Slashdot Mirror
Write Down Your Passwords
joeykiller writes "Microsoft's senior program manager for security policy, Jesper Johansson, presents a provocative but interesting view on password policy: He claims that prohibiting users from writing down their passwords is bad for security. His main point is that if users are prohibited from writing down their passwords, they will use the same easy to guess password everywhere." From the article: "Since not all systems allow good passwords, I am going to pick a really crappy one, use it everywhere and never change it...If I write them down and then protect the piece of paper--or whatever it is I wrote them down on--there is nothing wrong with that. That allows us to remember more passwords and better passwords."
Seriously though, instead of writing down the password, why not using what's already written on the hardware?
For example, I'm only reading Slashdot from this particular computer, and I'm using a IBM E94 monitor, and there is this Sellotape dispenser on my desk with 1531 written on it. So my Slashdot password can be easily remembered as IBM!1531@E94#, or simply ibm1531e94 for those systems that cannot accept special characters.
See? it's so easy to remember a long and good password, and nobody's going to find out how many items you use and how you combine them to make up your password.
The good password requiremnt is not helped by the fact that users are also required to change it every xx days, so not only you need to remember a strange password, you have to remember a different one every couple of days.
There a joke about the increasing frequency that a user is required to change his password nowdays, eventually crackers just need to keep on trying the same password and the system will change to match it.
Rock that crushes, Paper & Scissors that don't matter.
That would lead me to believe you'd have an environment where any discovered piece of paper on which there is some non-indigenous word written would be a candidate for plugging in as password attempts. This is just plain silly.... passwords written down would be one of the first things a social-engineering hack may try to leverage. I'm not a fan of draconian policies wrapped around impossible rules to manage security, but this "recommendation" flies in the face of reason.
Seems better to keep the long-hard passwords stored in an encrypted file protected by one good password that you remember.
We use physical keys to start our cars and to unlock our homes. Why don't we handle this stuff by using a similar strategy. Say a USB dongle that you need to start your computer? I've seen a few implementations of this theme, and I even believe MS threatened to do just this. Is this because the regular (l)users out there want their computer to work like their toaster does?
You'd be surpised about how many people do that.
I've never understood the whole "don't write down your password" warning. I carry a wallet full of credit card numbers that I probably care just as much to keep private. Those numbers are "written down."
What has to be done is make sure users are educated to PROTECT their passwords. The problem comes when the password is stored on a post-it note under the keyboard.
Common sense...
BTW, I always add a stray character at the beginning of my passwords when I write them down so even if someone gets the paper I wrote them down on they won't know my password.
One Really Bad Mistake (TM) will hurt you a lot more than it would with multiple passwords. I'm careful, I'm sure a lot of slashdotters are careful, but every once in a while someone is going to make a mistake. If it's one password for one place, it's possible to fix that. If it's the same password everywhere that becomes more difficult.
The "guard them as you would your cash" idea sounds good and is good to a certain extent, however, when someone has stolen your cash, you can generally tell it's gone. A password can be stolen without anything being missing.
Because ONE security breach would compromise all services? Yes, that sounds right. Also a single malicious administrator could emtpy your bank accounts, take your ID, book a few flights and so?
Do you trust the admins of slashdot enough? There has been breaches in past, there will be in future.
Assembling etherkillers for fun an profit
Why wouldn't a person choose one good password, and only one, and keep it?
Just because I want a login to buy something from a store doesn't mean I want to give the people working at that store the password for my online banking - especially if I'm giving them other banking details to make the payment.
Anything that requires me to have access to a specific type of hardware (PDA) or a specific operating system isn't going to be a lot of help if you're on the road without your gear or your gear gets stolen and you need access now.
Just do something trivial like rot-5 the 5th character of each password if you're concerned about somebody getting access. That would discourage most people from trying.
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
I'll share a commonly used mnemonic mapping for numbers. It maps consonants to digits:
Hard c goes with k, soft c with s, etc. So say you wanted to remember your bike combination of (rolls random number with python...) 3254. You construct a phrase with any vowels and spacing desired with the consonants m,n,l,r. For instance, "mine lore" comes to my mind, and I envision Tolkein dwarves chatting up their favorite topic. If needed, you would then write a paragraph about dwarves and mine lore in Lord of the Rings in your notebook.We all use lots of numbers every day,our own bank account numbers, Credit Card Numbers, Phone numbers, etc. We all remember all these numbers, because we use them over and over again. When you get a new credit card, for the first 10-15 online purchases you copy the number for the plastic; afterwards you just know the number, you get it out of your head. The more often you use these numbers, the faster you learn them, without any effort, repetition does the job for you. I think the age is irrelevant, this way happened when I was a kid, this is the way it happens today (I am 59). I know about 40 or 50 numbers I use frequently and they all have at least 7 or 8 digits some 12 digits. Why should passwords be different? Because they are not only numbers? I dont see any difference. The more often you use a password the easier to remember, it would take 10-15 logins to learn it, without doing anything special.
#6a) If you really must, must log in remotely (as root or anyone else, you must always use SSH - no exceptions! Always assume you're network is being sniffed. See (2) above.
Alison
"It is a miracle that curiosity survives formal education." - Albert Einstein
They even have a large section on "What We Learned from Passport", but failed to mention the single biggest lession Passport had to offer - that people fundementally don't trust Microsoft with security issues.
Note that this isn't a criticism of Microsoft. Doing security right is a difficult and time consuming process that is really a niche segment of the overall computer market. Because of their volume will always need to remain focused on the mass-market where time-to-market is more important than security. Delaying operating systems to appeal to the security market will only weaken their competitiveness on the desktop that made them so successful. And if they try to do both, they'll have to strike compromises and suck at both.
This isn't a technology issue, it's a business issue; and in the end, Microsoft will continue to rule in the largest spot of the market.
Just to pick one example, #7 (assume keyloggers, change your password when you get home): what if your home computer has a keylogger on it? Uh, oh, better go to Starbucks and change your password from their network. Wait a minute, somebody might packet-sniffing it. Oh, no, there's no way out, we're doomed!
Your paranoia is way overblown anyway. I've been an active network/web user for 20 years, and nobody's ever stolen one of my passwords or hijacked an account of mine. People have broken into my house and car and stolen stuff, though.
The best passwords are illogical. Something like k8iWq3xy.
That made sense up until the xy (seriously).
The best, very best log in tool for security I saw was a small clock a friend was given from his company. It had some funky algorithm on it, and it displayed a 14 alphanumeric code. When my friend logged in, he had to enter this code, which changed ever 1 minute. This was in addition to his username and password.
I use something like that. It's called the UNIX epoch. (One-time passwords, they're called. With increasing mobile device usage, this will become more viable although no where near bullet proof. If the device is lost or is cloned, game over. Might also want to look at Netkey, with is a method of hiding passwords.)
Set up a policy that only allows 2 attempts to log in, and after 2 failed attempts, it locks out that IP and MAC address for 30 minutes.
Not that great of an idea if we are dealing with complicated passwords. Believe me, users will come knocking down the door after about a week.
It's impossible to FORCE good passwords.
1) P4$$w0rd is a really bad password.
2) The same password for your bank and for warezRus.com is a bad idea.
Forcing people to change their passwords all the time encourages bad passwords and passwords on stickys.
Regular password changes are:
a) because you think someone is brue forcing them (so fix that problem, changing the password part way through the brute force sequence doesn't buy you anything.
b) because you think it has been compromised (if it has, it's too late).
It's by crypto genius Bruce Schneier, it uses Blowfish
A few things to keep in mind:
Bruce is a cool guy, and Password Safe may be great, but I wouldn't trust it soley on his reputation.
Democracy is two wolves and a sheep voting on lunch.
barring quantum computers, nobody's going to be breaking it within my lifetime.
Or research breakthroughs - nobody has yet proved that one-way functions exist, and it's entirely possible that some genius could figure out a fast factoring algorithm tomorrow and make your crypto worthless. Not likely, but a possibility worth considering.
Actually, PasswordSafe is actively maintained on SourceForge: http://passwordsafe.sourceforge.net/
You don't need to trust Schneier's rep, as the sources are available...
As to the Crypto, AES is currently much less reviewed than Blowfish, as it'smuch newer and 3DES, while reliable, is relatively SLOW...
Note: I'm the current project admin.
Ubi dubium ibi libertas: Where there is doubt, there is freedom.
I write down my passwords, but I do it in an encrypted form. Using a pattern I know, I will write down the password in a scambled form, and insert other letters as well. Anyone looking at the written password would only be able to narrow down the password to about 60 trillion possible combinations. With me however knowing the pattern to look for, and im be able to enter it easily.
All misspellings and grammatical errors in the above post are intentional and part of my artistic expression.