Slashdot Mirror
MS Employee Calls for No More Passwords
BobPaul writes "On his blog, Robert Hensing of the Microsoft PSS Security Team makes a really convincing argument for the abolishment of complicated passwords. He argues that precomputed hash tables, network sniffing, and programs like LoftCrack make passwords obsolete and dangerous in the windows environment. What does he recommend in their place? Passphrases: sentences and quotes that are easy to remember but may be more than 30 or 40 characters in length. With many companies requiring frequent password changes, (and we know exactly where that leads) this is a simple idea I'm surprised more people haven't been doing this more often."
Now replacing my brute force wordlists with "He's dead, Jim", "In soviet russia, passphrases validate YOU" and "passwords are for old korean people" will allow root access to 90% of the internet.
With all of the vulnerabilities and exploits in Windows who needs a password anyways? ;-)
So when the user creates there password it will be: "This is my passphrase" instead of "password"
And I quote, "Open Sesame!"
When things get complex, multiply by the complex conjugate.
or
Make of that what you want, but:
Of course, I changed the password to something more politically correct before leaving the companies....
The right to offend is far more important than the right not to be offended. (Rowan Atkinson)
Biometrics, on the other hand, requires that you only have your body present at the time!
Or that someone else has your body present. Or just search google for jelly fingerprint to see how to duplicate other people's prints for fun and profit.
Biometrics is bound to stick around for a while, but the fad will hopefully fade before all my bank and credit card accounts get tied to my fingerprint and I have to have new prints carved into my fingers to replace the ones that some identity thief lifted off the scanner.
If I have been able to see further than others, it is because I bought a pair of binoculars.
Lawrence Person (lawrencepersonh@gmailh.com (remove all "h"s to mail)
http://www.lawrenceperson.com/
ba ding :-)
because if you use a salted hash (chosen by the server)
... when I stop by our local Denny's for breakfast I let the waitress decide whether I get corned or roast beef with my eggs.
That's true
The higher the technology, the sharper that two-edged sword.
You don't need to make gloves with someone else's fingerprints. All you need are gummy bears.
Gummy Bears! Bouncing here and there and everywhere! Foiling security beyond compare! They are the Gummy Bearrrrrrrrrrrs.
I'll stick my penis in a hole at the atm to take out 60 bucks, hell I usually pay someone ELSE 'quick cash' for the privledge.
(just kidding, im a sexually frustrated computer nerd like the rest of you.
Suppose I make fake finger prints of "Carrot Top" or some other annoying guy and then wear glove and rob Fort Knox. While there I leave Carrot Top's fake finger prints all over everything.
Will Carrot Top go to jail?
that he's an MS empoyee, because what he suggested is stupid. People's vocabularies are not that extensive, so passphrases are easier to crack than they seem.
Multifactor auth is the only cure. I wish there was something available to implement it besides smartcards. Something that doesn't require a smart card reader and works everywhere, preferably something wireless within a few feet. You could do three-factor auth, even. This "something", pin code and biometric (fingerprint). That would be pretty darn cool.
Biometric authentication can't be changed. I can change a password, but I can't change my fingerprints.
Ooh...yea--that'll be the downfall of biometric authentication. Someone steals my retina and then all my accounts are 0wned for ever and ever...
There's no place like
Besides, it IS possible even today to change the pattern of blood vessels on the retina using lasers - this is done all the time to treat diabetic retinopathy.
;)
Good point, but anyone who wants to go through all that trouble is welcome to my slashdot account.
There's no place like
Dude, you pretty much figured out how to sell this, you just didn't put two and two together... you need to spread it around that PASSWORD length = PENIS length. Make sure the hot chicks in accounting are informed.
Indeed, that's all the security I need.
Something I have... Smith and Wesson.
Something I know... How to freaking shoot.
Something I am... Bad MotherFucker.
Loftcrack, you said?
:)
Thanks.
___
It's the end of my comment as I know it and I feel fine.
"You mean we're going to have to add an 's' to the end of 'http', do you really expect 100 people to change their bookmarks! They've been using those bookmarks all year!" Insight from other admins very welcome. Ummm... a HTTP redirect to the new HTTPS URL? :)
Biometrics sounds good. We already know that people like to hop on to the Xerox machine and photocopy their butt. This could be promising.
Patents pending.
You mean etching the fingerprints on those poor (but yummy) souls? My WTF-0-meter explodes at the very thought...
You can hold down the "B" button for continuous firing.
using any passwords with Microsoft products is futile. Passphrases cannot change that. Use any system designed with security in mind if you care.