Slashdot Mirror
Too Many Passwords
LK3 writes "A survey of 1700 technology end users in the United States released today reveals some interesting findings about password management habits. 'The results suggest that having to juggle multiple passwords causes users to compensate with risky security techniques and creates a drain on productivity by taxing the resources of IT support centers.' Further, corporate requirements of frequent password replacement further exacerbates the toll on human memory. Is the solution a master password, with all of the potential problems that represents, or biometrics, or are we stuck with post-it notes and a call to the help desk?"
I have a very very clever comment to add to that thread, but I forgot my password :(
Nothing for you to see here. Please move along.
/. stories?
Crap, what was the password to view
Becoming tired of remembering passwords, I wrote a little perl program to randomly generate a matrix like this:
:-) ).
a-E9 b-?p c-&m
d-6K e-aY f-eP
g-!S h-gn i-D=
j-Hd k-vw l-Cb
m-W5 n-4$ o-R3
p-x% q-7M r-NF
s-+2 t-s* u-Ay
v-fL w-zG x-Zu
y-cX z-Qr
I then print this, laminate it, and put it in my wallet (a backup copy somewhere isn't a bad idea either). Then, for every password I just remember a word (maybe "bank" for my bank for example) which gives me a password of: ?pE94$vw
Hard to guess, easy for me to "remember". If someone gets my paper (say I lose my wallet), it is still not simple to figure out what my passwords are, or even what the heck that little paper is. Shoulder surfing doesn't work too well either, unless you can memorize the whole card and then figure out which word I am using (it would be easier to try to watch me type the password on the keyboard then get it off the paper. Luckily I type fast and get annoyed when people stand over me while I type a password
I Am My Own Worst Enemy
This frustration is leading to behaviors that could jeopardize IT security, as well as compliance initiatives.
Any good sysadmin knows that if you make the password policy to strick you could actually be worsening your security situation. People will start sticking their passwords under their keyboards or on their monitors.
Bradley Holt
(BTW, this is basically a dupe from about four or five years ago...)
From the article (and the post):
First, I can't let this pass. I was on the IT team for a large company that had the described oodles of systems and oodles of passwords dilemma. And I'd been out on the floor where our users had to use these systems. The last thing in the world someone should be saying to them is, "You know how you are", as if these people are doing some wrong. Their jobs of dealing with the consumer public is hard enough without having to genuflect to the "security" (inconsistent, obfuscated, inane, ineffective, and myriad) measures of the systems from which they are supposed to server the consumers. I never had to deal with as many passwords as they did, but had I had to, I'd have been tempted to do the same thing.
As for the dilemma of too many passwords... yeah, there are too many passwords. And the funny thing about that is, they (in my opinion) provide little to no security and may even subtract from the overall security of the network. Especially in a closed access building (which these users were), passwords were and are a hindrance, not an enabler. I'd submit the entire organization would function more effectively were they all allowed access to the various systems sans passwords once they'd entered the building. Most stolen and broken passwords are via social engineering, and half the social engineering is just gaining access.
In the personal computing arena, I'd be awfully surprised if even 10% of the problems occur because of too many passwords. More likely it's because of incorrectly configured access levels for general users.
I'm guessing the world of passwords will never go away, but in settings where users have to deal with many (in the case described above, literally hundreds) of systems and their various password paradigms, passwords SHOULD go away (NOTE: the use of the plural... I'd be okay with somehow consolidating total access down to ONE password). Somehow it must be comforting to PHB's to know their universe is multiply protected by multiple schema, whether or not it affords any protection.
I find that kwallet works well for this in KDE, but its a feature sorely lacking in WinXP, though I am not sure I trust XP to store my passwords ;-)
I just use the same 4 passwords for everything, but trying to figure out which one of the four a certain one is can be a problem, since in some cases you only get 3 login attempts...
What could possibly hurt the security of the American people more than giving our own government the ability to hide its
Good idea?
My voice is my passport.
SSH keys are all you need, entering passwords is so 20th century.
SplashID or similar products give you a strongly encrypted database that you can sync with portable devices; in my case, a Palm OS based phone. I've been keeping my passwords and other sensitive information in there for years now. Works great.
You want to make the password protecting that database a good one, though...
Don't forget to add that programs use inconsistant rules for passwords. Some programs are case-sensitive, others aren't. Some programs don't allow special charaters, some require them. What's worse are programs that require a numerical password. For example, I refuse to use Verizon's online system because instead of using a username/password combination, I have to use an account number and a randomly-generated PIN.
No, I will not work for your startup
I'd answer, but then it'll give insight into my password preferences, and then I'll get c00tz0rs from t3h l33t h4x0r2!!1!eleventyone etc.
You can hold down the "B" button for continuous firing.
Is the solution a master password, with all of the potential problems that represents, or biometrics, or are we stuck with post-it notes and a call to the help desk?
I just use the rotating password of IAmGodsGiftToWomen01, 02, 03... No geek will ever come up with that one!
I can definitely relate to what they're saying in the article. At the company where I work, we are required to change our Windows password every 8 weeks and the password to get into the financial software every 3 months. To make matters worse, we can't use a password we used in the past again. So, you have a bunch of folks here that aren't concerned at all about passwords creating anything they can think of every 2 months minimum, and forgetting it that same day. It's a huge drain on the IT department and it constantly happens. Also, after 3 unsuccessful attemps at getting in the financial software, you're locked out. You have to call a completely different person that the usual IT guys to get the specialist for PeopleSoft to fix the screw up. It really amazes me at how much time gets wasted in our IT department alone, just fixing passwords for people.
Finance tutorials and more! Understandfinance
All it takes is a fingerprint scanner, USB ID Key, good NIS setup, or my personal favorite - tiny RFID tags under the skin... ohh nelly... now I've got to cut off a chunk of johnny's hip to commit identity theft!
I have given up with passwords and just switched to 'asdfasdf1234' never cracked yet.
45Ty34#
I store mine on Slashdot!
Some settling may occur during posting.
Companies want products "now". That means using a new product written specifically for a given task, often times a purchased product. That in turn means no connectivity with existing systems, which leads to yet more logins & passwords. Keeping them in sync can be a nightmare. Even knowing this is the cycle, many companies will continue with their historical way of doing things, yet wonder why their staff need to remember 20 different login/password combinations.
My Tech Posts on Twitter
Something you have (physical key)
Something you know (password)
Something you are (biometrics)
One is good, two is better. Give your users an RFID card, smartcard, RSA SecurID (or similar) or fingerprint reader. Tie in your gift(s) to your authentication scheme.
You can't lose your finger NEARLY as easily as you can lose your physical token or forget your password.
Dare to Hope. Prepare to be Disappointed.
For everyday users I don't think constantly rotating passwords is a good idea. It's too inconvenient for them. Once that happens they start to write them down. I think a combination of a hardware key and a passphrase offer better security. As the saying goes, something you know, something you have or something you are.
UNIX/Linux Consulting
Then there's also the fact that Lloyds performed a survey that contradicts the findings - passwords are fine as long as there's proper education.
A simple solution would be to just eliminate password protection on most of them. They're only available on the intranet -- is there really a serious threat of people hax0ring other workers' accounts and taking their online sexual harassment training for them?
What I'm listening to now on Pandora...
... nobody seems to be a big fan ...
-everphilski-
Is the solution a master password, with all of the potential problems that represents, or biometrics, or are we stuck with post-it notes and a call to the help desk?
Just use the right tool: MyPasswordSafe
There is also a GNOME or GTK tool that is similar, but I didn't like the features nearly as well. This thing will store your passwords in an AES encrypted file protected with (I believe) an arbitrary length passphrase (mine is about 100 characters). I believe that it similar to the password safe (or something like that) that comes with Mac OS X, but it has been a long time since I even had a look at it.
Its about compromise. Having a crazy password policy implemented is going to force the end users to write down their passwords underneath thie keyboards etc, and having a simplistic policy is no good for obvious reasons. What needs to be done is have a policy that is useable and secure. Not only do policies regarding passwords generations need to be put in place but policies about writting them down and leaving them on your desk need to be an issue as well. Computer security has to be both on the computer and the user end.
GL HF!
Furthermore, unless someone DOES obtain the calculator AND knows how you identify the machine, you can tell who you like what the password you remember is. They'd still have to guess the hash function and the salt you're using. And if the user doesn't know how the calculator works (only that it does), social engineering won't help in getting the function, even if the cracker got all the other data. A cracker would need to actually try different hashing functions to be able to crack passwords for other sites, which increases the odds of them being detected.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
I use MYCROFTXXX.
No folly is more costly than the folly of intolerant idealism. - Winston Churchill
I have to remember at least two PIN numbers for my job, then at least four safe combinations, and then countless computer passwords. It's ridiculous. This sort of thing actually encourages worse security, because there is NO way I am going be using a different password on every account, so I use the same one on every box. Whenever I am forced to "change the password" I switch to password B. Then the next time, it's back to password "A". And don't get me started on the "must be at least ten characters, use random numbers, letters, at least one capital letter and special character" crap.
I use Password Safe on a USB pen drive. It has a master password that it uses to encrypt all my other passwords in a tidy MFC application. In x86 Linux I access it using Wine, which works fine. For my OS X machine, I use pwsafe, a console app that lets you access Password Safe databases, and dumps the password directly into the X clipboard buffer. (Use the CVS version, the latest regular build can't access the latest Password Safe database format.) I found other unix password safe compatible workalikes to be extremely poor.
This solution works well for me. Just make sure you back up your pen drive.
I never seem to run into this problem. I have one password, with roughly four levels of complexity. Each version has the same meaning, and as such they're all easy to remember. Which one I use depends on the criticality of the resource it protects, but no matter which one it is, I'm never more than 3 tries away.
Now, when there are policies in effect that enforce password changing and prohibit reuse of old passwords, this presents a problem: it's hard to continue generating new obfustications of the same phrase.
It's a lot easier for me to remember "It was the best of times, it was the worst of times" or "Iwtbot,iwtwot" than some "strong" password (say, 10 characters, case-sensitive, with special characters and numbers thrown in).
Although we'd still have to deal with most of my co-workers using "Git r dun!" as a passphrase...le sigh.
The best password database storage app i have used is Password manager by Cp-Lab. It encrypts your passwords with 8 diff types of encryption in a small db. Well developed, cheap, allows for custom printing and custom fields. For IT admins this is a must NOT A SLASHVERTISEMNET http://www.cp-lab.com/
To Hell with the Queen of England!
In the (California-based!) tech support center. You might be shocked at the number of people who have no idea how security works.
Prime example. When a customer wants to cancel their account, we direct them to an online form which asks for their registration # or domain name and their password to verify their identity. Invariably, the customer forgets their password and when we respond that we can't cancel their account without that information, they ALWAYS ask, "can you tell me my password?"
I am not joking. People call in all the time wanting their login information without being able to verify a thing. By the way, when this happens, there are two options - the "forgot password" form which mails the info to the admin address on record, or providing the billing CC# (you pay the bill, you get the key)
But I digress. Ultimately, the general public couldn't care less about passwords because they don't truly understand their function other than "it gets me where I need to be"
Sony ha
What? You mean you all don't just use Microsoft Passport?
HA! HA!
Homer no function beer well without.
mnemonics make it simpler. Think of a phrase that's important to you personally, such as "now is the time for all good men to come to the aid of their country". For site #1 use the first letter of
each word as your password: "nittfagmtcttaotc". For site #2 use the second letter, etc. If the word is short substitute the site number. It can be easily remembered without any paper to prompt
you and generates long passwords not findable by dictionary
attacks.
I hope they didn't waste taxpayer money on that study.
-- Programming with boost is like building a house with lego. It's a cool but I wouldn't want to live in it
http://keepass.sourceforge.net/ Just a master password needed.
quis custodiet ipsos custodes?
..... Single Sign-On Manager by RSA. The IT manager then has the choice of using an RSA SecurID Authenticator, RSA Smart Card, RSA USB Authenticator, a biometric or (god forbid) a password.
This is my opinion. To make sure you don't steal it, it's covered by the DMCA.
Thsi is why i use a free a free program called Password Safe (http://www.schneier.com/passsafe.html) You remember 1 password to login to your safe and then you can see all your entries from there..and as far as i know there is no limit on #1 the entries in each list, #2 The amount of lists you can have..you just have to remember that one password..a definitely good utility for windows..all you apple and linux heads..dont know if it will work for you.It only takes a second to login and your are ready to go.. and when the fiel that stores them auto encrypts your data..as far as i know no one has broken it..From thier front page
With Password Safe, a free Windows utility designed by Bruce Schneier, users can keep their passwords securely encrypted on their computers. A single Safe Combination--just one thing to remember--unlocks them all. Password Safe protects passwords with the Blowfish encryption algorithm, a fast, free alternative to DES. The program's security has been thoroughly verified by Counterpane Labs under the supervision of Bruce Schneier, author of Applied Cryptography and creator of the Blowfish algorithm. Password Safe features a simple, intuitive interface that lets users set up their password database in minutes. You can copy a password just by double-clicking, and paste it directly into your application. Best of all, Password Safe is completely free: no license requirements, shareware fees, or other strings attached.
~~"Of course, that's just my opinion. I could be wrong." ~~Dennis Miller
Too many passwords? Definately, especially if you work in IT, I have dozens of them to remember... Even for home stuff I got dozens: different forums (web related, IT related, AV related, etc), news sites like /., dozens of online stores, email, etc... It's just too much for my memory, so instead of using the same password everywhere or writing them down or such, I resorted to use a decent password manager. I've picked KeyPass (worth every penny they ask IMHO), but there's lots of others - including some F/OSS ones like KeePass or Oubliette, you can even find a bunch on sourceforge, and they're usually quite simple programs to "tweak or enhance" if they're not exactly like you wish they were (add new cryptos, GUI changes, new features, etc). I've looked at the code of a couple and it was nicely done, good quality code, pretty secure stuff. It would be quite simple to make a basic one from scratch too (using some of the high level languages with very complete libraries and frameworks like we have nowadays), the DPAPI could be useful too.
Ideally it should run without being installed (and without too many dependancies), off a memory stick or PDA for portability. Some browsers have password managers, but it's a partial solution (only good for websites, and only work in this specific browser on this very PC), and I have problems trusting some of them (IE) to keep passwords secure at all.
Not sure what's out there for linux though...
///<sig
I have two apps on my Palm: one generates passwords, another stores them in a "vault" with a master password. Works well especially the password generator. I just select upper/lower/mixed case, alpha characters and how long to make the password string. Copy-paste into the password vault. Done.
I made the argument, some time ago, that instead of forcing us to make new passwords every 45 days ( which is basically a solid way to guarantee weak, easily dictionary-attacked passwords stuck on the monitor ) they should allow us to keep our passwords longer the more complicated they are.
Say, I choose an easily dictionary attacked password with just 5 lowercase letters. Whammo -- I'm told I can use that password for 3 days. So I make a 20 character, non-dictionary password with a mix of letters, numbers, random symbols, etc and I'm told I can keep it for a year.
Seems to me that's a reasonable approach: reward people for better passwords.
Suffice to say, I was told: "No way, we like it as it is"
lorem ipsum, dolor sit amet
There's a way to exploit just about anything. It's guaranteed someone is going to invent a way to fake a fingerprint or a retina to gain access. At least a password can be changed once guessed. I'd like to see you try changing your fingerprints.
Did anyone bother to ask the customers what they want?
Revelation for linux/gnome.
Lots more you can find on http://tucows.com/ or your favourite software download site..
I have close to a hundred logins stored (encrypted) and gave up trying to remember them all a long time ago.. its really not an issue with such a program. Just make sure to keep a backup somewhere or you are screwed when your pc dies.. ;)
FlexWallet or eWallet.
I prefer FlexWallet for all of my passwords. I use more than 30 passwords just for systems I am responsible for accessing. It has a desktop app and a pocketpc version that syncs when docked.
Triple encrypted goodness on the database it uses. Now I just have to remember the password for that.
I have three "good" passwords upon which I create variants. The three basic passwords all have a pseudo random combination of caps, lowercase, numbers, and punctuation. Then, when I have to change a password due to corporate policy, I simply change a single character so that my password gradually evolves... and stays very memorable. Admittedly, remembering the base passwords in the first place was a bit painful. But so far that I know of in over ten years of use, I have never had a password compromised, including passwords on servers that are publicly accessible. In my own experience, most tech users who are not technically inclined do indeed have very poor passwords: sometimes just their names even. I try to educate people on it but it is hard going. Most people just don't feel that it is worth the bother... and probably from their own perspective, a risk analysis would show they are correct.
Helping with organizational effectiveness is our job.
If my girlfriend needs a new password, she doesn't think of something personal to turn into a password, but instead finds objects around the computer (that will usually never stray from it) and uses that as her password. So for example, a Dell Trinitron monitor, her password becomes trinitron. She picks up brand names from things associated with her work area or things around the house, and uses it once. At least the password isn't carried over to different accounts she has, and the password is easy to remember when its right in front of you. Eventually she memorize's it by constantly having to look for it. Though I wouldn't recommend this technique for the Slashdot crowd -- Playboy is such an obvious password.
For he today that sheds his blood with me shall be my brother.
I seem to recall something on thinkgeek or something that had five buttons, and required 5+ keystrokes to validate that you could get into the password file. Then, on the attached LCD display, you'd see your passwords.
Seems like exactly the sort of thing that would be useful in this sort of situation. Anybody else had experience with this gadget, or similar?
ceci n'est pas un sig.
Every few months somebody makes the "discovery" that users can't remember all their various passwords, and that help-desks are swamped changing passwords, usually for the same dozen users that can't remember how to do their own job on the computer, and are always asking for help with some program called "Microsoft," as in, "Oh, I'm using Microsoft, and I need to know how to find out how many departments have gone over budget."
This is the same damned thing that's been going on for almost twenty years. And yes, corporate password policies add to the problem, rather than fixing it. As a superuser, I've been using "God as their password" as my password for years, since I heard that most 1337 h4ck3r6 use "God as their password." I've never been hacked. Or cracked. Or sniffed. Or snuffed. Go figure.
So, this is exactly the same thing they'll find out next year, too.
Microsoft is to software what Budweiser is to beer.
Seriously, I've got maybe 9 email addresses, 3 or 4 different logins at work and dozens of websites with passwords. With the websites, I can have the password manager do it's trick, but I'm screwed if I use someone else's PC or if someone uses mine, for that matter. So, I've had to resort to using the same couple passwords for the majority of things and I have to write down my work passwords. Who the hell can remember all of those passwords, especially if they rotate on a monthly (or whatever) basis and have to conform to rigorous password requirements?
I have offloaded Internet security into Material security.
I use a separate password for every forum I care about. My passwords on my personal computers are changed regularly. I can do this, because of my password book. Without it, this would be implausible.
It is conceivable that someone will get my password by taking my book from me, and snapping pictures of the password pages with their cell phone. Very well then, let someone make the $500 airplane trip over here, come into the office, find my book, and then start snapping pictures. Or maybe find me on the streets if it's lunch time, and rip the book out of my backpack. Conceivable.
But I think this is prohibitively expensive for most people. It would be cheaper to hack a website, and get some other guy's password, and see where else the password might be usable.
I think it is less risky to keep a watchful eye on my password book, than to use only a finite number of passwords.
If someone thinks this is wrong, tell me what you do, and tell me why it is more secure. Not what you can imagine doing; Rather, tell me what you really do.
I saw on a web site somewhere (sorry can't remember where) a simple, elegant solution to this problem, at least when it concerns logging on to web sites.
You have a single password. This password is combined with the domain name and then processed with an appropriate mechanism (e.g. MD5) to produce a unique password for an individual site.
I think that's a great solution and think it should be incorporated into all open source web browsers. The user doesn't even have to know it is happening. Much more practical than biometric solutions.
It was a joke, people.
Gx2700- impossible to guess ( the model number of Dell machine i logon to..)
7940 - imp to guess again..well its a pin for our corporate voip number...7940 happens to be my cisco phone model number too..
Fedoracore4 - imp to guess again..(That i m not telling what it is for...)
why can't all companiese simplify and streamline their system access by using single sign-on systems like Kerberos?
Then they can enforce frequent password change policies (45/90 days) without requiring the user to keep track of a dozen system accesses.
i used to work in a bank that has 2 passwords for the intranet, one for Novell/Windows, 1 for Oracle, 1 for DB2, and about 4 seperate Unix servers. gaaaaaaaaaaaaaaaaaaa
If you try and force users to use stronger passwords than they can remember or change them too frequently you'll just get post-its and helpdesk. If their passwords aren't secure enough, get them to use etokens or something similar.
I am trolling
http://www.GiveMeTheKey.com
i just started using PasswordMaker a few days ago and it's very cool. the only thing i don't like about this kind of solution is that if you somehow compromise your master password you've got to go and change ALL of your passwords.
the firefox extension for PM is very nice.
in this age of communication i'm just not getting through
And I had some app running in the background (something FF related?) that kept trying to auto apply my original password (yes I cleared password from inside FF). After the 6th lock out of the day, I got my network tek's to let me reset my password.
Total cost of the password change? Maybe a manhour's worth of time (between myself and waiting on the teks, and the teks stoping their work to fix my account). So maybe a hundred dollars or so. But we have 800+ employees in 5 branches. That's a lot of password change headaches.
-Rick
"Most people in the U.S. wouldn't know they live in a tyrannical state if it walked up and grabbed their junk." - MyFirs
I wonder how long before we figure out that this very requirement frequently leads to sequencing of the password, which completely defeats the purpose of changing it every so often.
I do like your idea, though, for places where I don't have to change the password every so often.
No-one seemed to have mentioned that the pass-phrase to decrypt everything in the world in the movie "Sneakers" was "Too Many Secrets". I guess it could have been too obvious.
I just use an algorithm based on the web site, plus an additional few letters. For example if the site is Slashdot your password could be slashDOG8cAt, on Google it could be googDOG8cAt, etc. You can get a little more creative when financial or other stuff is valuable, e.g. a different user name and password algorithm for banks/credit card sites, etc. One important note - treat every computer not in your home as being infected with a virus/key logger - DON'T use public computers for your financial stuff.
Obviously - for many websites, security really doesn't matter, and so the same password can be used for most of them - just don't use the same one for the important stuff.
..........FULL STOP.
Mom's maiden name is one of my biggest annoyances.- or-hack with a wide open back door.
My bank just implemented a mandatory Mom's maiden name password retrieval system. So now I have my super-secure-password-that-nobody-will-ever-guess
pisses me off.
This is a problem, however at my work (and a few other gigs) I've seen Password deficiency in the workplace. Too many projects headed up by non-technical people that don't understand the importance of passwords. Obviously a unified solution (NFS or the like) would help tremdously, but for things like servers, getting to a root acount woudln't be a good use, so I think it'd need to be a biometrics (fingerprints) solution, with a "sudo like" funtionality on the server. ie- the user with this fingerprint can do these things, etc.
fak3r.com
I use Another Password Generator for all my passwords. http://www.adel.nursat.kz/apg/
As a general security measure, I use different passwords for all the Internet services I use. I simply do not trust the random forum and service owners I use enough; not because I distrust any concrete service like say Slashdot, but because it only takes one dishonest service owner to look up my password in order to have them all if I were to use the same one everywhere. Instead, I have a very long, huge text-file with all my password which is stored on my bestcrypt http://www.jetico.com/ partition. The system works great for me. Alright, I have to look up the service and password every time, but as I always have that file open in kate since I use it frequently it is not a big deal. This works fine for me and I recommend it. This way I only have to remember the actual sentence I use as a password for my bestcrypt drive, and nobody can use the password on one service to guess my password on another since they are all random garbage like we4kBoc3fis...
So I think that a "a master password" IS the solution. Every employee can easily have their own personal master password where they keep a record of all their passwords, and this allows every employee to have a random password that only works for them assigned for each service they use.
9/11: Never forget it was a false-flag operation
KeePass Password Safe
self included.
But I kept getting access to John Holmes account. And they say those e-mail elargement ads never work! Ha!
(hopefully moderated for humor)
...OneBigTextFile?
Why don't sheep shrink when it rains?
I found that keepass works really well. But I've switched to a mac and the OSX keychain doesn't have as many features.
I wish there were a cross platform solution, so I could store the database on a flash drive and access it at work (on a windows pc) and at home (with an OSX solution).
It does not solve all the problems, but shibboleth may solve some of them at least.
I started using robotron, way too many passwords to type in daily. I have password safe with over 300 passwords, from sites, servers or applications. Crazy.
Then IT thinks its good to change passwords every 30 days on some sites, password management alone takes 1-2 hours a week, not counting the times I have to change passwords for other people.
If anyone knows a opensource robotron replacement that works in both IE and Firefox, reply. As for password safe, been trying a new opensource one called Keepass that looks pretty nice, and ported to multiple platforms.
Flamebait? Surely that mod didn't think the OP was serious?
It was not a simple task - its a shame - it shouldn't be complicated.
Anyway. The solution to too many passwords is implementing server side apps that use some sort of single sign on.
Also - personally I have hundreds of passwords for work ( I admin lots of stuff and work on lots of different servers )
And hundreds of passwords for my personal use. I manage them all with PasswordSafe - available on Source Forge.
Conserve Oil, Recycle, Boycott Walmart
The reason we have too many passwords is obviously because we have too many secrets!
old problem. I started four years ago with the goal to get rid of
all those passwords, and instead use a nice usb crypto token for
authentication.
my suggested token is a axalto/schlumberger cryptoflex 32k with
egate token adapter (so you don't need a smart card reader,
only a usb port). I don't work for them, I don't get any benefit
from this suggestion. but they are cheap, fast, latest technology
(important if you consider timing attacks, power analysis attacks
and all that stuff), and most important: well documented, well
supported, and easy to buy (www.scmegastore.com). most other
companies hide their details (even the user manual requires
an NDA), and buy is sometimes difficult (because they want
to sell software and services, not only the plain token).
openct: smart card reader
opensc: smart card library plus pkcs#11 module
openssh: recompile --with-opensc
mozilla: simply load the pkcs#11 module.
libp11: easier to use than the standard pkcs#11 interface.
engine_pkcs11: engine so you can use openssl with your smart card.
windows: "smart card bundle" our binary installer bundle with
openssl, opensc, putty, libp11 and engine_pkcs11.
pam_p11: login with your smart card (simple, local module).
pam_pkcs11_ login with your smart card (full features, signature checks,
ca chain checks, crl checks, ldap, kerberors, etc.)
all of that: www.opensc.org
disclaimor: this is shameless advertising for my open source projects.
I'm a typical engineer at an aerospace company and I have 15 passwords, 9 usernames and a voicemail PIN for my accounts. There are about 5 different sets of password requirements, depending on the system. Some require symbols, uppercase, or numbers and some don't. They have different refresh cycles, most on out-of-phase 90-day cycles. Some secondary systems have to be updated manually to be matched to primary passwords.
I can't remember them all, so I use a password minder program on my PDA to reference. This stores all my passwords - except for the three passwords and two usernames which are verboten outside of their area -- and I refer to it every few weeks when I blank on an infrequently used password.
Is this typical? How many do you have?
ShoutingMan.com
Is the solution a master password, with all of the potential problems that represents, or biometrics, or are we stuck with post-it notes and a call to the help desk?"
Doh, I can't believe this, this is why the Microsoft Passport Network exists!
What do you mean "potential problems" by the way??
Just submit a minor resumé of yourself and a valid mail address to Microsoft and you're in!
Beware: In C++, your friends can see your privates!
SplashID is my Palm password vault of choice. Windows and Mac users can also sync it with the associated desktop program. If only it would sync with KDE Wallet, it could be my most favoritist Palm application ever.
Dewey, what part of this looks like authorities should be involved?
I use digits selected from pi
I reviewed it at my security newsletter for nontechnical people
I use passwords that, even if they were broken, no one would dare type: CmdrTacoIsSoSexyAndHot!Droolz!11!
What's the advantages?
Cons:
I already carry a cell phone and a stack of cards everywhere. It's not expensive to me. But it'd take an insane amount of cooperation to get a standard going and the device popular.
Kjella
Live today, because you never know what tomorrow brings
So I just use the "Forgot Your Password?" links which are now everywhere, fortunately, to email me a new, randomly generated password to my email address. Within minutes I'm able to logon where I need to. Whenever possible I set the cookie to "Remember Me" so I don't have to do that little trick all too often.
When's the last time you logged on to Slashdot ? You can set the login cookie to expire every year... Good enough for me and perfect illustration of the point.
Why do we insist on believing that everything having to do with computers is new? We have a mechanism in place for just this kind of security. It's called the lock and key.
So, everyone has a usb pen drive. We'll call this a keyring. The keys are encrypted certs stored on this keyring. Think pgp.
Now, each system you want to access, you simply plug in your key ring and let the system do the rest.
Now, I hear some of you saying: What happens if I lose my keyring? Same thing that happens if you lose your regular keyring, you change the keys. And being encrypted bits of data, you can make backups in the comfort of your own home.
I imagine a system where you are never actually prompted for a password, although websites and the like may ask for your credentials. This would all be stored in either your keyring or the underlying OS itself, supplied as requested.
Mod me down with all of your hatred and your journey towards the dark side will be complete!
I use a mnemonic , usually a shape. As in, my yahoo mail password is shaped like a "Y", Amazon is an "A", etc. That is usually enough to trigger the rest from memory. Work is a "W". Since they do have a password expiration policy, I just walk the "W" around the keyboard since there are dozens of variations possible.
Good judgement comes from experience, and experience comes from bad judgement.
- W. Wriston, former Citibank CEO
I can tell you that even one password is too much for most people to remember. And I'm talking about university staff and students, you'd think their are smart enough to remember...
Anyway, the main reason is our windows policy that forces you to change your password every 3 months. People tend to be annoyed by this and just quickly think of something which they then easily forget. So I think this policy actually is doing more harm then good.
-DJ
testing 1 2 3
I am responsible for assisting in account management and security maintainence for my organization. People have the capacity to remember multiple passwords. When they complain about the complexity of the rules we have or the number of different passwords for the many systems we have, I remind them that they probably have remembered hundreds of telephone numbers and know many recipies without fail. This puts it all in perspective for most of them, but all the same I always check under their keyboards for evidence.. hehe
Unavoidable obstruction to high security on the end user level. if they're too lazy to write down or memorize their passwords, too cheap for higher-technology solutions (biometrics, etc..), and not employed by a company that offers neat little LED gizmos to feed them a new password every minute, how can they expect their data to remain secure from everyone else? I personally very much like this site's services... people don't often guess 20-character randomly-gneerated passwords.
"Those who think they know everything are of great annoyance to those of us who do." - Isaac Asimov
Passwords for individual websites is a bad idea. Better would be to modify software to generate custom key pairs on a per website basis based from a combined salt string generated from a digital signature for both the user and website. The browser could prompt, on first demand, for a username and password that would be hashed to create a unique sig for the user and that'd be hashed with the website's digital sig to create a unique id sig and that would then be transmitted to the website to prove the user's identity.
I'd use the site's domain name as part of it's sig so that it couldn't be spoofed easily. Have the browser check that the sig is coming from the site it claims it is coming from.
I'm sure this idea needs polish but it's really the sort of system we need. Something that doesn't require the user remember more than one username/password combo and doesn't require any computer to remember the user's password data for them (bad for security and troublesome if the user roams). If the user decided to change their password they could use current methods of going to the site and submitting their email address, which gets sent a link that will allow the user to associate their new password with the old identity.
At what price learning? At what cost wisdom? The price is a man's peace of mind, and the cost is his life.
Novell has a product called DirXML (Nsure Identity Manager) which can synchronise password from and to almost any database. They provide connector for ADS, Oracle, PeopleSoft, SAP, etc. And you can write your own... With NSure SecureLogin which can safely store password for you, I've setup some truly Single-Sign on solution. Connect a biometric or a token card reader, and you're all setup !
Mess with the best, die like the rest
The networks should standardize on a public key authentication system so that only ONE password and ONE I.D. is needed. Then the various networks, servers, and companies just add the authorized user to their authorized user list while a public key server maintains the users and keys. The client machine generates a login request with the private key, and the server authenticates the login request against the public key server.
If you have a post-it up on your monitor, then wouldn't someone figure out your password much easier? I never put numbers in my password, but I use caps and things that people wouldn't expect. It's crazy how people try so hard to hide their password and make it so complex that they forget it. That's happened to me on more than one occasion, and I had to ask the tech support to change it. From another post, I do believe everyone should have their own form of coding...like some secret spy network...
The reason he didn't explain it was because it was bleedingly obvious and he assumed you'd know what he was showing. I've never seen such a pratish post in my life. Ecode.. whatever.
One password to protect your certificate. The certificate can be used to provide access to as many sites or services as you need. Certificate revokations are relatively easy to implement, and in most cases yearly certificates would be sufficient to keep things secure. This concept is being implemented by the organization I support, and so far we haven't noticed any problems.
Seriously. It's annoying. I've tried it all: post-its, using the same password, using a "root" password with a number added to the end. Unique passwords for each site using the domain and a number, storing passwords in handheld devices and looking them up manually and various password managers.
I finally ended up with my preferred solution, which gives me a seemingly random string of characters for every site that I visit. These strings are a hash value generated by combining the domain name of the site, another private salt value and a master password as the final salt value. With this method, I only have to remember one complex password.
This doesn't work for sites that require you to change your password often (since the domain stays the same). But given that I only need a couple of those, another alternative works fine.
The major downside (one could argue, flaw) in this is that if someone were to have your master password, they'd potentially (assuming they knew the logic and hidden salt values behind the hash) have the ability to access ALL of your accounts you had used the system for.
Obviously, for this reason you must be careful in selecting a long, complex and unique password while avoiding the temptation to write it down on a post-it note
If your password is compromised, will someone be able to do stock trades and make it look like you did it? Would they be able to expose your company trade secrets and make it look like you did it? Would they be able to access classified material of a military nature (even mundane stuff?)
Stuff that could put you in a Federal Supermax or Gitmo deserves good security hygiene on YOUR part.
Can you pass this responsibility to your employees? Certainly! Make it a serious matter to forget a password. No help desk call needed. The post-it note? A firing offense! It's that simple.
Can you pass the responsibility on to your customers? NO! And here's where you are forced to compromise. All you can do here is a best-effort at security. That has different parameters for a bank, than for a mundane blog.
-fb Everything not expressly forbidden is now mandatory.
For most people, *one* password is too many to remember.
steve
Oh, you're not stuck, you're just unable to let go of the onion rings.
One of the Security Now podcasts had a good sugesstion to have a unique password algorithm (IMO a good suggestion). The algorithm is the same for each website, but the password itself is different for each website. For example, the inputs for the algorithm would be: the name of the website, and, some kind of hash unique to you. You insert the hash somewhere into the name of the website. Suchlike:
website: slashdot
hash: #somekindofnumericalsequenc#
Then
password: slah#somekindofnumericalsequence#dot
or
website: hotmail
hash: #somekindofnumericalsequenc#
Then
password: hot#somekindofnumericalsequence#mail
The point is, it's easy to remember a password formuala/algorith that applies to many, many places rather than trying to remember manay, many passwords. You don't even have to write them down.
I'm forced to change my NT password every 60 days at work. So I do something I know is "the wrong thing" -- I used the same password on every work system. My password is secure, and I'm not worried about it, so I just don't worry about it. What sucks, though, is that many of our systems have different password requirements. Some require a mixture of upper and lower case. Some don't allow a password to begin with digits and some do. Some require at least 8 characters and others have an 8 character limit. When my 60 days get close, it usually takes me three or four attempts to get the same password on every system until I work out the kinks in all of their different password demands. And God forbid I forget one of the systems; I'll never get access to it again with the passwords I choose.
Oh, thanks to someone here many, many moons ago, I don't try to think up hard-to-guess passwords any more, or make up pneumonics I'll forget, or any of that nonsense. Patterns in the keyboard are super easy to remember and impossible to just guess without having my accounts reset.
--Jim (me)
Identity 2.0 it's nearly been blogged to death.
/. news for the lazy and ignorant
Take a look at this really cool presentation, even if you find the subject matter boring the presentation is sharp, http://www.identity20.com/media/OSCON2005/
I've been using IBM Security Chip with biometrics for 2 or 3 years now and have had great luck. I just got the new T43P with built in biometrics and have it control everything from internet passwords to power on and hard drive passwords. The best part is everything is encrypted with a key stored in hardware which makes it pretty darn secure and really easy to use. Its a pain if the chip goes bad, so archives still have to be kept of the key on physical media, but in a corporate environment this could be done pretty securely for an entire organization from a centralized system.
Security Now podcast.
Technabyte - Read my tech news blog.
My solution is not nearly so geeky as some of the others, and is relatively low-tech.
There is one password that I use for all accounts that don't require frequent changing. It's a nickname that only one person in my life ever called me by, and it can easily be combined with a number for numeric/alpha requirements. The name is 8 characters long, which is sufficient again for many uses.
For accounts that require regular change (most of my work accounts), I tend to use one password, and change them all at the same time. This password is typically in the form of:
XXYYYYYYYY
Where XX is a two or four digit year, and YYYYYYYY is the name of a person or thing. The person or thing is associated with the year in some way (birth, death, marriage, etc), and the name may be a nickname or uncommon reference. I'm currently on my 12th or 13th version of this, and may or may not ever recycle them. (Some secure systems don't allow this, or prohibit it for an extended period.)
Some of the more cryptic things I have used were:
- Date of our church's original establishment, along with a portion of the church name
- Date of my first pet's birth, and that pet's name (don't use current pets)
- Date of first GF breakup, and GF's name (possibly not an option for some slashdotters)
- Model year of first car, and car model (72PINTO)
Current things in my life are generally off-limits. If I use a name of a friend, the date is then more cryptic, such as the year I met them, or the year of a significant event in their life.
I suppose this is a fairly hackable scheme. If so, feel free to suggest improvements.
Tim
I use SplashID on my Treo, combined with using one password for each of several classes of applications to cut down on the number of them. FWIW, I saw this weekend that Microsoft has a $50 fingerprint reader at Fry's, but with a big warning "Not to be used for financial or sensitive data". At least they're letting people know you can't trust it...
One of the biggest problems I have is when I cannot change my password on *my* schedule. I like to change my password on the first of every month, and sometimes the administrator has assigned an arbitrary number of days, such as 30 (31 would be better). A very few won't let you change your password earlier than 2 or 3 weeks, so it becomes difficult to catch up if you have to use a "temporary" password to satisfy the 30-day system.
I've found that, rather than use a grid or somesuch as others have suggested, what works for me is to make up a multipart password consisting of two unusual words plus a series of letters, numbers, and symbols referencing the current month and year (all in some consistant order). On the first of each month, you need only change the date part. The result appears random, is easy to remember in the long run, and requires nothing be written down. If you're *really* paranoid, you can select two different words translated into two different foreign languages.
As has been pointed out before, the administrators who enforce the toughest rules aren't improving security. The only thing they're improving is the sales of Post-It Notes.
"My country, right or wrong; if right, to be kept right; and if wrong, to be set right." --Senator Carl Schurz (1872)
I think that it is better to remember one long string of characters instead of remembering a bunch of passwords.
My old password was:
erihjt9hjnvsiudb9i0943ujgsdojnoa
the key problem here, is that people are lazy and stupid.
the best way to secure something without taxing the average persons feeble brain is to use a password and an ssh key on a swipe card or a usb drive.
that way even if someone gets one they are very very unlikely to get the other. it also means you can change the ssh key on them without them having to remmeber anything. hell in a system i'm impementing everyone get a new key when they swipe in for the day and it expires after 24 hours.
If you mod me down, I will become more powerful than you can imagine....
- My own login on my machine.
- The root login on my machine.
- The root login on my IPCop firewall.
- The banking website.
- The dozens of spurious web sites all get the word common to them all. Basically none of them actually _need_ a password at all, because there are no money or privacy issues, so a common word is a satisfactory solution.
Also they all have very effective mnemonics, so I won't forget them. Now-a-days KDE's Kwallet system is a very effective solution to the dozens of web site passwords stupidity.Here's my solution: I keep one good password in my head. On a piece of paper (or two - no need to keep it private, you can write it in the sky if you want), I write a "hint" for each password I need to remember. For instance, my yahoo hint is "yahoo". My ebay hint is "ebay".
The actual password for each site is the first 8 chars of the SHA1 hash of my memorized password concatenated with the hint (sha1(passwordyahoo), sha1(passwordebay) etc).
I keep a gdesklet applet open on my desktop to generate passwords when needed. The SHA1 algorithm is freely available and already implemeted as libraries in many languages, so moving to a new computer or rebuilding the password generator is simple.
use a system as follows - append a symbol such as $ and then a rotating number with a fixed codeword: - the rotating number changes when password changes are required.
codeword for private financial systems - finance, banking, etc. - example - costly$10rover
codeword for personal systems - email, etc. - example - mymail$10rover
codeword for games, etc. example - gamer$10rover
codeword for hardware around the house - firewalls, etc. example - keepout$10rover
Come on guys, there are reasonable products out there to synchronize passwords
between systems. Surely one strong, remembered, frequently-changed passwords
is more secure than a dozen passwords on a post-it note, less costly than a
smart card or hardware token, and not as vulnerable to gummy bears as a consumer-grade
fingerprint scanner!
One such product is here: http://psynch.com/
I'm sure others work too.
A techinique I have been using for almost 2 years is to Write a few sentences on a sticky note close to my workstation. Each sentence describes a time in my life, i.e. "I used to ride my bike after elementary school", "I watched Star Trek after I returned from Classes at College", etc. Maybe I'm just weird, but I remember the street numbers of all the places I've lived, so I use those numbers to form my password. If this seems to cryptic here is an example.
Rode bike around block after elementary school = 1234 Adam St.
Watched Star Trek after College = 493 Jones Ave.
Let son mow yard for the first time = 3009 George Lane
My password for this postit note would be: "12344933009"
I am able to remember a 19 digit numeric password very easily by using this method (even without the postit hint)
cat /proc/sys/kernel/random/uuid | cut -c -16
Why read the article when I can just make up a snap judgement?
uc = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
lc = uc.lower()
digits = "0123456789"
funny = "!@#$%^&*-_"
import random
for letter in lc:
if letter in vowels:
print letter + " - " + random.choice(uc) + random.choice(funny)
else:
print letter + " - " + random.choice(lc) + random.choice(digits)
# the indents are lost. Indent if/else by one tab and the print lines by two tabs
# 1 tab = 4 characters (don't flame me about tabs vs. spaces)
# there are lots of elaborations (three characters per line, randomly swapping the order, etc.)
Think global, act loco
Namaste
Isn't that the cleverest thing ever! Nobody could possibly guess that, not in 1000 years. Who would possibly think to look for such an obvious word? And when that doesn't work, I make my password my login name. It hurts being this smart.
i thought this article written by Kim Cameron addresses some of the issues mentioned here:e laws.html
http://www.identityblog.com/stories/2004/12/09/th
HD Trailers
... remember all my passwords. I am only talking on the order of 20-30, but I remember them all. It is not that hard, but then again flying isn't that hard for superman. ;-)
Z
2+2=5 for extremely large values of 2
but I have 9 other chances to switch that one up once "guessed." ;)
You know what?
I installed PINs, http://www.mirekw.com/winfreeware/pins.html, on a USB key over a year ago and haven't had a problem remembering passwords since. It's hard to beat a free solution that offers 448-bit Blowfish encryption and helpful features like password aging and password generation.
that is only 8 passwords, you are lucky!
I have to deal with: 1 Novel passwd (for 4 different systems), pincode + logname + passwd for internet, 1 passwd for LDAP (deals with about 6 different systems, however passwd length is limited between 6 and 8 characters!!!). 1 pin code + passwd for separate VLAN, 1 password for special large emails system (handles files > 2G!), 1 passwd for the 2 linux servers, login name + passwd for documentation system, 1 passwd for normal (outlook) email system, 1 for lotus notes email (yes, I have to use 3 different email systems). 2 logname + passwd for special database apps, And some of these are requiring you to change your passwd evcery 6 weeks or so.
So I have to remember about 4 different login names, 2 pincodes and more than 10 different passwords. At least some systems use LDAP otherwise it would have been 16 different passwords.
My best friend is a post-it! Of course, if you do not know the master passwd, the codes on this paper are useless.
this thing is great, because the big threat is not the shmuck looking at your physical machine or sitting at the desk next door but the guy sniffing packets, hacking your machine over a network or running a trojan on your machine. Also even if they get the tag you still should have a strong password to go with it and once it goes missing you call up the admins and they deactivate the token before he has a chance of getting into your system....That is until someone breaks RSA's number generation algorithm, about which little is known.
Based on the topic, this is probably as good as any to ask:
.Mac account, the syncing is obviously possible... just not sure how open the Keychain database is.
Does anyone know of an conduit and Palm app which will sync the OS X keychain to the Palm and allow me to view/edit/create keychain entries on my Palm?
Since Tiger supports syncing of the keychain over iSync to your
And yes, I know about all the OS X/Palm apps which allow you to store passwords and view/edit them on the Mac/Palm, but I don't want TWO password databases. OS X Keychain already does everything I need and it's well supported in many OS X applications. No need to reinvent the wheel.
-Aaron
Windows (as would be any OS that attained broad use) and/or disk hardware are sufficiently unstable that I occasionally have to scrap my existing data and start over from scratch. Additionally, I use many different computers on different networks to access the same websites, etc. Backups are a pathetic workaround for this, and are themselves a vulnerability.
In fact, any scheme that relies on a password safe resident on one machine will always be susceptible to catastropic lossage, and is a pain to use on other machines. And any scheme that relies on 3rd party storage of the passwords is vulnerable to attacks on that storage and is inherently harder to maintain.
Personally, I think the only thing that will eventually solve this problem is a single password plus a smartcard-like system (with automated backup to some other local storage). We're not going to get there easily, though. And it's not a panacea either, because smart cards can be lost, stolen or fried just as easily.
Ironically, this problem is essentially another variant of the fundamental issue surrounding identity theft: in an information society, it's absolutely crucial that we be able to reliably uniquely identify every person, but anything we use to do that will end up being abused just like SSNs.
Biometrics are starting to mature. We should be looking at "secure" biometric devices in the next five years or so, which could take a load off of both over-passworded employees and their helpdesk staff. In the meantime, current biometrics work well for getting rid of passwords, but are not very secure in and of themselves.
For now, we can only memorize or use password generators (like the perl script given above). Or forget and create a new account... if we can.
md5(master_password + website_domain);
Pick a totally random password, and put it in your wallet. If anyone can get access to your wallet, they can get access to you. If the bad men in the dark glasses want your password, they'll drag you off, and torture it out of you. But short of brute force, if you take care of your wallet, your password is safe.
If someone can read your password note as you type in your password, they've already got past the physical security in your building. Any decent spy who can get into your building can probably install a keylogger or just videotape (or even memorize!) your keystrokes if given the opportunity to watch you. If you're relying on a password to protect you against that kind of attack, you've already lost.
Fortunately, for most of us, that level of security isn't required. We just want to keep some semblence of an audit trail, so that it's fairly clear who did what. For that level of security, as long as someone isn't staring at the paper as you type in your password, you're probably quite secure. You've got total randomness against a non-local attacker (so those threelite internet haxors can't crack your password), and a local attacker has to physically compromise either *you* or your entire workplace security!
In short, don't put you password on a post-it, because yes, janitors can read those, and not all of them are computer illiterate. But don't use a weakened password just so you can remember it, or someone on the internet will crack it, and then you'll have *real* trouble.
This is where a decently support standard would really help. Something that's easy to use and implement in 3rd party applications (i.e. from PHP, ASP, ASP.NET, etc etc etc).
Isn't this where LDAP was supposed to help? Does anyone have any real world experience write 3rd party software that will do single sign on with MS's ActiveDirectory, Novel, Sun, Netscape, etc etc? All from the same code base and _simple_ to configure?
I have a strategy that has worked out very well for me. Well worth implementing, if I do say so myself!
(1) For any site or "thing" that makes you set up a password, first consider whether or not it needs to be secure in your own judgment. For example, I don't give a rat's ass of somebody figures out my NY Times login or my TitanTV login, but I'd rather they don't get my bank login!
(2) For "unimportant" logins, choose an UNUSUAL login name (so that you don't find that it's already been claimed on more popular web sites), and a password of 6-8 characters, that you use for ALL of them.
(3) For "important" logins, have one part that is a "master" password, maybe 5 characters. Then, for each site, choose a few additional characters that you tack on to the beginning or the end of it, which remind you (in some obscure way) of the service it's a password for. Personally, I have adopted a simple cipher. So, if the password is for Bob's Skate Shop, I might choose bss. Supposing my cipher is "1 letter later in the alphabet", that becomes ctt.
In my opinion, this creates an ideal balance between usability and security. If somebody finds out my password to Bob's Skate Shop, they would still need to know my cipher, and figure out which part of the password is "standard", before they could log into my credit card account.
Hook up your windoze computer to a network and have it owned in 12 minutes anyway. All good practices, when applied to insecure softare, are just an inconvenience to the user. What good are passwords, expensive biometric scanners and all that when your users have Outlook, IE and your "server" runs junk that gets owned all the time? That's just good money after bad.
Friends don't help friends install M$ junk.
Except that it masks PGP keys etc. behind a very simple user interface.
Several open source implementations are available already.
http://lid.netmesh.org/
At the top, are your ultra secure passwords that you only use for your bank / brokerage / etc. At the next level down, is your password that you use on all your personal computers, encrypted volumes, shell account, etc. Below that, is your password that you use for stuff you login to over the internet and don't want other people logging into (e-commerce, etc). Below that, is the one you use for crap you couldn't care less if people use (nytimes.com, etc.).
If you follow that system, you'll end up with only half a dozen passwords or so, and you'll still be pretty secure, as the important passwords aren't used as often as the less important ones.
Great utility that generate password for each site by hashingO n.html
the values of a master password plus the domain name of site
E.g.
my_master_password+cnn.com=unique hash
my_master_password+slashdot.com=unique hash
The unique hashes are used as password and you only have to
remember the master password which remains the same.
See a video tutorial: http://weblog.infoworld.com/udell/gems/singleSign
Or original site of utilitiy: http://angel.net/~nic/passwd.html
Plus a bloggers explanation:
http://weblog.infoworld.com/udell/2005/05/03.html
I realize that they aren't generally designed to be hidden, but I often get more frustrated with the number of user names which I have to remember. Sure I would like to maintain a consistent account name across all services but there is always some 'jerk' who parks on my preferred username. Some sites are beginning to wise up to the situation and including a "mail me my username" option. Writing all my usernames on paper is unrealistic and a single sign-on system, internet wide, is infeasible. Logon overload is certainly a realistic problem as registration becomes required on more and more services. Hopefully logon's will not become so prolific that I will need a username to Google search. Am I the only one who is finding this?
Proof by very large bribes. QED.
I have a password that will be easy for everyone to remember, foo.bar. Change it to that and everyone send me your id's and I'll make sure it's secure. That way everyone only ever has to have one password.
I worked for a company that had the most retarded rules for passwords. It had to have a number and a capital letter in it. The number had to between the first and last letters. We had multiple logins for various systems. We had a separate login for our computer, then a login to access our application suite, then a password for each application. And we had 7 or 8 of them. Needless to say, I kept the same password for as many of them as I could. My password was ih8Sprint. And then they made us change them every 60 days, so it became Ih8sprint, then iH8sprint, then Ih85print. You'd never guess who I worked for.
"You'll get nothing, and you'll like it!"
I don't work for sun, but I think that the mobile phone makes a pretty good store for passwords encrypted by a master password.
The PC is obviously out of the question if you use different operating systems... for instance, my home PC is primarily a KDE desktop, so its wallet app is used for storing all passwords. But I have no simple way to access that wallet from the Winblows machine I have to use at work.
Phones, however, usually have this "code memo" feature these days, which lets you wrap any information you want in crypto, and seems to be quite useful for password storage.
Of course, the same master password problems apply... if you lose that one password, you lose them all. And if someone steals that one password (and the phone) they steal all your passwords. But it's better than a simple text file on disk somewhere, and much better than the post-it notes.
Karma: It's all a bunch of tree-huggin' hippy crap!
Where I work (a university) we used to have a fairly fierce password regime. Change it every four weeks, no re-using of old passwords, minimum eight characters including mixed case, numerals and punctuation - that kind of thing.
Later on, we learned better, and adopted a much more relaxed regime, in which we specifically didn't force expiry or insist on passwords like tH1s#0n£3&@ for most of the users (we were stricter with people who could order goods or edit the payroll!).
The main reason was that we evaluated (for a range of typical users) the potential financial cost and likelihood of being prevented from working by our password regime, against the potential financial cost and likelihood of suffering a security breach. And in almost all cases, our security policy turned out to be much more damaging than any plausible security breach.
What I'm wondering, in connection with the requirement by many companies that passwords be changed regularly, is this: is there any empirical evidence as to how much password hacking actually occurs, and whether this policy has any real effect? By "password hacking" I mean anything other than theft of the actual password files housed by the authenticating system.
Because unless someone has stolen your password from another source (like the authenticating system itself, in which case changing the password regularly has no effect), changing passwords just provides another opportunity for your password to be written down and then lost/stolen. The fact that most people write the password down somewhere in the vicinity of their computer makes this even worse.
And changing passwords can't prevent brute force attacks, which rely on running through multiple combinations automatically.
(By the way, anyone want to guess how unlikely it is that bad guys will try to figure out your password by determining your dog's name and your birthday, or whatever silly mnemonic device you've converted into a password? Bruce Schneier calls some bad terrorism response plans "movie plot" scenarios because they are responding to things that only occur in movies, not real life. Although the movie scene with someone breaking into someone's computer by reasoning out what the person would use as a password is ubiquitous, does this really happen?)
Finally, the other justification for this policy of having ever-changing passwords is that if someone does get access to your password, it will either be outdated already or will become outdated. But how many situations does this really cover -- and how much of a help is it if you are not scheduled to change your password until 2 months later (now, a password that changed every day or every minute would be a different story -- oh, wait, isn't that encryption?)? And even it it helps somwhat, does that outweigh the risk of having employees post their passwords next to their computer?
Know what these policies may really represent, at least in some instances? Businesses trying to make it appear that they are putting security into place, when it's really just a fig leaf.
- Web Passwords
- Application Passwords
- Security Certificates
- Public/Private keypairs
- Secure Notes
It integrates with most apps on the system so, for instance, if I go to a passworded site in Safari (the Web browser) and Safari can get the username and password from the keychain (by asking me for my keychain password) and then I can optionally allow Safari to always access this item without asking me first. You can have multiple keychains, have some unlocked automatically and have more secure ones that you have to unlock each time, or even go into the Keychain Access application and manually unlock...Specialist Mac support for creative pros, Melbourne
very nice..i woul dswitch to apple but #1 is price, #2 is too much softwar i run that is not compatible...
~~"Of course, that's just my opinion. I could be wrong." ~~Dennis Miller
I've worked in companies which require you to have to remember passwords for lots of different systems.
In my most recent company I've worked to ensure that Windows, UNIX, Remote Access passwords are all sync'd.
When we ask someone to log in to a system, we ask them to use their 'office' password, not your network password, not your windows password, not your unix password, your office password.
Single logon, can be done - should be used.
How is it that no one has mentioned distributed identity protocols, such as Open ID? That would solve the problem for the web, at least.
God became man to enable men to become sons of God. -C.S. Lewis
One USB stick is not enough for your passwords.
I picked one of my PDAs fully dedicated for only password database, plus other technical details for my machines, net services or other accounts. Methodically not using it for anything else, no network, no usb plug to any machine, ever. Backups on flashcards. Second identical PDA in the drawer, without data but ready to accept backup flashcard at any moment, usualy used for playing with NetBSD.
Today, the database has 726 records of active nick/identities, Maljin Jolt on Slashdot among others. What a pile of sticky labels could that be!
There you are, staring at me again.
I've written an online service called www.muyseguro.com (which stands for "very safe" in spanish). Currently is in spanish only. It is a digital vault online for storing passwords, credit card info, and any other sensitive information that you may need to keep it safe and ubiquitous. The info you store there is encrypted with powerfull algorithms (128 bits encription), so it can be kept safe. Please, review it and let me know your thoughts about it.
I have 3, count them 3 different passwords for my phone alone at work. God save me from the passwords! Biometrics never looked so good....
Too many passwords
are being lost in the dark
Too many passwords
are stained up or marked
with the brown of coffee that must get spilled
so that we can stay up without caffeine pills
Too many passwords
are being posted on Fark
Too many passwords
are lost on a lark
Moderator hint: a comment is neither "Flamebait" nor "Troll" if it is true.
I have a few words, all of which are non-English that I combine with certain numbers. In all there are about 5 words and 5 numbers that I combine to make up the vast majority of my passwords.
Sometimes I splt the word and insert a number, other times I add a leading or trailing number and other times I do a combination. So sometimes I forget a password, but I can give a few guesses and get my stuff.
LK
"Hi. This is my friend, Jack Shit, and you don't know him." - Lord Kano
I work for the network engineering department at my college, and a quick tally puts me at: 3 switch passwords 4 passwords for different types of wireless AP's, etc. 4 passwords for utilities to manage said hardware 3 passwords for various scripts written by people around the cubicle farm 2 passwords for programs we use to log the location, serial number, etc. of all of our switches 1 home login 2 passwords for email addresses (school and gmail) 1 universal password I use for stuff that doesn't need to be particularly secure. The only passwords that are static are the home login, gmail account, and universal password. The work passwords are changed every 45 days, the school password has to be changed at least every 120 days. Because of my affinity for losing wallets, I can't really keep a list or anything. I don't use any cheating methods like prefixing all the passwords with the same string. This is partly because I don't choose any of the work passwords, and partly because that's lame. The idea is if you're not a moron, you should be able to keep track of a couple of passwords if you're going to be using them reasonably frequently.
"Even a monkey can remember 10 digits. Are you dumber than a monkey?"
E.g.: IWillBeBackBaby,ILovePizzaHut,LifeIsWonderful, etc I think passphrases are much simpler and easy to remember.
Changing passwords and entropy-enforcing rules seem to me like putting your cash on the table-top, then building a barb-wire fence around the table. Putting cash on the table is something you do when threats are small. If threats become larger, you put the cash in a safe, not try to secure the table.
An IT department that's worried enough it wants to juggle passwords, should instead hire a security expert. Then they can look at ideas such as requiring logins to be from a physically secured console, biometrics, challenge-response tokens, etc.
http://www.schneier.com/passsafe.html
http://www.cyber-ark.com/networksecurity/password
My solution -- I changed all my passwords to "passw0rd". Notice that the "oh" is actually a "zero". No one will ever guess that!
I object to that article, and to the next reply.
What the hell *is* the purpose of forcing password changes? If my account is compromised, is it not so bad if the bad people only have access to it for ~60 days or less?
And if the account hasn't been compromised (say 99.99999% of the time), what good is a new password?
Seems useless to me.
Most people don't even think inside the box.
Everyone here using inovative forumals to encrypt and remember a password? I just make the letters rhyme, and then make a song out of it, depending which website I use!
Slashdot, Slashdot where are you? HxcB4MU!
Waste of Mod Point
Pyramid like the old pyramid should be the old FOOD pyramid.
Use DNA.
Including turnkey or "cookie" systems, such as the one GWB carries to identify himself to Launch Control. A simple flash memory card plugged into a USB port, etc. All it takes is the will to develop systems that DON'T use passwords. The minor stuff on the Internet is already managed by KeyChain on Mac OS X, and presumably similar stuff elsewhere. Passwords are sooooo passe, and dongle security is soooooo scalable, you have to assume passwords are still around because NSA wants you to use them.
``Tension, apprehension & dissension have begun!'' - Duffy Wyg&, in Alfred Bester's _The Demolished Man_
Macintosh has had a password manager, Keychain, since 1995. It uses a single master password and integrates with applications. For example, if you access a web site with a Keychain-savvy browser such as Safari, Omniweb, or Camino, the site's password and username fields are automagically filled in. Other applications are supported. See the other poster on this subject whose post was buried.
1995, Dude.
- Inbuilt randomizer that is quite flexible to constrain as needed.
- Nice and easy drag and drop between Oubliette app and target app... This means no keys actually being typed.
- Not entirely certain but I *think* the cut and paste is secured somehow.
Anyways it works and has solved my password problem. The problem in a corporate environment is that this kind of approach is not deemed "seemless" enough. In my opinion the whole directory based SSO approach is overkill in the majority of cases. But if that floats your boat check out:- Protocom Secure Login (now owned by ActivCard)
- Passlogix
- many others but market is consolidating
There seems to be a move towards store and replay of these types of passwords on a smart card in the medium term.Are anyone else finding that it is actually easier to remember longer passwords?
:)
I recently started using passwords of about 30 characters and they are much much easier to remember than small ones (and I actually have short-term amnesia! Or maybe that's the explanation?). Actually I'm even thinking about trying out 60 characters the next time I need a serious password (I'm not talking about stuff like logging into Slashdot which I simply don't bother remembering).
With the long passwords I have the flexibility to use a few standard words combined with pseudo-random keyboard patterns as well as meta-information (information I immediately associate with the password itself).
A generic example could be:
word word, several pseudo-random pattern strings, meta-information
The words act as a sort of list lookup or trigger effect for the rest of the password. So the first "word" I remember if I think for example "black morning" is the rest of the password, it becomes kind of a synonym in my own private dictionary.
A specific example could be (created for this occasion of course):
Black mOrNing Xr7o_:AW#OKjh FFF:D 1c#(
Thats 37 characters and filled with patterns of various kinds (most importantly the pattern established in my brain after typing it regularily). The seemingly jibberish patterns all have a distinct meaning to me, lots of personal human stuff that would not only require an AI or two to figure out (probably even if I told them) but those AI's would have to be very similar to myself (fat chance!)
Also I throw in at least 1 "rule-breaker" into the password (usually the most difficult thing to remember in the start).
Btw for using about 60 characters I'm considering iterating the process one step based on an intial 30ish password.
And as to speed I would guess I use something akin to 10 seconds typing in the about 30 character passwords, perhaps 15, anyway it is fast and becomes automatic after a while.
this comment is provided "as is" and without any express or implied legibility or congruity [...]
Damned this was funny lol
:)
So please moderators mod this gem up.
Thank you LordFnord you made my day! (and it's still morning over here)
this comment is provided "as is" and without any express or implied legibility or congruity [...]
KeePass has to be the best password manager around IMO. Free, Open Source, AES encryption, and in addition to a master password for your password database you can also specify a key file needed to open the database that you can carry around on a separate USB key or whatever. http://keepass.sourceforge.net/
One way password generation based on a simple recognition factor.
:-) Please don't hack.
For instance, I take the url of a site and place a process on it (in this case I look at first letters of syllables) and then add the number of letters in the main url, if there is a hyphen I add each section as seperate numbers of letters. I then add a reveral of my dob (adds some security for brute forcers - which might as well take an eternity) then my initials reveresed in alternate caps, then tag the dns tld onto the end.
So my password for slashdot can be easily deduce is you know I was born on July 9th 1973. I am hoping it is still hard enough that even knowing my middle name is Paul you still cannot work it out.
I suggest everyone does this, you soon find it easy to manage site passwords in your head, and then every year you can change you algorith.
I am starting to think I should change my algorithm, erm!
please type the word in this image: eternity
random letters - if you are visually impaired, please email us at pater@slashdot.org
#hostfile 0.0.0.0 primidi.com 0.0.0.0 www.primidi.com 0.0.0.0 radio.weblogs.com
I have 1... 2... 3... 8 computers just in the room I'm sitting in. I have three computers in the living room; two are in the kitchen. I use about 4-5 computers daily at work. Soo... shell out at least $50 for a biometric device for each one, rather than remember a password? How would biometrics work for a remote console session, which is an indispensible part of my job?
Biometrics are like the Dvorak keyboard layout - a fantastic idea for a small part of the populace. Unfortunately, unless a computer idea is a great idea for computer professionals, it won't fly.
1. No password should be based on personal information, unless it lives inside a protected perimeter (your house) and the password can't be used remotely to access the system. But if that's the case, then maybe you don't need a password at all!
2. Passwords for high-end web sites should be hard to guess (1 chance in a thousand), if you are confident that the web site will detect attempts at trial-and-error attacks against your account. Unfortunately, it's hard to tell what sites do when they get bad password attempts.
3. If you're using Microsoft domain authentication, or a web site that's not going to detect trial-and-error attacks, you're screwed. You have to pick a really nasty, impossible to remember password. This is because it's possible to do on-line trial and error guessing through things like the SMB protocol. I use two longish words with a comma in between - that defeats on-line and off-line attacks.
4. If you are really protecting important information, then spend a hundred or two dollars per computer and put in something serious, like smart card authentication based on a public/private key pair.
I just started at a company (Secured Services), we make a SSO (single sign-on) product (Identiprise) that is Solaris/Linux/Win32 compatible. Not only that but we can require Certs or RSA tokens (the key fob things with the changing random numbers). Once authenticated we can protect all coorporate assets. (We can even secure command line FTP traffic)
/.)
Our system also has user self-service, so your helpdesk doesn't have to field password change requests.
Once you're signed on to windows, the Proxy add-on system can automatically log you into any website, It will learn and maintain your passwords. Most of our customers use it to secure their web apps which are given out to subscribers, but it can work the otehr way: secure access to the services your organization subscribe to.
It's a really cool system.
If you have a large organization, I'd love to hear from you. (Note that this is my first ever hawking of a product for whom I work on in all my years on
jhihn@secured-services.NOSPAM.com (Remove the 'NOSPAM.')
Slashdot's rate-of-post filter: Preventing you from posting too many great ideas at once.
I really should preview!!!
That is Secured - Services.com.
Slashdot's rate-of-post filter: Preventing you from posting too many great ideas at once.
How many times are we going to see an article about this kind of stuff?? I don't check /. on a daily, or even sometimes weekily basis, but I've seen at least 3 articles on this same issue within the last month!
/. would be lobbying for the Department of Homeland Security.
Seems to me, if we were in D.C.,
Do what I say, cuz I said it.
-Meatwad
uh, has no one here ever used Roboform? yeah, they don't have a linux version (yet) - but I gotta admit I'm happy with my password organization.
at least it keeps everything local, works in IE & Mozilla.... and they even have a USB key and PALM sync'er
(roboform.com, duh)
You know I have long been saying that this complex password thing is a crock of bull!!! A web site I log into for my student loans requires me to have a password at least 6 character long with one upper, one lower, and one numeric...
Now everyone out there shouldn't we have the right to keep our personal information insecure if we want to... I could live with 1 or 2 popups saying "Are you sure?" but let me make a simple password if I want to it's my info not yours... Am I wrong??
I guess for companies internal networks that's another thing but these website are all crazy... Maybe I don't care if someone can login to my bank account and steel the $3 I have...
Just my thoughts...
.... are internal jobs.
Path of less resistence (an internal attacker does not have to go through as many loops as an external cracker. There are fraudsters whose step #1 is to get a job in the company to be attacked).
Stringent rules are completely justified.
IANAL but write like a drunk one.
I wish with all my heart that the incompetnet security administrators of $BIG_BANK where I work read this.
One of our password systems (because we have about 4 different ones!) makes us type a password, completely unrelated to the one we need to access our application, when we need to request a reset.
We are emailed half password, then we read the other half on screen (which we can access with the initial password), in order to check the progress of our request.
Once it is approved, we get another half password that can be used to claim the real password we are after.
Every single time I have to go through this proceudre, the password has been houston1 (name of town changed to protect the innocent).
How idiotic is that?