Write Down Your Passwords

joeykiller writes "Microsoft's senior program manager for security policy, Jesper Johansson, presents a provocative but interesting view on password policy: He claims that prohibiting users from writing down their passwords is bad for security. His main point is that if users are prohibited from writing down their passwords, they will use the same easy to guess password everywhere." From the article: "Since not all systems allow good passwords, I am going to pick a really crappy one, use it everywhere and never change it...If I write them down and then protect the piece of paper--or whatever it is I wrote them down on--there is nothing wrong with that. That allows us to remember more passwords and better passwords."

Comments

Pseudo-Written Password

[fembots]

Seriously though, instead of writing down the password, why not using what's already written on the hardware?

For example, I'm only reading Slashdot from this particular computer, and I'm using a IBM E94 monitor, and there is this Sellotape dispenser on my desk with 1531 written on it. So my Slashdot password can be easily remembered as IBM!1531@E94#, or simply ibm1531e94 for those systems that cannot accept special characters.

See? it's so easy to remember a long and good password, and nobody's going to find out how many items you use and how you combine them to make up your password.

The good password requiremnt is not helped by the fact that users are also required to change it every xx days, so not only you need to remember a strange password, you have to remember a different one every couple of days.

There a joke about the increasing frequency that a user is required to change his password nowdays, eventually crackers just need to keep on trying the same password and the system will change to match it.

Re:Pseudo-Written Password

[Anonymous Coward]

I've guessed numerous passwords with your technique. I hope you were kidding.

Re:Pseudo-Written Password

[Anonymous Coward]

Everyone I know at work with a lot of passwords uses (password protected) software (like pins) to store all of their passwords...

Re:Pseudo-Written Password

[Gilk180]

The good password requiremnt is not helped by the fact that users are also required to change it every xx days, so not only you need to remember a strange password, you have to remember a different one every couple of days

Yeah, plus having to buy all that new hardware gets expensive!

Re:Pseudo-Written Password

[Scruffeh]

I think the bigger point here is that most people don't care about passwords. They see them as necessary but annoying which is why they use easy to remember things. It's also silly to say writing down passwords is bad or good. People are always going to use different systems which may or may not work well for someone else. I rotate my passwords and do not write them down, another person my just find this annoying. It's all subjective IMHO

Re:Pseudo-Written Password

[LordSnooty]

But what happens if someone moves the Sellotape? And more obviously, what if someone cracks on to your method? The password is right in front of them!

Actually it's not too bad because it requires physical access. At my famous Educational Establishment, there's been a recent spate of hackers using weak passwords to gain access - all from off campus. Make it strong and keep it written down somewhere secure, and you're pretty much safe from the majority of abuses. Keep it hidden innocuously in a book or a file of boring documents, rather like a file in a cake.

Re:Pseudo-Written Password

[Anonymous Coward]

If I have 10 items on my desk with various serial numbers or part numbers on them, and you KNOW FOR A FACT (of course you won't) that I'm using 4 of them, that's still 10!/(10-4)! combinations, or 5040 possibilities. Furthermore, there's the possibility that I added characters in between each item, each one increasing complexity by 62 (assuming ONLY alphanumerics). So in a bad example, with only 10 numbers to choose from, and your having a good deal of knowledge about choices, it is INCREDIBLY unlikely that you'll successfully guess the password before the system locks you out (essentially what a local attack will be limited by anyway). If you grab a copy of the hash somehow (which generally indicates another security problem in itself), your attempts can be rather easily be foiled by character substitutions (password -> p4$5W0rd), each possible one adding another order of complexity to the problem, increading the permutations by at least a factor of 2. Given 3 substitution choices per letter (there will usually be many more than that), 'password' becomes 3^8, or 6561 TIMES more complex.

In short, if this is true, the passwords really, really sucked.

Re:Pseudo-Written Password

[Em Ellel]

Everyone I know at work with a lot of passwords uses (password protected) software (like pins) to store all of their passwords...

In the end, it is probably one of the better ways , although I always wondered that since now there is a potentially weak password protecting MANY possibly strong passwords, do the strong passwords matter? A simple keylogger will give access to ALL of your passwords in seconds.

-Em

Re:Pseudo-Written Password

[Anonymous Coward]

Shhh! Someone is going to crack my elite Slashdot password: lled

Re:Pseudo-Written Password

[essreenim]

The good password requiremnt is not helped by the fact that users are also required to change it every xx days, so not only you need to remember a strange password, you have to remember a different one every couple of days.

Thats why I think my solution - http://it.slashdot.org/comments.pl?sid=150601&cid= 12628446 - is better. And if its a password that expires every couple of days, use a seperate hash that puts in random bits as well for this task... http://it.slashdot.org/comments.pl?sid=150601&cid= 12628446

Re:Pseudo-Written Password

[Anonymous Coward]

I used to use a password-generation "method" which was to create a rather rude anagram about the particular user (with the appropriate number/symbol substitutions for letters, as necessary). After a couple of years of odd passwords one of the engineers finally started to catch on (it didn't help that he could sometimes hear me laughing while creating new-user passwords...).

Re:Pseudo-Written Password

[Em Ellel]

On a more practical note, back in a day when I backpacked through europe I wanted to have a backup of important data to take with me, in case I lose my passport/bank cards/etc. However being a paranoid freak I did not want to write the numbers down on paper in plain-text, as I would be doubly exposed - I could loose my wallet or I can loose my notebook.

So to resolve this issue I wrote the information using a simple rot-n algorithm with random keys. I wrote down all numbers (including rot-n keys, which looked just like the rest of the data) in my notebook and knew that if I had to use them, it would take me a little time but I could work it out, and if I were to loose the notebook, I could be pretty sure that noone would bother trying to make sense of a bunch of numbers written on the back cover - most likely it will be just tossed.

Obscurity combined with physical security makes things severely more difficult for a casual snooper. In the end it is a game of making the cost of figuring it out to be more that the desire to do so. Writing down key data, such as passwords, with a little obfuscation goes a long way.

-Em

Re:Pseudo-Written Password

[ginotech]

if someone has that kind of access to your computer, you're screwed anyway.

Re:Pseudo-Written Password

[Em Ellel]

if someone has that kind of access to your computer, you're screwed anyway.

True. This is where a 2-factor auth (if done correctly) can shine. All and all this is probably where we will end up soon.

Re:Pseudo-Written Password

[aussie_a]

One-computer per password is fairly expensive though. I also use different computers to log into the same site.

Re:Pseudo-Written Password

[KinkifyTheNation]

Or use a sentence and remove the spaces.

thispasswordwillnotbebruteforced

for example. The only weakness I can think of is that it may or may not be easier for someone to guess it.

Re:Pseudo-Written Password

[Erik Fish]

If they take the Sellotape then you just set the building on fire.

Re:Pseudo-Written Password

[JustOK]

Yah, I might pay a dollar to see what happens when some over eager DHS agent sees it when you come back... "Oh, just rambling about 'Europe', huh? Meet any interesting people? What's all these numbers? What specific countries did you go to? Do you have proof of where you stayed in each of these countries?"

Re:Pseudo-Written Password

[Squareball]

A better approach to that is take a phrase and change it like so

iLikeFi$he$Bec@useTheyreSoDelicio$

Now all you have to remember is the phrase and what letters you changed to symbols. That's pretty straightforward and much much easier to remember than like w7sk24#1d or something.

Re:Pseudo-Written Password

[ShortSpecialBus]

This is the first post that I have ever wished I had mod points today for.

Re:Pseudo-Written Password

[Em Ellel]

Yah, I might pay a dollar to see what happens when some over eager DHS agent sees it when you come back... "Oh, just rambling about 'Europe', huh? Meet any interesting people? What's all these numbers? What specific countries did you go to? Do you have proof of where you stayed in each of these countries?"

LOL. Luckely for me those were the pre-minipax days.

Re:Pseudo-Written Password

[Anonymous Coward]

The fish was delish and it made quite a dish.

Re:Pseudo-Written Password

[Tsu Dho Nimh]

One place I worked used an astrology program to generate frequently changed access passwords for a terminal that could not be physically secured.

To retrieve the password, we used the ephemeris that was conveniently parked in the bookshelf near the computer, with a lot of boring references and some ancient magazines. Look up the date and time, enter the correct astrological data and the terminal let you complete the login process for the lab system.

Re:Pseudo-Written Password

[anagama]

I just cryptopad for my Handspring. It doesn't connect to the internet so even if keylogging is available for palm, I don't care much. I have 30 or so passwords in there -- there's no way I could possibly remember them as most are basically alphabet soup.

Re:Pseudo-Written Password

[ChatHuant]

A better approach to that is take a phrase and change it like so

iLikeFi$he$Bec@useTheyreSoDelicio$

That doesn't add much to your password's security, you know; your changes aren't random enough, especially since "leet" ortography is so prevalent. There are dictionary attack programs that use expanded dictionaries, using also words with the obvious replacements (I/L -> 1, e -> 3 and so on).

Re:Pseudo-Written Password

[Em Ellel]

I just cryptopad for my Handspring. It doesn't connect to the internet so even if keylogging is available for palm, I don't care much.

But when you sync to the PC(which is likely to be internet connected) does it not store backup of your data on the PC? That being said, even if it does, I am probably going to do the same thing as soon as I get that treo I've been eyeing. :-)

Re:Pseudo-Written Password

[CynicalGuy]

I have a Treo and I use GNU keyring for this.. It's free and works great..

Re:Pseudo-Written Password

[Aeiri]

For the expiring passwords, you can use something like:

bah bah black sheep have you any wool-slashdot-20050524

And know that you only change it on even days (say it's the 27th, you would use the 26th's date there), or only use the month for 30 day passwords, whatever.

GREAT idea though, and I think I'm going to use it!

Re:Pseudo-Written Password

[Analogy Man]

iLikeFi$h

Along the same lines, once you have an "encryption" method you can list your passwords on a sheet of paper with a little clue:

laptop : Elvis slashdot : Beatles

....real passwords B1u3$ued3$h0e5, 8ackInTheU55R

Re:Pseudo-Written Password

[spacecowboy420]

IMHO, an even better way is to pick a pattern on your keyboard and alternate your shift key. If you look at this password: o0i9u8&TR% it may look impossible to remember, but if you were to actually type it, it becomes surpisingly simple to remember. Once you know it, it is even difficult to tell someone your password, but easy as hell to remember when typing on a keyboard - just remember the pattern.

Re:Pseudo-Written Password

[kz45]

actually, I think it's better to pick a password of random characters that are near each other on the keyboard. Such as: 4rfvbgt5

I often times will remember only the location of my password, but cannot recall the password when I am not near a computer.

Re:Pseudo-Written Password

[J. Random Luser]

A couple of days ago I was directed to http://www.cisecurity.org/ to get their "Macintosh OS X Panther Benchmark Security Document". I was surprised to see (p.20) they recommend old chestnuts like 1qaz@Wsx and 89)Okm,. as "strong" passwords which are fairly easy to remember. Of course MacOS' bad joke 8 char limit doesn't help.

Re:Pseudo-Written Password

[Anonymous Coward]

A simple keylogger will give access to ALL of your passwords in seconds.

Yes. Remembering your individual passwords will help how? If you're worried, just make the app display a random keyboard mapping for each character of the password. If you have keyboard logging, you're still screwed anyway of course.

Compartmentalise your passwords by protecting them with different passphrases. This works well if you ever need to divulge some passwords (e.g. work related passwords) while keeping your personal passwords secure.

Re:Pseudo-Written Password

[mustangsal66]

Pass Phrases are much better then passwords. Change up the letter substitution...ie...

Big8@dw0!fl1{3sSnake$-[yuk!]

BigBadwolflikesSnakes-[yuk!]

This basically turns days into weeks for crackers like Lophtcrack.

Nothing is uncrackable, but you make it as hard as you can... For windows, use groups of 7 chars.

Re:Pseudo-Written Password

[Anonymous Coward]

Hmm, I memorized my ATM PIN somatically, and when I had to log in to the website using it I actually locked myself out -- the keypad is inverted on the PC keyboard. So, your suggestion is fine, but stay away from Dvorak keyboards.

Re:Pseudo-Written Password

[jkosturko]

I use a similar technique, using a dollar bill. Take the serial number of a dollar bill and choose an offset between 1 and 4. Type in each character of the serial number number, pressing the shift key for every character that is a multiple of the offset (every third character for example) This way, you have the password "written down," but it is stored in an inconspicuous manner that will not be recognized or comprimized if you lose your wallet. Obviously, don't lose/spend that bill :)

Re:Pseudo-Written Password

[Nasarius]

Those kind of passwords are great against brute-forcing, but extremely vulnerable to the classic technique of shoulder-surfing.

Re:Pseudo-Written Password

[Anonymous Coward]

I tell them that, if they write them down, they should keep the paper with it in their wallet and treat it like cash.

So far, it seems to have helped some, at least.

Re:Pseudo-Written Password

[Mattcelt]

In short, if this is true, the passwords really, really sucked.

Not really. What it means is that users generally really, really suck at picking good passwords.

In order for Mr. Johansson's idea to be truly effective, three things need to happen:
1) the IT department much choose strong passwords for the users. They must NOT allow the users to choose the passwords themselves.
2) there must be an incredibly explicit policy regarding the protection of the media on which the passwords are stored and accessed. The policy must provide stiff penalties for failure to comply, and periodic checks need to be made to ensure compliance.
3) the users need to be educated on the relevant security practices so they know why it is so important to follow the letter of the policy and not circumvent any part of it.

Failure to do any of these will compromise the success of the strategy.

Re:Pseudo-Written Password

[anagama]

That's a good point I should doublecheck. I've always assumed that it encrypts the file so even if viewed, it would be scrambled. At least that is what it ought to do and if doesn't I'll find something else. As for syncing, since I've gotten a laptop I haven't done that in ages .... which presents a problem should the thing die and I have no backup. Personally, I don't think there is any great solution to password issues. I know I can't remember them all, and recording them makes for other problems.

Re:Pseudo-Written Password

[Em Ellel]

Yes. Remembering your individual passwords will help how? If you're worried, just make the app display a random keyboard mapping for each character of the password. If you have keyboard logging, you're still screwed anyway of course.

Looking up a slashdot password (or any other one password) will not reveal every single password you have. To get every password you need to log into every site. Less chance you loose all your password at the same time. Not that it is much comfort, but at least there is more of a chance to discover you are being logged before it is too late.

-Em

Re:Pseudo-Written Password

[noidentity]

There a joke about the increasing frequency that a user is required to change his password nowdays, eventually crackers just need to keep on trying the same password and the system will change to match it.

In Soviet Russia, the system dictionary attacks YOU!

Re:Pseudo-Written Password

[mdfst13]

It's easier to just use the first letter of each word: tB8wlSy! (The big bad wolf likes snakes. Yuk!) is as secure and easy to remember as your phrase but shorter to type. The hardest part would be remembering the capitalization.

The first letter of every word passwords are proven cryptographically strong. I'm not sure that the same can be said of Pass Phrases. They have internal logic that could potentially be revealing. Plus, they are easier to observe. I.e. if I'm watching you type your password, it's easier to pick up that you are writing a phrase. No single letter of the first letter password says anything about the other letters, but your phrase has hints all over.

Re:Pseudo-Written Password

[jigyasubalak]

So to resolve this issue I wrote the information using a simple rot-n algorithm with random keys. I wrote down all numbers (including rot-n keys, which looked just like the rest of the data) in my notebook and knew that if I had to use them, it would take me a little time but I could work it out, and if I were to loose the notebook, I could be pretty sure that noone would bother trying to make sense of a bunch of numbers written on the back cover - most likely it will be just tossed.

And if you had lost your notebook you would have done what? I thought you'd say something like "I emailed the bunch of numbers to an email account the password for which I can never forget." But have to grant it to you for your whatever flash of brilliance.

Re:Pseudo-Written Password

[gengee]

Yes; This is in our corporate information security policies, along with the suggestion that users use memorable song lyrics as the source pass phrase. Most users like that system, as it becomes fun to think up a new password.

14ckwbwtdbwb = Fourteen cannibal kings / wondering blindly what the dinner bell will bring

For a root system password, you may want an even longer password, both for cryptographic security where cryptographic systems support > 8 characters, and more importantly to discourage the use of the root system account by administrators when tools like sudo make its use unnecessary.

ItastD,DIgtiop,lttuatt,wyesok? = I turned and said to Dan, "Dan I guess this is our prime / like they tell us all the time / were you expecting some other kind?"

It's difficult to forget that password, but even in the event you do forget it, there's a strong possibility you'll remember enough to Google-up the answer. And I guarantee administrators will more frequently use (rules-driven, command-logged) sudo when the alternative is a 35-character root password.

Re:Pseudo-Written Password

[marksven]

This works until you go to a different country and try using a computer there. Every keyboard layout has its symbol keys at different places on the keyboard. This screwed me over once when I tried to check my email from a computer in Japan.

Re:Pseudo-Written Password

[Anonymous Coward]

"I'm using a IBM E94 monitor, and there is this Sellotape dispenser on my desk with 1531 written on it. So my Slashdot password can be easily remembered as IBM!1531@E94#"

And what do you do when someone steals your tape dispenser?

Re:Pseudo-Written Password

[wolja]

I think the bigger point here is that most people don't care about passwords.

In reality the need to change passwords is an artifact of the burgeoning security industry that forgets that people aren't geared to remember multitudes of non word like passwords, some people here at work have 50 different passwords. This means they write them down and use repetitive passwords.

The solution is single sign on with proper physical and pass phrase based authentication but this would reduce the need for audit and Security to an extent.

Re:Pseudo-Written Password

[nebs555]

yeah but if you had been pickpocketed by albanian cryptography experts... you'd be buggered

Re:Pseudo-Written Password

[dotgain]

But then, depending on what you let them do through sudo, your root p/w might end up being irrelevant, as the administrators passwords can be used to do potentially nasty things.

But if you've locked sudo down to only a handful of carefully considered commands, then fine.

Re:Pseudo-Written Password

[Anonymous Coward]

He could start it by having a light saber fight with some flourescent tubes!

Re:Pseudo-Written Password

[Anonymous Coward]

Sorry, we had to replace your monitor while you were out last week. Someone accidentally drenched it with Coke. As a consolation we got you a much nicer monitor and also replaced your dingy old tape dispenser.

What do you mean that keeps you from logging in? Don't be ridiculous.

Re:Pseudo-Written Password

[shicklin]

I would suggest they think of it as a credit card. If you lose a note that's the end of the story (and u feel gutted that you can't buy beer with it). Loose your card(s) and you could be stung for a lot more over the period of time before you notify your bank. (Yes I know that banks will refund your money back but they usually say you have to pay the first x pounds if your slow in reporting the loss)

Re:Pseudo-Written Password

[Spug]

Sucks if you have to enter your password on a PC using Dvorak, for example, though.

Re:Pseudo-Written Password

[nkv]

Writing them down initially and then entering them everyday for 10-15 days will probably make you memorise them anyway. I used to write down a password a couple of times on a piece of paper to memoriese it and then destroy the paper.

Re:Pseudo-Written Password

[Pxtl]

Until you run into systems where some retarded DB admin as decided that paswords shall not be longer than 13 characters. That's one that pisses me off to no end.

Re:Pseudo-Written Password

[Rexdude]

This becomes easy for Indian audiences. I throw an open challenge to anyone who can decipher the name of the latest Bollywood flick, or some phrase from any Indian language translated into english. Indian films have long names, more like phrases-and there's no rule on how to spell them written in english, so they can be spelt in any way. Same goes for anything else-swear words, phrases, proverbs...you won't even need to write it down!

Re:Pseudo-Written Password

[Ed Avis]

Why do people need more than one password? Why can't websites and applications authenticate you using your PGP public key? Then there would only be one thing to remember - the passphrase for that key - or at most two, if you need a password to log in to the OS at the start of the day.

It's not needed that users know how to use PGP to encrypt and decrypt messages, only that there is some means for the public key to be automatically uploaded when you first create an account. An SSH public key would work just as well.

But it's the sort of thing that nobody will bother with because until it becomes commonplace it would just look strange. Much easier to add yet another password to the list users must remember.

Re:Pseudo-Written Password

[Anonymous Coward]

All that brilliant thinking and you can't even spell lose correctly. Remember, if your pants are too loose, they might fall off and you might lose them.

Re:Pseudo-Written Password

[jackofallbrandnames]

" Why do people need more than one password? Why can't websites and applications authenticate you using your PGP public key?" Because some morons setup web sites for just that purpose...to "get" your password that you use everywhere else. Duh.

Re:Pseudo-Written Password

[Anonymous Coward]

Accepting as possible what you say about people not caring about passwords the best solution is therefore probably to issue them complex random ones that they are allowed to write down. For remote sites at least.

For local protection from casual missuse it is a different story and probably needs a different approach.

Re:Pseudo-Written Password

[smyle]

I don't know about cryptopad, but I'm quite positive strip does it "right". I used it extensively before buying a Zaurus a little over 2 years ago and moved to zSafe.

Re:Pseudo-Written Password

[phlinn]

I tend to do this with song lyrics. However, I also like to throw in non-typeable ascii codes specifically to derail some cracking software, at least for passwords I'm really concerned about, when possible. IIRC, most tools don't even try charachters like a ± or .

Re:Pseudo-Written Password

[Ed Avis]

Graydon Hoare wrote a password generator that makes a new password depending on the hostname of the website and a master passphrase - so you the user remember only one thing but each site gets a different password. I can't find the link to it now, however.

If web browsers had this functionality built in I would certainly use it. Otherwise, I'm too lazy.

Re:Pseudo-Written Password

[BillX]

Hey, the parent already did admit to having rot-n password security.

(Sorry, couldn't resist)

Re:Pseudo-Written Password

[Anonymous Coward]

filled with petrol?

Re:Pseudo-Written Password

[confused.brit]

I take a word and code it with my mobile/cellphone keypad into numbers, then back into letters using the first on the keypad. Then any characters that are one of 3 letters become numbers again. Yeah, i have too much time on my hands. Do you guys know how annoying that "are you a script" check is?

Re:Pseudo-Written Password

[sumdumass]

If your in a networked anviroment the lockout becomes pretty much non-existant. This is especialy true if in a domain. All you really need is a small handheld computer conected and if anythign is shared you can try the password thru the network share. This should allow thousands of passwrds to be tried a minute and once it succeeds, it should allow you access on the desktop. If it is in a domain, you can capture the ssid chalenge and responce and even fake being a valid member of the domain with full rights. Then is it just a matter of some scripts to change the password and your gold. There are also lots of bootable cd's or floppies that will create user acounts and give access were you can get the hash and decript the passwords.

I'm not saying any of this is exactly easy, but it is definatly something possible and wether or not you wrote down the password or how you decided to make the password doesn't realy matter how i get access in the machine. If i have local access to Computer a password is somewhat pointless. Sure there are devices that detect this and report it but then it would be too late. A good remeberable password or anythign writen down should be sufficient in about any situation were local security is a threat. No lock can keep a thief out if you let him goto the door and try to pick it. We need to remeber not to get over confidnet with just one part of the security equasion.

So Pen&Paper's the new replacement for Passpor

[team99parody]

Now we know what's replacing Microsoft Passport in Longhorn - pen&paper!

Bruce Schneier agrees

[alanw]

From Bruce Schneier's Crypto-Gram, May 15 2001, and then updated in a news.com article, December 9, 2004.

You can't memorize good enough passwords any more, so don't bother. For high-security Web sites such as banks, create long random passwords and write them down. Guard them as you would your cash: i.e., store them in your wallet, etc. Never reuse a password for something you care about. (It's fine to have a single password for low-security sites, such as for newspaper archive access.) Assume that all PINs can be easily broken and plan accordingly. Never type a password you care about, such as for a bank account, into a non-SSL encrypted page. If your bank makes it possible to do that, complain to them. When they tell you that it is OK, don't believe them; they're wrong.

Re:Bruce Schneier agrees

[team99parody]

Seems better to keep the long-hard passwords stored in an encrypted file protected by one good password that you remember.

Re:Bruce Schneier agrees

[Anonymous Coward]

That's what I do. I use a tool that stores passwords encrypted, and I have one very good passphrase I use to decrypt the passwords. Any time I need a password for a Web site, I generate one (32 random letters/numbers) and use that. I don't even know any important passwords, except for the one master passphrase.

Re:Bruce Schneier agrees

[l3prador]

The "guard them as you would your cash" idea sounds good and is good to a certain extent, however, when someone has stolen your cash, you can generally tell it's gone. A password can be stolen without anything being missing.

Re:Bruce Schneier agrees

[loqi]

KDE's wallet manager handles this rather nicely.

Re:Bruce Schneier agrees

[conteXXt]

Tape it to your cash.

You'll notice it then amigo.

Re:Bruce Schneier agrees

[chris_mahan]

What do you mean tape it? write your passwords on your cash. On a $50. You'll never just leave it laying around on your desk.

Re:Bruce Schneier agrees

[xlv]

For Windows, see http://sourceforge.net/projects/passwordsafe originally from Bruce Schneier himself but then released on sourceforge.

Re:Bruce Schneier agrees

[Mavakoy]

Or use a shorthand system i.e.

main login: ML7
mainframe access: I12

To me, these would tell me _exactly_ what the passwords were, but to a passer by, they are meaningless.

Re:Bruce Schneier agrees

[Anonymous Coward]

what happens when your harddrive fails?

Re:Bruce Schneier agrees

[Incongruity]

well, if the previous poster dutifully backs their data up, as they should...nothing happens. -inco

Re:Bruce Schneier agrees

[GoCoGi]

But what, when you have no other $50 left?

What? Confirm I'm not a script? This will be a serious problem for slashdot readers who can't see the image for whatever reason.

Re:Bruce Schneier agrees

[Ann Elk]

PasswordSafe is basically a GUI wrapped around an encrypted file such as you describe. Unfortunately, it's Win32 only, but there are a few portable solutions available.

Re:Bruce Schneier agrees

[muckdog]

Important information like this should be backed up. A firesafe is $20, cd-r is $0.05 or just use that 8MB flash card that came with your camera. There's really no excuse not to.

Re:Bruce Schneier agrees

[conteXXt]

then you pick an easier password, write it on a sticky mote, and tape it to a $20.

Why are you guys making this so hard. It's the obvious solution here.

(still kidding BTW)

Re:Bruce Schneier agrees

[arminw]

The OSX keychain is a pretty good password protection system provided your log-in password is hard to guess.

Re:Bruce Schneier agrees

[bizard]

which is exactly what systems like Keychain Access, Password Wallet (or Password Wallet), Keywallet etc. are for.

Re:Bruce Schneier agrees

[Anonymous Coward]

then why go thru the trouble of encrypting it and putting it on digital media? why not list your passwords on paper and put them in a safe?

Re:Bruce Schneier agrees

[Cutriss]

All these people are mentioning Password Manager, but I use Keyring for PalmOS (formerly "GNU Keyring"). This way, I can bring the .PDB database with me in my handheld if I would like to take my passwords on the go, and running the app on a client machine isn't hard since there are a variety of Palm emulators out there for a variety of platforms.

So, you have an app that, by virtue of being on a portable emulated platform, is OS-portable as well.

Re:Bruce Schneier agrees

[Anonymous Coward]

As does OS X's Keychain.

Re:Bruce Schneier agrees

[Tran]

I often write my passwords down, but embedded in another string that looks like something else - like a pin number filled out to resemble a phone number. Or a longer alphanumeric password to look like an address. Just written on scraps of paper.

Re:Bruce Schneier agrees

[Anonymous Coward]

s/Password Manager/PasswordSafe/

-_-;

Re:Bruce Schneier agrees

[Ninwa]

I got this confirm I'm not a script thing also and I see it as an issue, I know this is off-topic but why was this not announced... and in the probable case that it was where was it announced so I can read this into this.

Re:Bruce Schneier agrees

[KiloByte]

This is dangerous, as 1) you can easily lose the file, 2) it's a single point of failure.

What I do, is remembering just an algorithm. For example, one of sets of passwords I used was generated as follows:

1. pick an ASCII character
2. add a '!' to it if its ASCII code is less than 100
3. add the ASCII code in decimal
4. add '/-\|'

The last part was static -- this was a bad idea, but it was one of my early password sets. The benefit is, if you forget the character associated with a host, you need to try at most 256 (-#0..#31, -#127, etc) combinations. You can use any non-obvious association that you remember. It can be the ASCII code, it can be the initials of Doom2 map names -- a sport spectator can use 1936 game results, and so on. If you have a non-obvious mapping with some twists in the algorithm, it's pretty hard to guess the rest of the password unless the attacker manages to catch several of them.

Re:Bruce Schneier agrees

[mhotchin]

Yes, it's called 'Password Safe', and was produced by (wait for it!) Bruce Schneider! Sourceforge Site

Re:Bruce Schneier agrees

[CodeBuster]

The disadvantage of this approach is that it increases the attractiveness, from the standpoint of the attacker, of cracking the one good password or key in order to recover all of the others. Depending upon how large the encrypted password file is the attacker may decide that it is worthwhile to have a go at recovering the key (good password) through cryptanalysis. Thus, the strength of the master key or password and therefore its length must constantly increase as new passwords are added to the file so that the appropriate level of deterrence is maintained as the file size increases.

Re:Bruce Schneier agrees

[CptSkydrop]

For high-security Web sites such as banks

A couple of days ago I registered with my bank for internet banking. It would be far easier but probably less secure if there was just a userid and password scheme in place. At the bank I use you have to enter your account number (9 digits), sort code (6 digits) and security number (4 digits). The account number and sort code can be got from your bank card or cheques, the security number is something only you know. But then, they go on to ask you a question, pretty generic but they can have specific answers that must be spelled right. When I was registering over the phone, after I had put in the account number, sort code and security number they asked me for all six or so of the security questions. I then discovered that at each login atempt at the banks internet site I'm asked one of these questions at random.

Maybe a bit of a ramble but everything I'm asked is easy enough to remember, it's a matter of finding a good way for people not to have to put this number anywhere else but in their memory. It seems secure enough for me?

And to add to that, my computer most of the time has a screensaver with a password. Everytime I'm asked by someone for my password when the screensavers up I say to them "What's the point of a password if you tell someone it?".

Re:Bruce Schneier agrees

[SuperBigGulp]

I think you're semi-joking, but this does make me wonder. Why not just write the passwords on a new bill (whatever denomination, lower is probably better) and spend the $50.

Maybe I'm being naive, but assuming the bill was spent at a relatively high-volume location (e.g., gas station, grocery store), the bill would circulate and within a few hours would be difficult to trace back to you or I. So it has a password on it...without a corresponding user name a link to specific system (e.g., web site) I can't see this does much good. The password could be to a bank account or to a zip file on some hard drive. Even if it is found and could be linked back to a given user, the user could have changed their password in the mean time.

In many ways, this is analgous to finding a key in the street. What is anyone really going to do with it? Start looking for locks and trying the key in every lock?

Re:Bruce Schneier agrees

[ymgve]

Nobody has yet mentioned the strongest reason why this is dangerous: Keyloggers. A malicious hacker captures your master password as you enter it, and suddenly every password you have is compromised.

Re:Bruce Schneier agrees

[Penguinshit]

One password to rule them all
One password to find them
One password to bring them all
And in the darkness bind them.

Re:Bruce Schneier agrees

[amliebsch]

Take the whole concept to its logical conclusion. Get a bunch of singles. On each bill, write name of the service(s), then use the bill's serial number as the password.

Re:Bruce Schneier agrees

[SirTalon42]

Why go through the trouble of writting down dozens of passwords and what they are for? It would be much easier to just dump the password db to a CD-R and throw it in the safe.

Re:Bruce Schneier agrees

[fmobus]

Great
And what if your bank won't let you change your internet access password (easily)? Every single Brazilian bank is like this but wait, it gets worst: all passwords are weak 8-DIGITs ones. The only form of protection is the use-the-mouse-to-type-the-pass stuff, but that won't defeat shoulder riders.

Re:Bruce Schneier agrees

[cavemanf16]

I do. Several years back I began getting access to so many different development servers, boxes, software packages, and websites that I couldn't keep anything straight anymore. I decided that PGP was the way to go. I've since switched to GPG, but the concept is the same.

I created an HTML file at the time, and listed everything out using a table format to store the website, software, etc. along with my username, password, and any other pertinent info needed to access the specific system. Then I signed and encrypted my html file with my GPG key. Virtually unbreakable (2048-bit) file, easy to remember passwords. (I only need to remember my GPG key now!) Yes, my GPG passphrase is long and is ONLY used as my GPG passphrase.

So now I have a file which I can email around to myself, store on my work laptop, and save out to my shared drive with little fear of anyone ever cracking my password schemes 'cause they're all different and constantly changing. Granted, I'm not usually that cavalier with this file, but at least I have that flexibility available when I need it.

Re:Bruce Schneier agrees

[Anonymous Coward]

not really, then you have to load the db onto a computer and remember the master password instead of just looking at the paper(if the harddrive were to fail)

Re:Bruce Schneier agrees

[Anonymous Coward]

But what do you do when you REALLY need a buck? Give away your password?

Re:Bruce Schneier agrees

[pongo000]

Diceware generates secure passphrases that are very useful for this purpose.

Re:Bruce Schneier agrees

[Thundersnatch]

Two words for windows users: Password Safe. Originally written by Counterpane, Schneier's company. Stick it on a USB pen, and carry it around with you. There are also similar Linux tools that can use the same 3DES-encrypted password database file.

Re:Bruce Schneier agrees

[Anonymous Coward]

ML7
my last 7
7 being an ordinal value from the standard 1-10 scale used to measure a woman's overall bonability. (or the number of beers one must drink before being able to commense boning)
"enith" or "candy"

Re:Bruce Schneier agrees

[Anonymous Coward]

My computer is running Windows XP Pro. My passwords are stored in a plain text file, in a folder encrypted using EFS. The only password I remember is my Windows logon password, which is a random string of 20 characters.

My Windows logon password was generated randomly, and written down on a small piece of paper I carried on my person 24/7 until I had it memorized, after which the paper was destroyed. I repeat this process once every six months or so.

Password Safe is probably more secure though, as EFS relies on X.509 certificates that use only 1024 bit RSA (the files themselves are encrypted using AES-256). What I want is a way to create a new certificate for EFS of at least 1536 bits, or better yet, 2048 bits. My past attempts have failed. Apparently the certificate needs to be flagged for use with EFS, which I have not yet figured out how to do.

Re:Bruce Schneier agrees

[Anonymous Coward]

The "guard them as you would your cash" idea sounds good and is good to a certain extent, however, when someone has stolen your cash, you can generally tell it's gone. A password can be stolen without anything being missing.

By calling things that aren't stealing, stealing, apparent exceptions like the above arise. But if you state it correctly from the beginning, no exceptions are needed: you guard the cash from being stolen, thus know if it's gone, but you must guard the passwords from merely being copied, which you have no way of knowing about.

I read one of Bruce Schneier's books and it was filled with repeated misstatements of this sort, where the apparent paradox or inconsistency was an illusion created by incorrect descriptions.

Re:Bruce Schneier agrees

[JahToasted]

But... if they have a keylogger installed, they're gonna have every password anyway, right?

Re:Bruce Schneier agrees

[Nethead]

Never type a password you care about, such as for a bank account, into a non-SSL encrypted page. If your bank makes it possible to do that, complain to them. When they tell you that it is OK, don't believe them; they're wrong.

Try telling that to US Bank. They don't listen. I have to enter a bogus account and pw, let it error and then it will give me a SSL page to login with. Bastards.

Re:Bruce Schneier agrees

[ymgve]

No, only the ones that you use frequently. Access to a password file, however, gives the hacker all your passwords, even the ones you haven't used for a few years.

Re:Bruce Schneier agrees

[nmb3000]

Here's a question someone might be able to answer:

If the login page is non-SSL is there any way that the form info is secure? What if the ACTION of the form is a secure page, does the transit of the form data take place before or after an SSL session is formed? My bank has a form for logging into online banking on their homepage which is not SSL, however as soon as you log in you're in SSL.

Anyone know?

Re:Bruce Schneier agrees

[AoT]

No, do not tape it. Hash the serial, of the bill, with an easy to remember password to make a password.

Re:Bruce Schneier agrees

[Anonymous Coward]

I keep my banking details in Keychain in OS X - not just the password, but even the memorable data I get asked. Then I have a screen scraping script I wrote that is able to go to my bank URL and fill in all the fields on my behalf based on the info in my Keychain.

Banking has never been easier: just press my Quicksilver button, type in the first two letters of my banking script, type in my Keychain password and hey presto there I am at my bank. Plus I know that any keystroke loggers will have a harder time!

Re:Bruce Schneier agrees

[locofungus]

All that has to happen is that that ssl site, rather than asking you to pick a password, asks you for a certificate (which can be self signed).

Or if the site wants to verify your email address, asks you for a certificate request and it signs that and then emails it back to you.

For the more clueless, the server can even offer to generate the certificate and key and let you download them. Assuming we are using SSL for this connection then there isn't really a problem. Of course, potentially, the server could give your key to someone else as well and then they could impersonate you to that server but the server could currently give away your password.

Note there is no need for "Certificate Authorities". They only apply if two people want to use a third party to verify who they are.

Now the "key" is only stored on the users machine. There is no need for revocation lists because the certificate isn't being used to verify your identity to a third party - I upload a new cert (change my password) and the server just forgets the old one so even if someone did get the key to that cert it is only as useful as an old password.

Re:Bruce Schneier agrees

[rastos1]

Right. On the other hand, I wish KDE wallet manager got the same amount of review as gpg for example.

Re:Bruce Schneier agrees

[Anonymous Coward]

With my solution listed above (Keyring for Palm), I can use mouse gestures to write my characters in.

Re:Bruce Schneier agrees

[elemental23]

Yes, this is secure. The form itself, as it's sent to your browser, contains nothing but empty textboxes and doesn't need to be secured. As you fill in your information, it exists only on your computer. Not until you press 'Submit' does it actually go anywhere, and then it will go to whatever URI is specified in the action="" attribute. If this action is a SSL-secured URL, the data transmission will be secure.

Note however, that this is considered bad practice. Users have been taught to look for SSL on any page where they fill in sensitive information. Not using SSL for your form page may cause distrust in the system, even if the transmitted data really will be secure.

Re:Bruce Schneier agrees

[elemental23]

If you're talking about the login form on the front page of their site, contrary to appearance, it is secure. The page the form appears on does not need to be sent over SSL as long as the data sent back to the server is. This is a bad idea, however, as it tends to cause this kind of distrust.

See my response to another poster's question about this.

I have a better idea

[Anonymous Coward]

It is safer to post it on here, and be sure to write the username down and what it is used for.

Microsoft hard at work for security

[yagu]

"Since not all systems allow good passwords, I am going to pick a really crappy one, use it everywhere and never change it...If I write them down and then protect the piece of paper--or whatever it is I wrote them down on--there is nothing wrong with that. That allows us to remember more passwords and better passwords."

That would lead me to believe you'd have an environment where any discovered piece of paper on which there is some non-indigenous word written would be a candidate for plugging in as password attempts. This is just plain silly.... passwords written down would be one of the first things a social-engineering hack may try to leverage. I'm not a fan of draconian policies wrapped around impossible rules to manage security, but this "recommendation" flies in the face of reason.

Re:Microsoft hard at work for security

[CommieOverlord]

The solution is encrypt your password list. Say have string that is added to the added to end of every password on list. So, say your list is:

1. $tret43f
   
2. GFH#$V
   
3. DSgb45
   

then you passwords would be $tret43fHELLO, GFH#$VHELLO, and DSgb45HELLO. You get 3 secure passwords but only have to remember one.

Re:Microsoft hard at work for security

[Anonymous Coward]

really -- isn't that how they broken into the school's computer and changed their grades in WarGames? The school's secretary had the password on a post-it under the keyboard.

Re:Microsoft hard at work for security

[Ooblek]

No no no....you don't get it. The REAL solution is to just cut off the thumb of the person sitting next to you and use THEIR fingerprint to unlock a biometrically protected password store. You can even make money:

1. Cut off thumb of guy in next cube (you didn't like that bastard looking over the wall all the time anyway.)
2. Eat some chili, VERY CAREFULLY.
3. ???
4. Profit

Re:Microsoft hard at work for security

[coyote-san]

Nobody is defending the "right" of morons to write their passwords on post-it notes stuck on office equipment.

But a password list in your wallet? Or a file on your PDA that's sufficiently well protected that nobody can take a peek while you take a leak?

If unauthorized people have access to these items you have real world problems much more serious than worrying that somebody will use them to try to get into your accounts.

Re:Microsoft hard at work for security

[Anonymous Coward]

no i think it was a piece of paper in the top desk drawer with a list a passwords

Re:Microsoft hard at work for security

[nacturation]

No kidding: http://www.theregister.co.uk/2005/04/04/fingerprin t_merc_chop/!!

Re:Microsoft hard at work for security

[anonicon]

FWIW, this is what I do for my "need to be secure" passwords, as opposed to my Slashdot login password. Every password has the same 5 digits that I don't care if someone sees; some of them have the unwritten key prefixing them, and some of them have the key afterwards. IMO, it's nice, but YMMV.

Re:Microsoft hard at work for security

[StarsAreAlsoFire]

If they have access to your desk, they have access to your computer. If they have access to the computer, they can get your passwords one way or another -- brute force with an inline keyboard logger, take the whole bloody computer, software searches. What have you.

Re:Microsoft hard at work for security

[Cornflake917]

If you read the quote which is in your post. He says "If I write them down AND THEN PROTECT the piece of paper..."

For example, the company I work for has strict policies for protecting passwords. We must keep our computer passwords in locked cabinets or we will face minor to moderate penalties.

Re:Microsoft hard at work for security

[gbjbaanb]

I must say I do something similar, but in reverse - I have passwords like.. lets say "PasswordMyPassword78", and I write it down as PMP78.

go ahead and type PMP78 into the password box.. it ain't going to get you anywhere, and as long as I remember what P means (its not difficult with the first letter to remind me), I'm happy, except that I have so many damn passwords to remember I need a booklet to keep them in. God help me if I lose or spill coffee over it.

Re:Microsoft hard at work for security

[Anonymous Coward]

I currently need to log into 3 different windows domains (with different accounts), one exchange server (with an unique account), two nis+ environments and - believe in or not - 3 SINGLE SIGN-ON (thats irony for you) accounts to do my work.
This was the year when I finally gave up and wrote down the passwords on postit notes. I just cant keep track of all these accounts. And did I mention that they all need to be changed every three months?

Re:Microsoft hard at work for security

[owlstead]

Of course, the problem with current PDA's is their ability to be networked, which makes it a pretty untrustworthy device. Actually, it might be less secure than your average desktop PC. Even if you encrypt your password, who's going to secure your input/output?

Re:Microsoft hard at work for security

[rainman_bc]

I use geometric passwords - I let my fingers walk around the keyboard in a pattern. People watching my fingers just think I'm typing really fast.

Stuff like
CVdfer34
MNjhUY76
>lkoi(*

Etc... So many permutations that make little sense. Good luck brute forcing something like that.

(And no, those aren't even close to the root password on my FreeBSD box - don't even try...

Re:Microsoft hard at work for security

[brkello]

This is clearly a first. A person is posting a quote from the summary and clearly did not bother to read that. Ok, that's not a first, but the fact that it is modded +5 insightful is! He clearly said that the passwords are protected. i.e. kept in a locked desk, a vault, a secure PDA. I mean, seriously, anytime you come across a piece of paper with a strange combination of letters and numbers...when is that NOT a candidate for being a password. It does not fly in the face of reason because the users aren't choosing "password1" as their password. As long as the password is physically secured, what's the problem here? Yeah, some moron can leave his password unsecure, but we have yet to find a scientific soultion to morons.

Re:Microsoft hard at work for security

[Lord Kano]

I'm not a fan of draconian policies wrapped around impossible rules to manage security, but this "recommendation" flies in the face of reason.

A piece of paper kept in the wallet is better for security than the same 7 letter password getting reused.

We can talk about how things should be in an "ideal" world or we can deal with how things are in this one.

In an ideal world, passwords wouldn't be necessary because everyone would be honest.

LK

Re:Microsoft hard at work for security

[yagu]

I chose the quote from the summary because it worked best for what I wanted to point out. I did read the article (I always do, or I won't post against it)...

No biggy. I agree with your point we haven't found any scientific solution for morons yet, but that's sort of my point. If we let (as a policy) people just write passwords down, that little slice of moron-dom is the part that always bites us in the rear.

I know the article talked about securing the scrap of paper on which the password is written stowed, and secure, but my experience has been that doesn't happen. And, when combined with the policy that passwords be written down (he almost states they must be written down -- the exposure is greatly increased.

I'm not proposing any rebuttal or solution, I've always found the more oppressive a regime, the more determined hackers are to find a way in. I've been approached many times by the security organizations where I've worked to help them with their policies (I'm pretty good at hacking) and I've always declined -- I find it a difficult universe to exist in where no matter how hard you try, there are always people out there who break what you make.

Security in computers is a losing battle. It's an extension of our social makeup and there'll always be good guys and bad guys and there'll always be breaches. I just think what the article proposes is yet another proposal, and it adds little to overall real security.

By the way, I don't think this is at all a first, seeing a post modded +5 from a poster who hasn't read the article... I've seen a number of what are fairly obvious examples of that. Used to get my dander up, too, but I've come to accept sometimes the poster may have enough credible and useful to add to the discussion without having to read the article (though, not always :-)). And, again, for the record -- I did read the article.

Good feedback.

Re:Microsoft hard at work for security

[quarkscat]

The parent poster is right on target!

This MSFT "news-flash" is a very good indication of just how retarded MSFT's notion of security is, judging by MSFT's efforts to date at "Security is Job One".

Somehow, I have a hard time envisioning a 3M Post-It Note with my hard-to-remember password on it as any improvement in security. Many offices employ contract cleaners to come in at night and vacuum carpets, empty trash bins, etc. Any hacker worth his/her weight in salt would be on the lookout for social engineering vulnerabilities like this.

How about using a personally memorable phrase or sentence as the basis for a hard-to-forget password, instead?

Doh!

Re:Microsoft hard at work for security

[Anonymous Coward]

A person is posting a quote from the summary and clearly did not bother to read that. Ok, that's not a first, but the fact that it is modded +5 insightful is!

You must be new here.

Re:Microsoft hard at work for security

[Kent Recal]

I bet many of these are already in most cracker dictionaries, at least the obvious patterns. But then again, its definately still harder than just a dictionary word with a number at the end...

Re:Microsoft hard at work for security

[ortholattice]

Who said anything about a post-it note on your desk? Are you an idiot? And everyone else here who keeps bringing this up over and over? Sheesh.

You keep the piece of paper - or probably a business-card sized card - in your wallet, dumbass, where you keep your credit cards. (Or do you tape your credit cards to your terminal for handy reference?) Just as your credit cards don't get seen by anyone you don't show them to, neither will your passwords. The only risk is if your wallet gets stolen, but you will know that pretty quickly, and you can change all your passwords in that case, just like you will change all your credit card numbers.

Re:Microsoft hard at work for security

[tftp]

I mean, seriously, anytime you come across a piece of paper with a strange combination of letters and numbers...when is that NOT a candidate for being a password.

Apples from mother - UPS tracking 1Z0987764393
Rebate on that Fujitsu drive: s/n MTGH123-A083B

There are plenty more if you look for them.

Re:Microsoft hard at work for security

[Shadowlore]

"Since not all systems allow good passwords, I am going to pick a really crappy one, use it everywhere and never change it...If I write them down and then protect the piece of paper--or whatever it is I wrote them down on--there is nothing wrong with that. That allows us to remember more passwords and better passwords."

That would lead me to believe you'd have an environment where any discovered piece of paper on which there is some non-indigenous word written would be a candidate for plugging in as password attempts. This is just plain silly.... passwords written down would be one of the first things a social-engineering hack may try to leverage. I'm not a fan of draconian policies wrapped around impossible rules to manage security, but this "recommendation" flies in the face of reason.


Then you missed part of what the OP wrote:
and then protect the piece of paper--or whatever it is I wrote them down on.

You are talking about random bits of paper on the desk with random words on it. The person you are responding to is not.

But then again, go ahead; try to social engineer your way into my system using bits of words/patterns/characters found on papers on my desk. Given the stacks of notes, comments, things that appear to be passwords but are not, and so on you'll be here for several weeks solid. Assuming you can read my writing.

As far as flying in the face of reason consider this.

Nowadays credit cards have a number on the back of them, usually right in the signature area. This is ostensibly to be used online to verify you have the card. You go to a clerk at the gas station/grocery store/whatever, and use your credit card. The clerk sees your number right there. It's usually very short and easy to remember for the short term. After you go out it is usually nothing for him or her to look at your transaction for the credit card to get your CC number, then match that with the "verification" number on the back and bingo. Now s/he has a CC number and the verification used online. The only thing missing is zip code and maybe billing address. But wait, s/he also asks for ID and thus it is there. A quick mental note of approximately where you live, say the zip code, and a google later s/he has your address. Now the circle is complete.

The point of this little excursion? You often have far more valuable information "written down" in your wallet than your computer passwords. "But I protect those as best I can" you say? Exactly. The poster you replied to was saying the same thing about the written down passwords.

Re:Microsoft hard at work for security

[advid]

There's a post it note stuck over my id in my wallet with three 4-digit numbers written on it. None of them are my PIN. My hope is that anyone unscrupulous who winds up in possession of my wallet will try to use an ATM and lose my bank card.

(The numbers are... the password for a bank website that goes with a card that I always keep at home, and two gate codes for my workplace.)

Re:Microsoft hard at work for security

[SoupIsGoodFood_42]

Not if your building is secure. Where I work, you'd be questioned within a minute if you sat at someone's desk and started to use their computer. And if don't work for our company, you wouldn't even get through the door.

Re:Microsoft hard at work for security

[jc42]

You keep the piece of paper - or probably a business-card sized card - in your wallet, dumbass, where you keep your credit cards.

Nah. I keep mine in a few hidden files in a few of my web directories.

Good luck guessing the rather demented-looking URLs.

And I don't try to access the files from public Windows machines. Too likely to be a keylogger there.

I know a number of people who keep useful but private information "hidden in plain view" this way. It's pretty easy to hide stuff on the Web.

Re:Microsoft hard at work for security

[Anonymous Coward]

> Not if your building is secure. Where I work, you'd be questioned within a minute
> if you sat at someone's desk and started to use their computer. And if don't work
> for our company, you wouldn't even get through the door.

Our building is fairly secure. We have keypad combination locks on the outer doors, and armed security inside. The hallways have ceiling-mounted cameras. All the office doors are locked at the end of the day.

And despite this, nobody would look twice at me if I sat down and used a co-worker's computer. Why? Because I'm a tech support guy--all I need is to be holding a CD-ROM in my hand for people to trust me. They're used to me asking them to step aside for a minute while I tinker with their machines. All because management is too damn busy (or lazy) to actually write policies and procedures for handling tech support issues.

The kicker? I'm not an employee of the company, I'm a temp. I've never been interviewed or had a background check. Most of the people I work with don't know my name, because I wear a "visitor" badge. They probably still won't know my name after I leave next month, when I could carry away a few CD-Rs full of their private e-mails. It's astonishing how much trust they place in off-the-street geeks.

I'll buy that piece of paper with some chocolate

[me at werk]

But really, I don't have a problem with this. Why not use one of those password vault type programs which allow users to have a master password to access their other passwords?

My password vault happens to be Firefox, though.

And I'll keep it under my keyboard...

[beorach]

with my bank name and account number next to it..

Re:And I'll keep it under my keyboard...

[nukem996]

You'd be surpised about how many people do that.

Re:And I'll keep it under my keyboard...

[dodald]

I have a single post it note under my keyboard that reads "9uL1i613".

Re:And I'll keep it under my keyboard...

[justforaday]

I have a single post it note under my keyboard that reads "9uL1i613".

mine says "password"

Re:And I'll keep it under my keyboard...

[Anonymous Coward]

I honestly do have a post-it note with my passwords, it's under my speaker not my keyboard. As a loser onanistic shut-in I don't see the problem with this.

Re:And I'll keep it under my keyboard...

[camkind]

mine says "This side down"

Re:And I'll keep it under my keyboard...

[Anonymous Coward]

So your password is El9!l7n6 ?

Re:And I'll keep it under my keyboard...

[spot35]

Yeah, but your word is in the dictionary, whereas justforaday's word isn't in any dictionary.

Ok.

[cmburns69]

Ok, here they are:

Slashdot password: 12345
Personal site password: 12345
Bank account password: 12345

Now my password is even more secure! Yay!

Re:Ok.

[fembots]

Now my password is even more secure!

So true, by open-sourcing your password, you don't need to worry about security anymore.

Re:Ok.

[ClownsScareMe]

This joke is sooooo obvious. I though of it, I just didn't post it.

Re:Ok.

[thegamerformelyknown]

I'll take bets that at LEAST 50 people that see that will actually try to log into /. as you :)

Re:Ok.

[mattyrobinson69]

thats because thousands of people would be more than happy to 'upgrade' your password.

Re:Ok.

[budgenator]

a few years ago, we held the domain poiuyt.com, and you'd be amazed at how many times user qwerty got and email confirming that the password for qwerty@poiuyt.com was qwerty or poiuyt! I used to take great delight in going to the various websites and changing their passwords on them. every once in a while I still try them on p()rn sites to see if any work. qwerty and poiuyt seemed to be more popular uid and passwords in asian countries the with anglophones but not by much.

Re:Ok.

[Anonymous Coward]

This is my actual /. passwd I wrote in my notebook ___a______5, go figure that out..:P

Re:Ok.

[Anonymous Coward]

I discovered my (non-tech) boyfriend actually used 1234567 as his passwords wherever he needed one. I've managed to upgrade him to versions of his dog's name.

Lift Keyboard

[Anonymous Coward]

Thats where I find most cubicle passwords written down.

Hey a good pass phrase from this

[FerretFrottage]

M$SWDYPW

Maybe they have something here.
Now nobody else use it or and promise to forget it after to read this post. Thanks.

Now EVERYONE knows my password!

[WillAffleckUW]

Dang, why did that MSFT guy have to spill the beans!

It's 1337 44xx0A ...

Passwords suck: simple solution:

[t_allardyce]

This is why we need to drop the outdated idea of passwords as soon as possible and start using fingerprint scans, the only way someone can steal your finger print is by lifting it from something you've touched or putting a gun to your head, or cutting your finger off, and that's all in the realm of science fiction and left wing propaganda...

Re:Passwords suck: simple solution:

[MankyD]

Left Wing Propaganda ahoy! Honestly, while I like your idea, I'm not convinced fingerprints are the best solution.

Re:Passwords suck: simple solution:

[axonal]

Or the realm of Wendy's Chili Bowls.

Re:Passwords suck: simple solution:

[iCEBaLM]

Or find it in a bowl of chili.

Re:Passwords suck: simple solution:

[bmongar]

Though they can't steal your fingerprint they can steal your fingerprint metric. It all becomes bits at some point and if they have those bits they can buypass having your finger.

Re:Passwords suck: simple solution:

[cmburns69]

The problem with this suggestion is that if your fingerprint (or some other bio-metric info) is stolen or duplicated, you can't change it. How would you like a genius hacker to have permanent access to all of your data for life?

With a password, at least you can change it if it is compromised.

Authentication methods can all be broken down into the following categories:
1) Something you know (such as a password).
2) Something you have (such as a keycard).
3) Something you are (such as a fingerprint).

High security requires 2 or 3 of these things. However, most things are good enough with only 1 of the three..

Re:Passwords suck: simple solution:

[xv4n]

...we need to drop the outdated idea of passwords as soon as possible and start using fingerprint scans, the only way someone can steal your finger print is by lifting it from something you've touched or putting a gun to your head, or cutting your finger off...

You've just stated the very reason why passwords will stay with us for decades. The main advantage of passwords is they are stored where nobody else can read them -- our minds.

Re:Passwords suck: simple solution:

[xAXISx]

You misspelled right wing scare tactic.

Re:Passwords suck: simple solution:

[scseth]

That is not in the realm of science fiction. Malaysian man's finger cut off so thieves can steal his car using fingerprint technology

Re:Passwords suck: simple solution:

[kentborg]

Can't steal your finger print? Bah!

1) You didn't read about the guy who can fool finger print scanners with simple kitchen ingredients, a scanner, and Photoshop? Too 'phisticated for you? Ok...

2) You didn't hear about they guy with the fancy new car that requires his finger to start it? Well, the bad guys took his finger and his car. I wonder whether he has enough money to buy 9 more cars.

-kb

Re:Passwords suck: simple solution:

[Anonymous Coward]

or cutting your finger off, and that's all in the realm of science fiction and left wing propaganda...


You mean like this:
http://www.newscientist.com/channel/mech-tech/moto ring-tech/mg18624943.600

jajtsfj

Re:Passwords suck: simple solution:

[Mr. Slippery]

start using fingerprint scans, the only way someone can steal your finger print is by lifting it from something you've touched

Which is quite easy.

But you don't even need to do that - some scanners can be fooled into accepting the latent print you leave on it. D'oh!

An authentication token that when used leaves behind all the information you need to construct a conterfeit - this is not something I want to rely on.

Biometrics is a fundamentally flawed scheme. A biometric is just a token that you can't replace (a scar on your finger? too bad), repudiate if stolen (I can lift your prints but you can't change them without pain), or use to separate priviledges (difficult to use a different thumbprint at the bank, at the library, and to open your car, unless you have interesting anatomy).

As for passwords, yeah, I've gotten to the point of having to write them down. I used to use only a few passwords - my login and root password, one common for low security sites, one shared one for a few sites I cared more about, and my on-line banking. But as sites put various non-sensical restrictions on password selection ("your password must contain two digits", "your password must not use any non-alphanumeric characters", etcetera), I've had to start writing them down.

"Something you are" reduces to "something you have". "Something you know", as you have to remember more and more things to deal with dozens of systems, reduces to "something you have" (that piece of paper with all the password written on it). It's all about the authentication tokens.

Re:Passwords suck: simple solution:

[Jeff85]

How do you account for cuts and other things that could change your fingerprint?

Re:Passwords suck: simple solution:

[bmongar]

Fair enough. Though you really support my point that fingerprints aren't an end all security solution.

Re:Passwords suck: simple solution:

[DavidYaw]

The problem with this suggestion is that if your fingerprint (or some other bio-metric info) is stolen or duplicated, you can't change it. How would you like a genius hacker to have permanent access to all of your data for life?

Perhaps a genius user could outwit the genius hacker by changing their fingerprint... by using a different finger.

Re:Passwords suck: simple solution:

[Anonymous Coward]

Biometerics are still just a series of numbers. That's the point, it reduces a complex shape to a short series of numbers. Tough but not impossible to hack.

Re:Passwords suck: simple solution:

[TexNAss]

Passwords 101...
4nma6aoT.
----- 4 nice men ate 6 apples on Tuesday.
EMicmp;tmtl47dbte.
----- Every Monday i change my password; that means they last for 7 days before they expire.

Resonably strong password yet not that hard to remember... For those of us in higher security areas it is a weekly thing..

Writing down passwords never sits well with me.. Biometrics are just too messy for the time being IMHO.

Re:Passwords suck: simple solution:

[quelrat]

I think that a fingerprint counts more as "2) Something you have."

Security risks of biometrics.

Re:Passwords suck: simple solution:

[Mr. Slippery]

Resonably strong password yet not that hard to remember...

The problem is not remembering a password. The problem is remembering twenty of them, some of them used daily, some only a few times a year.

Re:Passwords suck: simple solution:

[urbaer]

and start using fingerprint scans
My work has been using fingerprints for about a month now. I got this message this morning: "Your fingerprint will expire in 7 day(s).
Do you wish to change it now?"
Hmmm.... maybe I should start swapping fingers with my coworkers.

Re:Passwords suck: simple solution:

[defiant1]

Can't you change your finger? You have 7 more

One Word:

[DrunkenTerror]

Tattoos.

Re:One Word:

[Durinthal]

Particularly in a private region. That way no geek would ever have to worry about someone else seeing it!

Re:One Word:

[toygeek]

Two geeks are discussing network security, and one explains that he has his password tattood on his penis, so that the password can only be read when his penis is erect. The other geek says "WOW, ME TOO! What a coincidence! My password is 133+. What's yours?"
The other geek thinks for a second and says
"19double84plus"

Re:One Word:

[fbform]

Particularly in a private region.

That's not how one does private key encryption.

Re:One Word:

[Anonymous Coward]

You'll just have to trust your proctologist.

Re:One Word:

[nojomofo]

Eek. Don't work anywhere where the policy is to change your password every month!

Wow...

[MrByte420]

I've got the same combonation on my luggage!
(sorry sorry sorry!)

Re:Wow...

[mobby_6kl]

Hah, that's my dog's name...this week!

(I'm also sorry, I remember reading something like this in one of the previous password-related threads)

Riddle Me This

[the0ther]

We use physical keys to start our cars and to unlock our homes. Why don't we handle this stuff by using a similar strategy. Say a USB dongle that you need to start your computer? I've seen a few implementations of this theme, and I even believe MS threatened to do just this. Is this because the regular (l)users out there want their computer to work like their toaster does?

Re:Riddle Me This

[Anonymous Coward]

> We use physical keys to start our cars and to unlock our homes. Why don't we handle
> this stuff by using a similar strategy. Say a USB dongle that you need to start your computer?

This should have become standard procedure somewhere around 1990!

When you take a job, you get a PC key, a Mailbox key, an Internet key and an Intranet/Shared drive key (as many of each as you need). There would be none of this nonsense with passwords; any network admin or site admin could authorize your keys as needed, and revoke them when you no longer need them. It could be so simple, but we insist on doing things the hard way when it comes to PCs.

not the ...

[Anonymous Coward]

while its not the best idea. It is what I do. I pick ungodly long and hash-like passwords write them down and guard it with my life. After a while I do end up remembering them. The paper is a safe guard against forgetting them and being locked out of my accounts.

Passwords are useless.

[Beardo the Bearded]

When you've got a brute-force computer that can guess every possible password you can type in (or will type in), there's not much point to having them, is there?

I have one password for all my low-level stuff (web logins, email, etc.) and one for my banking.

I have never changed them.

Re:Passwords are useless.

[14erCleaner]

I have one password for all my low-level stuff (web logins, email, etc.) and one for my banking.

Have you written it down anywhere? If not, post it here and we'll remember it for you.

Re:Passwords are useless.

[jaseuk]

Any reasonable system will lock out the account (even if temporarily) for a period of time.

For various reasons at work we permit one failed login a minute over a 30 minute period. If that figure is breached then the account is locked out for an hour. That limits the number of passwords that can be brute forced to 59 an hour providing that they are aware of these timing restraints.

With enforced password changes every 6 months a grand total of 50K passwords can be attempted via brute force assuming that brute force checking starts from the minute the password is changed. Thats nowhere near enough to realistically breach security through brute force.

Jason

Re:Passwords are useless.

[Adult film producer]

When you've got a brute-force computer that can guess every possible password you can type in (or will type in), there's not much point to having them, is there?

"will type in" ... For a while I used on fairly strong password for all my accounts, everything.. "amy6go23oakfield55" I don't know the math behind brute forcing but I doubt that would be easily tackled by any computer, maybe I'm wrong though. (no, I don't use that anymore and now I use multiple strong passwords, for pretty much everything.)

Re:Passwords are useless.

[remarkeht]

what if the service suspends an account after 50 or so unsuccessful login attempts?

Re:Passwords are useless.

[Cro Magnon]

Have you written it down anywhere? If not, post it here and we'll remember it for you.

Thanks! My banking password is ********.

Re:Passwords are useless.

[loqi]

Let's see... assuming lower- and upper-case letters and numbers are the only allowed components of a password, even a machine capable of one trillion password checks per second would take about 22,337,120,292,586,187,942 years to run through all the possible twenty-character passwords.

So yes, your statement is true, but the brute-force computer you're theorizing doesn't exist, and probably won't for a long, long time.

Re:Passwords are useless.

[Anonymous Coward]

Dear Beardo,

I am one of the hacker who owns your bank account but unfortunately for me, because of your weak password, multiple hackers also own it. As a consequence, we are currently all debating on how to spend your money, and no global consensus seems to emerge. This unnecessarily complicates the situation. So would you please be kind enough to change your password to a more secure one, and send it to me by the way ?

Your beloved hacker,

Th3_Pun1sh3r
-- AMD 4000+ @ 2.89GHz -- 2 GB RAM DDR -- ATI X8000.99+ Super FX -- Born to frag !!! WaZaaaaa

Re:Passwords are useless.

[14erCleaner]

Hey, mine is too! What's your bank name and account number?

Re:Passwords are useless.

[afabbro]

For a while I used on fairly strong password for all my accounts, everything.. "amy6go23oakfield55"

Yeah, but then you broke up with amy and didn't want to be reminded of her every time you typed in your password and had to change it. Been there.

Re:Passwords are useless.

[Fortran IV]

Any reasonable system will lock out the account (even if temporarily) for a period of time.

Microsoft's Small Business Server system has a feature called Remote Web Workplace, whereby you remotely log on your office network over the Internet. Apparently, RWW on SBS specifically refuses to lock out the Administrator account. If you have RWW enabled, your only protection is to have such an obflavious administrator password that by the time a hacker can break it, you've already changed it again.

Re:Passwords are useless.

[Anonymous Coward]

I have one password for all my low-level stuff (web logins, email, etc.) and one for my banking.

I have never changed them.

I don't wear a seat-belt, yet I've never been in a car accident. Therefore, I'm invincible!

Re:Passwords are useless.

[Fortran IV]

But then, you specified a reasonable system, didn't you?

Re:Passwords are useless.

[Adult film producer]

*laugh* reminds me of my atm card, the pin number is an old gf's birthday.. I've tried hard to forget it but , *please don't remember next time I press those numbers, please!* :)

Re:Passwords are useless.

[Beardo the Bearded]

Your math is correct, but it doesn't take into account the way people work. People are LAZY. The minimum length for a password is 6 characters. That means that most people are going to have 6 character passwords.

That's down to 44 x 10 ^9 combinations. A computer capable of 1 trillion combinations will figure it out in 44 milliseconds.

62P10 -> 390 ks = 2 hours.

Re:Passwords are useless.

[budgenator]

I use four, one high level off-line, one high level on-line, one low-level, and one for the morons that that refuse to allow special characters

Re:Passwords are useless.

[loqi]

True, but the GP was arguing that passwords are useless because any password can be brute-forced. So I'm assuming a strong password to disprove his point.

Re:Passwords are useless.

[Detritus]

It is reasonable. It prevents a denial-of-service attack on the Administrator account.

Re:Passwords are useless.

[Anonymous Coward]

Uh, what about the guys that are creating hashes of all the password combinations that exist in a database. They just need a couple of terabytes to do this in, and with HDs showing up as 300, 400, or even 500gb that's more practical every day. They can then just do a quick search for your password without having to crack anything.

Your 20 character password just means that they need a couple more 500gb HDs, that's all.

It wouldn't take all those years, now would it??

Re:Passwords are useless.

[Fortran IV]

Yeah, but the system is capable of distinguishing between RWW and intranet access; they don't even use the same logon protocol. A DOS attack on RWW shouldn't affect local administrator logon at all. Why does SBS force access to Administrator through RWW, then refuse to let you put safeguards on it?

Re:Passwords are useless.

[SoupIsGoodFood_42]

Any properly designed system should not be prone to brute-force. Even a simple measure such as restricting to one login attempt per second.

Re:Passwords are useless.

[Anonymous Coward]

They need to create the database at least once. That means they need to create the database and then a couple of years later (when they are finished) they can break any 20-character password with a database search. But then it seems the limit was increased to 26 characters....

Re:Passwords are useless.

[Anonymous Coward]

Key loggers exist today.

Really?

[aftk2]

What would be the problem with using one really strong password everywhere? Rather than many strong (or semi-strong) passwords that have to be written down, or one really weak password? Why wouldn't a person choose one good password, and only one, and keep it?

Maybe it's because people really just don't think they're that important. It'll probably take serious problems to change people's minds (like a theft of identity, or fraudulent charges, etc...)

And while we're on the subject of passwords, can we please get rid of those "change your passwords EVERY THIRTY DAYS!" systems? God...those have probably done more to propagate the phenomenon of writing passwords down than anything else.

Re:Really?

[pLnCrZy]

>What would be the problem with using one really strong password everywhere?

You are kidding, right?

Re:Really?

[vidarlo]

What would be the problem with using one really strong password everywhere? Rather than many strong (or semi-strong) passwords that have to be written down, or one really weak password? Why wouldn't a person choose one good password, and only one, and keep it?

Because ONE security breach would compromise all services? Yes, that sounds right. Also a single malicious administrator could emtpy your bank accounts, take your ID, book a few flights and so?

Do you trust the admins of slashdot enough? There has been breaches in past, there will be in future.

Re:Really?

[Nugget]

If you use the same password everywhere then CmdrTaco can log in to your bank account.

Login credentials are often stored unencrypted on the server side, leaving your password open for compromise by any legitimate admin of that site or anyone who manages to hack into it.

Do you want to trust your single password that you use to all sites to the least secure of all the crappy web boards you've got an account on?

Re:Really?

[grasshoppa]

Login credentials are often stored unencrypted on the server side, leaving your password open for compromise by any legitimate admin of that site or anyone who manages to hack into it.

You're speaking out your ass: Most places that store login information encrypt it before it hits the database. Even more paranoia can be had if you have someone like me who uses javascript to md5 the password before sending it over the wire.

So at best, an admin will have access to a hash of your password.

Re:Really?

[Given M. Sur]

What would be the problem with using one really strong password everywhere?

Just think about that for a minute... (I'll wait)

If you use the same password everywhere and just one of those places gets compromised then somebody could have access to every password-protected piece of information that you value.

Re:Really?

[GlacierDragon]

And while we're on the subject of passwords, can we please get rid of those "change your passwords EVERY THIRTY DAYS!" systems?

Amen!

I have to try to remember a *lot* of different passwords for work. If they unified the logins on these tools, it would help tremendously. You can try to have the passwords sync up, but the reset time frames on them are all offset. I had to change my Corporate password 2 weeks ago, my windows password one week ago, and my network password on Friday. As a result, I've typed in the wrong network password first try almost every time today.

Another frustration is the 100% numeric password for voicemail. It used to change every month. I--and many others--communicate primarily with email. This translated into having to change the password every time we got a voicemail before we can listen to it. It appears that they have changed the reset time length to several months now. Probably because they were tired of resetting passwords for everyone all the time.

Re:Really?

[Anonymous Coward]

Why wouldn't a person choose one good password, and only one, and keep it?

Just because I want a login to buy something from a store doesn't mean I want to give the people working at that store the password for my online banking - especially if I'm giving them other banking details to make the payment.

Re:Really?

[neonfreon]

The problem with having just one really strong password is that in the event that someone managages to get that one password (always plan security around how things might fail, not how they should work), its strength no longer matters and you're in the same position as having just one weak password for everything.

Someone could use a mechanism to get your one password that totally bypasses its strength againt cracking/guessing. For example, and this is rather common, someone could trojan an sshd, httpd, or smtpd server by either modifying it or replacing it with a version that just grabs your password when you enter it and store it. They can then take that password and use it for all of your other accounts, and do tons of damage to you before you have a chance to change your password everywhere.

Regarding "change your password every 30 days" systems - these are useful incase someone gets your password and you don't know, they can only use it for 30 days max (avg of 15) before the password is bunk. This also helps in the event that someone gets an encrypted or hashed copy of your password, say from a UNIX's /etc/shadow; gives them less time to crack the password before it expires.

Re:Really?

[coolmadsi]

And while we're on the subject of passwords, can we please get rid of those "change your passwords EVERY THIRTY DAYS!" systems? God...those have probably done more to propagate the phenomenon of writing passwords down than anything else.

Things like that really annoy me but luckily I dont think i use anything that forces me to change any passwords every x days, although if i didnt have to do so i would go by a system of password1, password2, password3 etc.

Something that i find useful is not using a strange string of characters but names, think of two or three people that you know, preferbally people with uncommon names and have these names as a password with some numbers seperating them, for example:
name123name456name789

Something like that would mean that its going to be hard for anyone who knows you personally to guess, let alone someone who hasnt a clue who you are.

Sometimes complicated passwords can be typed easily, i guess the faster you type the better you are at remembering where the keys on a keyboard are and the faster you can type in a password without anyone looking over your shoulder and reading, also, typing in the same word over and over commits the key places and order to memory to be used again.

Re:Really?

[BaudKarma]

Slashdot would be an example of one of those "trivial" sites, like newspaper archives. But you're correct, using a single password would mean that a security breach anywhere would compromise all of your accounts. Someone puts a keystroke logger on your work computer, gets your login there, and all of sudden they're in your bank account and ebay and wherever else they want to go.

Changing passwords every 30 days is sensible, too. People share their passwords with their coworkers, and you really can't stop them. You can let Dave use your account now and it's not a big deal. What about in six months though, when he gets laid off? If he still has your password written down somewhere and it hasn't been changed, he could cause some trouble.

Re:Really?

[3nuff]

Another frustration is the 100% numeric password for voicemail.

Ummmm..why not use to fancy letters next to (or below) the numbers on your phone keypad? (for example 248363 = biteme)

Re:Really?

[baadger]

If all websites started MD5'ing passwords before they were transmitted to the server then this would become completely ineffective for the attack mentioned in grandparent.

Think about it.

Re:Really?

[Gregg Alan]

You're speaking out your ass: Most places that store login information encrypt it before it hits the database. Even more paranoia can be had if you have someone like me who uses javascript to md5 the password before sending it over the wire.

Holy crap! I hope this is supposed to be funny. You do realize that by pre-encrypting the password you effectively make the crypted password in the database a plaintext password?

So at best, an admin will have access to a hash of your password.

Which in your javascript MD5 scheme above is the same as a plaintext password.

Now, even if you are using a different method for the javascript encryption, you still need to get the plaintext password back on the server to encrypt it again with the same method used in the database hash so that you can compare to two hashes to make sure they match.

Either that or you've left out some important detail.

Re:Really?

[Rob Riggs]

You're speaking out your ass: Most places that store login information encrypt it before it hits the database.

Don't be insulting, young grasshoppa. Your severe lack of clue shows it is not your place. Most places isn't good enough. I ordered something online recently with a credit card. Had to create an account with a password. Got a nice confirmation email back telling me, in plain text, how to log back in to their system. My password went through how many networks and mail servers in clear text on that one?

It only takes one idiot to ruin everyone's day.

Re:Really?

[bheer]

The point is, you don't know if J Random website will hash your password before storing it.

> Login credentials are often stored unencrypted on the server side

Judging by the number of sites that can email your password back to you, the GP wasn't wrong.

Re:Really?

[DA-MAN]

Even more paranoia can be had if you have someone like me who uses javascript to md5 the password before sending it over the wire.

MD5 is one way encryption, so if you are sending an md5 over the wire then the destination must have the plain text version for which to compare against.

Re:Really?

[tshak]

If all websites started MD5'ing passwords before they were transmitted to the server then this would become completely ineffective for the attack mentioned in grandparent.

Think about it.

I'd heed your own advice. Most websites do hash passwords - probably with something much more secure than MD5. However no passwords are hashed before they transmit, they're hashed on the server side before being stored into the database. This way if the database is compromised your password isn't easily attainable. However there are still problems with this from a trust standpoint. First, you have no way of knowing that said website is protecting your password (well) in the first place. While most hopefully do, some do not. Second, a rogue developer (i.e. contractor, pissed off employee, etc.) could easily (depending on code review policies) inject code that could secretly store a plaintext version of your password in another location for future retrieval.

The bottom line is that you simply can not trust websites with your password. The parent post is spot on about the risks related to using the same password accross multiple sites.

Re:Really?

[donkstuff]

How about this:

MD5 On the client side, seeded with the current time, and also send the time it was seeded with. The server would then deny any logins with after predefined limit.

Then, server side, have an md5 of the password, no seed, then seed the server's hash with the time the client sent (if its good).

This way, a person sniffing your net traffic would have to get the hash, seed, and then login within the time limit.

Re:Really?

[surprise_audit]

I *wish* we had a single corporate password... I'm registered on over 1800 systems, each with 30-45 day password reset requirements. Some of them remember old password for 180 days, some won't let you reuse the last 6 passwords, some will allow alphanumeric combos that others won't. Passowrd Change Day is a bitch. If it only takes 1 minute to change a password, that's 30 hours...

Re:Really?

[Runagate Rampant]

Most places that store login information encrypt it

If you trust the admin to store a hash of your password, then why not trust them with the password itself?

I have a bad feeling that lots of the "roll-your-own" logins on web-sites implemented with the same rigor and attention to detail as 90% of the production software I've seen.

Re:Really?

[GlacierDragon]

3nuff, I do that already, doesn't make it any less a pain in the ass to change it every month though.

Re:Really?

[GlacierDragon]

Corporate password is just it's name. It gets me into about 3 things that I use with any regularity.

On that note, you certainly have made me feel better about the number of passwords I do have to remember!

Re:Really?

[mrscorpio]

Wouldn't writing down all of my passwords on a single sheet of paper leave me open to the same problem? One security breech (e.g. mugging, lose wallet, etc.) and all is compromised?

Re:Really?

[kisielk]

From what I understood at my last IT job, the password change and complexity requirements were part of Sarbanes-Oxley compliance.. If you don't know what SOx is, just google it. Bane of our existence as IT workers :)

Re:Really?

[surprise_audit]

Well, there is one corporate password that we use for all company websites. Whichever one you go to first, pops up an authentication box for netid & password, and then all the others are supposed to use the same thing. Some don't recognise it, or use a different realm, or something stupid, so you have to re-enter the same damn netid/password yet again... I think it's the same password for access to corporate Windows servers and Exchange email too. For people that fit that profile, there's only one password to remember, and I think *that* one only has to change every 90 days.

Problem is, I'm a Unix admin, and the nearest thing there is to Single Sign On on the Unix boxes is SeOS, which is the biggest PITA ever. I think it even *reduces* security, because if an attacker can guess a userid/password, he immediately has access to "sesu" to root. Yep, SeOS takes all the fun out of gaining root access after breaking into a user account. Oh, not all users have sesu access - oh wait, yes we do, because the only users *are* the admins... SeOS has policy servers that allow you to be locked out of whole clouds of servers instantly if you get your password wrong 3 times...

I'm working on my own Single Sign On solution - passwords encrypted in a database and a Tcl/Tk front-end to pop up an xterm and ssh to the target. That way I could run a cron job every 28 days to update every password to some truly random value and I wouldn't have to care about it.

Re:Really?

[GlacierDragon]

At our company, it predates SOX. But SOX has certainly caused us myriad other problems. Including rolling out a new ordering system before all the bugs were worked out.

Oh, and taking away the ability of the service rep to just go ahead and give you your money back. Now those poor people have to tell the customer they're forwarding the request on for review. It's nice to be able to say "It's done. Check your card and the money will be there in 72 hours or less." Now it takes weeks.

Re:Really?

[gcauthon]

That's a good idea actually. Just make sure you use some kind of unique seed. It would all be pointless if the md5 hash matched up with the hash from some other site that just happened to have the same idea.

Re:Really?

[grasshoppa]

Holy crap! I hope this is supposed to be funny. You do realize that by pre-encrypting the password you effectively make the crypted password in the database a plaintext password?

I wasn't here to give a class on website security, I was here to make a point. If you can't connect the dots, that's your problem, not mine. Further, it does not make it a plain text password: It makes it a hash of a password that is not well protected. The difference being you can't log into someone else's site with it like you could with a plain text password.

Which in your javascript MD5 scheme above is the same as a plaintext password.

See, md5 is what's called "One way encryption". You can't not get back to a password once you've encrypted it with md5.

Now, even if you are using a different method for the javascript encryption, you still need to get the plaintext password back on the server to encrypt it again with the same method used in the database hash so that you can compare to two hashes to make sure they match.

Er...no you don't. You are too hung up on plain text passwords. Ignore them. The trick is to get the client to present a sequence of data that the server is expecting from this user.

My original point remains: Most backends don't store plain text passwords.

Re:Really?

[the_raptor]

I use the same crappy password for things I don't really care about. Someone stealing my "forums" password wouldnt achieve much. At worst I spend five minutes recovering and changing my password for the site (my email uses a strong password). But its a hell of a lot easier then having a password for every single forum I ever joined, or any of the other random sites that require passwords.

Re:Really?

[Peeteriz]

I can feel your pain.

I have around 20 places where I need to have passwords, every one of them requires passwords to be changed every 30 days.

I use 5 of these systems daily, but most others I use, say, every two weeks, or every six weeks - basically, every time I log in, I need to think of a new password. Remembering them is nearly impossible.

he's not the first

[wintermute1000]

Bruce Schneier also advocates this method on his website. I don't remember where the article is exactly (read it a little while ago) but he said basically to write them down and keep them where you keep your cash - and protect them as vigilantly. I don't think that was quite complete, myself; if I have $5 cash, I'm not going to try to prevent people from seeing it the way I'd be sure to guard a sheet of passwords from an errant camera.

My suggestion? Pretend that the passwords are a $500 bill and you're in a bad neighborhood.

I keep meaning to do this, but changing passwords is such a hassle...

Re:he's not the first

[mranchovy]

I have some of my passwords written down, but usually no user IDs--there's just enough of a memory jogger for me to be able to log into the stuff I use.

I have a user ID and password posted on my wall in my cube. But it doesn't say what the ID and password will log you into--I remember, but no one else will be able to figure it out. I also have a password list that consists of a numbered list of my relatives' names--you could look at it and have no way of knowing it's a list of passwords, knowing which ones are in use, or what the passwords give you access to (and no user IDs either).

So I don't need to treat my passwords like $500 bills if I'm the only one who can figure out what they are.

Anyone with 5 digits in their UID has a solution

[Anonymous Coward]

Just use your slashdot UID!

Makes perfect sense

[Audent]

If someone's hacking in from outside you want as good a password as possible... That's my fear, not someone sitting at my desk and logging on as me.

Peter Gutmann said the same thing: you fear the hacker, not the guy stealing your PC.

http://computerworld.co.nz/news.nsf/nl/3F25D67E479 80786CC256E6C007EE7D2

Re:Makes perfect sense

[Anonymous Coward]

In my last workplace someone (probably a janitor) stole checks from people's desks.

A Lot of hacking is internal. If you're in a company bigger than a dozen or people or so, you're at risk.

Re:Makes perfect sense

[aziraphale]

You aren't paranoid enough.

If someone in your company wants to do something illegal, and they need network access to do it, and they choose to steal your password, how are you going to prove, when the audit trail points to it being you who raided the pension funds, that it was done with a stolen password?

Most hacks are inside jobs. Insiders know the systems, they know what checks are in place, they can find loopholes and exploit them. If they can make it look like it's you doing it, so much the better.

Re:I'll buy that piece of paper with some chocolat

[Fulcrum of Evil]

My password vault happens to be Firefox, though.

How do you get your passwords out?

Problem is portability

[seanscottrogers]

Writing down passwords and storing them in a secure location isn't the issue, it is portability. Most passwords these days need to go with you wherever you are, at home, the office, on travel. If your password is too complicated to remember, then it would have to be stored somewhere on your person. That's the security risk.

Reliance on Physical security has merit..

[IanDanforth]

If you have a card in your wallet/purse with no identifying information on it, but on which is written your complicated password, this is an effective tool for password protection which I have recommended to friends for years.

However, this only applies to non-home computer security. At home users will invariably store passwords for websites and bank accounts and leave their computers unlocked and easily compromised.

So... if you are trying to protect the use of a password in a public place, and deter remote access to your information through guess-hacking this is a good system.

-Ian

Re:Reliance on Physical security has merit..

[nsaspook]

Exactly, I always kept the combo to the outer safe with the nuc release codes in my address book inside the wallet.

Mordac

[neomiasma]

Mordac isn't going to like this.

Inscribe it on your thumb

[WillAffleckUW]

then they'll take it when they chop off your hand and pry out your eye to get thru the security station just like they've already done in Hong Kong.

Seriously, most passwords are fairly easy to guess. Making them too hard defeats the human engram, forcing people to write them down somewhere.

You can get 99 percent of the possible security with only 1 percent of the effort by choosing a system that's not easily hackable and not based on the typical password schemae anyway ...

Re:fp

[Anonymous Coward]

Anonymous Coward writes: first post

Gee, is that your Slashdot password?

The problem with users is...

[MrByte420]

they think that its hard to remember a alphanumeric password with upper/lower case, but the reality of the situation is that if you write it down, you'll use it for a few weeks but after a while just by rote repetition its in there and no longer an issue. When I get a new job, I create some weird ass password hide a sticky note for a few days around with the hint, and then when i've got it straight, to the shredder it goes...

Re:The problem with users is...

[Detritus]

That doesn't work when it's an account that is only used on rare occasions. I've had accounts that were only used once a year.

Secure your passwords

[kjfitz]

I've never understood the whole "don't write down your password" warning. I carry a wallet full of credit card numbers that I probably care just as much to keep private. Those numbers are "written down."

What has to be done is make sure users are educated to PROTECT their passwords. The problem comes when the password is stored on a post-it note under the keyboard.

Common sense...

BTW, I always add a stray character at the beginning of my passwords when I write them down so even if someone gets the paper I wrote them down on they won't know my password.

Re:Secure your passwords

[abiessu]

Always at the beginning? Interesting... (substr($_, 1)).

Re:Secure your passwords

[Anonymous Coward]

BTW, I always add a stray character at the beginning of my passwords when I write them down so even if someone gets the paper I wrote them down on they won't know my password.

Damn, that's why I wasn't able to login to your workstation! I'll knock off a character or two from the beginning and try again tomorrow morning! :)

Re:Secure your passwords

[WasteOfAmmo]

BTW, I always add a stray character at the beginning of my passwords when I write them down so even if someone gets the paper I wrote them down on they won't know my password.

I have no idea why more people have not posted similar ideas. For years I have written down many of the numerous passwords that I have. But I also "encrypt" my passwords as I write then down. The "encryption" method can be as simple as the parent suggests or using rot1 or rot25, adding/subtracting X from each number in the password, or including "known to you" bogus letters ("I hereby state that I shall never use the letters E and R in my real passwords") and use these to seed your passwords.

There are many simple ways to "write your passwords down" without actually putting them on the paper. Use anagrams and pass phrases. Write the answers down where the passwords are the questions or the reverse.

Be creative. Chances are if someone finds your magic list and thinks "Hey, these are his/her passwords! I 0wn3 them!" that once they try 1 or 2 of them as written and they fail they will discard the list as being old or garbage.

Merlin.

Re:Secure your passwords

[hchaput]

BTW, I always add a stray character at the beginning of my passwords when I write them down so even if someone gets the paper I wrote them down on they won't know my password.

Heck, why not just have a one-character password, and not write anything down at all?

Re:Secure your passwords

[scribblej]

I have no idea why more people have not posted similar ideas.

Seconded. I carry all my important passwords on the back of a business card in an inside pocket of my wallet. I *always* have my wallet on my person, and if I ever should lose it or the card, it's just like losing my credit card -- I know exactly what to do to make sure that data is immediately obsoleted.

I don't currently "encrypt" my passwords as they're written down, but I think that's probably a pretty good idea, too. I believe I will begin doing that myself.

The list I use though is just the passwords, I know what each one is for. I figure if I should lose it, no one will have any idea what the funny letters are for, and even if they assume they are passwords, they wouldn't know where to use them.

Of course I wouldn't stake my security on that assumption. If I should ever be compromised, those passwords get changed immediately!

Re:Secure your passwords

[brianmed]

So _that's_ why your passwords I found never worked. Thx.

Re:Secure your passwords

[Beryllium Sphere(tm)]

>The problem comes when the password is stored on a post-it note under the keyboard.

Another way to look at it is that the problem comes when untrusted people can turn keyboards upside down without someone challenging them.

If your physical security is lax enough for bad guys to copy passwords from under keyboards, then only luck protects you from a bad guy smart enough to plug a wireless access point into an unused Ethernet jack (could be done in seconds). Or boot from a CDROM and Trojanize the computer (minutes).

(Of course even with good physical security you still want to discourage passwords under keyboards because then the trusted insiders can impersonate each other and destroy accountability).

Re:Secure your passwords

[Anonymous Coward]

Yes, but do you write your PIN on the back of your ATM card?

Re:Secure your passwords

[tsotha]

Be creative. Chances are if someone finds your magic list and thinks "Hey, these are his/her passwords! I 0wn3 them!" that once they try 1 or 2 of them as written and they fail they will discard the list as being old or garbage.

Agreed. Sure, some crypto whiz will cut through that clutter in a day or two, but that's probably not the guy who'll lift your wallet at a ball game.

One thing I wish security systems had was some kind of "tripwire" password, i.e. the account is locked if anyone ever tries it. That way you could put the tripwire at the top of the list so if it ever did get stolen the theif would lock himself out permanently before you ever knew your wallet was gone.

Re:Secure your passwords

[superyooser]

Here's another method of "encryption." Start with a common word or name. When you type it, type one letter to the right or left (have a policy) of each character. You can add a character at the beginning to remind you which direction to go. For instance, start with an R (Republican) if you need to type the keys to the right. D (Democrat) to remind you to go left. If G (Green), go two keys to the left. Be creative, but don't try to go up or down, because rows on different keyboards do not line up the same, and it's hard to tell which character you're supposed to move to.

When using keyboard tricks in lieu of memorizing the actual passwords, beware of potential problems if you ever have to use international or DVORAK keyboards.

Re:Secure your passwords

[noidentity]

You could use passwords that appear to be normal bits of information you'd have laying around, so that you can leave the passwords laying around (as long as you remember which are passwords and which are what they appear to be!). For example: phone number, website address, e-mail address, etc.

Re:Secure your passwords

[Anonymous Coward]

The first thing a pickpocket does when he finds a list of phonenumbers in the wallet is go through them and see which numbers *are* actual phonenumbers.

When he finds one that isn't - odds are pretty good that it contains the PIN number for the credit card.

Re:Secure your passwords

[yetanothertechie]

There are many simple ways to "write your passwords down" without actually putting them on the paper. Use anagrams and pass phrases. Write the answers down where the passwords are the questions or the reverse.

But what happens to all of your accounts if you die? At least in my case, many of them would need to go on living, (my family's insurance or banking information, web sites I maintain, my home systems, etc.)

I keep the dozens of passwords I have written down, clearly marked as to what systems and sites they're for, and safely stored. I've told my wife where they are and what to do in case I die. Otherwise she'd be in a world of hurt trying to take care of the online things I currently take care of.

Even if she wasn't able to deal with it herself, at least she'd be able to hire a (trustworthy) technician to help her sort it out, without losing access to all of our important accounts.

Re:Secure your passwords

[theTerribleRobbo]

Hey! While you're at it, why don't you use your first name, dog's name, date of birth... ?

So, I'm probably not typical, but...

[IANAAC]

I use a password app on my PDA (a Zaurus), but most people have cell phones. There must be a little java applet around that does the same thing. If not, there's a great opportunity there, I would think.

Re:So, I'm probably not typical, but...

[Concerned Onlooker]

Web Confidential on my Treo600 works great. It also has a desktop counterpart. (Don't forget your daily backups). That way you can have a strong and different password for everything if you like. You only need to memorize one strong password for opening the Web Confidential file and all your passwords are always with you. Easy, easy, easy.

Re:So, I'm probably not typical, but...

[kwalker]

I just got one for my cell phone called MobileSafe. It was $6 from Handango and downloaded directly to my phone. That way I always have my account numbers, CC numbers, login info, and general notes encrypted with 168-bit 3DES (IIRC) on my phone protected by my master password. It's already saved my bacon more than once.

The only down-side is that I can't sync it with anything at home, but I generally don't have to update it very often, so when I do, I also write down the passwords in an encrypted text file on my home machine.

Re:So, I'm probably not typical, but...

[Anonymous Coward]

Try Keyring for PalmOS. You can run the app in a Palm emulator on your desktop system and sync the databases.

Re:So, I'm probably not typical, but...

[surprise_audit]

Try not to do what my daughter did - accidentally get the phone mixed in with dirty laundry. It went through a whole wash/spin/tumbledry cycle... Came out mostly working - the backlight is busted and the keypad doesn't work as well as it should, but it's sort of OK. Not having a backlight makes it difficult to read the display, though.

The really stupid thing is that we have a whole working spare phone, but it's AT&T, and the washed'n'dried phone is Cingular. OK, so they're the same damn company now, but they still won't unlock the AT&T phone to use the Cingular SIM card in it.

Re:So, I'm probably not typical, but...

[Anonymous Coward]

6 bucks for an outdated cipher! where do I sign up!?

Re:So, I'm probably not typical, but...

[Anonymous Coward]

I use my own encryption called "Rot13!", pronounced "rot 13 factoral". just take your letters and to a 13! movement of their positional value. That way even if someone has managed to crack the mainstay ROT13 just go :P and ROT13! them.

peace out.

Re:So, I'm probably not typical, but...

[kwalker]

One of my coworkers lost his Visor to the laundry like that. Fortunately I am way too attached to my phone to leave it in pants I'm not wearing. The only way I could love this thing more is if it were running Linux (My next phone will, no matter who I have to kill, because I'm tired of this proprietary playground they keep us in).

And yeah, AT&T and Cingular are the same company, sorta kinda not really. Besides, they're both a collection of mouth-breathing asshats who I refuse to even talk to anymore. I mean how hard is it to get a damn phone shipped to the right address? And how hard is it to take off a bogus charge?!

(breathe, just breathe)

Re:So, I'm probably not typical, but...

[Anonymous Coward]

The Ericsson T39 series has a built-in password app which appears to be based around a one-time-pad system with no checksums. It uses a "checkword", which is some phrase only you know which appears for a few seconds after entering the password (which, btw, doesn't have to be the same as the PIN or PIN2). Seems very solid to me - unless there's a backdoor in the phone then I don't see how someone can get your code (a brute-force will merely give every possible combination, but won't tell you which is right).

Re:So, I'm probably not typical, but...

[Harlan879]

For PalmOS devices, there's an app called "Secret!" with an encrypted database. It comes with a conduit for Palm Desktop too. Very very useful.

It's probably better...

[Sheetrock]

To use some bit of knowledge you have rather than writing down something obscure on a piece of paper that you can lose.

For example, your password could be your birthdate, or favorite football team, or even the year you graduated from high school. Or all three if a longer password is necessary. It's fairly easy to learn to enter this information backwards as well, for further obfuscation, without making it harder to remember.

Gone are the days when you can leave the password blank or simply use your login name again and expect any level of security. Hackers eat that stuff up. But if you protect your account better than the rest it's more likely they'll move on to some other schmoe who isn't as hip to security as you are.

Re:It's probably better...

[randyflood]

Using your birthdate as a password is a horrible idea because it is easily guessable by people who know you, and easy to socially engineer out of you by people who don't really know you well. Using a football team is a horrible password because it is a dictionary word, and it is commonly used by like a zillion other people that think that no one would ever guess that.

In general, passwords should use a combination of upper and lower case letters with at least one number and one special character. Just taking dictionary words and replacing letters with numbers is not really a good idea either.

CFS storage of passwords

[zCyl]

If you have a secure system somewhere, you can use CFS, an encrypted filesystem, to store your passwords for various other systems. Then you can memorize a good password for the CFS system, and refer to it if you forget the password you're using for some other system.

This is fairly secure as long as the system CFS is accessed from is not compromised with a key logger. It has the advantages of paper, but with the capability of accessing it from remote with ssh. It also has the bonus of being harder to lose and easier to back up than a bunch of paper, and the backups of CFS are unreadable without the password, unlike extra paper copies.

Re:CFS storage of passwords

[arminw]

...long as the system CFS is accessed from is not compromised with a key logger...

the Apple OSX keychain system uses the user login password to unlock the keychain which contains the encrypted passwords to other accounts and websites. To install a key logger would require the remote hacker to trick an administrator user to allow the install into the system itself. A keylogger installed in an ordinary non-admin OSX account would not do much, since the keylogger would not run until after the user logs into his/her account. Bank and other Internet passwords are then supplied by the keychain, not from the keyboard, so the keylogger would have to somehow be able to intercept those also. Having to frequently change the password would reduce this security against a keylogger, because the user would need to periodically re-type the passwords into the keychain, giving a surreptitiously installed keylogger the new password. In the end, requiring routine password changes reduces security against such keylog programs.

I have a cheap, credit card sized pocket calculator to generate a number to use as a password along with a letter or two. For example someone having a birthday on August 13 might use the password A13 as being the letter A in front of the square root of that day using 5 to 7 digits which you type into the computer as: A3605551 for example. If the system allows periods you can use the decimal point also. Someone who knows your birthdate would still also have to know the square root secret and have a calculator handy.

Re:CFS storage of passwords

[zCyl]

*note to self: arminw's password is a square root of something...* ;)

Who do you trust more?

[Ride Jib]

Seriously, it just comes down to who you trust more.... people with access to your work area (where password would be written), or potential hackers. If you trust the people you work with (or your family members, for those at home) then what is the problem with writing down your pass? I know my dad has every one of his passwords written on the monitor itself on his home pc.

Re:Who do you trust more?

[surprise_audit]

I may trust my co-workers, but I'm not sure I trust the out-sourced janitorial staff who come around during the evening when there's nobody else there. I don't know what kind of background check might be done on the janitors, but it's probably not as thorough as that done on employees.

Re:I'll buy that piece of paper with some chocolat

[thegamerformelyknown]

My friend has something like this, but a little more secure. For about $80 CAD, you can get one just like his. What is it? A fingerprint scanner.

When he has a login anywhere, instead of Firefox typign it on pageload, he just pushes his finger onto the pad. Chances of someone faking his hand?
Let's just say low.

Uhhh Negative

[Albinofrenchy]

One IT administrator from an international entertainment company who asked not to be named said that his company has a strict policy against allowing employees to write down passwords. Still, he said, he collates his personal passwords in an encrypted file because it "made more sense" than trying to remember multiple strong passwords.

I agree with writing it down, but storing passwords on your computer, even encrypted, is horrible.

Switch between passwords

[coop0030]

I typically like to use about 3-4 passwords that I rotate between sites, with different usernames. If I forget one of the passwords, I can usually guess it on the second try.

My passwords are at least 6 letters, and 6 digits. Hopefully, that is secure enough.

IF they protect the paper...

[slusich]

which we all know they won't. Most of the time we find them on a post-it note stuck to the monitor. The really sharp ones tape it under the keyboard. The best one I've seen was a guy who kept his taped under his monitor. He'd actually lift this bulky CRT every time he needed to login.

The Downside of One Really Strong Password (TM)

[Anonymous Coward]

One Really Bad Mistake (TM) will hurt you a lot more than it would with multiple passwords. I'm careful, I'm sure a lot of slashdotters are careful, but every once in a while someone is going to make a mistake. If it's one password for one place, it's possible to fix that. If it's the same password everywhere that becomes more difficult.

This works for me

[Anonymous Coward]

PEN15 as a password.

What?

[Macgyveric]

Are you telling me we aren't supposed to use HHKJK-D4FWY-34B2D-RB7K2-C2QVJ for all of our passwords?

True story

[HaeMaker]

I'm a SysAdmin and at one place I worked, I noticed someone had written 'aaaaa' on their monitor. They wern't at their desk at the time, so I sat down, hit ctrl-alt-del and typed 'aaaaa' into the password field...

Re:True story

[justforaday]

...and then?

Re:True story

[DrewCapu]

Great, now I'm going to have to change my password. I think 'aaaaaaa' will do, just in case someone guesses 1 less a.

What a coincidence. Even slashdot wants me to enter that before I post this reply.

Re:True story

[sconeu]

I refuse to play your chinese food mindgames!

Re:True story

[conteXXt]

If only management could have seen that.

(and understood the implications).

Perhaps then an HR person would finally get fired for THEIR incompetence.

Re:True story

[HaeMaker]

He was a contractor. He was gone before COB.

Re:True story

[sd_diamond]

I'm a SysAdmin and at one place I worked, I noticed someone had written 'aaaaa' on their monitor.

Maybe he died while he was writing it.

Re:True story

[gregfortune]

Heh, I've got a password on a post it note attached to my monitor. It's something like P43F^ss2Bn. I always wonder how many times people try it.

Re:True story

[Anonymous Coward]

I'm a software developer and what I did was code up a fake little ctrl-alt-delete box and pop it up on my screen when I walk away. If someone tries to get into my box, that post it note with the fake password is so enticing, the login will fail and then prompt another login dialog box stating that an application error has occurred and that person must login to save any active work before reboot. Of course this is fake too, it just logs the attempted hackers username and password for me. You wouldn't believe how many passwords I've gotten this way in my office....

Re:True story

[theTerribleRobbo]

Isn't there a St Aaaaaaves in Cornwall?

MS Security Through Clarity?

[Eberlin]

Let's get this straight -- writing down passwords is a bad thing. Remembering passwords isn't that difficult in the end if you use a proper scheme. A securityfocus article suggests creating an acronym from the first line of a song. Makes enough sense. Add a bit of 1337 to it by changing some letters to numbers and you can be a bit safer.

Now on the other hand, if you wrote down some sort of hash to a password that you mentally decode to create the REAL password, then it may not be so bad. Still gives someone a place to start, thoguh. In most cases, though, having a physical record of a password just screams "BAD IDEA!"

It actually makes some sense...

[sterno]

Today, the greater threat to users is having their password stolen somewhere in the network. The number of passwords stolen by actually going up to somebody's desk and reading it is, much lower in comparison.

The advantage of this is that you can use relatively obscure and complex passwords because you don't actually have to burn brain cells to keep track of them.

This makes perfect sense.

[Daniel Baumgarten]

I like how Slashdot is listening to Microsoft for security advice.

Re:This makes perfect sense.

[The Bungi]

Very funny! I suppose it's better than listening to themselves though.

Or they could maybe listen to Bruce Scheider, who says essentially the same thing in a recent article I saw on news.com (IIRC).

Or they could buy an input device with a built-in fingerprint scanner.

In short, they could do many things. Instead of making snide remarks about topics they really don't understand, even though they think they do.

It's what master password is for

[microbee]

I personally keep all my passwords in an Excel spreadsheet and protect it with a master password. As you say there is nothing wrong with that. Unfortunately, I end up still using the same set of passwords (about 5) anyway. :)

Exactly right. . .

[Sialagogue]

This is the exact reason that I write all my passwords on post-it notes and stick them to my monitor.

I have a 21-inch tube monitor and it weighs like 80 pounds, so nobody could even get it out the door much less steal it, so my passwords are going nowhere.

Re:Exactly right. . .

[forkazoo]

I reccomend writing *on* the monitor, rather than on a sticky note on the monitor. They aren't *that* sticky!

Re:Exactly right. . .

[Poeir]

They'd be even harder to steal if you wrote the passwords on the monitor itself. I recommend a Sharpie, or even an engraver.

Re:Exactly right. . .

[Anonymous Coward]

* <--- The joke


o <--- Your head

Write down part, memorize part

[Anonymous Coward]

There's a useful security-through-obscurity technique here: use a small set of easily-remembered prefixes or suffixes on all your passwords, and write down the part that varies.

For example, always prefix your password with your dog's name, so one account uses "FidoBlargh" and another uses "FidoAnakin", but write down only the "Blargh" and "Anakin" parts.

That makes sense

[RayDude]

Write them all down and keep them next to your Mastercard. Pretty much the same security mechanism.

The problem is: what if your wallet is stolen, its one call to cancel the Mastercard, but how are you going to change all those damn passwords? Especially if you don't remember any of them.

Maybe writing them down and locking them in a safe is better. Or maybe keep the master list in your wallet and a copy in a safe so that if its stolen you can log in and change them all before the thief realizes what he has.

Raydude

I just use Gnu Keyring on my Tungsten

[StressGuy]

Remember one password to access the program, and encrypt my more critical ones as strong as I need to.

Re:Anyone with 5 digits in their UID has a solutio

[zCyl]

And so begin the "my UID is smaller than your UID" posts...

Re:So Pen&Paper's the new replacement for Pass

[coop0030]

Maybe it's the new trend.

Maybe pen&paper AD&D will be cool again!

Fixing the wrong problem

[np_bernstein]

That's the solution to the wrong problem. The problem is those systems allowing the users to use bad passwords. If a your authentication program expires passwords once every six months or so and requires non-dictionary based passwords and a combination of letters special chars. And hard passwords to crack aren't necessarally hard passwords to remember. Especially if you use some type of memory assistance, like a sentance:

"I have three dogs: elmo, burt and erney"
Password: "1h3dgs:E,B&E."

the point is that system administrators should be activly sending out emails and talking to users who might have a problem with this, not disregarding important aspects of their jobs, like educating users as to a very important piece of their security.

Keepass

[DarkHelmet]

http://keepass.sourceforge.net/

I can't re-iterate this enough.

A program like this with the database stored on a keydrive is ideal: your passwords can be as long as you like, cryptographically secure, and be different for all sites.

Well, both are poor choices

[Jugalator]

Neither writing down your password or picking a simple password is clever, so I don't see why he even discuss this?
Like saying you should really try start smoking sometime because it's worse to use heroin.

I think a good way to come up with non-dictionary passwords while keeping them reasonably easy to remember is to take the first letter in a sentence and somehow mix it up with numbers. Like "I Am A Geek And Like Slashdot" would become "iaagals". Then add some number from your social security number or something to make it truly alphanumeric and voila.

There are numerous other ways, and if I have to use a password somewhere, I really prefer to pick my own. If it's randomized and forced on me by some admin for "maximum security", I'll almost guaranteed write it down somewhere. Instead I'd prefer said admin to run my personally made password through an extensive dictionary to ensure it's not simply an easy victim for a dictionary attack, and maybe also check it's alphanumeric. I really dislike those enforced passwords like "3zq@q!02". Jee, thanks, let me get a pen and paper. :-p

Re:So Pen&Paper's the new replacement for Pass

[DaltonRS]

And of course, they(M$) will introduce the following security initiative when pen and paper security protocols show evidence of security lapses. White-Out.

Common passwords...

[__aaclcg7560]

The most common passwords I have seen at different companies was HOCKEY (unix/linux machines, why I don't know) and YOUSUCK (windows machines, surprising isn't it). And, we can't forget this one, it's everywhere (especially for email accounts): PASSWORD.

wrong attitude, wrong solution

[hherb]

When we start writing down passwords, we compromise them. Obviously.
Instead, we should learn how to algorithmically generate good passwords ourselves, so that we don't need to memorize a complex character sequence, but just the way how to generate it.

Example: I take the second and fifth letter of the site name I want to log in, which I use as an index to a poem, movie or book name I know, of which I take in turn letters and numbers ...

While this process sounds complex, once you get used to "your" algorithm you don't even have to think much about it any more. That way, I am now using up to 48 quality passwords (long, mixed capitalization, including punctuation, interdispersed numbers) without having any troubles at all remembering.

Password Safe is the answer

[windowpain]

It's by crypto genius Bruce Schneier, it uses Blowfish, it's open source and if you want that extra measure of security you can compile it yourself. It's for Windows but there are Unix/Linux versions too.

Password Safe

Re:Password Safe is the answer

[Jugalator]

However, don't pick an easy password for its master password, and don't write it down. ;-)

Re:Password Safe is the answer

[roubles]

Or pwmanager for the linux users amongst us:

http://passwordmanager.sourceforge.net/

It uses blowfish to encrypt passwords too.

Re:Password Safe is the answer

[RayMarron]

CrypBox is really handy if you have a Palm device - you can carry your password database with you AND have access to it on the desktop.

Re:Password Safe is the answer

[grumpyman]

Yeah... I've thought about this idea too - for a huge list of hard-to-remember passwords, but if the master password is not good enough, the ENTIRE password database will be up for grab, isn't it? Then the purpose of using hard-to-remember passwords is defeated. Or is the idea -> use only one hard-to-remember password instead of 20+? Am I missing something here?

Re:Password Safe is the answer

[Anonymous Coward]

Or you could just buy a Mac and use the Keychain application which is the same concept, except it's integrated into the OS and everything plugs into it.

You can even have it store your ssh passphrases that get intercepted by a third-party ssh-keychain application that inserts the passphrase into your Apple Keychain.

You also can place your keychain on a USB memory key (it's already encrypted) and plug the USB memory key into your laptop and login. If you forget the USB memory key then you login to the system but you don't have any stored passwords.

Re:Password Safe is the answer

[Anonymous Coward]

Naw. A better, integrated solution like Factotum on Plan 9

Re:Password Safe is the answer

[Frohboy]

Use one fairly hard (but still memorable) password locally to protect the random unmemorizable passwords you send across potentially insecure environments.

Sure, if someone who's out to get me busts into my apartment, they might be able to figure out the password for my password database (since it's easy enough for me to remember) or perhaps bruteforce it (assuming they own have the processing power). At that point though, since they have access to my home, they could just eat all my food, kill my dog, and spraypaint profanity on my walls (or eat my walls, kill my food, and spraypaint profanity on my dog), which is as much of an inconvenience to me as if they drained my meagre bank account.

Remember that the important thing about security is not to make it impossible to screw you over, but rather to make it so it's just not worth it.

Re:Password Safe is the answer

[jridley]

Where's the palm version?

Re:Password Safe is the answer

[eddeye]

It's by crypto genius Bruce Schneier, it uses Blowfish

A few things to keep in mind:

• Schneier handed this project off to others several years ago. His involvement since appears to be minimal. While he wrote the initial version, that code may have long since been sent to the bitbucket in the sky.
• Schneier's crypto credentials are well established, but how is his programming knowledge, especially in regards to security? I don't know of any large open projects he's worked on that give us an indication of this.
• AES and 3-DES are more reliable than Blowfish, having received orders of magnitude more attention from cryptanalysts. Besides which, "uses Blowfish" is a long way from "uses Blowfish correctly with proper handling of the key material and plaintext at every point in its lifecycle".

Bruce is a cool guy, and Password Safe may be great, but I wouldn't trust it soley on his reputation.

Re:Password Safe is the answer

[ronys]

Actually, PasswordSafe is actively maintained on SourceForge: http://passwordsafe.sourceforge.net/

You don't need to trust Schneier's rep, as the sources are available...

As to the Crypto, AES is currently much less reviewed than Blowfish, as it'smuch newer and 3DES, while reliable, is relatively SLOW...

Note: I'm the current project admin.

Re:Password Safe is the answer

[dcam]

Use Keyring.

Re:Password Safe is the answer

[grumpyman]

I see one of the major benefit is'local-vs-remote' password. But if the machine is connected to the net, it's also vulnerable eh? So that mean local security is very important with such password DB stored? Or maybe put the entire DB on a USB key and plug it in when needed?

Re:Password Safe is the answer

[Anonymous Coward]

if you want that extra measure of security you can compile it yourself.

Yeah, but who compiled your compiler????? *significant look*

Re:Password Safe is the answer

[cratermoon]

A good, secure password does not automatically equate to hard-to-remember. It takes some effort, but it's possible to come up with memorable good passwords. Given the choice I'd rather put thought into coming up with one good strong memorable password that I don't have to keep changing, and use it to protect all my hard-to-remember passwords that I'm required to change all the time.

Yep, like what's happening at Gmail

[Snaller]

Since the jerks at google tell the browser not to remember the password (autocomplete="off" ) I've picked a really simple password.
(No, I don't want them to remember it a couple of days)

Re:Yep, like what's happening at Gmail

[roubles]

Will this work for you in IE ?

http://www.squarefree.com/bookmarklets/forms.html# remember_password

works fine in firefox.

Re:Yep, like what's happening at Gmail

[smellystudent]

Meh, Opera can remember Gmail passwords. If it's a system you trust enough to store your password, why is it using IE?

Re:Yep, like what's happening at Gmail

[Snaller]

Meh, Opera can remember Gmail passwords.

Because Opera chose to ignore the html command. Good for Opera.

If it's a system you trust enough to store your password, why is it using IE?


I don't understand your question?

Re:Yep, like what's happening at Gmail

[Snaller]

Alas it seems not. Was a neat idea though. Thanks for suggesting it roubles.

I've always written my passwords . . .

[ndansmith]

. . . on a Post-It note on my monitor.

Physical security only has SOME use

[WillAffleckUW]

However, this only applies to non-home computer security. At home users will invariably store passwords for websites and bank accounts and leave their computers unlocked and easily compromised.

Or use unsecured default password WiFi thus making it all a waste of time. 90 percent of all WiFi-capable laptops are insecure.

I give them chocolate, it makes the laptops feel better about themselves ... and more mentally secure.

Hold on a second.....

[The Green Skeleton]

Controversial ideas on security from a Microsoft employee?
That we're taking seriously?
Did I miss something?

Keychain Access on Mac

[SYFer]

Mac users have a very powerful tool for password management in the Keychain Access program (which many users pay little attention to). You can store many strong passwords then remember one strong password to unlock and use them all. Additionally, when Keychain Access is locked, you can store the various password files it creates on a server (or on a flash drive) with peace of mind because it's DES encrypted. Note also that you can now sync Keychain Access via .Mac.

I've taught some of my friends to memorize one strong password, then use it to unlock Keychain Access which will simplify the process of assigning separate strong passwords for each account, server, etc. (or at least as strong as each scenario will allow). Because I often also need to access passwords from a PC, I also keep a short spreadsheet of "vital" passwords on the flash drive as well and I encrypt that with Kremlin (which is cross platform).

Use hashes and/or passphrases

[MobyDisk]

This has come up on many Slashdot comments and people seem to gloss over it. Both are simple ways to eliminate the problem. Why must all these pundits come out and announce how useless passwords are, or how dumb users are, while ignoring real solutions?

1) Passphrases I hate Joe Smith because he stole my ex-girlfriend, Soandso, then ran over my dog...

It is amazing the number of systems with dumb limitations like 6 or 8 characters, or no symbols. Fix those, then people can use pass phrases and security is good again.

2) Hashes SIl1alsuhvd3oEtlmo

That is the name of site you are logging into ("Slashdot") + a single passphrase used for all passwords (I used "I luv Elmo") hashed together. I just interleave the letters and replaced spaces with the number of characters in the preceeding word.

That is very secure and easy to remember. Years later I still can log in to places I've totally forgotten about. Show people these techniques and the problems go away.

acronym

[mohrt]

Just use an acronym. example:

il1k2b1k!

"I like to bike."

Just use shortened words, make substitions like i=1, s=$, etc., and maybe an oddball character or two like the exclamation point.

It looks difficult, but once you make up a password in this fashion and use it a couple times, it becomes automatic to remember. It's much easier than having to memorize a whole random string of meaningless characters.

I write mine down

[i_should_be_working]

At the bottom of my desk drawer. But I encrypt them with a method I'll never forget. As long as no one else figures it out I can write them down and change them frequently if needed.

When I have enough money to make it worth the effort to steal it, maybe I'll get a better system. But even as it is I don't see how someone could figure out my system.

Re:I'll buy that piece of paper with some chocolat

[nacturation]

Of course, there's Scheier's Password Safe, which is now a SourceForge project. See: http://www.schneier.com/passsafe.html. Works for me... I carry the encrypted file around on USB flash and who cares if I lose it... barring quantum computers, nobody's going to be breaking it within my lifetime.

Simple Fix

[Irish_Samurai]

I happen to use really easy phrases and terms so that I can remember what my passwords are.

I then have a numeric category for all the sites and apps that I use Ex: Bank = 5, Email = 6, ect...

I then ROT# the term where # = the category the password is in. Viola!

It's worked for me.

My personal favourite password

[Anonymous Coward]

wtfisit2u

There's always room for Jello!

[coyote-san]

If clerks (in the study) never noticed the gunk on everyone's fingers as they demolished the "security" of these systems, what chance does any system have in the relative privacy of a cubicle or home?

Re:So Pen&Paper's the new replacement for Pass

[irm]

I've always written down my passwords. You just have make sure to keep them on the top of the Mountain of Despair, beyond the River of Doom. Total security!

I do this.

[that _evil _gleek]

I do this, and I've I done it for a while. Basically, for anything that can be memorized instantly, there's already a rule for in crack. So, I've been doing this since 1996, evolving offer time, until the point where I choose random passwords,
rejecting ones that are too hard to type, one needs to be able to type it quickly, as well, after a while I learn the new password, but they are complicated enough, that its more muscle memory than anything else, I'd need to be at a keyboard
to remember the whole password, If injected w/ sodium pentathol I'd probably only be able to give up the first 3 characters of any password ;-], not actually being able to remember, since they aren't really words, unless they stuck a keyboard in front of me... Its like of like a sports swing, or a combo move in a game, once learned, you bypass conscious thought to perform them. A better example still, would be like tying a shoe-lace, I can do this w/o thought, and in fact
, thinking about it only makes it harder.

Passphrase

[YrWrstNtmr]

With site specific modification

Bite My Ass Amazon
Bite My Ass Microsoft
Bite My Ass Google

Easy enough to actually remember, without writing it down.

Substitute numbers/special chars if required.
B1te My A$$ D311

My Solution

[3ryon]

I use a small PINS database stored on a USB flash drive on my keychain. Instead of launching the application when I need a password I launch a batch file that detects if the drive is plugged in, if so it copies the password file to my profile and launches it (if I'm using either my home or work computer). If the drive isn't plugged in it uses the local copy. If I make an update it copies it back to the USB drive.

The master copy is on my keyring, but my home and work computers have copies. I've been doing this for a year and I highly recommend the solution. I can now use random passwords.

Re:My Solution

[Anonymous Coward]

I use a small PINS

I guess nobody cares what I read that as.

Re:My Solution

[Anonymous Coward]

Ick. Sorry, the pop-ups turned me off.

Re:My Solution

[Anonymous Coward]

what's a pop-up?

Re:My Solution

[ydrol]

As well as adding dummy characters or offsets to my plain-text passwords file, (useful if someone happens to look over my shoulder etc) I initially zipped my plain text file using Winzip. Then I realised that WinZip encryption isn't portable between various zip implementations (and hence platforms).

I've now decided to move my plain-text passwords file to an OpenOffice Write document and save with password option. Not sure what algorithm it uses though, just wanted something that seemed straight forward and fairly transparent without having to explicitly deal with any special software.

Mod parent UP (funny)

[Spy der Mann]

For providing us with an EXCELLENT reference to SpaceBalls the movie.

Doesn't this statement cry out for smart cards?

[ecloud]

If having the user write down passwords is good, why can't the "lookup" be automated to save all that typing...That way logging in could require none of the user's memory at all, and be much more secure, because the card could use a rolling code or hash-algorithm scheme, so that the data being passed back and forth between the card and the system is never the same, and the card contains all the secrets, and will not release them under any circumstances. Ultra-paranoid sysadmins might want to require a password or at least a username along with the card, but as long as users are taught never to leave the card unattended, I think it's not really necessary. This username/password crap is so insecure and outdated. My Dell laptop at work has a smart-card reader built in, and Windows already has support for this kind of authentication. My company hasn't tried to deploy it though.

Password Safe

[Nerdgasm]

Pen and paper may provide you with an airgap from the internet, but it is also not very convenient. I would prefer someone use some sort of a password safe, remember only one very difficult password/phrase and make sure they change that often. http://passwordsafe.sourceforge.net/

Damn

[MrAnnoyanceToYou]

Here I thought I was going to be able to make a, "I just reduced my UID size by 70%, and you can too if you send me your password" post.

Credit card numbers aren't secret.

[Anonymous Coward]

They never have been, and you're not responsible for any charges made by someone who has stolen your number.

Obligatory Microsoft Bashing

[RobFrontier]

There is absolutely nothing wrong with writing down passwords. As long as the user protects the paper they are written on. If it wasn't against our corporate policy, I'd encourage our users to do it. We expect them to use strong passwords, but don't give any viable way for them to remember them. Do you think the average user is going to remember upwards of 5 strong passwords for each different application they need to access. I Don't.

Develop your own password algorithm.

[Anonymous Coward]

For example,

1. Select a date.
Thursday March, 14th 2005
2. Take the first letter from the day
m
3. Take the first letter from the day March 3rd falls on in 2006
mt
4. Take the last number in the day
mt4
5. take the number of the month.
mt43
6. take the third and second letter of the last day in the months
mt43uh
7. take the last number of the day of the next week.
mt43uh1
8. take the first letter from the first 3 days in the next month.
mt43uh1fss

Memorize the algorithm, and wirte down the dates.

Re:So Pen&Paper's the new replacement for Pass

[CaymanIslandCarpedie]

Funny ;-)

Seriously, MS replacement for Passport seems to be InfoCard. Now I know this is MS, but this does actually look like a cool concept (we'll have to wait and see about the implementation).

Kim Cameron (the lead guy on this) is actually pretty adament that this need to be an "Open" system that others can implement. We'll see if that ends up meaning "open source", but interesting none the less.

Everything you ever wanted to know about passwords

[John Seminal]

#1) The hackers have huge dictionaries that can crack just about any word, in any language, and with any added numbers, like compaq002 or 01compaq01. Second, they have custom dictionaries that can take 2 or 3 words and put them together in logical ways (like people think). These are all easily cracked. Picking a password by splitting the words of items on your desk and adding them back together is not smart. Comp05HP is not a good password.

#2) The best passwords are illogical. Something like k8iWq3xy. Mixing in letters in and numbers, not based on any words, is a good start. If your program recognizes upper and lower case, mixing that can help too.

#3) The best, very best log in tool for security I saw was a small clock a friend was given from his company. It had some funky algorithm on it, and it displayed a 14 alphanumeric code. When my friend logged in, he had to enter this code, which changed ever 1 minute. This was in addition to his username and password.

#4) People will sniff your network. Nothing is bulletproof. Finding passwords sent is easy. If it comes as clear text, you are screwed off the bat. This defeats #1 and #2, but not #3, because #3 is based on an algorithm that changes every 1 minute.

#5) Set up a policy that only allows 2 attempts to log in, and after 2 failed attempts, it locks out that IP and MAC address for 30 minutes. This will be a major pain when you try and log in and make a mistake. It won't really stop hackers, just the ones with slow/bad proxies. Maybe 1 of the 500 proxies the hacker is using is not as anonyomous as they believe. As for your own use, take a book with you when you believe you might have to log in remotley, just in case you make a mistake. You need something to blow those 20 minutes.

#6) Never, ever log in root from a remote location. Have a crippled account to log into from remote locations. Expect this account to get cracked. Limit the damage. If you must, have 2 computer systems at home. One secured off line, and the other on line. Hell, toss in a third computer connected to the web based on via a serial cable and dump all the logging on that computer. The hacker/cracker can't edit the logging files on that second PC.

#7) When using a computer, always assume the key strokes are being logged. When you get home, change your password for that account.

#8) After you have done all these things, you will still get hacked. Call the FBI. Call your congressman. Lets bomb another country to releave our collective mutual stress.

Speaks of Microsoft's Mentality

[Comatose51]

That's really representative of the MS mentality:
Do something stupid as long as it prevents you from doing something equally stupid or worse. I guess that makes sense in a PHP's mind... It's great that Microsoft shoot for ever lower standards.

It makes as much sense as becoming an alcoholic so you would be too drunk to go and do crack.

Re:Speaks of Microsoft's Mentality

[Guru2Newbie]

I guess that makes sense in a PHP's mind...

That's a pretty funny malaprop (considering it's Slashdot)! Hmmm, the 2nd "P" in PHP stands for...what, again? Pointy-Haired...Pixie? Person? Professor?

It couldn't be Pointy-Haired Boss, could it? Naaaaa... ;-)

It all depends on your biggest risk factor

[gnunzo]

While this is important to mention, a more even approach would be to weigh whether your biggest risk is from outside crackers (and thus excellent passwords are most important) or from inside crackers (and thus onsight security is most important).

Re:Anyone with 5 digits in their UID has a solutio

[chinakow]

I knew this UID would come in handy one day. YAY!!!!1one

:-)

Re:I'll buy that piece of paper with some chocolat

[jacksonj04]

Put another password in.

I use a rather nice piece of kit which goes by the name of KeePass ( http://keepass.sf.net/ ), and a 78-bit master password for that. Works wonders, and can use external drives as keys or parts of keys (So you have the traditional something you know, something you have).

or.....

[to_kallon]

i could carry one of these....

Re:Anyone with 5 digits in their UID has a solutio

[Anonymous Coward]

And so begin the "my UID is smaller than your UID" posts...

I don't know why you guys bother with this pissing contest when I win every single time.

Anonymous Coward - UID Null

Re:So Pen&Paper's the new replacement for Pass

[Anonymous Coward]

I can see what's next.

• Oil Paints replacing Microsoft Paint in Longhorn
• A printed dictionary replacing Word's spell checker.

Perhaps Longhorn really will revolutionize the computng industry.

Not as portable as paper

[winkydink]

Anything that requires me to have access to a specific type of hardware (PDA) or a specific operating system isn't going to be a lot of help if you're on the road without your gear or your gear gets stolen and you need access now.

Just do something trivial like rot-5 the 5th character of each password if you're concerned about somebody getting access. That would discourage most people from trying.

Re:Not as portable as paper

[WolfWithoutAClause]

If it's properly encrypted, you can put the file up on your webspace and you should be able to access it from anywhere in the world.

If you choose the encryption carefully, you shouldn't have any problem with OS specificity.

Also, there are encryption systems that can be run literally on a pack of cards(!) or with pen and paper, but I'm not sure how secure they are.

No!

[RoverDaddy]

Why put the list in cyberspace at all? That's the beauty of paper, nobody online can steal a sheet of paper sitting in your home/office/dorm/loft/cave.

Re:No!

[Anonymous Coward]

Why put the list in cyberspace at all? That's the beauty of paper, nobody online can steal a sheet of paper sitting in your home/office/dorm/loft/cave.

I've had more stolen from my office than I have from my keychain (where the encrypted file resides). I've also lost a wallet before.

With an encrypted file they need to break both the physical security (office, pocket, whetever) and teh encryption.

Re:No!

[Anonymous Coward]

That's until somebody cracks that home/office/dorm/loft/cave directory you are talking about

Re:No!

[MrDomino]

"Your computer" isn't "cyberspace" unless you're running an unpatched Windows install, and in any case, encrypting the file guards against most problems. It has the problem of creating a single point of failure, though; if a cracker figures out the one password you use to store all your other passwords, then rather than losing just your bank account or just your e-mail or something of that sort, your whole online identity is compromised. Regardless, though, an encrypted file is still probably best so long as you pick a really good password for it; you can use good passwords everywhere without worrying about forgetting them, and it isn't quite as easily compromisable as a slip of paper (which is extraordinarily easy to compromise with a bit of social engineering).

Re:No!

[FirstTimeCaller]

Why put the list in cyberspace at all? That's the beauty of paper, nobody online can steal a sheet of paper sitting in your home/office/dorm/loft/cave.

But I thought you said not to put it on your machine at all!?!?! So what the heck is it doing under your home directory? :-)

Re:No!

[Anonymous Coward]

Untill they pull up to your house with a war spying box, and look over your shoulder by connecting to your unencrypted security cam... then they steal a look at your piece of paper, and have your password.. muahah

MY pin numbers

[P3NIS_CLEAVER]

I will write them down as a phone number in my wallet... the first 3 numbers are bogus and the rest of the number is the pin.

First Post

[Anonymous Coward]

First Post

Parent is Informative

[Anonymous Coward]

passwordsafe = good program

Good Idea

[Tyrson]

I've found a great way for making many complex but easily remembered passwords is creating a simple process.
For example:
Take your user name and make your password 1 letter after.
Username: abcd
Password: bcde
Username: MyUserName01
Password: nzvtfsobnf12
This way your passwords are all different and not at all easy to guess or dictonary attack.
A problem with this might arise if you use the same username for everything. In which case another simple step could be added to prevent the passwords from being the same.
By adding the name of the site after the password for example.
Username: abcd
Password: bcdeyahoo
Username: MyUserName
Password: nzvtfsobnfslashdot

Re:Good Idea

[Anonymous Coward]

This is similar to what I do. I'm not going to say what mine is but here are two of my passwords:

tlgiiusjpp25181515
ntvlbjzunsml1325211411

My mental generator is a little more complicated and can take a little longer to spit them out, but I'm not worried about my passwords getting discovered. In fact sometimes I'll show my passwords to co-workers without any fear of them remembering them.

Roll on biometrics

[LordSnooty]

Let's face it... of course, the use of fingers, palms, voices, footprints will have the privacy advocates up in arms, but it's going to be bloody handy (NPI) just presenting your palm to the wall-mounted reader, Star Trek-style (used as a general representation of sci-fi, I never watched the thing) when compared to remembering 10 passwords.

Re:So Pen&Paper's the new replacement for Pass

[Anonymous Coward]

It's now called D&D and has always been cool!

I can just see this...

[Em Ellel]

For example, I'm only reading Slashdot from this particular computer, and I'm using a IBM E94 monitor, and there is this Sellotape dispenser on my desk with 1531 written on it. So my Slashdot password can be easily remembered as IBM!1531@E94#, or simply ibm1531e94 for those systems that cannot accept special characters.

I can just see the following request to helpdesk:

Please reset my password as someone borrowed my Sellotape dispenser and I can no longer log in.

-Em

don't write them -- generate them

[Anonymous Coward]

Another approach beyond generating random passwords for each site and writing them all down would be to generate a separate password for each site based on a formula. The formula would take some information about the site (such as the domain name) plus a master password and generate a new password for that site.

If you use such a scheme, then you just need to choose a master password and a formula, and then that defines the password for every possible site you might create an account with. Thus, there's a lot less bookkeeping to do.

One important thing, though: in choosing the formula, it would be helpful if knowing the password for one site would not help you guess the password for another site. Luckily, this is easy to achieve by using one-way hashes. Let me give an example of a scheme that uses MD5 (although there are better one-way hashes out there).

Let's say your master password is aydjrcg and that you want to choose a password for the account name joeuser at the site gmail.com. What would your password be? Well, all you have to do to generate one is to find the md5 hash of some string like aydjrcg!joeuser!gmail.com. That md5 happens to be 226726945b66a89ed4b6b5a0f8da6ee9. That's a bit cumbersome to type, so maybe it'd be best to UUencode it or use some other scheme that maps it to common printable characters (other than just 0-9 and a-f), but the principle remains the same.

The handy thing about this scheme is that a standard scheme for doing this can be created (and thus it can be done in software), and thus an individual only needs to remember their master password. Since you only need one master password, you can choose a fairly complex and safe one.

One weakness of this idea is that you are sort of putting all your eggs in one basket. But then, if you write all your passwords on a piece of paper, you are doing that too, and you have the additional burden of carrying around that piece of paper and the additional risk that someone can steal it from you. (You are also relying on the one-way hash not having a flaw that can be exploited, but even if it does have a flaw, it's still not as bad as just using the same password for two different sites.)

The worst Slashdot password

[Simonetta]

The worst password that a Slashdot reader can use is the initials of all the girls that you have made love with since middle school.
Even a simple BASIC program running on an old Commodore could probably crack that one in a few minutes.
Now the initials of all the girls that wouldn't make love with you, no matter how much you begged...that would be a secure password.

Re:The worst Slashdot password

[kakos]

Most systems don't allow empty passwords.

What an insightful article!

[craXORjack]

I sure hope that Microsoft gets a patent on this new business process of password management because that will encourage them to continue innovating.

...Oh, sorry. I thought we were still doing the sarcasm thing.

why write down the *password*....

[3-State Bit]

instead of a mnemonic?

For example, if I had to write down a seven-character password, I would write down:

"
Note to self: Return microwave and vcr. Pay late-fee ($9.30)
"

and then put it on a stickie on my monitor.
Can you guess what the seven-character password is? [I used a suggestion from the javascript I linked above.]

Try Oubliette..

[Anonymous Coward]

I have one strong password. I don't know any of my passwords besides it, even though I have 30+... I just keep the open source program Oubliette on a usb keychain drive. http://www.tranglos.com/free/oubliette.html/ I also have a truecrypted backup. Using the same password everywhere and writing it down is just plain stupid.

brought to you by:

[lordsid]

The same people who want you to use Internut Exploder. confirming the text shown in an image is ghey, get rid of it.

Oh, you mean like keychain?

[Anonymous Coward]

Oh, write them down somewhere secure? You must mean, like, that Keychain app Apple's got, or any of the other tons of password organizers out there!

Thanks for coming out Microsoft, too bad you yet again missed the bus by several years.

Another advantage

[Anonymous Coward]

If anything was to happen to you, having your passwords written down would allow your surviors to access your accounts - which can be otherwise impossible. Consider the case of the Marine whose parents were unable to access his email after he died - http://www.infowars.com/articles/military/yahoo_re fuses_give_dead_marine_password.htm

Re:So Pen&Paper's the new replacement for Pass

[arminw]

Pen and paper doesn't crash and still works the same when the power goes off. If you write your password with good ink on acid free paper kept in a dry dark place, someone may find your password intact 3000 years from now. I don't know about the computer system though....

Steganography

[CustomDesigned]

When I write down passwords, I use some form of steganography. For example, one of my earlier systems was to add a fictictious address to my address book, with the password encoded within the address using a mnemonic mapping scheme.

I'll share a commonly used mnemonic mapping for numbers. It maps consonants to digits:

0 - 's', 'z' (think 'zero' and hissing like snakes)
1 - 't', 'd' (1 looks kind of like t)
2 - 'n' (n has two legs)
3 - 'm' (m has three legs)
4 - 'r' (four ends with r)
5 - 'l' (L is latin for fifty)
6 - 'j', 'g' (soft g, like upside down 6)
7 - 'k', 'g' (hard g, k and 7 have diagonals)
8 - 'f', 'ph' (cursive f like 8)
9 - 'p', 'b'

Hard c goes with k, soft c with s, etc. So say you wanted to remember your bike combination of (rolls random number with python...) 3254. You construct a phrase with any vowels and spacing desired with the consonants m,n,l,r. For instance, "mine lore" comes to my mind, and I envision Tolkein dwarves chatting up their favorite topic. If needed, you would then write a paragraph about dwarves and mine lore in Lord of the Rings in your notebook.

Don't treat it like cash

[exp(pi*sqrt(163))]

Use cash!

Just pick up any dollar bill. There's already a convenient unique password made up of alphabetic and numeric characters printed in the corner. For more important passwords use $5, $20, or even the good old Madison.

So if Jackson is on the $20 bill, what do 5 Jacksons make?

Re:Don't treat it like cash

[Amoeba]

So if Jackson is on the $20 bill, what do 5 Jacksons make?

The world's most dysfunctional family?

My e-livelihood proposal

[essreenim]

scary stuff like you see in movies like "The Net" with SAndra Bullock would actually happen.

You would have your credit card, e-mail, .etc all reachable with one password. You would be owned like you've never been pwnd before!!

My solution. Blend culture into your "e-life" Come up with a rhyme that you use to make passwords.

Like: bah bah black sheep have you any wool!!!

Now generate a SHA hash for your rhyme.

Carry the sha program wherever you go..flash drive, CD, floppy whatever you use. All your passwords would be hashes of the rhyme

Example:

your e-mail password: SHA("bah bah black sheep have you any wool-email"); Your credit card. SHA("bah bah black sheep have you any wool-ccard"); etc etc etc. You would never have to worry about forgetting your passwords. They would all be based on one rhyme.

But you better keep you sha program handy wherever you go.

Also, you cannot replace common sense. Dont use dodgy cafes. Patch your home computer as much as possible. Use Linux or OpenBSD or something for your sensitive data!! ; )

All you ever need is a good strong hash function (as long as it's still strong!) and a nice nursery rhyme!!!!

I give my passwords to strangers

[shift.red.avni]

I store most of my passwords on some off the wall free password manager website that looks like it was designed in 1997. I am confident that any two bit script kiddie could and probably already has compromised their server.

It serves as constant reminder that password based security is no security at all.

Biometric password scanners suck

[EvilStein]

Why?

They aren't capable of recognizing "chicken sandwich" or "barbeque sauce" as being part of the thumbprint.

Those new IBM ThinkPads are just begging to get lunch crusted in the fingerprint reader thingy. We got a few of them here, and within a week, food was becoming a problem.

Engineers are such pigs, I swear.

Re:Anyone with 5 digits in their UID has a solutio

[dbIII]

I knew this UID would come in handy one day

If I could remember my password for the old username I would have a lower UID! I should have written it down or changed it before the old email address vanished.

Each really important password should be in the heads of a few people or written down and locked in a safe - but since it's easy to get root on just about anything with boot media it usually doesn't matter a lot in those IT guy hit by a bus situations.

Almost, but not quite--here's what I do.

[istartedi]

I stego my passwords on a small card that I keep with me. Someone can get the card and they don't know what the password is for, and even if they did, they don't know what's the password and what's just a "junk character".

Re:Almost, but not quite--here's what I do.

[patio11]

And then if someone pickpockets you and you catch them, you can say "Hey, thief, leggo my stego!"

security through obscurity

[Anonymous Coward]

I write down the passwords on paper.

You try to find that paper in the mess that is my desk. I have trouble doing so on my own...

True obscurity.

Indeed. Who can remember 5+ passwords for work?

[skoda]

Shortly after getting a "real" job, post grad school, I got a PDA and bought a password-minder program for it.

I don't trust myself to remember the 6+ passwords for the 10+ systems I have to use, each with differing requirements.

It's not unusual for me to try and login to the travel-expense manager web app, that I use maybe once every six months, and just blank on my username and password combo. Thankfully, I can easily find it in my password minder program.

And then there's the 100+ passwords for misc. websites, both trivial and important...

How to generate and remember complex passwords

[Radi-0-head]

This Microsoft guy is an idiot... Senior Program Director for Security Policy? Please.

Creating and remembering complex passwords is trivial if you have a system. Here's one that works well for everyone I've introduced it to:

Think of a long word, or even a phrase, that you will easily remember. For example, let's use "iloveslashdot".

Now, take all of the vowels and replace them with punctuation or numeric characters that resemble the letters. So, "iloveslashdot" becomes "!l0v#sl@shd0t".

You can modify this "core" password for use at different sites/services. Let's say your bank is Bank of America... the password could then become "b0f@!l0v#sl@shd0t". Your ebay password, using this system, would be "#b@y!l0v#sl@shd0t".

The nice part about this system is that it can be modified for obscurity. Above, I used a 4-letter abbreviation for the various sites/services and attached it before the "core" password. You could add it to the middle or end of the password as well.

As long as you are consistent with your vowel/punctuation character replacements and the unique identifiers you use for your various sites/services, this system is almost impossible to forget. Even the biggest BOFH i've encountered uses this method and has no issue remembering 14+ character passwords that have extraordinary complexity.

Re:How to generate and remember complex passwords

[wk633]

So you basically have one password. If it's compromised in two versions, it's toast. That's fine for things like NY Times registration, but I wouldn't trust my Bank of America account to it.

I've given up trying to remember- I have no idea how many passwords I have. Some I use maybe once per yeaer. They're all in http://passwordsafe.sourceforge.net/

So I also have only one password, but I only use it in password safe. And I only use that on my machine (no keyboard loggers).

Re:How to generate and remember complex passwords

[praxis]

I would argue that they don't have extraordinary complexity. For one, the character frequency would mimic that of English (or other language one used to generated the "long word"). That means less entropy and therefore, weaker passwords.

My solution is to print out a grid of random characters, say five by five. Then assign passwords by remembering patterns. For example, start with position (2, 3) then go up one, then go down three, then right one, etc. Once you have the desired pattern, read off the characters and use that for your password. Once a month, reprint a new random assortment of characters and change your passwords to match. Once every six months or so, also change your patterns. For a slightly weaker, but more mnemonic system use a three (columns) by four (rows) grid of characters and map that to a telephone keypad and use telephone numbers as the pattern. Carry around the grid until you remember the passwords, then destroy the grid. It takes me about two days to do so.

Of course, to make this work, the patterns must be easy to remember, changed every n iterations. Each iteration should use a secure random number generator to generate the character grid.

Nonsense

[Roadkills-R-Us]

There are plenty of ways to do this. For instance, you can keep the passwords on (picked at random) page 57 of a red notebook that stays locked in your drawer when you're not around, and is only out of the drawer when it's in use. You can leave clues to yourself what they mean.

For instance:

mama: no dates

The actual password, not written down, is "n0datez!" The machine this is for is the largest system you work on (big mama).

If using random strings, try to make it look like serial numbers; again the place or account to use this for should be hinted at (to you), not stated.

There are many, many ways to do this and be very secure. I once left a set of passwords and hints out in plain sight on purpose, just to see if anyone would recognize and try to crack them. They were never cracked, and I'm reasonably certain nobody even tried. They had no idea what they were seeing.

A quote...

[Anonymous Coward]

A quote from, of all places, a Tom Clancy novel.

Put all your eggs in one basket, then WATCH THE BASKET

How to Choose A Good Password

[Anonymous Coward]

a) don't write the password on a peace of paper, instead just write what websites/stuff a particular password is used for so that you can change them all once in a while.

b) Create a Crazy Sentence and use the first letters and certain combos to make a good random password:

Ex: In the Future, cars will run on Solar Energy and Dog Food 9. = !n+h3FC3!11r0nS3&DF00d9

Afterwards, you can just repeat the sentence in your mind and you will subconsciously be able to choose the correct letters to type.

Re: Pen & Paper?

[Alwin Henseler]

Pen & paper? Too high-tech for me, I use a pencil, you insensitive clod!

Passwords-Easy to remember-Repetition is the key

[Anonymous Coward]

We all use lots of numbers every day,our own bank account numbers, Credit Card Numbers, Phone numbers, etc. We all remember all these numbers, because we use them over and over again. When you get a new credit card, for the first 10-15 online purchases you copy the number for the plastic; afterwards you just know the number, you get it out of your head. The more often you use these numbers, the faster you learn them, without any effort, repetition does the job for you. I think the age is irrelevant, this way happened when I was a kid, this is the way it happens today (I am 59). I know about 40 or 50 numbers I use frequently and they all have at least 7 or 8 digits some 12 digits. Why should passwords be different? Because they are not only numbers? I dont see any difference. The more often you use a password the easier to remember, it would take 10-15 logins to learn it, without doing anything special.

Re:Everything you ever wanted to know about passwo

[shift.red.avni]

#3) The best, very best log in tool for security I saw was a small clock a friend was given from his company. It had some funky algorithm on it, and it displayed a 14 alphanumeric code. When my friend logged in, he had to enter this code, which changed ever 1 minute. This was in addition to his username and password.


Most likely an RSA SecurID. They are all supposed to be unique, and are very expensive to replace. We use them for VPN passwords across the net between databases.

Re:Everything you ever wanted to know about passwo

[Draoi]

#6a) If you really must, must log in remotely (as root or anyone else, you must always use SSH - no exceptions! Always assume you're network is being sniffed. See (2) above.

Challenge-Response / Token Passwords

[DavidDPD]

Not a huge fan of RSA or their product SecurID (R), however, there are other brands and what not. With some many dang passwords, I'd be up for a Challenge-Response or Token Passwords a la SecurID ... and just build it into my cell phone. ... add bluetooth, and add RSA/DSA key exchanges (ssh-style, for various uses) ... and one has a really nice password tracker. (I hate paper.)

[ Don't flame me about Bluetooth viruses. ]

Re:So Pen&Paper's the new replacement for Pass

[Anonymous Coward]

Thanks for the link. It's funny how incomplete that page is, though.

They even have a large section on "What We Learned from Passport", but failed to mention the single biggest lession Passport had to offer - that people fundementally don't trust Microsoft with security issues.

Note that this isn't a criticism of Microsoft. Doing security right is a difficult and time consuming process that is really a niche segment of the overall computer market. Because of their volume will always need to remain focused on the mass-market where time-to-market is more important than security. Delaying operating systems to appeal to the security market will only weaken their competitiveness on the desktop that made them so successful. And if they try to do both, they'll have to strike compromises and suck at both.

This isn't a technology issue, it's a business issue; and in the end, Microsoft will continue to rule in the largest spot of the market.

Re:Everything you ever wanted to know about passwo

[afabbro]

#3) The best, very best log in tool for security I saw was a small clock a friend was given from his company. It had some funky algorithm on it, and it displayed a 14 alphanumeric code. When my friend logged in, he had to enter this code, which changed ever 1 minute. This was in addition to his username and password.

AKA SecureID. Nearest open source equivalent is S/Key.

Re:Everything you ever wanted to know about passwo

[Tim C]

With regards to #3, that sounds like something like RSA's SecurID key fob.

Cryptography

[General Wesc]

Why, of course I write down my passwords. All except one: my GPG password never gets written down, and it's used to encrypt my password list.

Does kind of make for a 'break one; break them all' system, but I'm quite careful with nmy GPG key .In fact, it's currently sitting on a broken hard disk, along with my password list. D'oh!

Another alternative would be to use a non-obvious system ties to the site. Slashdot password could be calculated by hashing the word 'Slashdot'. The only problem is that it must be hard for a person to take my Slashdot password and derive the system, and it's quite nice if I can calculate the passwords quickly and in my head.

Re:So Pen&Paper's the new replacement for Pass

[PakProtector]

I should expect that kind of talk coming from a young, low uid person like yourself. You kids don't know how good you have it these days. Fancy computer graphics and a machine to keep track of details for you, letting you have your 'action' in 'real time.' Back in my day, we had cardboard cutouts, if we were lucky! Most of us used hand made lead figures that we had to paint by hand! And it could take hours just to do one massive battle because we had to do everything ourselves! In the snow! In our parent's basements! Pssh. You young people these days. I don't want your opinion until your UID is in the lower 50% of the population. PSssh. Kids. Think they know everything. In my day, we were lucky if we knew nothing! You were lucky just to not be a negative container of knowledge, sucking it out of other people until everyone knew nothing. Pssh. Kids.

Re:I'll buy that piece of paper with some chocolat

[coolmadsi]

You could always get an iris scanner alternativly.

Extend it?

[owlstead]

It might be an idea to write down a difficult 8 character password, and keep it in your wallet. Then extend this difficult to crack password with a more easily remembered one. This prevents anyone from logging into your PC if they find your secure password, and it keeps network hackers from guessing your simple one. Of course, one could brute force your simple password using the network if they found out your secure one, but this is not such a likely scenario. And it's all about mitigating risks...

Re:Everything you ever wanted to know about passwo

[Shkuey]

"#5) Set up a policy that only allows 2 attempts to log in, and after 2 failed attempts, it locks out that IP and MAC address for 30 minutes. This will be a major pain when you try and log in and make a mistake. It won't really stop hackers, just the ones with slow/bad proxies. Maybe 1 of the 500 proxies the hacker is using is not as anonyomous as they believe. As for your own use, take a book with you when you believe you might have to log in remotley, just in case you make a mistake. You need something to blow those 20 minutes."

Makes it pretty simple if somebody wants to launch a DoS attack against you.

Never!

[the phantom]

This is just another Micro$oft scheme to get your passwords. First, they convince you to write down your passwords, then they send the Micro$oft Ninjas (MSN) or Micro$oft Death Ninjas (MSDN) to sneak into your house in the middle of the night and steal your passwords.

Re:Everything you ever wanted to know about passwo

[Anonymous Coward]

Wow, that's got to be one of the most random collections of stupid/excessive/ineffective advice that I've ever seen rated +5.

Just to pick one example, #7 (assume keyloggers, change your password when you get home): what if your home computer has a keylogger on it? Uh, oh, better go to Starbucks and change your password from their network. Wait a minute, somebody might packet-sniffing it. Oh, no, there's no way out, we're doomed!

Your paranoia is way overblown anyway. I've been an active network/web user for 20 years, and nobody's ever stolen one of my passwords or hijacked an account of mine. People have broken into my house and car and stolen stuff, though.

More hacked passwds or more likely stolen?

[ayeco]

Do you think that more passwords are hacked each year, or that more are discovered written on a piece of paper and then used? /didn't rtfa

It's not writing it down that's the problem

[darkonc]

The problem is people who do things like write down their password, and then tape it to the keyboard (and things like that).

A friend of mine has a good rule "Never store a written password within 8 feet of your computer". (why 8 feet, and not 10?? 10 sounds like a rounded-off number that quickly degenerates to 5, and then 2 8 sounds like it was chosen for a reason -- Just tell them that it was chosen for social engineering reasons).

Another thing that I'll do is not actually put the password itself onto paper == instead, I'll put something from which I can generate the password. For passwords that I use often enough to memorize I'll destroy the written version once I've got it memorized.

For short passwords (e.g. Solaris 8,9) I suggest that people use the mnemonic method

passwords

[Universal Indicator]

In addition to writing them down and putting them in your wallet/purse/whatever, I recommend creating long passwords that are easy to remember by putting 3 or 4 characters separated by something like a period --- for example 4dt35z2en is difficult to remember, but 4dt.35z.2en is not only a better, more secure password; it is also much easier to remember!

Writing down passwords

[lahuard]

You would have to have a password protected document, with an easy to guess password to guard the list.

Yeah thats great!

[essreenim]

What is it? A fingerprint scanner.

When he has a login anywhere, instead of Firefox typign it on pageload, he just pushes his finger onto the pad. Chances of someone faking his hand?

Right, so he uses it to login ANYWHERE. So he goes into a cafe and plugs it in (meanwhile people are looking at hime like he's a nutter - which he is!!) I am an assraping haxor with spyware + keystroke etc. recorder on his cafe machine. No matter what exotic approach he takes there still has to be a plaintext version of his password on the computer at some point so he can login (this is why audio DRM's music files dont work!! : )

Now Not only do I have the password, but if I got his email account name and bank details etc, I have the passwords for all of them too since he is using one master password.

Now I have all his money and buy many many fingerprint scanners of my own for my uber ass-rape facility in a secret mountain layer...

Re:fp

[Anonymous Coward]

Yeah, it is! See, I even logged on as him to prove it!

Yeah write down that password

[foonf]

And make sure you leave it on a post-it note stuck to your monitor, or in a desk drawer, your laptop bag, or somewhere else where absolutely no one would possibly think of looking for it.

Voluntarily giving passwords away (ie through phishing or other kinds of trojan horses), having them intercepted (by packet sniffers, keystroke loggers, etc.), or brute-force search are much bigger threats to password integrity than guessing. In none of those cases does a complicated password that would need to be written down fare any worse than a "stupid, easy to guess" password. Password guessing seems a comparably minor threat, and would only seem to apply to really dumb passwords (birth dates, '123456', etc.).

Just use a passphrase

[CypherXero]

Just use a passphrase! You can write out an entire phrase (with spaces and special characters) for Windows passwords. Infact, this post could be used for a passphrase!

Mindless reply

[Anonymous Coward]

The best passwords are illogical. Something like k8iWq3xy.

That made sense up until the xy (seriously).

The best, very best log in tool for security I saw was a small clock a friend was given from his company. It had some funky algorithm on it, and it displayed a 14 alphanumeric code. When my friend logged in, he had to enter this code, which changed ever 1 minute. This was in addition to his username and password.

I use something like that. It's called the UNIX epoch. (One-time passwords, they're called. With increasing mobile device usage, this will become more viable although no where near bullet proof. If the device is lost or is cloned, game over. Might also want to look at Netkey, with is a method of hiding passwords.)

Set up a policy that only allows 2 attempts to log in, and after 2 failed attempts, it locks out that IP and MAC address for 30 minutes.

Not that great of an idea if we are dealing with complicated passwords. Believe me, users will come knocking down the door after about a week.

What's wrong with....

[jd]

• Using S/Key or OPIE to create a secure password out of a normally weak one
  
• Using indirect connections, where you've strong passwords you can't remember on a proxy, which you log onto with a single password you CAN remember
  
• Using Kerberos to do single-sign-on
  
• Using a mnemonically-rememberable stong set of passwords, so you CAN remember a lot of them
  
• Putting a large pile of doughnuts next to a rival's computer, so the in-house computer cracker breaks into their system instead (99% of cracks are in-house, not from outsiders)
  

Re:Everything you ever wanted to know about passwo

[Anonymous Coward]

Time to switch to decaf, buddy.

To confirm you're not a script, please type the text shown in this image: rnqdfnj

A cool trick for passwords...

[LesPaul75]

A cool way to always have good passwords is to just choose a short phrase that you'll remember and run the text through MD5. So, if you're creating an account for your PC at work, you might use something like "Work PC password, May 2005" and then just run it throgh something like this.

This will give you a good mixed-case, alphanumeric password, and you can always retrieve it if you forget it, as long as you can remember the phrase that you used (which is much easier than remembering Qwy4%!Xx). The only other caveat is that you must have access to the web or to a machine with an MD5 generator.

And, being an uber-geek, you can even go one step further and eliminate that last requirement. You can make up your own algorithm for converting a phrase into pseudo-random characters. Keep it simple, and something that you can do with pencil and paper! You have to be able to remember the algorithm a month from now (when IT forces you to change your password) or else it's useless. But if you keep it simple, you'll have no trouble remembering how to do it. I've been using this system for a while now and it works like a charm.

Easy-to-remember and strong passwords

[koinu]

Diceware

APG

Yawn -- solved this years ago

[26199]

Get a password keyring and stop worring about it.

Actually I have the first version of the keyring, which didn't come with a dock and was a whole lot cheaper ($60 if I remember correctly). The new version sounds better for businesses but not a great improvement for individuals.

Still. These completely solve the problem of creating and remembering secure passwords. What more d'you want?

Re:Yawn -- solved this years ago

[Anonymous Coward]

What more d'you want?

A solution that didn't introduce a single point of failure for losing every password you need.

Re:Yawn -- solved this years ago

[26199]

You attach it to your keys.

Passwords are much easier to change than keys. Added to which, you will remember any password that you use frequently, strong password or not.

So, no, that isn't a problem.

Ultimate Security Problem

[kopper187]

To this readership I pose a problem. This one may fall into the category of mundane for some, however, for others, it may prove to be quite the conundrum.

The Problem:

Write down many, strong passwords,

or,

Use the same strong password everywhere.

Given: that a 'strong password' represents a password created using the most secure, or unbreakable, methods currently available; that 'write down' requires a physical object with the passwords inscribed on them in a way that is decipherable to the owner without possibility of memory loss causing an inability to decipher; and that 'everywhere' denotes the group of systems requiring user identity authentication by means of a stored password check setup, where 'systems' are generally electronic in nature.

This question may be the final, and most crucial, step to creating a maximally secured electronic system. There will always be a need for the user of the system to prove its identity, while there will also always be a potential for the user to forget what it has to do to authenticate.

This problem does not consider any alternative solutions, nor does it consider biometric methods(1), however its author most certainly does.

(1) Biometrics should be considered insecure in any system where the user is not in the same physical location of the system and should also, therefore, be considered inadequate as applied to all system a particular user might access.

If this problem appears mundane at first read give it some time and mull over it until you find yourself posing a question about your own belief on the matter

Re:Ultimate Security Problem

[wk633]

That's easy. You should never use the same password on multiple systems, because quite simply, you don't know where your password is going. You are giving a secret to the keeper of the system you want access to. That keeper might keep it safe, or that keeper might use it to log into your bank account.

The only time I use the same password on multiple systems is when I REALLY don't care if it gets compromised. That is, the kinds of passowrds I'd be happy to give to bugmenot.com for everyone and his dog to use.

ehh... i bought a candy bar with my password...

[TreeHead]

;uhm... what happens when someone *spends* the money?!

;treehead

Re:ehh... i bought a candy bar with my password...

[exp(pi*sqrt(163))]

Is that candy worth more than keeping your email private?

That's a paddlin'

[Heffe Llama]

Jesper:
Talkin' outta turn -- that's a paddlin'.
Lookin' out the window -- that a paddlin'.
Starin' at my sandals -- that's a paddlin'.
Writin' down your passwords -- oh you better believe that's a paddlin'.

I remember

[DennisInDallas]

I still remeber the system generated TSO password from 30-freaking years ago

It was three Kay seven six victor victor zulu romeo!

but, there was no toprow stuff in it.

A better technique is to remember a phrase that can be expressed in a brief series of charaters, something like "I am not a crook" for example might become iM!a(cr?)

But then the shifted key strokes can give you up to a shoulder surfers... if you're in a situation where that might be an issue.

In that case multiple double taps on the home row will help obfuscate the sequence.

I have over 40 different passwords

[Anonymous Coward]

Just last night (literally) I was looking at all the passwords I have written on my password list. I have over 40 different websites that I have visited that require a login name and password. I will NEVER remember 40 different passwords and login names. Some of those sites I visit about once a year (airline sites for travel). If you have only one or maybe two sites that require login passwords, good for you. The rest of us use more of the internet than just slashdot and our work site. Our only reasonable options are:
- one password and login name for everywhere (bad security).
- individual passwords and login names for each site, but written down (bad security).
- stop using the internet (not going to happen).

I choose to keep using the internet and store my passwords and login names (over 40 currently, over 50 including past sites I don't visit anymore) written on a piece of paper that I have to pull out (no, it's not taped to my computer) when I visit the sites that require it.

And I am posting as anonymous coward because I have no account here and I do not want to add anymore damn logins and passwords when it's not neccessary.

Re:Everything you ever wanted to know about passwo

[ignavus]

"Lets bomb another country to releave our collective mutual stress."

Bomb your own country and cut down the transport costs. Bombs are heavy!

And blowing yourself up means never being stressed again.

this guy is thier chief advisor?

[timmarhy]

he's an idiot. the answer isn't to let users do what they want with thier passwords. if you ALLOW people to pick their passwords, they will pick shit ones everytime. he's solution does nothing at all. the answer, is to FORCE them to use a good password, and to change it reqularly. allowing them to put it on a sticky note on their monitor is a shitty shitty idea. MS is never gain street cred in the security world taking advise from morons like this guy.

Re:this guy is thier chief advisor?

[wk633]

It's impossible to FORCE good passwords.

1) P4$$w0rd is a really bad password.
2) The same password for your bank and for warezRus.com is a bad idea.

Forcing people to change their passwords all the time encourages bad passwords and passwords on stickys.

Regular password changes are:
a) because you think someone is brue forcing them (so fix that problem, changing the password part way through the brute force sequence doesn't buy you anything.
b) because you think it has been compromised (if it has, it's too late).

Why not have passphrases instead?

[DrugCheese]

I think most passwords should be opened up to having any length combination of any key on your keyboard. So you password could be your favorite line from a movie, or something. Why limit it to so many characters of just alphanumeric ?

Equally important, but otherwise valueless paper

[Nick Driver]

I write mine down on the back of my auto insurance "id card" (actually a piece of paper, not an actual card, and when folded in half is roughly the size of a business card). Since proof of insurance is required for vehicle registration renewals, plus you always need it on you whenever you might get pulled over by the cops, it's an important piece of paper to always hang onto, but has zero monetary value in and of itself. It also expires every 6 months and I get a new one from my insurance company. Every 6 months also seems at minimum a good time to be changing passwords too, and I then write them down onto the new insurance card.

Re:Everything you ever wanted to know about passwo

[Anonymous Coward]

I like option #8; let our Air Force handle it!

In other news:

[u2pa]

Microsoft garbagemen recive big bonuses

Simple Formula for Strong Passwords (SFSP) Tutoria

[packetdump]

There was an interesting paper I came across recently at the SANS readinng room. Although the techniques it talks about are not revolutionary, it does present them in an easy to read manner, which may be used as a basis to train end-users.

http://www.sans.org/rr/whitepapers/authentication/ 1636.php

I dont like the suggested way to deal with required password changes (add a number to the end) because it goes against best practice. I did however question why adding numbers to the end of passwords during a force change is not recommended and all I came up with is:-
- if you know users have strong passwords, the reason why you still force them to change passwords reguarly is to mitigate the risk that someone else other then the user has gained access to that password. So by simply adding numbers to the end of passwords voids the mitigation of the required password change.

Re:I'll buy that piece of paper with some chocolat

[thegamerformelyknown]

If you have a few hundred extra, sure.

Passphrase

[Stackis]

I've found it easier and more secure to remember a passphrase as oppose to a password.

...Or build it into the OS

[mnot]

e.g., Apple's Keychain. Of course, Microsoft has taken steps towards this, but no one trusts them.

Not likely.

[Evanisincontrol]

Maybe it's just me, but it seems that the liklihood of someone cracking that method is very unlikely.

As you said, physical access is required. (which makes things MUCH more difficult) However, even if physical access WASN'T required, I don't think some hacker would suddenly say to himself, "AH HA! I bet this user is combining the serial number of his roller-chair and product number of his processor to create his password! Let me just try these numbers..."

There is a VERY large combination of passwords available from product/serial/model numbers on various items that reside in a typical office. Even if a hacker somehow broke into Joe Blow's apartment and spent twenty minutes writing down all of Joe's stapler model numbers, he likely wouldn't get them all, and definitely wouldn't need to run a program (remotely) to try all the possible combinations. (Especially given that the password might consist of half a dozen different product numbers!)

All in all, the odds of someone breaking this password aren't likely. If someone was determined enough to go through all afore-mentioned garbage at all, whatever he's getting at must be pretty valuable... and would probably be better protected than just by an arbitrary password.

Re:Everything you ever wanted to know about passwo

[Anonymous Coward]

I like the discussion you're starting, but if you're going to create a numbered list for something as hard and important as security, you should probably put more effort into it. (I'm unqualified to make a list, but I would like to respond to yours.)

#1) The hackers have huge dictionaries that can crack just about any word, in any language, and with any added numbers, like compaq002 or 01compaq01. Second, they have custom dictionaries that can take 2 or 3 words and put them together in logical ways (like people think). These are all easily cracked. Picking a password by splitting the words of items on your desk and adding them back together is not smart. Comp05HP is not a good password.

Huh? Dictionary attacks might succeed on more passwords than you would imagine, but ANY added numbers? I don't think you understand how large of a domain you're describing.

#2) The best passwords are illogical. Something like k8iWq3xy. Mixing in letters in and numbers, not based on any words, is a good start. If your program recognizes upper and lower case, mixing that can help too.

Not illogical so much as random (or at least very high-entropy). If you rely on a pattern for generating passwords, so can someone trying to guess them.

#3) The best, very best log in tool for security I saw was a small clock a friend was given from his company. It had some funky algorithm on it, and it displayed a 14 alphanumeric code. When my friend logged in, he had to enter this code, which changed ever 1 minute. This was in addition to his username and password.

You're talking about SecurID.

#4) People will sniff your network. Nothing is bulletproof. Finding passwords sent is easy. If it comes as clear text, you are screwed off the bat. This defeats #1 and #2, but not #3, because #3 is based on an algorithm that changes every 1 minute.

No, some algorithms are provably "bulletproof," or crypto wouldn't work at all. However, complex and/or large systems often contain oversights, so redundant security mechanisms are a good call.

#5) Set up a policy that only allows 2 attempts to log in, and after 2 failed attempts, it locks out that IP and MAC address for 30 minutes. This will be a major pain when you try and log in and make a mistake. It won't really stop hackers, just the ones with slow/bad proxies. Maybe 1 of the 500 proxies the hacker is using is not as anonyomous as they believe. As for your own use, take a book with you when you believe you might have to log in remotley, just in case you make a mistake. You need something to blow those 20 minutes.

No. This allows a malicious third party to prevent you from logging in without knowing your password.

#6) Never, ever log in root from a remote location. Have a crippled account to log into from remote locations. Expect this account to get cracked. Limit the damage. If you must, have 2 computer systems at home. One secured off line, and the other on line. Hell, toss in a third computer connected to the web based on via a serial cable and dump all the logging on that computer. The hacker/cracker can't edit the logging files on that second PC.

Or, use SSH

Re:So Pen&Paper's the new replacement for Pass

[bergeron76]

Great, so on the new Tablet PC's you can simply "write" your password in the PW box.

Heh.

Re:Everything you ever wanted to know about passwo

[praxis]

"#4) People will sniff your network. Nothing is bulletproof. Finding passwords sent is easy. If it comes as clear text, you are screwed off the bat. This defeats #1 and #2, but not #3, because #3 is based on an algorithm that changes every 1 minute."

Actually, this only defeats #3 for the remaining part of that minute. With code sniffing the network, its trivial to reply that login information in under the time remaining. A better solution would be to use a algorithmic addition to the password *and* encrypt your login information, just be sure to use encryption that takes longer than sixty seconds to break on a fast machine. (Think, publicly reviewed encryption algorithm with a large enough key).

Re:So Pen&Paper's the new replacement for Pass

[Anonymous Coward]

Evil Overlord list of things to do:

5) The artifact which is the source of my power will not be kept on the Mountain of Despair beyond the River of Fire guarded by the Dragons of Eternity. It will be in my safe-deposit box. The same applies to the object which is my one weakness.

- http://www.eviloverlord.com/lists/overlord.html

Good Christ

[TheUz]

WTF is wrong with you people.
Line noise. At least eight characters of it.

#wG/+"s2

Memorize the damn thing. Seven repetitions moves data from short term to long term memory. If you have some sort of cognitive disability, then by all means, write them down. The majority of you, I suspect, simply need to step away from teh b0ng.

Re:Good Christ

[Anonymous Coward]

WTF is wrong with us?

At work I have about 15 passwords which get changed on different schedules. At home, I have another four or five, not including my ISP logins (two more). There are quite a few more that I'm missing, but in the end, I have about 30 passwords that I'm responsible for keeping, all with different schedules. I have better things to do with my time than generate line-noise passwords, and memorise them.

There _are_ ways of getting pseudo-noise passwords that are easy to memorise, but that's another story.

Re: Pen & Paper?

[Anonymous Coward]

WHat are you, in the Russian Space program?

Wierd!!! Planetary security password?

[Anonymous Coward]

Phoa, dayam, how did u get that password?

Thats the planetary password for a air sheild i know!!!

http://www.google.com.au/search?q=spaceballs+the+m ovie

For U.S. readers

[Anonymous Coward]

In the U.S., you can invoke the 5th amendment to refuse to answer questions about a password, but you can not refuse to hand over written material. So if your password is protecting something you'd rather keep out of sight from the feds, you would be well advised not to write it down.

PAPER?!

[HailSatan]

I can barely keep track of my passwords as it is, forget trying to keep track of a piece of paper. Sheesh, what is this, the late 20th century?

The PROGRAM MANAGER FOR MICROSOFT SECURITY!??

[wealthychef]

Holy shit! He said what? I guess that explains a lot. Sure, write your password down and put it underneath your keyboard. How about using an easy to remember phrase like "I like sex" but replace some of the letters with crazy symbols like $ for s and 3 for e, etc. That makes a very strong password, actually. It's the one I use, in fact. Can you guess my password now? I don't think so.

Re:Everything you ever wanted to know about passwo

[Anonymous Coward]

#7) When using a computer, always assume the key strokes are being logged. When you get home, change your password for that account.

This is not practical when travelling for extended periods without a notebook PC.

When I was last travelling, I would occasionally need to log into my Internet banking facility to transfer funds to my Visa card account (it's widely accepted by ATMs). Since I never really knew if the local Internet cafe PCs had keyloggers installed, I'd open up Notepad as well as the site, and intersperse the keystrokes going into the username and password fields with random keystrokes into the Notepad window. I'd also randomly move the windows around, so that even if the keylogger logged mouse actions, it would not be easy to follow.

It was a PITA, but since I was visiting some countries where the balance of my account at the time would be enough to buy an apartment, I didn't want to risk it.

Password related sync software

[Anonymous Coward]

www.psynch.com

www.mtechit.com

OFF TOPIC: script

[SirTalon42]

They added that because for the past few days Slashdot was crap flooded with spam from previous articles.

From what I can figure out its only required for people that don't have good karma, and users not logged in.

Re:OFF TOPIC: script

[Ninwa]

Ah thank you, my Karma is at "Good" and I still have to enter it however.

Re:OFF TOPIC: script

[Ninwa]

also, could you reference me to this "crap", because I regular slashdot and I really hadn't noticed anything out of place... disclaimer: that was not a joke :]

Re:OFF TOPIC: script

[Bobsledboy]

I took this for a previous post
http://img276.echo.cx/img276/2319/script6cp.jpg

Mod parent down

[bsdrawkcab]

+5 Informative? I'm all for discussion of security, and I generally abhor the substitution of harsh moderation for dissenting replies, but the parent post purports to be "everything you ever wanted to know about passwords."

Security is as hard as it is important to get right, and respectfully, John, you're not qualified to compile such a list. (Nor am I, admittedly.) You can't identify something as prevalent as SecurID, you're misstating security fundamentals, and you're conflating related concepts.

Passwords are relevant only for authentication, and better schemes involve additional proofs of identity (e.g. SecurID tokens). A good security policy correctly uses crypto primitives to create layered defenses that supply mutual authentication, secure communication, and data integrity. A good password is generated randomly from a large domain, is stored securely, and is not reused for multiple purposes.

Re:Mod parent down

[kmortelite]

Agreed. Mod parent down. Security is a big issue, but the 9th tin foil hat makes about as much difference as the 8th.

Liar.

[apparently]

So my Slashdot password can be easily remembered as IBM!1531@E94# Tried that, and got: "Danger, Will Robinson! You didn't log in! You apparently put in the wrong password, or the wrong nickname. Either try again, or have your password mailed to you if you forgot your password." Please advise.

Use a simple system

[gsyswerda]

I use a simple system to generate and remember passwords. I'm posting it here so others can use it. If it has problems, please let me know!

First, memorize a long sentence or paragraph. It should not be a well known sentence.

Next, form passwords by choosing two consecutive words and placing a number between them. The number between each word can correspond to which sequential pair they are in the sentence. For example, if your sentence began with "Four score and seven years ago" the first password would be four1score and the second score2and.

You don't want to use the same password everywhere, so next choose a simple numbering scheme for the types of accounts you are protecting. Let's say you choose 00 for accounts you don't care much about (so you use it often for things like NYT registration), and other numbers for other types of accounts. Embed the number somewhere in your password, perhaps at the end. Just be consistent in where you place them. If placing at the end, the example passwords now become four1score00 and score2and00.

You now have a system that can generate a large number of strong passwords, and all you have to do is remember the sentence you started with, and the account number system.

To get started, choose the first two words in your sentence, and password protect everything according to account type. Everyone once in a while (e.g. once a year), move to the next pair of words and incrementally update passwords as you encounter old ones.

The real utility of this system comes into play when you forget a password, since there are only a small number of combinations to try. Simply determine which account types might have been used, and then try previous word combinations. I've gone back and logged into accounts that I haven't accessed in years, where the password was long forgotten.

Wouldn't Java be more portable?

[Urusai]

Usually you can just run 'java myprog.jar' or double-click it to run (if Java is available). Perhaps he was concerned about the unverifiable security of the Java VM? Also, I know Bruce did Blowfish, but wouldn't AES/Rijndael or even his own Twofish be a better choice?

STEGNAOGRAPHY is the answer

[goombah99]

I frequently use steganography to write down my passwords and pins. I take and old, legitimate document or drawing and write my password into it in a way that it does not stick out like a sore thumb. I'm also not stupid enough to make the password a single word in the document. (otherwsie someone could do a dictionary attack using the keywords from a desktop search database. Instead I'll break it up into several peices and put them in places that make sesne to me but no one else. That is to say, since I wrote the document it's easy for me to see what does not belong. For example, pehaps the zipcode is wrong for my address. Further by using phonem type passwords it's very easy to incorporate these into other words. I highly reccomend this. It beats the tape dispensor method. you can cary the document with you on a USB key. and if you are paranoid you can even encrypt the document with a master password or use a biometric USB key.

Re:STEGNAOGRAPHY is the answer

[mrchaotica]

I've got a system better than a biometric USB key: I use an app called "Keyring" on my Palm, and store my passwords in that.

Re:STEGNAOGRAPHY is the answer

[Anonymous Coward]

the trouble is keyrings have in the past proven to have
1) holes in their security
2) be a single point of attack with a known encoding algorithm
3) in typical implementation often the keyring password is your main computer's login password which is used so frequently it's vulnerable and probably not very secure to begin with.

hinding the information makes it harder to guess the method used to encrypt it.

Re:STEGNAOGRAPHY is the answer

[PReDiToR]

I have a watch very much like the ThinkGeek one (have they stopped selling it?), and on it I have a copy of KeePass that will generate, store and encrypt your password list. This solution is great when you're working on a machine you know to be clean, but I wouldn't plug it into a cafe/library system.

Re:STEGNAOGRAPHY is the answer

[Owza]

OK what message have you encrypted into your reply(or do you just spell badly!), hope it wasn't your passwords...

Re:STEGNAOGRAPHY is the answer

[fbjon]

I store all important passwords on my Zaurus PDA, encrypted with a long passphrase constructed with diceware. It's there so I don't have to worry about memorizing multiple long passwords, kind of like a backup. As long as I can remember one, I can get all the others. The memory advantage is that one 40-char 8-word phrase is a lot easier to remember than 4 different 10-char passwords with all kinds of weird characters and capitalisations. This gives me freedom to choose really good passwords for everything else, since they don't necessarily have to be easy to remember as well.

Of course, passwords I use often are another matter, but by using them often one remembers them. And again, forgetting is merely an inconvenience.

Paperless office?

[Stankatz]

So how do you write down your password in those paperless offices that Microsoft is always talking about? Carve it into the desk with a letter opener?

You forgot one

[c0d3h4x0r]

Authentication methods can all be broken down into the following categories:
1) Something you know (such as a password).
2) Something you have (such as a keycard).
3) Something you are (such as a fingerprint).

You're forgetting: (4) Something you do. Everyone does things in subtly unique ways. If we could build a security mechanism that picked up on that, it would be the most effective, since you don't have to remember or carry around anything.

For instance, I bet everyone types differently. I bet if you profiled a person's typing and built up a record of the average timing that particular individual took between typing any two particular letters, you could have a program to figure out whether it was really the individual typing or not, regardless of what it was they typed. The login prompt could then just ask you to retype something shown on the screen so it can profile your typing characteristics.

Sure, at the moment this requires a bit too much guesswork or intelligence, but something like that would certainly be the most user-friendly and non-annoying implementation of security.

Re:You forgot one

[Anonymous Coward]

Then keyloggers would simply build their own profiles of your typing habits.

Your /. account didn't work!

[antdude]

[grin]

Danger, Will Robinson! You didn't log in! You apparently put in the wrong password, or the wrong nickname. Either try again, or have your password mailed to you if you forgot your password.

Re:Everything you ever wanted to know about passwo

[jschottm]

Picking a password by splitting the words of items on your desk and adding them back together is not smart. Comp05HP is not a good password.

But B&m:7599-BtBr} would be, and was just generated from an item on my desk. Easily rememberable to me.

Something like k8iWq3xy.

All alphanumeric eight character password? A bruteforce check would crack that on average in ~4.9e+55 attempts. That's a very small number to today's computers. A high end home computer will chew through that in a very short period of time.

Set up a policy that only allows 2 attempts to log in, and after 2 failed attempts, it locks out that IP and MAC address for 30 minutes.

So all I have do to DOS your system is do two failed logins remotely so that your switch's MAC gets locked out?

And get ready for all of your passwords to get harvested as your insane policy causes everyone to write their password down on post-its.

Never, ever log in root from a remote location.

Never, ever allow remote root logins. Period. SSH is easily configured for this.

Expect this account to get cracked.

Log in wisely and you shouldn't get cracked unless there's a really good reason you're being targeted. [hint: you aren't]

Just a word

[Anonymous Coward]

If I ever have a word with M. Johansson it will be "SSH"

Re:I'll buy that piece of paper with some chocolat

[value_added]

Isn't a full blown GUI program a bit overkill?

Seems to me that a list of OverlongSuperComplexHardToRemember passwords can easily be stored and read from a simple text file that's been encrypted. Using something like ccrypt (available for Windows with Cygwin) and typing

$ ccrypt -c path/to/secret_password_file | grep slashdotlogin

and entering the requisite password when prompted allows you to read the information from your screen.

A bit simpler, no?

Don't misunderestimate people ;-)

[Venner]

Why put the list in cyberspace at all? That's the beauty of paper, nobody online can steal a sheet of paper sitting in your home/office/dorm/loft/cave.

Not necessarily :) I used to know someone who had a webcam in their office. It was one of those geeky "things to do" at the time. He had controls to pan & zoom, control the a small light, etc, on his website.

One day, I zoomed in on a piece of paper on the corner of his desk. Some rotation & sharpening in photoshop* revealed an IP and the word "gizzards8524". I telnetted** to the IP, tried his usual nickname and that word as the password and bingo - I was in.

He was quite startled when a he got a console chat invitation from...himself. :)

*as opposed to hollywood's ideas of image restoration that boggle the mind and break the laws of physics.

**ssh wasn't popular yet.

Chinese whisper passwords

[sturat]

A colleague of mine went away on a long vacation and told me her password, which she always kept as "pookie" (the Garfield teddy bear) with two digits appended, so I could log in as her if necessary.

A few weeks later I went to log in to her account and couldn't - password had expired or something - so I called the admin folks and asked them to reset the password. "What do you want it reset to?". Thinking... "ummm, now what was it...oh yeah, wookie. It's April, right, so make it wookie04". Done.

The following week, I'm on leave, my colleague returns and I get the following text message:

her: "cant log in. password?"
me: "w.....04"
her: "???"
me: "wookie04!"
her: "WTF?"

What I tell my users

[Tsiangkun]

Here's the solution I came up with for my users.

Take some card out of your wallet. it could be a health care ID, a drivers license, business card, etc.

pick a column or diagonal through the text.

Voilla, a password you can carry with you.

Suprisingly effective at generating hard to guess passwords.

It's not that hard...

[eno2001]

...to come up with good and memorable passwords. Especially if you love music or movies. Just pick your favorites and take a phrase or quote from them. Wayyyyy back in the past at another job (servers have probably been nuked by now), I had a really good one from the Blade Runner: The line was "Good Evening JF"! as said by his replicant toys. So my password became, 'goodeveningj.f.' Long, easy to remember and complex enough to never be guessed. Simple.

Problem also is with some companies

[houghi]

At one company I had to have 6 passwords that needed changeing at different times. Some as soon as after 1 week. Others after 1 month and others after 30 days.

So the only way to remember the paswordsets du jour was by writing it down.

I have tried to explain to the IT people that what they did made the system LESS secure, but they kept by the story that many passwords changed often was the best way to work. The best excuse they had that 6 was not so bad. They had to write down 30.

At an other company where I had just one password, I just phoned in every month to say I forgot my new password. They did a reset and I could change it back to the old one. I used the same password for several years without ever having to write it down. The difference with the first and the last company was that with the last I used a secure password and with the first I used easy passwords.

Re:So Pen&Paper's the new replacement for Pass

[pdbaby]

That'd be a pretty cool idea... imagine if tablet PCs allowed you to do a little doodle as your password. If you get it structurally close to the stored version then you're allowed access...

Re:Everything you ever wanted to know about passwo

[Anonymous Coward]

Today's lockout policies of (x bad attempts before account locked out for y minutes) are even easier to DoS, since you can lockout an account from anywhere, just by feeding it bad passwords.

At least with IP/MAC lockout, only the originating system is locked out. Yes IP/MAC are spoofable, but

a) this raises the bar. Now the attacker must know both your account name and your IP/MAC
b) in many cases, such spoofing can be reduced or eliminated with proper ingress/egress rules at switches and routers, and additionally by IDS.

feeble attempt at MS bashing humor

[kurzweilfreak]

Despite all the preliminary fake screenshots and whatnot, Longhorn is really just a fancy code name for Microsoft's new progam punchcard organizer.

The *IAA's rejoice at these steps backwards, one industry speaker commenting "Ha! Let's see them pirate now!"

"Where do you want to hobble to today, old timer?" was revealed as Microsoft's new slogan.

Re:So Pen&Paper's the new replacement for Pass

[punkass]

No, he's right. AD&D has, and still, sucks.

Write them down

[Anonymous Coward]

It's okay; write them down. Just surround them with a page full of fake passwords. It would take somebody all day to enter all of them.

My passwords are tattooed on the inside of my eyelids.

Shameless plug

[bennymack]

http://www.forgetyourpassword.com/
A great alternative to writing down passwords!

Re:Everything you ever wanted to know about passwo

[Anonymous Coward]

I love my institution. when I remote login, the message now shows:

From 1 July 2005 only encrypted connections will be allowed. This means that you must use ssh instead of telnet, and sftp instead of ftp.

Hurrah for security. Talk about living on the bleedin' edge! :-) But I'm worried - do you think they're making a hasty decision to implement this 'security' thing? ;-)

(posted anonymously - don't want to compromise the stupid bastards too much!)

Another crazy credit user

[astormy]

I have a friend that has her PIN's on the credit card.

She will never forget them...

Passwords are not the answer

[Rick Genter]

As many people on this forum have already pointed out, people and strong passwords generally don't mix. The real solution is biometrics. A retinal scan or fingerprint is much more difficult to "steal" than a password. Yes, it can be done, but not easily; certainly not by 99.99% of those who can and do steal passwords.

Re:Passwords are not the answer

[Creepy Crawler]

A spoon.

A spoon beats retinal scans.. COUGH

Well

[achurch]

In 15 years of Net use, I have had my machine broken into once. But then, logging into my machine over a telnet connection on a university network and then su'ing to root may not have been among my more brilliant ideas . . .

Re:Well

[RovingSlug]

Dude! I did exactly the same thing and exactly the same thing happened. I did it like 6 years ago, and I think I telnetted in to start the ssh daemon :).

Re:Everything you ever wanted to know about passwo

[Morrog]

I don't think this was stressed enough in the comments. Passwords are useless beyond home security. If you need real security you need to go beyond passwords. But for 90% of people, passwords that are familiar but non-dictionary based, possibly written down in a safe place, will do just fine. No need to worry about any of the parent's comments except when you use a public computer (never use a public computer to enter ANY passwords, period). And don't make any enemies...

Re:I'll buy that piece of paper with some chocolat

[Anonymous Coward]

"A bit simpler, no?"

No.

I wouldn't want to drag Cygwin around with me everywhere just to open an encrypted password file.

And you can forget about teaching the average Windows user about grep.

p4ssw0rd pr0t3ct10n m4d3 s1mpl3

[Mal-2]

Step 1: pick a catch PHRASE, not word, with some meaning to it.
"Worst. American Idol. Ever." for example (with a meaning of "She Bangs").

Step 2: Convert the meaning to symbols in some cutesy way, such as "She!sShe!s". You can work l33t-5p34k into it somehow (just be consistent so you can remember it). This is your password, but you only write down the catch phrase.

Lather. Rinse. Repeat as necessary.

Mal-2

Nice solution, but it's Mac-only

[93 Escort Wagon]

If you have a Mac with OS X, you can store your passwords in the built-in secure keychain. It basically means that you really only need to remember one password - the one to your keychain - in order to have access to all of the other passwords.

By default with the default install your keychain password is the same as your account's login password; but that's easily remedied if you're concerned about it.

The keychain is also a great place to keep secure notes where you put, for example, your kid's Social Security number, installation keys for programs like MS Office or Adobe Photoshop, or other information that you won't remember but don't want just sitting there in your documents folder in a plain-text file.

Re:I'll buy that piece of paper with some chocolat

[nacturation]

But that will display your password in plaintext. Password Safe program allows you to enter your master password, choose the appropriate login, it shows you your username and you double-click on the entry to have it copied to the clipboard. Paste into your browser's (or other app's) password field, and nobody (not even you!) can see what it is by looking at the screen.

There are some logins even I don't remember the password to, such as my eBay and PayPal accounts. All I need to remember is the one master password and then make sure I don't lose the password file! :)

First lines from books

[Centurix]

I tend to use the first letter from each word of the opening line out of a book. Non-dictionary strings, plus I pick books that are relevant to where I work.

Like Mein Kampf...

Similar True story

[cipher uk]

I'm a SysAdmin and at one place I worked, I noticed someone had written 'bbbbb' on their monitor. They wern't at their desk at the time, so I sat down, hit ctrl-alt-del and typed 'bbbbb' into the password field AND IT DIDN'T WORK. interesting eh.

Pass phrases instead of passwords.

[Reeses]

This is why I've always been a proponent of pass phrases instead of pass words.

1) It's a lot easier to remember the phrase "My dog is jake" than it is to make a password that's "j4k3d0g!"

2) The number of permutations for passwords is MUCH higher, and will take much more work with a brute force generator. I mean, how long will it take to crack a string of 255 characters? Or longer? (I'm sure someone here will do the math). Plus, with passwords of indeterminate length, it'll be even harder. It's the million monkeys theory. Has there even been a few thousand monkeys yet that have managed to write one sentence of a great work of literature?

3) Then, you can have your passwords stored in an anonymous looking book in case it gets forgotten. Like, say, the opening line to your favorite comic. Who's going to look there? Or, a phrase like "I miss my high school sweetheart". That's a lot easier to remember than some random hashed word.

You get the point.

[rice_burners_suck]

Microsoft today announced an unbreakable method for IT security. The system, dubbed Password Protector Server 2003, stores all usernames and passwords in a plaintext file, world-readable and served to the Internet. Additionally, the system is connected to electronic billboards located around the world in high traffic areas, where system IP addresses, usernames, and passwords are displayed for the world to see.

"Since everybody will know the password, it will become unnecessary to guess the password," said a Microsoft spokeswoman. "This will be the cause of unbreakable security."

.
.
.
.

Oh well, you get the point.

Wachovia scandal...

[Anonymous Coward]

Sorry to have to post this anonymously...

I just read today that Wachovia has lost control of some of their customers accounts - much of it attributable to their criminal employees.

No shit, really? Gee, I thought that'd NEVER happen. Actually, I'm surprised it took this long. I saw this coming 10 years ago. Simply stroll through their offices and you'll be sure to find more than a few passwords stickied to the monitor, under the keyboard, etc.

I was a consultant who worked there (during the Corestate/Meridian years) and after that shocking experience, I decided to do my banking (and my consulting) elsewhere. While today's news is no surprise to me, it certainly confirmed what I'd felt all along - the greatest security risks are from within.

With all the buyouts of banks that go on, chaos reigns and security is a total joke. The CEO's get their golden parachutes and those execs that remain battle it out. Meanwhile, IT issues that existed at each bank before only get worse and new issues appear when a merger is completed. Want to be a successful criminal? Get into IT, work as a temp at a place like Wachovia, and look for post-it notes...

Re:Wachovia scandal...

[Anonymous Coward]

Yeah, like any other fucking bank's security is going to be any fucking better.

Re:Everything you ever wanted to know about passwo

[trime]

Why would you ever need to log in remotely as root?!

Re:I'll buy that piece of paper with some chocolat

[Anonymous Coward]

Beware middle clicking to paste passwords in browsers, since middle clicking outside of the password box in Mozilla/Firefox/Netscape will spam DNS servers everywhere with your secret pass phrase. I've changed passwords a couple times because of this... feature.

NO

[btnheazy03]

Installing Windows is bad for security

Magazines

[Anonymous Coward]

I often have several magazines open to different articles on my desk. My password will derive from some article title, usually something with 3 four letter words (to get to 12 chars). I then insert a special char between words instead of spaces, and append the page number. I can circle the article title without raising suspicion, and unless you know the trick plus the special character...easy for me difficult otherwise.

Been Using The Same Four or Five Passwords

[Master of Transhuman]

for three years. No problem yet. If anybody can get close enough to me to guess them, I'm screwed anyway. I've got my bank password written down sitting on my old Compaq machine as I write this. Break into my room to find it if you think $62 is worth the effort! Why did I write it down? Because the asshole bank sent me a message saying somebody from overseas had been probing the account (probably a phisher's email anyway), so on the off chance I went to the account and changed it to something else I've used, but might not remember I did so. Sure enough, I didn't until I remembered to look at the paper!

This stuff is WAY overblown (except for really secure places like banks).

The real issue is: do you have anything worth protecting? 99% of HOME users don't (unless it's their SSN or a bank account number with PIN, which is obtainable a hundred other ways.) Corporate users should be under a sophisticated single-sign-on/token/biometric/blah-blah system anyway.

So whether people write them down or not is totally irrelevant to real security issues.

Paper...the ultimate security medium?

[cryptocom]

Think about it. Paper cannot be "hacked" like wireless devices. It can easily be hidden, and if necessary, the data can be encrypted. It can easily be destroyed beyond recovery. It can be cleared and written over many times, is easily indexed, can be read without the help of any device, and is allowed on airplanes. Name another medium that provides all that.

Re:Everything you ever wanted to know about passwo

[David_W]

Actually, this only defeats #3 for the remaining part of that minute. With code sniffing the network, its trivial to reply that login information in under the time remaining.

Nope. Once you use a SecurID code it is burned. If you want to log in to another SecurID protected service, you have to wait for the code on your fob to change. (Trust me, I ran into it enough at the last job I had that used one.)

I had a meltdown a few months back.

[Unknown Poltroon]

I log into 20+ different networks and computers in a given week. i can use the same password scheme on about half, but the rest all use mutually excluseve password schemes, ie, some only allow 4 digits, some require 6 letters or digits, but exclude characters, some need caps, others disallow caps, some need at least 8 letters and a special characetr, anyway you get the idea.

The problem is, most also require a new password every 3 months, and some i dont log into that often, others keep the same one forever, some password schemes change.

Im a bright guy. I get security. I had a strong password scheme that was working, then in the course of a week, my brain jsut broke down. I could NOT keep tract of any, or remember the old ones. I still havent worked it all out. I dont know what went wrong, it was jsut like some kind of cascading failure of my brain. I think i finally hit some kind of wall in my memory. Anyone else had this happen?

Re:Everything you ever wanted to know about passwo

[Draoi]

Why would you ever need to log in remotely as root?!

If you're remote administering a server in a co-lo farm where you've not set up a privileged user account for maintenance. There are times when you *must* be root and where console access is simply impossible.

Remember six characters, write down two

[kandresen]

From digi.no where they have had a similar discussion (but in Norwegian), a very good tip was given:

Make a hard password leaving two open spots. Never write down the password, and remember where in it you left the open spots.

Now every time you create a new password, store the location, maybe even username, the two missing letters, and that's it!

If now someone took your notebook, they would only know two characters needing to crack the X characters remaining and need to figure where the two letters fit in addition.

Re:Everything you ever wanted to know about passwo

[Anonymous Coward]

In my 13-year career as a lead dev, I never once laid eyes on most of the machines I had root or Administrator on. I doubt many of them even had a video card installed.

suggestion for writting them down

[Ozwald]

Well, writing them down as-is is not ideal but it's tonnes better than using the same password or simular password per site. I do have an alternative that I thought worked:

Write on a pad or text file Unix commands. You know, like >tar cvfz MyProject-1.2.tar.gz /cvs/MyProject

Take the two or three letters from each word to make the password, for example tavcMy12/M

The only trick is to align websites with passwords which is solvable and God knows there's a million combinations of common Unix commands to remember. There should be no way a coworker/bandit can guess correctly that your passwords are in clear sight and no two passwords should ever look simular.

Just a suggestion.

Oz

Security through obscurity

[xixax]

I have no idea why more people have not posted similar ideas.

I have loose formulas for creating strong passwords and methods for obfuscating them when I write them down. I deliberately don't tell anyone.

But in general, my passwords are effectively random mixed case alpha/numeric sequences generated and obfuscated using techniques similar to those described above, and seeded by a selection of text sources. While the password itself is saved somewhere secure, I can usually rememebr how I derived the password rather than digging up the stored version.

I also keep a tray of useless decoy keys and gibberish Post-It notes in my desk drawer at work.

Another neat tr1ck is to us3 th3 l3tt3rz "e",and "i" no-one suspects that!

Xix.

Think big.

[rafael_es_son]

This is Microsoft. Microsoft is good at:

a. being big
b. selling

"a" and "b" are problems that belong to the business management domain. Business managers at Microsoft rule. So do business managers at medium software companies and up.

When business managers rule at any given workplace, in order to advance economically beyond a certain given point, an individual needs to "become" a business manager. "Success" inside medium-to-large software businesses is measured by a combination of hyerarchical position and remuneration. Higher hyerarchical position and remuneration are achieved by individuals whose actions increase sales volume. Sales volume is increased by decisions made at a managerial level. "Success" at medium to large software businesses does not correlate in any way with technical excellence.

In order to become a business manager, you need to either: give up on whatever you're doing and go back to college and study business management, or keep doing what you do while learning how to think think and act like other (prefferably senior) business managers in your place of work in hopes for a "promotion" to a position in management. The latter results in very strange -if not pathetic- behaviour.

Business managers are not known for being exceptional in any endeavor related to either science nor the humanities. Mr. Johanson's reasoning is typical of the above-mentioned behaviour. When confronted with such commonsense nonsense, I tried to remember that for every problem there is at least one simple solution that is wrong and that working for a medium-large software factory is not the only way to advance economically, not to say intellectually. ;-)

Re:Everything you ever wanted to know about passwo

[nova_ostrich]

nobody's ever stolen one of my passwords or hijacked an account of mine

Correction: To your knowledge, nobody's ever stolen one of my passwords or hijacked an account. Just because you haven't noticed doesn't mean that it hasn't happened.

Virtual Mod

[Anonymous Coward]

+1 HSR comment.

I consider this obvious...

[vyrus128]

I've been doing it for years, but I generally don't talk about it unless directly asked, since it goes against the grain of traditional security advice. My feeling is, 1) My passwords are no more valuable than anything else in my wallet, and 2) if my wallet gets stolen, I will know near-immediately and change all my passwords (probably even before cancelling my credit cards.)

PasswordSafe

[ronys]

Actually, Bruce Schneier wrote exactly such an application, and put in on SourceForge a while ago, where it is now currently maintained:
PasswordSafe

Note: I'm the project's current admin.

Re:I'll buy that piece of paper with some chocolat

[Autobahn]

barring quantum computers, nobody's going to be breaking it within my lifetime.

Or research breakthroughs - nobody has yet proved that one-way functions exist, and it's entirely possible that some genius could figure out a fast factoring algorithm tomorrow and make your crypto worthless. Not likely, but a possibility worth considering.

writting it down, hard core

[ucsckevin]

I used to work for a human rights group that a (not the US) large government was actively trying to mess with. If I am not using a mac, which of course has the password keychain (Brilliant) then I think the best thing to do would be to write the password down in a long string of mutually unintelligble keystrokes, or a long list, or add an extra character or two. I would write my 6s to look like bs, + and T. The user of course would remember what is what, but if the paper is comprimised, the data is not.

Why bother

[Anonymous Coward]

"prohibiting users from writing down their passwords.."

Users won't stop writing down their passwords just because you prohibit them from doing so. By all means, suggest to users good ways of dealing with passwords.

But some users are going to write them down, send them in a reply to an email from fake_security@yourbank.com and stick them on a postit note on their computer.

So when their computers get compromised, sack them and get someone who is not as dumb.

PIN and calendars/phone lists

[xixax]

If you find someone's wallet, there's a reasonable chance that the phone list or calendar has their PIN listed in it. Every time we talk about hiding a PIN, at least one person offers this as their ingenious solution.

Xix.

Re:PIN and calendars/phone lists

[noidentity]

A PIN is bad for this since its format is so restricted, usually a fixed number of numeric characters only. I offered this for storing passwords where there is little restriction on what it can be (and where there is some kind of lockout if too many incorrect attempts are made).

In the abstract, the idea is to encode the information at a different level, or even make the password a "hash" of information easily available. It's not actively placed in the environment, but does exist there.

Hes right

[dcam]

He is right, people should write down passwords.

People are bad at remembering good, strong passwords. So as he suggests, you end up with a small number of passwords (which may or may not be strong), that are used everywhere. The problem with this is that a password gets used in more than one location with varying degrees of security and information. For example, I could use by password for online banking also when I register for a mailing list.

The problem with this is that the mailing list info is of low value and my login details are going to be less well protected than my bank login details.

So concievably, someone could hack the mailing list server, get my login details and use them to access my bank account. Now if you consider that a single password may be in a large number situations, this becomes a serious problem.

I found an article a while ago that pointed out just this flaw with the MS Passport scheme, unfortunately I can't find it right now.

So our approach should be to write down passwords and protect our password "safe".

My approach has been:
1. Use Keyring for Palm. Passwords are encrypted with 128 3DES.
2. Never use the same password is more than one place.

Keyring backs up to my desktop whenever I do a sync. I can also read passwords on my desktop using KeyRingWin.

My dekstop is backed up to my file server, which is then backed up to a USB drive.

I consider this to be a relatively secure approach that also provides me with backups of my passwords.

This does leave one issue. I have created a single point of failure. Get the password for the encrypted password store, and you have all of them. This is mitigated somewhat by the fact that the password store is only stored on my local network and palm. You also need to get to the password store itself. You also could brute force it, but again you would need to get to the password store itself.

Password management software

[Anonymous Coward]

OS X has had their keychain tool in the OS since practically day one.

Win32 has lots of good options for this, the Passwordsafe tool created by Bruce Schnier originally is a wonderful option for this, especially since there's a PocketPC version available too.

There's a rather bad implementation of this tech in IE already, why not just make a nice encrypptedpassword storage tool a standard part of windows instead of making these idiotic suggestions in an attempt to say something 'newsworthy'.

Hopeless executive hot air as usual from MS. While I have no problemm believing there are some talented people working for MS, their execs have never given me that impression,.

Re:Password management software

[alsutton]

Theres also browser accessible stuff like Argosy TelCrests' EPS (http://www.argosytelcrest.co.uk/pwsafe/). It saves on the hassle of trying to keep a load of seperate stores in sync.

Mathew Broderick

[CleverBoy]

Writing down passwords... has War Games and Mathew Broderick taught us nothing? (grin) No matter how clever they think they are... the folks with the important passwords will always hide them in the most obvious places...!

Re:Everything you ever wanted to know about passwo

[Anonymous Coward]

I've always used my first name as my password for everything and I've never never had it hijacked, so it must be good.

Re:Everything you ever wanted to know about passwo

[Westacular]

#9) When constructing your tin-foil hat, make sure the shiny side is facing outwards.

Access Denied

[Anonymous Coward]

Think of all the bullsh*t a user carries around in their brain....inane senseless stuff, but they remember it.
If they cant remember something as simple as a password, they dont deserve access to my systems.

Re:I'll buy that piece of paper with some chocolat

[value_added]

But that will display your password in plaintext.

The passwords are prompted for, and nothing typed appears on screen (fairly standard stuff). If using ccrypt, the only thing that appears in plaintext is the decrypted contents of your encrypted file, after you've chosen to decrypt it (and before you cleared your screen buffer, of course).

Clipboard-anything is always a Bad Idea(TM). It's fairly trivial (read "ActiveX, among other methods), to read the contents of the Windows clipboard. Then again, I think clicking/double clicking anything is a Bad Idea, as well, especially when the multiple steps of loading and clicking your way through GUI can be repaced with a one line command. :-)

Not such a bad idea...

[SphericalCrusher]

But let's not forget that even though it's easy for someone to make a complex password and write it down, they also want it to be easy to access... hince they are going to stick that Post It note or whatever they choose to write it on in a place they can easily find -- whether that be under the keyboard, on the monitor (a common thing) or just anywhere in their office space, people tend to do this on a regular basis. Now what a good company precedure would be is to ban this type of activity. Issue warnings and such to people that do not follow this rule and potentially terminate them if they choose not to do it. After all, this may sound like a bad idea to fire them, but you wouldn't want your company to be breached by a social engineer who is out to get your precious intellectual property, now would you? Plus, for the simple fact of them not following the rules creates a flaw in management and shows bad teamwork. It's just not good for business.

Re:I'll buy that piece of paper with some chocolat

[nacturation]

Clipboard-anything is always a Bad Idea(TM). It's fairly trivial (read "ActiveX, among other methods), to read the contents of the Windows clipboard.

Probably about as trivial as writing a keyboard event handler I'd imagine. The point is that at least it isn't displayed in plaintext at any point unless you manually choose to edit the password. Plus you don't have to worry about command line histories (eg: .bash_history for *nix), someone sharing the system scanning `ps -aux` for command-line parameters, etc. I think the clipboard is the lesser of two evils.

Password tricks i use ....

[pH03n1X]

I understand that having different passwords for various logins is essential for security reasons ( otherwise .. if you have same password for all logins ... you are as safe as the least safe system !!!) ... This is a small trick i use ... my passwords are made up of 2 parts ... first part is a some text with special characters common to all my passwords and second part is dependent on where i login ... fr eg. if my common part is 'foo' then my slashdot password would be 'foo/.' or 'fooslash' and my yahoo password would be 'fooy!' or 'fooyahoo' and so on .... This has several advantages ... 1) easy to remember since you only have to remember the common part ( its like having a single paswword!) , 2) password is different for different logins so its secure ... hope it helps .... ( btw my slashdot password is NOT 'foo/.' ;)

Re:Password tricks i use ....

[klang]

( btw my slashdot password is NOT 'foo/.' ;)

no, obviously it's "fooslash" as you write yourself! :-)

USAF password security

[lelio98]

While I was in the Air Force they preached computer security (CompuSec) day in and day out. The biggest threat wasn't from hacking or malicious software, but from someone walking by your desk, seeing your Post-It-Note with your password on it and memorizing it. The other issue was with someone calling an employee and telling them they were the Help Desk and they needed their password for some reason or another. I used to do this to people, to teach them, and was surprised at the number of morons who would give out their password. I would say, "Hi this is [my name], I need your password to remotely log you into the XXXX server so that I can back up your XXXXX files". Most people would just give me their password. Anways, password security is a real problem if the information being password protected is important.

How I write my passwords down:

[stfvon007]

I write down my passwords, but I do it in an encrypted form. Using a pattern I know, I will write down the password in a scambled form, and insert other letters as well. Anyone looking at the written password would only be able to narrow down the password to about 60 trillion possible combinations. With me however knowing the pattern to look for, and im be able to enter it easily.

Re:How I write my passwords down:

[darkain]

60 trillian? thats what... about 48 bits of unknown data? how long does it take to crack 56-bit encryption nowadays? ;)

truthfully tho, i beleive that the complexity of the password should reflect the confidentiality of the information that is being protected, and the knowledge of the people you are trying to protect the information from.

i have to teenage brothers who share a computer, and each are about as capabable as turning it on and playing star craft/neo pets all day. i doubt they need any sort of 7 day autogenereted password cycling system to prevent each other form seeing their bookmarks in their personal folders. however, when it comes to some of my personal systems, i have a much higher sense of security (such as on my source code repository)

so, basically what im getting at here, is this: put your effort where effort is due. no 2 systems are alike, nor should they be treated that way. there is no one-size-fits-all sollution to security, passwords, encryption, etc...

Re:How I write my passwords down:

[Luigi30]

How many zaphods are in a trillian?

Re:How I write my passwords down:

[Big Sean O]

Let's see... Two heads, three arms. If other appendages follow the same pattern, I'm going to guess 2.5 zaphods in a trillian.

No wonder poor Arthur can't make a dent.

Re:How I write my passwords down:

[Dog135]

That's me to a "T".

I'm autistic so all my passwords are pattern based. I even shift the pattern groups to different locations on the keyboard through the password.

Nice thing about pattern based passwords is it's easy to make them big. At home I use a 20 and a 24 character password for my encrypted dmg files. (osx disk images) I could make them smaller, but why? It takes me all of 2 seconds to type them.

Until...

[Stonewolf57]

Some thief who also happens to know something about malicious hacking steals your wallet/password list which conveniently states not only your password, but probably also the computers that each one goes to. Another telltale sign that MS is run by fucking morons. Here's the solution. This is not a solution for the casual user, because the casual user typically wouldn't follow this anyway. Create a difficult password (mine are usually 10 to 14 characters, randomly created entirely from my head, contain at least a couple special characters, and a couple of caps. If I'm working on a desktop, I also throw in alt+255 as well). I memorize these usually very difficult passwords, and use usually one or two for everything. Personal comp gets one, and because it's a work computer, that one gets a totally different one. Websites usually get a very simple one, because frankly I don't really care if someone breaks into my fileplanet.com or gamespot.com account. Nothing terribly interesting in there.

Use a combination of both

[Nice2Cats]

Why not combine the two techniques? Make one part of your password long and complicated and write it down in a safe place. Memorize the other part of your password, never write it down anywhere, and keep it for a long, long time. That way, if your wallet and keys are stolen, they might get your credit card, burgle your house and steal your car, but the porn collection on your laptop will be safe. Er. For example.

Mircosoft's view...

[PGC]

So this is Microsoft's view on security. And they wonder why people don't take them seriously when saying they wish to dominate the security sector...

Case sensitive?

[Anonymous Coward]

My passwords aren't case-sensitive, you insensitive clod! It only takes 423,880,471,170 years to run through all my possible twenty-character passwords :(

PasswordMaker

[NightFears]

I was more than surprised to find out that none of the [4+ rated] comments mentioned the PasswordMaker Firefox extension. I have been using it quite happily for 2 or 3 months now in conjunction with FF's built-in ability to store the forms data, encrypted with the master password.

So what one has to do in order to get rid of the complex meaningless passwords is define a single master password for both PasswordMaker and Firefox and with the help of their encryption capabilities use it to respectively generate and auto-fill distinct passwords for all the sites he/she is registered on.

The need to enter the master password into PasswordMaker is slightly unpleasant, considering that you already enter it once for FF's session, but, hopefully, this will be dealt with in the future PM's versions.

Highly recommended stuff.

Write them down coded

[Anonymous Coward]

I occasionally write important passwords down, but not in the way they're used. Numbers get changed by a particular method, and the sequence of characters is changed as well.

But backing it up is sooo important ..

Of course, people can't remember...

[Kjella]

...20 characters of random data, it would have to be pseudorandom. I do remember reading the police cracked a 20 letter password that consisted of five words, all lowercase. Probably "fuckoffyoustupidcops" or something like that.

The key to a good password is to create one that only makes "sense" within the context. For a very high-security password, I recommend starting with a passphrase you remember easily, like a quote, saying or similar then add three typos - letter, capital, number or sign. Example: "simXplever8ygoodpas.sword" - remember "simXple" , "ver8y" , "pas.sword" (easier than remembering the typos alone).

Remembering three flawed word comes rather easy, certainly much easier than even a standard "random" password like hjk2Edn3. And yet the number of permutations makes it several orders of magnitude more difficult to find. It is slightly longer to type though, but since it is more "normal" typing I find it just as easy.

Kjella

Re:Of course, people can't remember...

[Anonymous Coward]

Good idea on the passwords.

But your sig... Banning grain and potatoes to prevent a fraction of a percent of them from being used to make moonshine would indeed be stupid. But the same argument can't be applied to P2P, because piracy is many orders of magnitude more prevalent by comparison.

And we do, in fact, ban or regulate the sale of many substances which have numerous legitimate uses, in order to curtail one or two specific illegal activities.

I'm not saying that P2P should be banned, but the analogy you make is extremely poor.

Bruce Schneier is an NSA shill. Blowfish TAINTED!

[Anonymous Coward]

There is a CRITICAL backdoor in blowfish that Bruce put in the code and NEVER admitted or corrected in print for many years, long after 30 commerical crypto liraries foolishly embedded the exploit.

It looks like an innocent mistake in the code... but the sinister weakness was deliberate. I caught it VERY early on and spent years pointing it out to others that Bruce is a shill, a dupe, or merely the worlds most retarded programmer.

Discussion of the Blowfish backdoor never found in all original normal test suites:

There is a problem whenever the most significant bit of key[index] is a '1': for
example, if key[index]=0x0080, key[index], a signed char, is sign
extended to 0xffffff80 before it is ORed with data.
For examle, when:

(index&0x3)==0x3 (such as index=0x3,0x7,0xf, etc.)
- -and-
(key[index]&0x80)==0x80 (or when k[index]=0x80,0x81,etc.)

data=0xffffff80 (0xffffff81,etc.) upon exit from the above
"for(k=...)" loop. ORing all of these 1's into data
effectively wipes out 3/4 of the key characters! (that is,
3/4 of the key characters are known to be set to 1 when the
4th key byte to be ORed into data has a 1 in the most
significant bit.) For a randomly selected 32-bit key,
there is a 50% chance that 3/4 of the key could be
considered as all '1's, even if they weren't that way to
begin with. The length of the key is irrelevant to the exploit.

The line of code was :
data = (data 8) | key[index];

it should have been similar to :

data = (data 8);
data |= ((unsigned long)key[index] & 0x00FF);

Anyways the weakness made blowfish trivial to crack for many years.

Email - the ultimate security whole

[Mitch Monmouth]

Using different passwords everywhere my help, but not that much. There is only one password someone needs to get access to most of your accounts: your email - and they may not even need that. Most emails passwords are sent in plaintext and can be sniffed on the network or keyboard.

Just about every bank, brokerage, etc. site will email you a password or password change/reset URL if you "forgot" your password. If someone has access to your email - or the network your email is delivered to - you're easily toast.

Those of you using webmail and checking it from an internet cafe on Soi Cowboy, take note.

Stereograms

[clickety6]

I have all my passwords on posters around my office in stereogram form. The only trouble is my office mate often spends hours sitting at his desk with his eyes glazed over and I don't know if he's just zoned out or if he's tryiong to steal my passwords!

Worried about writing pws down? XOR them!

[DesiGuy421]

All you have to do is convert each character to its corresponding ASCII number and then XOR it with a value of your choice. If you XOR the result, you'll get the original character. For those that don't know, XOR is exclusive OR. Truth Table: a b c 0 0 0 0 1 1 1 0 1 1 1 0 a XOR b = c c XOR a = b c XOR b = a No commoner will know how to decode your written down password then. Just hope the commoner isn't a slashdot reader, :/

sometimes theres no other way...

[Anonymous Coward]

well, in my case, I would have to remember about 20 passwords and change them on a regular (90 days) basis. Almost all of them must contain upper case, lower case, numbers and special characters...
Theres no way I could remember that many passwords along with my private ones, especially when I dont need to log on to some system for say 2-3 weeks. So I store a plaintext file with all my passwords on a network drive, with restricted access. If anyone should get this file, it will be the IT guys responsible for it :)
But with all the project documents stored on network drives, some login info will be the lesser loss in this case :))

OMFG

[Intrinsic]

I think this problem has to do with being lazy. You can remember passwords, you just have to actually make an attempt to try (which nobody wants to want to do these days). I recommend you at least store your passwords in a encrypted file that has weak security then to be writing them down somewhere.

reliability is improving as well!

[Anonymous Coward]

"with over 250 million active Passport accounts and over 1 billion authentications per day."

anyone else read this as meaning *only* 3 crashes per machine per day!

they are doing well these days aren't they..

Remembering PIN numbers

[rjwoodhead]

Here's a simple technique I use for keeping all my card PINs straight.

I have one secret 4 digit number that I remember.

I subtract this number from the PIN for a card using modulo arithmetic.

I write the result on the back of the card.

So if my secret number is 9427 and the actual pin is 9876, I write down 0459.

Now I only have to remember one number for all of my cards, each card has a different PIN, and if the bad guys get my card and try the number helpfully written on the back, it won't work.

If only I could get my bank to use the adjusted number as a panic code...

Re:Everything you ever wanted to know about passwo

[rastos1]

Think about it. Even if you use ssh, it is using shared libraries that you can't trust to run on operating system that you can't trust possibly on hardware that you can't trust.

Using ssh is often usefull, but in this scenario it helps a little.

Loose your wallet???

[Anonymous Coward]

Why would you do that? If you are going to loose your wallet, first take out the money, credit cards, and passwords.

Of course this won't help if you lose your wallet.

Re:Everything you ever wanted to know about passwo

[Draoi]

Sure - but it gets to the point of absurdity very quickly. Nothing is 100% secure; everything is a compromise. All you can do is take *reasonable* precautions - SSH is reasonable, telnet is not.

2 simple steps

[mcn]

1) think of a system to create your password for different classes of things (eg, banking, personal accts, office accts, mailing lists, misc).

2) write down in a spreadsheet in some 'truncated' manner (eg, 1st and last character of password). not just anywhere, and encrypt file with a good password that you make sure will remember.

PassPhrases

[Wyrd01]

I changed the moderation to 4 and read through all the comments. I saw all kinds of things about people using mental hashes, combining parts of words from things on their desks, and several very arcane sounding methods of generating new passwords. But I didn't see much about passphrases.

It's always been my understanding that this is probably the best option, assuming the system will allow 25+ characters for passwords, which, sadly, many don't.

The passphrase "try to crack this password fools", even without any extended characters, would just take too long to try to crack through conventional means. Add in some puncuation and capital letters and it becomes even more difficult to crack. And it is something I can easily remember, moreso than a random password like "E4#b.?8Y". So is there a good reason, aside from many sites only allowing 16 or fewer characters for passwords, not to use passphrases?

Wyrd One

A device to keep passwords secure

[pyite69]

There is this device that people have for containing things that are valuable - it is called a "wallet".

I write down my passwords and keep them there until I have them memorized. It is really 1337!

Not good enough.

[Richard Steiner]

Some of the systems where I work require a new password every 30 days, and one of those is a system I only have to access once or twice a week.

By the time I have the PW memorized, it's time to change it again.

Why not use an password safe

[alsutton]

Something like the product at http://www.argosytelcrest.co.uk/pwsafe/ Pretty much everyone has a browser on the devices they use to access systems, and it seems to avoid the need for a million and one local passwordsafe all storing out of date copies of the password.

Some of us must access several dissimilar systems.

[Richard Steiner]

When I worked at Northwest Airlines as a programmer, I needed regular access to:

* Windows NT/Novell
* Three different Unisys OS2200 DEMAND environments for development/support.
* Three different Unisys OS2200 TIP environments for development/support (one USAS, two UNIMATIC).
* Two Solaris servers for development/support
* IBM TSO/ISPF (mainframe) for change management.
* IBM CICS environment for hours/projects (PCS).
* AIX server for maintaining intranet site.

The platforms involved had vastly different password length and content requirements and did not share security information.

At my current position, I need access to a Linux box, a Solaris box, three OS2200 boxes, Novell, and a whole pile of different applications (some web based, some not) for training, time reporting, change management, problem monitoring, and various other things.

Some of the latter could share a common password if the various vendors got together and agreed to implement a standard (since all are access via my Windows XP Pro box), but the former are all server logins on platforms which are quite different from each other (Solaris and Linux aren't, but neither is remotely like OS2200).

Re:Everything you ever wanted to know about passwo

[RealAlaskan]

#6) Never, ever log in root from a remote location. ... If you must, have 2 computer systems at home. One secured off line, and the other on line.

All the other stuff is un-necessary if you can do this. If your computer is physically isolated, with no net connection, most of your problems are solved. Any sensitive information should, in general, be separated from the internet by an airgap.

At home, I have a Windows box which my children use for educational software. It's never been cracked, and never gotten a virus or spyware. It's more secure than my online linux box. Why? The airgap. I've removed the modem and NIC from the Windows box.

To give an ecommerce example of security through air gap, take the order and credit card number via net, then write it to a csv file of orders which gets burned twice a day to cd and carried to the offline machine. On the online machine, keep only the name and last 4 digits of the card number, so next time that customer shows up, you can safely offer him the choice to use the same card. Safely, because even if the online machine gets cracked, the cracker gets only a name and 4 digits, without the expiration date and remaining digits. If the online machine gets cracked, only that orders placed since the last CD was burned can be compromised.

The offline machine stores the credit card numbers and prepares the orders for processing. Of course, the credit card processing still has to be done online. Stick the CD of numbers, et cetera, into an online machine, and have it transmit numbers, amounts, et cetera, to Visa. If you want to be really serious about security, this machine could be reinstalled before each batch (via Ghost, or some Linux Live CD, or so).

This all sounds practical, but it's cheaper and easier to just do everything on the online machine, so it'll never happen.

Generating passwords

[lelkes]

What about using an algorythm to generate passwords for different sites? For example, I could take the name of the site (eg. Slashdot), write any specific word after it, so I'd get for example Slasdhotasdfg, then md5 it. My password would be c03d483f205d67c7f8d5a509d55c50f7. Seems pretty secure, doesn't it?

Re:Everything you ever wanted to know about passwo

[Anonymous Coward]

I've been an active network/web user for 20 years, and nobody's ever stolen one of my passwords or hijacked an account of mine.

Congratulations, you win the Sample Of One Award for Stupid Slashdot Comments!

Re:Some of us must access several dissimilar syste

[Ed Avis]

They shouldn't share a common password. If they did then getting access to the password on one system would give access to all the others.

However, they could share a common authentication mechanism such as using a public/private key pair. At least the three Unix boxes can be accessed using ssh and a keypair; it's a shame that there is no real equivalent for Windows (unless you do something very funky with Samba and domain controllers).

Re:Some of us must access several dissimilar syste

[Ed Avis]

They shouldn't share a common password. If they did then getting access to the password on one system would give access to all the others.

Okay, this is also true if you get hold of the private key - but while password authentication requires you to send your password to the remote system, with keypair authentication the other system or an eavesdropper can't find out your private key.

Upside down

[wonkavader]

Good gravy. Talk about backwards. Passwords should be long and intuitive and used on secure machines with secure communications so that you can use the same password on a group of trusted machines without having to write them down.

Out with the password, in with the pass-phrase, and in with TOKENS.

Re:Everything you ever wanted to know about passwo

[Anonymous Coward]

I see. So if has never happened to you, then it doesn't happen to anyone.

heh heh heh

[lothie]

Cool! What was your username again? ;)

Re:So Pen&Paper's the new replacement for Pass

[saskboy]

That sounds like a cool feature actually. Have the password on a paper on the desk, possibly in encrypted form. Then touching the paper to an area on the computer, the password is read into the machine, but not stored. So the paper acts as a key, that isn't able to be seen by simply breaking into the machine.

Re:So Pen&Paper's the new replacement for Pass

[team99parody]

I think you've got yourself a great startup idea there. Ever think of writing that up in a business plan and bringing it to VC's? And all that time when I posted the grandparent posting I thought I was just trolling; but this is actually very cool.