together.. and you're only halfway there.
Other ideas were song lyrics and book meta data... ie: book: page, paragraph, word... ala 4665Brightblade, where of course i would underline the word.. this way I could keep the books around for reference if needed, maybe with a bookmark at the right page.
Anyways, there are lots of good and practical methodologies for picking secure passwords... just be creative.
A fool throws a stone into a well and a thousand sages can not remove it.
Biometrics, my friends, it's the way to go.
Not for research labs. Not for government agencies. Not for nuclear wessels or the CIA.
No, it's for the other 80% of the users. Bob in Accounting, Sally in Finance, Anne, who currently is working hard under Bobs desk. These are the raving morons who write down their passwords, who pick really dumb easy ones, who cause grief.
It's the dumb salespeople and the drooling managers who cost us the most money and the most time. THESE are the accounts that biometrics are best for. My pref is for fingerprint pads, because (a) they're unobtrusive (b) they're easy to use and (c) they have a 'cool' factor.
These are the accounts that have a low tech factor, but can hose us if someone gets access.
Yes, yes, someone can hack a fingerprint with some candy and a little time... but this is no different than anything else. Social engineering got me more passwords than hacking ever did. And, really, if Bobs password is his fingerprint, he's not likely to get hacked from outside. If his password is "annesass", someone will get that.
At our org, most of our passwords are still "321" from when we changed domains and reset all user accounts. It hurts me, it does, to see such idiocy. Knowing that a little stupid pad and a secure server would be 8x more secure than our existing (nonexistant) policy toasts my grits. It's about "bang for the buck", and how likely said account is to be nailed... and biometrics is easy to use, relatively more secure than text passwords, and can't be written down, or told to someone on the phone. It's almost impervious to general, not-on-site social engineering.
I had an (ex) manager who I once convinced of the wonders of heavy passwords. 12 chars, changed 6x annually, nonalphanumeric requirements, dictionary challenged... he wanted security, I gave him what I could at the time. Everyone obeyed policy, didn't write it down, worked hard to remember it. Said manager got a call one day... "Hi, this is Dave with Telus, I'm just running some maintenance on our DSL accounts. Could you please tell me your username/password?"
Said company was underbid on every contract for the next 6 mos, and folded.
That's my rant. Users are dumb. They will take the easiest route to get to something, no matter what the possible consequences are, and they will claim innocence and ignorance when they fsck everything up. We must get around the users brain... fingerprints are the best way to do this.
And cattleprods. Used as anal probes. After hi-octane enemas. I like this plan...
Damn users.
If I knew the wedgies I gave you back in 6th grade would have resulted in this . . . I might have taken a moments pause.
Real men don't remember passwords - they upload them via ftp and let the world remember...
"A goldfish was his muse, eternally amused"
Why don't you just switch back and forth between two sets of imaginative, more sucure passwords each month?
Did not supprise me. I know lots of people who just increment the two numerics.
It was always my belive that if you make a password scheme to strict it becomes insecure because people cannot or don't want to remember a compilcated new password every x days.
As the old saying for screws goes: after very tight comes very looses. {For those not firm with mechanics: if you tighten an screw too much it will break}
Because everybody will write the password down as soon as nobody looks.
I started a new job in jan this year, and the main password used some of these rules, mixed case, numbers >8 chars etc
I lasted 6 months before I went to a password that I increment each time.
I think the problem was not that needed to come up with a new password each time, but the fact that I had around 8 different passwords to change (with different rules as well!) making the entire process a pain in the arse.
I want to go to work to work, not change passwords.
----- I refuse to have an argument with an unarmed person
I started to write down passwords every time I had trouble remembering one I should use. I store them in my cell phone in a dedicated area where they are "protected" by the phone pin code. (I have no idea how much protection that actually is.) I haven't written down the pin code for my credit card, the password for my netbank, the password for my government sponsored digital signature, or the phone pin code itself (doh!). But everything else I have used the last three months are there.
/. (yes, I have a /. login but don't want to broadcast where I'm storing my passwords to every half-witted google user out there) will start using some kind of identity server (like MS passport or whatever the Sun/Oracle alternative is called, or for national sites the government id I mentioned earlier), rather than keep inventing their own.
Last week, we discussed passwords, and I counted how many was on my phone. There were 28 passwords. Now good passwords should be at least 7 characters long, contain numbers, letters, and special characters so they can't be cracked easily by brute force. They should all be unique, so compromising one won't compromise all. And they should never be written down, so a simple thief may get access to them.
Now, I can rememeber one good password. I can even remember two good passwords, and two pin codes as I have decided to do, but there is no fucking way I'm going to remember 28 (+4) of them.
So I hope sites like
Compuserve used to have a great password generation mechanism. They used two common words separated by a punctuation mark, like "sofa'cloud" or "mouse=light". They sent me my password, I read it once, and never forgot it.
At my last job I had 28 passwords ranging from the Lucent Navis password that gave total control over the SE US ATM network (which was left for years as the manufacturer's default password, shared with hundreds of users- though lately changed. Anybody who felt like it could have shut down virtually the whole Southeast's data network in under a minute.) to that eldrich horror, COSMOS/FOMS which holds all the region's central office wiring records and orders. The latter constantly changed passwords with rigid policies for format. I can tell you that security through obsurity does have its points - no one ever wanted to use the damn thing, it was so picky - it only runs on Amdahl hardware that perfectly replicates its 30+ -year-old IBM environment. It can only be accessed through Wang teminal emuation programs with curious settings- the ones we used for all our other mainframe apps wouldn't have anything to do with it, and even with the right software it cared which "enter" key you pressed - had to be the one on the keypad. The system documentation was primarily oral tradition, jealously guarded for the sake of job security by the paranoid elder union gnomes.
Anyway, there is no human way to remember 28 passwords which all change on different schedules, have different rules and cover wildly differing systems that may require logging in 25 times a day or once every 2 months. All 250+ techs recorded their passwords, most both on paper, on their local drive and on their space on the Windows network drives.
Also, there is no way that anyone who has to do 50-100 assorted logins per day will not script their logins if there is any way they can. Virually all our mainframe and *NIX shell access stuff was scripted, against company policy - but if management had cracked down, productivity would have dropped at least 25%.
You cannot get better security by having more than four of five good passwords for a person in the whole of their personal and professional life at any given time, and people cannot come up with good new ones all that often. Trying to use more passwords is just counterproductive. The psychological factors overwhelm the theoretical advantages.
The best real-world compromise I have found is the encrypted keyring, but most companies still don't make high-level encryption part of their standard desktop install. Encrypting the keys to your multibillion-dollar network in MS Word is sad, but is actually better than the average practice of no encryption at all.
Well, if they compromise the matrix, you're looking at two and a half bits of entropy per character, or approximately 1,000 attempts before they brute-force the password. Additionally, if someone is shoulder-surfing, they only need to pay attention to every other letter. Admittedly, choices like "u" or "e" (which utilize the same starting letter in their corresponding letter-tuple) insert a single bit of entropy, but given the choice between "team" and "tuam", I think most people wouldn't even have to brute-force it.
If someone doesn't compromise the matrix, but is able to analyse a large number of these generated passwords, he or she can come up with the complete set of codes pretty quickly, and then you're back to the 1,000 attempts or so.
In the final situation, however, someone with no knowledge of your scheme is confronted with one of your passwords and challenged to find another. In that circumstance, your scheme is indeed a good way to generate eight-character, random- looking passwords out of normal, four-character words.
Jouster
Every time you need to change one password, change them all to the same thing....
IANAL but write like a drunk one.
If the different departments in your firm don't talk to each other and there is no guiding IT central authotiry, well....
IANAL but write like a drunk one.
Christ man... you can plead laziness or dyslexia or whatever excuse you want, but reading your comment makes me think a retarded 3rd grader could do better. LEARN TO FUCKING SPELL. /wipes the vomit off monitor
Remember to not to count the numbers. like 5. In the above post.
I've got a PHP version, which is a bit different. Code's public domain, do with it what you will.
Try it:
http://webmages.com/misc/passkey.php
Grab the source:
http://webmages.com/misc/passkey.phps
If you really, REALLY care about security - you make it transparent and simple... Frankly 8 distinct passwords, OUCH
I have mod points and I am not afraid to use them