Slashdot Mirror
Spafford On Security Myths and Passwords
An anonymous reader writes "In a recent blog post, Eugene Spafford examines password security along with related issues and myths. In particular, he discusses how policies that may not necessarily make much sense anymore end up being labeled 'best practices,' and then propagated based on their reputation as such."
If I recall correctly, this has been posted before.
God save our Queen, and Heaven bless The Maple Leaf Forever!
I still think changing passwords periodically is a great idea. Even just to keep some cracker on his toes or incase you accidentally wrote it down or devulged it or typed it in the wrong field and is in clear text.
You have a more secure system if it's harder to use a password when un-authorized. Especially if the user is an Admin account.
That which does not kill me only postpones the inevitable.
I have found that using APG is a great way to generate passwords. They are easy to remember since you can pronounce them. For example, I just ran the generation and these are the passwords that popped out. I have found that most users can remember these kinds of passwords.
We all know that its stupid. People write it down on post it notes etc. But when the luser gets hacked he is going to be gunning for the sysadmin who needs to be able to prove that he is serious about security so that he can put the onus back where it belongs.
Thats just how politics work in a corporate environment. People will cover their arses first, do the sensible thing second.
http://michaelsmith.id.au
... getting your server brute-forced by a Slashdotting.
Help poke pirates in the eyepatch, arr.
Monthly change policies. they are simple stupid. If your password is inherently weak, such as your car number, date of birth etc., it will be easy to crack. If you throw a monthly change policy at such people they will change their passwords to simple things. Other option is to educate them to choose good passwords, but that works with half the people. Best solution, let the users not choose a password. Let the machine generate random passwords. Then the user can choose out of those random combinations. At a place where I used to work, the web login system on internal network was set this way. You would click on a button saying, choose new password. Many options would appear and you choose one. If you dont like any of the options you could keep on generating new ones indefinitely. The change policy was that after 1 year you had to get a new password. Perfectly sane and secure. In those random 6 lettered words, sometimes easy to remember combinations would appear, like y1pl3t. Remeber it as yiplet!
If you dont have the benefit of a machine generator and want to specify something remembrable dont be too obvious. For example you have a poodle named fido(If you do I doubt you would be readingMy Aurora : http://www.youtube.com/watch?v=o91ZsGwJYyg
FB : https://www.facebook.com/TanveersPhotography
I worked at a company that rolled out increasingly stringent password policies. It got to a point where the passwords required upper and lower case characters, numbers, non-alpha numeric characters, and (this is the kicker) were required to be changed every few weeks.
I asked around, and gradually discovered that most of the people I worked with had ended up (after months of dilligently trying to adhere to this policy properly) had begun writing their passwords down at their desks.
Writing. Their. Passwords. Down.
It's like this well intentioned security policy had short-circuited itself and put the company in a position far worse than it had been before the reforms. None of the people involved were bad, in fact, I worked with a fine bunch of people who really cared about security and individually had great ideas for making the company safer, but when they were all implemented simultaneously: Ka-BLAM.
A security policy cannot be a list of best practices, it has to be a designed holistic plan that takes into consideration the very human nature of the people it is protecting.
Passwords are like toothbrushes; change them every three months and don't share them with your friends.
With that said, I'd like to argue the point made by the article about periodic changing of passwords. He gave the (not so) hypothetical situation of a password being typed in a login box where someone might see it. This actually happened in my high school, and then we had the admin password to every computer in the lab. And had that access until the last of us graduated. While periodic password changing won't protect you from a serious hacker, it will save you lots of grief from more petty mischief, especially if the person who has your password is clever enough to not let you know that he has it.
writing passwords down is not secure. This is untrue, Sticky Notes now has a special invisible ink mode.
Wish I had pressed preview! Anways this will work with non english speakers or if you know a language other than english. Well best are the languages like Punjabi, Hindi, Arabic etc., which are not popular in the web. You can have a word from those languages. Like bh44gj4. This is pronounced as Bhaag Ja. Which means Run away. Long time back I had a password which was t0g4dh4. This means To gadha, or "you donkey".
My Aurora : http://www.youtube.com/watch?v=o91ZsGwJYyg
FB : https://www.facebook.com/TanveersPhotography
An old company I was with found out how many users forgot their passwords & the stats for password resets with the Help Desk (passwords usually account for more tickets than anything). Upper management didn't like the number of tickets for passwords, so they told people to start using family names for their passwords and suggested they put all the passwords on a sticky note near their desk "in case they forgot".
Funnypics
I tell this to every sysadmin that turns on 100% of the annoying features of enforced password change policies:
"You have to balance security with convenience."
Otherwise people will just circumvent your security by changing their password twice (or 10 times), resulting in the same password they started with, or just write their password down.
How we know is more important than what we know.
Uh... yeah, those passwords look easy enough to remember.
Heck, I forgot my 4 digit alarm code about 6 months ago... and you want me to remember how to "spell" glid-Tev-Pos-EIGHT???
Doesn't anyone remember the 'pass phrase' thing from awhile back? You know - less complex but much longer passwords, so they're secure but easy to remember? "The quick fox jumps over the lazy brown dog" type of thing (though that should probably not be allowed :)
Just please, NO biometrics.
There was never any rational basis for rotating passwords. Spafford's 70's rationale is amusing but bogus.
Well, they *look* like passwords.
They're not actually *to* the systems they're next to, but it's funny how long some baby cracker-d00d will just sit there and keep fiddling with them, trying to get them to work.
Several comments actually:
1- What's the usually accepted frequency of changing the admin password where you work? I work in a Microsoft shop, and there are way too many systems that have the password hard-coded (yes, I know that should not be), and everytime we change it everything breaks down, bringing down the wrath of upper management (the very same upper management that pushes for more frequent changes and more stringent password policy).
2- Another company I know of forced so many frequent changes that users started generating short passwords with an incremental number (d00D$001, d00D$002, d00D$003), making them easy to guess once you learn one (but complying with the password policy otherwise). Is that acceptable? (no I did not read TFA)
3- There was a nice article on Microsoft on passphrases and how they are so much better than passwords. Has anyone had a good (or bad) experience with that?
There are three kinds of lies: lies, damned lies, and statistics.
I always thought the picture based passwords shown here were a creative way of making passwords.
Basically you click a few spots on a random image, and next time you login, you have to pick those same spots again. Forget remembering your password.
Then again, changing passes too frequently causes people to forget them and the end up writing them down, which might be worse. I dunno, it's a tough nut to crack. Need something unique to the person... biometric, RFID, retinal scan, brain wave scan, etc.
The last supposed "high security" place I worked (Oak Ridge National Labs) had a pretty sane password scheme - computer generated every 6 months or year (too long ago, I do not remember now). They generated a big list and you picked one so you could get one you could remember. It was good combination of stuff, not really something that was attackable by a dictionary and they watched external requests pretty hard (ad most of the service providers did also).
But, the problem was that every single hack/intrusion we knew of (either on our machines or lab wide) had nothing to do with password and all to do with users desktops on SSH key management. Everyone wanted symetric keys so they never needed to type a passphrase of password. No one wanted to mess with keeping thier computer updated. So once one computer was violated nearly all in the lab were - even those of us who tried to patch and watch were brought down by what the users demanded. We were really damned when an offsite place (say a university) was weak and a user had symmetric keys installed.
That ended up being a VERY difficult issue to educate on - it's a fairly abstract idea. Very very very few of the people there were unintelligent but few were educated enough in that field to even really understand the issues (no reason why a chemist should understand key management any more than I should know how carbon rings react in some random environment). Password management is pretty obvious, heck many of us even had "secret" clubs in elementary school that did similar stuff. However strong encrypted keys tend to be something different, offering the ease of no password and the security of really strong ones (when done correctly). It take some amount of knowledge to "get it" along with thinking about having the private keys stored in unsafe places.
*shrug* I think that password management (in secure business processes) is becoming much less important. Even hotel reservation systems are mostly moving over to SSH and key management. For logging into your credit card service? SSH key and passphrase is great. For much of business practice, as SSH and similar type things become the standard password management this is MUCH more important. Right now we are horrid in that area of education.
Less articles about password management, if it has not been beat into your head by now you are a lost cause. Lets spend some time on key management and other security issues that are becoming MUCH more useful.
------- Sorry about the spelling, I suffer from two problems. Dyslexia makes it difficult to spell well, lazy makes it
You ever wonder why password fields don't echo the actual characters back to the screen?
If other reasons we do lack, we swear no one will die when we attack
From a comment I just made on Spaf's blog....
I've mandated rotating passwords before. My thought was that I knew my users shared passwords over time (oh, I need to use your computer for a few minutes, but your screen is locked) so by forcing a change I was hoping that if a person left the company they wouldn't retain access to anyone's accounts. However, the better solution in that case would have been termination for people who shared passwords and/or forcing all users (only about 15-20 in the company) to change passwords everytime someone left.
And of course, there are times in larger companies where I simply got told by those higher up that passwords would be rotated.
Thank you!
I have been looking for ways at new password generation for system administration, and that is brilliant. Throw in some l33t speak for number / letter swaps and the suggestion you mentioned is golden.
The company I work for enforces a lot of these password "best practice" rules. Most of our systems require passwords to be exactly 8 characters long, contining one digit but not in the first or last position, and must be changed every month. I'm certain this only makes things less secure, as users have a tendency to use even dumber and less secure passwords under these rules. For instance, if you instruct ten thousand users to change their password every month, then at least 500 of them will have "APRIL" or "APR" in their password at this very moment - even if you expressly forbid them to do this. Having complicated rules like "You must use 8 characters, including a digit in the middle" means that helpdesk staff often need to explain to the user several times what their password can be, and what they might or might not be able to have. When the average luser is now spending 3 minutes asking helpdesk - quite loudly in a crowded office - whether "BENJIDOG4" is a good password or not - then you've instantly lost the security of the password. Would it be more secure to let the user set a password without any requirement for it to contain numbers, or is it more secure to include the requirement and have every second user holding a long and loud discussion with everyone around them about what they're putting in and why won't it frickin work?
Not reading TFA is like not bothering to unzip, not bothering to point at the porcelain, just letting go in your pants.
Sure, it saves time, but everyone gets to see the big old wet patch.
They do sound an awful lot like planet names... "Scotty, beam me down to Lac Waup 7!" "Can we recover the team on Sek Gul 4?" "The colony of Ip Laft 3 is under Romulan attack!"
One, the requirement that passwords be exactly 8 characters long. An minimum length specification is fine, but it shouldn't be the same as the maximum.
Further, changing every month is too often. You end up with people having to write them down because they don't have time to get used to any one. I'm all for changing passwords reguarly, but that's waaaaay too often. On average, I think the ideal number of times that you should change a password is maybe 4 times in one year.
File under 'M' for 'Manic ranting'
Seriously, what's more important to the company: people logging in as another employeee, or actually having employees with morale!
Who cares if people use the same password. I've worked in a hospital where everyone shares passwords, and in a lab where everyone's password was the same. (Won't say where, but it happens everywhere)
There's nothing worse than a stupid nerdy geek telling people off for following some geekhole paranoid rule that has only minimal risk in real life. Like the telltale at school who takes all the rules literally, without trying to understand their purpose and the spirit behind them.
While I like the idea of pronounceable gibberish passwords, an alternative is to use a pass-phrase and then abbreviate it - like so:
I don't trust password generators from Khazikstan -> Id'tpgfKz
My Birth-Day is February 29th - MB-DiF29th
I like beagle puppies for dinner at 6pm - Ilbpfd@6pm
I like hotdogs for lunch at 12pm - Ilhfl@12pm
Using a phrase like that lets you assign some sort of meaning to the password which can help you recall it in the future. It also lets use "themed" passwords like the last two which helps at sites with rapid password expiration - you can remember that for a certain system your password is always about a certain theme which makes it easier to remember when you have to change it frequently.
Porn sites, in fact, were Bruce Schneier's idea for large-scale password theft. A crook could send out spam advertising a free porn site, simply requiring a no-cost signup. Umpteen suckers sign up, they choose umpteen passwords, some fraction f uses the same password for everything, and your "porn site" has just accumulated f*umpteen valid passwords and associated IP addresses.
Yes, I would fire people for that. I'd fire people for any intentional violation of corporate policy. It's one thing if you don't know, it's another if you choose to break the rules, especially after repeated warnings. I've often found that people who break little rules will ocassionally break big ones - like those kids in school you mentioned, those who tell little lies will from time to time tell a whopper.
./er trying to insult someone and having to pull from his own life example of being that poor little geeky kid that nobody liked....
It's an issue of trust, not to mention security (why bother with multiple user accounts at all if people are going to have access to all accounts anyway?).
Being able to trust your employees leads to them being able to trust you (and yes, vice versa, I'm aware of that implication). This in turn creates an atmosphere with good employee morale.
There's nothing worse than a
I used to work for a banking institution, that had a similar policy.
8 characters, had to have a special character somewhere in the middle, change every month, last 20 passwords cannot be re-used.
The result: Post-It notes with password written on them on most monitors or at least under keyboards.
Do you work for RWE Npower? We have exactly the same policy on the client site I'm working on at the moment and it drives me mad. Pretty much everyone I know writes their password down, and its always a pain to think of a new one. Even though I try to be security concious i only have about three passwords, and i rotate them myself, and occasionally change the upper/lower case or the number. The old policy of changing every 3 months worked much better.
Never underestimate the power of stupid people in large groups.
As always, all IMO. Insert "I think" everywhere grammatically possible.
As a sysadmin, It's always a red flag with me when the idea (password changes, use of 'root', etc) is being sold as a 'best practice'. I almost feel it's the equivalent of 'blah blah blah', used when a person can't be bothered to present meaningful dialogue.
If it's a best practice, it should be referenceable. I want page and source.
A real error message from a real e-store registration, denying access for a customer who entered his actual, legit personal data:
"Your surname name is too short. Surname must be at least 4 characters long."
Anagram("United States of America") == "Dine out, taste a Mac, fries"
There's also rules on top of that where you can find which character to capitalize and where to add symbols and spaces.
HD Trailers
One, the requirement that passwords be exactly 8 characters long. An minimum length specification is fine, but it shouldn't be the same as the maximum.
To elabourate... 8 characters long reduces the number of permutations a password can have. Brute force attacks take less time because of this password policy. Minimum good, but forced length will take considerable less time.
Further, changing every month is too often.
No kidding, especially when the warning comes 15 days in advance. That means you have 15 days of nagging and 15 days of quiet time. I can't stand that 30 day password rule. I do what another poster said - cycle through passwords five times until I get my same password again.
I used to be responsible for IT security at for my previous employer and find that the biggest danger to any password based security is the user. When I started there were no passwords in use anywhere, After about a month and a half I implemented a password policy (nothing strenuous, just the requirement for a 6+ char password, with a monthly change requirement. I was not popular. (this may have been the passwords or possibly the pave and nuke job I did on all the corporate desktops killing at least 3 of those electronic pet things...)
The good news is that after the first month the number of password resets required reduced dramatically and we actually had some accounting of user activity on things like network use etc..
However 6 months in we started to note the usual issues of people sharing passwords (i.e. how come John doe is logged on on three computers at the same time...) and had to curb that.
Then we started carrying physical audits of desk areas and started to clamp down on people writing down passwords (including those people that wrote them down in a poorly obfusticated manner....)
Again our security situation improved (I should point out that we did have internal users actively engaged in 'hostile' activities for their own gain...) and we were quite happy for a while..
Finally we started to carry out regular penetration testing, including a social engineering portion, this bit surprised me most. I came to the conclusion that 70% of our user base would give out their user name an password to anyone claiming to be IT staff - including when the tester called from outside of the company, and the number showing as internal.
So in short the problem with security is always going to be with the user, that is as long as the user is authenticated by either password, or token (swipe card etc..) and will only become significantly better when security is based on something the user cant forget or lose. Oh and anyone trying to implement security is always going to be the bad guy if it causes inconvenience.... And best practice in my oppinion is finding reasonable security procedures that are applicable to your situation, whether thats a 4 digit pin, daily changing 12 character complex passwords or rectal probes and dna testing, and then more importantly implementing it in such a manner that it is actually adhered to.
just my thoughts
this beige theme looks like crap.
i just use 1234 and be done with with it.
"when you fall in a bottomless pit you die of starvation."
I broadly agree with parent, but let's illustrate one possible benefit of password changing:
Using myself as a subject, I have tended to use variations on a common, 'hard' password in many different contexts over the years. Hence, it would most likely have been possible for someone to intercept my password in one context (I.e. website) and use it in another (I.e. network access).
It's quite possible that this is one of the areas in which forced password switching is a plus - it forces users to differentiate their passwords over different networks and sites, so that it is more difficult to "fish" for a particular password.
It's free, secure, easy to use and runs off a thumb drive.
Changing passwords isn't really a big deal when using KeePass.
No one expects admin as a password anymore so I use it for all my accounts - easy to remember and great for the ego. nimda is a close second or 12345, works great for luggage security.
ITS SPAF!!! Hey old man, ever held a job outside of academia? Oh yeah, you can't.
Hope I don't have to get new fingers every 30 days when they bring biometrics as password replacements....
...what you can do once your in is where security comes in.
We've seen time and time again peoples opinions on enforcing password strength, but we all know that you can get someones password with a chocolate bar and a clip-board (http://www.out-law.com/page-4469)
The next part is what we have to concentrate on; make sure that your permissions adhere to the principle of least privilege.
Think of the firewall Deny All rule apply it to your users and grant only the permissions they actually need.
Another useless rule of thumb is the one that locks you out after three unsuccessful login attempts. It was based on the theory that the authentic user would be able to remember the password within three attempts.
In reality, with passwords being case sensitive and people having to remember dozens of passwords for different systems at work and personal web sites, three attempts will end up locking out numerous legitimate users.
Caps lock is on... one failed attempt. You turn off caps lock and enter the password for a different system... another bad attempt. You think your bad attempt was due to a typo, so you re-enter the same password... you're locked out.
With so many people getting locked out, either they become lax with the password-reset procedures, allowing an intruder to take advantage of that. Or they stay strict, which results in numerous users losing hours of productive time.
Give 10 or 20 attempts, dammit.
---------
There is inferior bacteria on the interior of your posterior.
-Esme
There was a MMORPG that used to play that had nearly a whole clan hacked. Something like 60 or so accounts hacked, stripped bare and/or deleted.
There were more then 60 members, and they couldn't figure out the pattern for the attack. They checked thier servers, the login logs showed no brute forcing at all.
Finally they figured out what had happened. One disgruntled person who hated the clan had created an alt and joined the clan. He played with them for a few months and then asked a question on thier clan forum of "What is your mothers maiden name" in a series of a group of questions. The questions was like a joke email where you guess a number or something.
The point is a large number of people actually posted that information. After that he cross-referenced the email addresses on the forums (to hotmail) and just told them he had lost the password and here is my mothers maiden name.
Once in thier email he told the MMORPG he had forgotten the password, it emailed them. He grabbed that and deleted the email.
Social hacking wins over passwords.
Depends on where you are. I used to work for UK social security. Crappy little admintrative job, but I had access to people's benefits info. We used smart card and password systems to log into the computers, and there was the risk of instant firing and application of the Official Secrets Act (though unlikely in practice) if anyone left their card unattended.
Most people kept their card attached to their belt by a chain to be damn sure. If I was ever head geek in a place where people had access to data of that security (I'm including credit card numbers at that level) I'll apply the same policy. Tokens that must remain physically attached to the user.
They are easy to remember since you can pronounce them.
Pronunciation is only one half of the coin. Essentially, you're still going to have to remember how to spell the password, whether you can pronounce it or not.
(lew-cy-Hir-Ux-SIX)
Let's see, here:
Sure, I can pronouce it, but I'm still locked out after 3 attempts.
Give 10 or 20 attempts, dammit.
Screw that. Give 500. Give a number so rediculously high that your help desk should practically never have to deal with another "locked account" again, but so stunningly low that a brute-force attack will never succeed. It turns out that these two boundaries are still pretty far apart from one another.
You're special forces then? That's great! I just love your olympics!
is what I use to keep track of passwords for various places.
Cracking is when an intermediate form of the password (e.g., an encrypted form stored in the authentication database) is captured and attacked algorithmically, or where iterated attempts are made to generate the password algorithmically. The efficacy of this approach is determined by the strength of the obfuscation used (e.g., encryption), the checks on bad attempts, and the power and scope of the resources brought to bear (e.g., parallel computing, multi-lingual databases).
So, if I capture an ntlm hash, and run it through a rainbow table, how in the hell is 3 checks on bad logon attempts or parallel computing going to do anything? Excuse me mr expert, but I think you need to STFU.
n00b.
Your sig(k) has been stolen. There is a puff of smoke!
Never fear, I is here. My name is The Plague.
Someone didn't bother reading my carefully prepared memo on commonly-used passwords. Now, then, as I so meticulously pointed out, the four most-used passwords are: love, sex, secret, and... god. So, would your holiness care to change her password?
Oh, wait, the article was by Eugene Spafford? I thought you said Belford. Nevermind.
Off topic: my captcha for submitting this message is "crotch"? oookaaaaaay.
But why is the rum gone?
The University of Michigan had a "Poster Campaign" at all of the computing sites a bunch of years ago when I started there. All the posters compared kerberos passwords to underwear.
Passwords are like underwear: The longer the better. (had a drawing of a guy braving a michigan winter storm)
Passwords are like underwear: Don't share them with friends.
Passwords are like underwear: Change them often.
There might have been more but I've forgotten the rest. Any other U of M alumi who remember those ads?
If you force your users to change passwords too frequently they'll just pick one password and increment some number in it, or write it down each time.
Or if they're really tricksy ones, they'll just change the password $numberOfTimesSystemRemembers + 1 in one sitting and resume using their old one within minutes of changing it.
There's a fine balance to be struck between security and inconviencing your users to the point that they work around security for convenience.
Question everything
IMHO, I think a relatively-small artificial delay (after a certain number of attempts) should slow down the "brute-force" attack significantly as well...
After all, let's say that it has an artificial delay of 1 second after every 5 tries. Most human-entered attempts won't even notice the delay (and even if they do, it's a relatively minor inconvenience - much more minor than having to contact someone about unlocking the account after 3 unsuccessful attempts).
But a brute-force attack that would send, say, 1,000,000 passwords in quick succession will take at least 50 hours, or over two days. Not very practical. Especially when it may take more than 1,000,000 tries (assuming the password was set up to deliberately avoid things such as dictionary searches and things like that).
Not only that, but those two things (after how many "attempts" to have the delay, and the delay itself) could even be tweaked based on how much abuse the site is getting. Maybe a 2 second delay after 3 failed attempts, which would be even MORE effective (approx. 7.7 days if my calculations are correct) than a 1 second delay after 5, while only being slightly more intrusive for legitimate users.
I can tell you what happens. My girlfriend works at company where they have several different passwords for several different purpose made programs that they use daily.
The passwords can't be all the same, they have to contain numbers and enough letter, and they have to be changed periodically. And the changes have to be more than just one or two (or even three, I think) digits.
You would think this would make the system incredibly safe. Unfortunately, because of the number of passwords, nobody can remember any of them and everyone is totally confused!
So they just end up writing the passwords on paper and hiding the note under the blotter.
So there, whover has designed their "incredibly secure" system has just made it incredibly insecure simply by making it too complicated.
Some say he is made with ascii, others that he is eyeballed daily by millions. All we know is, he is known as the Sig
Yes. Passwords suck. Any piece of software that can be configured to use X.509 certs or public keys should be configured to do so. And it should also refuse any and all attempts at password authentication.
Of course, in the real world, this isn't so easy. But I look forward to the day when I can pop my smartcard into my laptop, type in a passphrase ONCE to prove that I am its rightful owner, and not have to type in another single password until I log out.
"We can categorically state that we have not released man-eating badgers into the area." - Major Mike Shearer, UK
What I find the best thing to do is to make the password the first letters in the sentence of some phrase, lyric, etc and try to include numbers in this.
For instance, I'm kind of a NIN fan, so you could use a lyric like:
"I will take my place in the great below"
iwtmpitgb
then add numbers
that way if you forget the password, you just have to remember the phrase you used to came up with it, and the numbers
Judges and senates have been bought for gold; Esteem and love were never to be sold.
Encrypted key exchange protocols (e.g. EKE, SPEKE) allow the safe use of relatively weak passwords. They resist all known passive sniffing, man-in-the-middle and offline dictionary attacks. How can a system be secure with weak passwords? Think of your ATM card's 4-digit PIN: it's pretty safe because it's limited to only a couple of unsuccessful attempts and you can't do an offline dictionary attack that would bypass this limit.
Unfortunately, these algorithms are all patented.
As far as I can tell, the SRP system infringes on the EKE patent. The fact that Stanford got a patent for SRP means nothing - a patent grant says nothing about infringement of other patents. AT&T probably won't sue anyone using it in an open source project but they will not issue a statement that SRP does not infringe the Bellovin patent, either. Result: commercial users shy away from SRP.
The only widely deployed remote password authentication mechanism which is safe even with weak passwords is "plaintext over SSL" but it relies on PKI which has its own set of problems.
Kerberos tickets are pretty secure because they use machine-generated random keys instead of user-provided passwords. But this whole tower is built on a weak foundation because the initial authentication to the TGT does use the weak user password. If just this part was replaced by EKE all Kerberos services would benefit from increased security.
Microsoft domains use Kerberos. Is there any chance Microsoft would bite the bullet and pay the EKE or SPEKE patent license fees?
Stop worrying about the risks of nuclear power and start worrying about the risks of not using nuclear power.
Abcd0001
Increment as needed.
Most people don't even think inside the box.
... how to keep a web server running while it gets knocked about a bit by the /. crowd. The minions in the Purdue IT Dept might benefit from that :) That box isn't answering HTTP reqests - wonder why? :)
Did you know my dad's dog died?
Want to get that changed?
Just try to log in as your sysadmin (or his boss) every time you get some free time (don't try this from your desk).
Eventually they will get tired of having their account reset every time they log in/access-a-network-share/try to print/etc.
But isn't most of the content of the article highly cliched at this stage in the game.
Surely it doesn't take a "Ph.D., D.Sc.(h.c.), FAAAS, FACM, FIEEE, CISSP (h.c.)" (in the European style!) to point out these issues. Most of it seemed like straightforward, common sense issues dressed up in pseudo-academic-speak.
Did you know my dad's dog died?
It wouldn't be difficult to impliment a better authentication scheme than passwords, without the cost of smart-cards or biometrics.
Just use Challenge/Response. Have a simple little app that takes a password, a challenge text, and generates a response text.
When logging in instead of asking 'Username:', 'Password:' the system would ask 'Username:', 'If I said 'xyz' what would you say:'
The user enters the challenge text into his little app, and the response is put right into the copy/paste buffer.
The user's password is never sent across any network.
- For the complete works of Shakespeare: cat
Don't forget the passwords that only give you like three tries/attempts. After that, the account gets locked out PERMANENTLY because you entered the passwords incorrectly three times. Lame!
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
The author is a professor in the CS department at Purdue. At the beginning of 2005-2006, Purdue IT announced that they were going to require *every* password on *every* computer to be changed every 30 days. They made it clear that this policy was not restricted to administrator accounts, and in fact it has been pointed out in several articles that students will have to remember to change their passwords during summer and co-op sessions, or their accounts will be disabled. You also won't be allowed to re-use passwords for six replacement cycles. The policy isn't enforced yet but will be "real soon now."
s sguidelines.cfm
This policy seems to be generally seen as idiotic by students, faculty, and staff. The IT people who talk about it seem to be made to "toe the line," and make up excuses about how this policy went through all the review/administrative processes. Nobody has an explanation for how this policy will be made practical for all the alumni and external accounts which might be accessed only a few times a year.
Many people see this policy as a copout response to the multiple security breaches in the past several years. On multiple occasions the whole university (30K+ studenets, plus faculty/staff) received orders to change passwords immediately because some database was compromised. Rumor had it that one database was storing passwords in plaintext because of incompatibility between hashing mechanisms used by different systems. Rather than take responsibility for and fix their security breaches, they are simply forcing this policy on everyone.
I suspect the author wrote this article largely as a condemnation of this policy.
Here's the link to the Purdue password policy: http://www.itap.purdue.edu/security/procedures/pa
You're correct, I must admit.
:-)
However, it would help if Slashdot submitted the cache link so the webpage was not slashdotted.
I'll have to look up that Firefox extension.
BTW, what's an analogy for Anonymous Coward
There are three kinds of lies: lies, damned lies, and statistics.
I do something similar, i use a random generated matrix used to decode simple passwords like "father" into a complex password, each month I generate a new matrix and file the old one, just in case I need to use a backup (when I backup I write the sheet id on the media). Only I know the column I use this month (I suppose it can be the real month too) and the simple key I use with cipher to get out my password. As long as in don't tell anyone my simple cipher, I can use it as many times as I like, on as many sites and computers, I just change the matrix. If I am good I may remember the complex password, if not, its easy to look up. I put my matrix right on the wall over my monitor or terminal.
Here is the python code if you care, white space was eaten see placeholders.
uc = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
lc = uc.lower()
digits = "0123456789"
funny = "!@#$%^&*-_"
vowels = "aeiou"
cols = 12
counter = 0
import random
print version + " sheet-" + random.choice(uc) + random.choice(digits) + random.choice(digits)
print "C 1 2 3 4 5 6 7 8 9 10 11 12"
for letter in lc:
[TAB] line = letter
[TAB] while counter [TAB][TAB] counter = counter+1
[TAB][TAB] if letter in vowels:
[TAB][TAB][TAB] line = line + " " + random.choice(uc) + random.choice(funny)
[TAB][TAB] else:
[TAB][TAB][TAB] line = line + " " + random.choice(lc) + random.choice(digits)
[TAB] print line
[TAB] counter = 0
Actually, I don't think the locking after 3 attempts was meant to stop brute force attemps, but rather to stop password guessing attempts, i.e. birthdays, mother's maiden name, children's names and ages... There are at least a couple dozen likely passwords for someone based on things you can find out about them. Having suffered through a couple lock-outs, I still think 3 is too low, however, 500 is too high to prevent this sort of thing.
Not such a great idea when many companies ban thumb drives. And many companies prohibit running unapproved software.
But YMMV.
We're working on it. This is by far the most traffic we've gotten on this box. We need to take it down for a bit to get in a caching system on the blog, and then (hopefully) it should handle the traffic much better.
BTW, you guys are kicking the Digg folks' ass in terms of taking down hosts... digg hardly affected us. 8)
I would also fail the company in their annual audit if it was known that user accountability had been compromised - only financial systems though, any others we really could care less about.
What this would mean would be a substantive audit, costing around 4x the cost of a controls based audit. Trust me, more than one person would be fired once THAT bill reaches the upper echelons!
However, the better solution in that case would have been termination for people who shared passwords
There are two scenarios where this would happen:
1) the password sharing has not compromised any security, in which case you've just lost a potentially valuable team member over something where no harm was done, or
2) the password sharing HAS compromised security, in which case the damage has already been done and the policy is worthless as a preventative.
I don't really see how either of those is any better.
I'd fire people for any intentional violation of corporate policy. [...] Being able to trust your employees leads to them being able to trust you (and yes, vice versa, I'm aware of that implication). This in turn creates an atmosphere with good employee morale.
Quick tip: telling people you will fire them for violations of policy, even when they are trivial or when they *should* violate the policy to serve a higher goal, is not the best way to build trust or morale.
Draconian enforcement only makes sense when the policies perfectly address every situation ever encountered. With policies that complex, nobody will remember them anyhow. Given the choice, I'll always take an employee with good judgement over one who's pefectly obedient.
No window should be allowed to programmatically, without user intervention, pop to the foreground and get focus
There are times when a rather immediate attention is required. Important messages such as "The network is going down, save your work!" or "you're running low on both RAM and SWAP space" etc are rather important. Personally I wouldn't mind if my spreadsheet or web-browsing were interrupted to show me a message indicating a possibly more serious interruption was imminent.
But I do agree that your general userland applications should not be able to popup you to death and steal focus, just the OS-integral ones.
do you people have any clue how a brute-force attack is carried out?
One does not use the password entry UI of the system.
Nothing in the world is more dangerous than sincere ignorance and conscientious stupidity.
Many people don't realize that it is far more effective to 'memorize' a random password by using your muscle memory. The brain does a very poor job of memorizing random strings because when using the linguistic and speech areas of your brain, there are subconscious patterns that you don't even realize that you notice. I purely random password doesn't have these patterns and is very difficult to memorize. However, the areas of the brain that control muscle movements can very quickly memorize a pattern after just a few iterations.
For example:
I just generated the following password using passwordsafe (theres a sourceforge site for this, but I'm too lazy to look it up right now): 1/E.I!BEp[
I modified this slightly to make it a little easier to type (ymmv): 1/E>i1BEp[
And I typed this 20 times into notepad.
I now have this password pretty much memorized (although if asked to repeat it out loud I would be at a complete loss) and I am 80% sure that I will still remember it tomorrow morning. If I continue to use it on a daily basis I will be able to remember it indefinately.
Just remember, folks; your brain has a lot more power than you give it credit for.
On a side note: its pretty obvious that some of you didn't read the article. Spaf is advocating NOT changing passwords every month. That doesn't mean he's saying you should never change passwords, just not so often. And, keep in mind, this is a blog post, not an acedemic paper; and therefore it has a less formal tone and of course is relating information that many people already know.
"Sorry, your password is based on a Romulan dictionary word. Please choose a password with at least three non-alphanumeric characters, a "!" in position 5, a number at the end, at least 3 different puntuation marks, then write it down and tape it to the bottom of your keyboard."
Give a man a fish and you have fed him for today. Teach a man to fish, and he'll say "WHERE'S MY FISH, YOU IDIOT?"
A security consultant once told me little kids can be great password generators. As an example, he explained how his toddler couldn't say "penguin"; it came out sounding something like "pewing". Instant (admittedly, low sec) password.
Quick tip: telling people you will fire them for violations of policy, even when they are trivial or when they *should* violate the policy to serve a higher goal, is not the best way to build trust or morale.
Quick tip: having policies you make known are not enforced will not build morale. Some will follow it and resent those that don't. Others won't follow it and get annoyed at those that do. Since the policy "please feel free to share your password with everyone else" doesn't seem reasonable, I'd suggest that firing someone for a password sharing is better for overall morale than ignoring multiple repeated violations of the policies.
I think you are assuming "fire on a first offence." I understand and realize that people will occassionally (like once every 5 years or so, maybe less frequently) have an actual reason to violate such a rule. However, there is no reason for someone to violate it on a weekly basis. From how I read the thread, you are saying it is unreasonable to fire someone for the first offence. That is perfectly compatible with the statements of the person you are responding to. Read his posts again, and insert the word "eventually" before every instance of "fire" and you'll see what I think he was meaning. "Yes, I would *eventually* fire someone for repeated violations of the corporate policy."
Learn to love Alaska
how do you resist what is little more then a myth when it is labeled a best practice ? Humans have a propensity to regard anything they hear as a basis; even though you know it is totally rediculous, if i say that using consonant free paswwords is a good practice, simply hearing it will make you think in that direction; there is a whole literature in the psychology field on this ( i forge the term)
for instance, the whole change paswword frequency debate - if one can't get data, should one just ignore the "commonsense" idea that longer = better ?
Yes, because authentication is a whole different beast from accounting. I don't care so much that you accessed a resource with a different userid than we issued to you, but I care a whole awful lot about the fact that I can't tell who updated Salary.xls last Saturday at 2:34 PM.
If you think this stuff doesn't matter, then trade paychecks with someone who makes the same as you, and attempt to simultaneously cash them at the same back. Since the amounts are the same, the bank shouldn't care, right?
Dewey, what part of this looks like authorities should be involved?
In reality, with passwords being case sensitive and people having to remember dozens of passwords for different systems at work and personal web sites, three attempts will end up locking out numerous legitimate users. ...
Give 10 or 20 attempts, dammit.
I've seen people use this "feature" for practical jokes plenty of times. I don't think increasing it to 10 or 20 would deter this. And if it's used as a practical joke, it can certainly be used as a serious attempt at a DoS.
If anything, it should simply lock people out from the terminal or ip they are attempting it from. And if you want something that will do a smarter job of defeating brute force attacks, simply have a variable delay that doubles each time for that particular terminal or ip. If the password is wrong once, wait two seconds before giving that location another chance. If the password is wrong four times, wait 16 seconds. By the 10th attempt from that location, it would take 17 hours for the 11th attempt, and by the 20th, this would be 12 days, effectively preventing a brute force attack while only minimally inconveniencing real users, and requiring essentially no complex reset procedures.
Somebody else gets it! Of the 6 passwords I have to use on a daily basis, I cannot recite a SINGLE ONE from memory. I have no idea what they are! But if I sit down at the keyboard, I can type them with no problem.
Many of the places that plaintext passwords are used, one needn't allow a password login at all. The strongest security is to disable all other login services (like telnet, rsh etc) and require remote users to log in via ssh using rsa or dsa keys. The whole beauty of this rsa/dsa-only method is the users could choose easily guessed passwords and the protected computer still wouldn't be at risk from external attackers because the user's password is only used to access their local computer. To break in the remote attacker would still have to guess the RSA or DSA key which is computer-chosen and very long (1024 - 2048 bits). If all computers are configured such that unix passwords are only acceptable for local (console or perhaps hardwired rs-232 terminal) logins, then a remote attacker gains little by discovering the unix plaintext password.
(The last line may fail on computers that have PAM turned off at compile time. Leaving PAM logins on for machines that have PAM globally enabled negates the whole rsa/dsa-only requirement.)
Does anyone remember (and have a link?) the spoof password policy from *mumbles* years ago - it started off innocuously with things like "must not be a dictionary word" and "must include a number", progressed through things like "cannot repeat characters" and "characters must not be adjacent on the keyboard", until the last part was "There is only one password that meets these requirements - please ask your sysadmin to give it to you".
My next sig will be ready soon, but subscribers can beat the rush
I have commented on this before, as it is something that ticked me off. I work for a large company, in which they recently (last several years) changed their security policy (no idea why, just out of the blue). So now not only do I have a ton of passwords, they also have to change every stupid month, and cannot be the same or like the previous passwords. Talk about a nightmare. I have accounts all over for various networks, different corporate application, etc... I have little spidery arms out everywhere in IT, and it is hard enough to remember them all. I tried to explain to the IT people (I work with IT, but not for the people who are in change of our networks or IT security policies), that this sort of policy while you think you are doing good is really very very bad. Where I had a handfull of passwords that I used to use, I was very protective of them and they were quite good. Now everyone is contantly forgeting their passwords so they end up calling the stupid help desk to get their password reset or released to them. Worse is people finally just get fed up and write them on a sticky note and stick it to their computer. Yeah, good policy in action there.
Well seeing as no one heeded my warning, I found a fun way to protest:
Many of my Passwords now are something of this flavor: StupidRandomPass#19 or ITSecurityPolicySucks, or JustAnotherPass#11, IT&SecurityEqual0, etc.... So every time I forget a password, I get a little laugh when I have to contact the smuck at the Help desk to get my password.... ah fun times. (note none of those are are my passwords)
do you people have any clue how a brute-force attack is carried out?
One does not use the password entry UI of the system.
What's your point? This has nothing to do with the number of attacks it takes for the password verification component to lock the account, no matter what your backend architecture.
You're special forces then? That's great! I just love your olympics!
My point is a brute-force attack has nothing to do with the number of attacks it takes for the password verification component to lock the account, no matter what the back-end architecture is. In fact the attack doesn't have to even occur on the target's hardware (although it can) nor does it have to use the target's OS (although it can). And as far as I know any OS which does not salt the password hash is susceptible... all of Microsoft's offerings, nearly all Linux distros (SELinux maybe?) and Mac OS X. I do know that OpenBSD does salt the password hash by default. I don't know about Sun or Solaris.
So any computer which an attacker can perform an account escalation on, or has physical access to, is vulnerable.
I've seen it done... it took less than 15 minutes to recover every password stored on the box.
Go read up on it.
Nothing in the world is more dangerous than sincere ignorance and conscientious stupidity.
Ahh ha! Since MAC OS 10.3 Apple has added a 12bit salt to the password hash.
I have no idea about Linux but presumably FreeBSD & NetBSD do too.
Nothing in the world is more dangerous than sincere ignorance and conscientious stupidity.
Having been responsible for the implementation of internal controls in my domain (Solaris servers running B2B applications) as required under the Sarbanes-Oxley Act, I can attest to the fact that auditors make some very stupid demands because that's what the "best practices" say. Unfortunately, in my case we seemed to have an auditor on-site that was fresh out of school and was basically just doing what she was told by her employer and was completely unable to justify such demands. I would explain why something did not make sense in our environment and how it would actually increase our cost of doing business while at the same time adding absolutely no value and get a response of, "well, it needs to be that way".
Have others encountered these sorts of problems with auditors? What did you do? How do we deal with pointless, or harmful "best practices"?
Quick tip: having policies you make known are not enforced will not build morale. Some will follow it and resent those that don't. [...]firing someone for a password sharing is better for overall morale [...]
You're creating a false dichotomy. I'm not saying that one should create a bunch of policies and then ignore them. I'm saying one should ask employees to further big-picture goals rather than load them down with a zillion rules that may or may not make sense in all circumstances.
If they're sharing passwords, that either means they don't understand why it's bad or the system is set up poorly, forcing them to share passwords to get work done. The solution to the former is education; the latter, better systems. If you've got an employee that won't learn or fails to develop good judgement, by all means fire them.
There's nothing worse than a stupid nerdy geek telling people off for following some geekhole paranoid rule that has only minimal risk in real life. Like the telltale at school who takes all the rules literally, without trying to understand their purpose and the spirit behind them.
Considering the laws that have gone into effect concerning accountability and auditing in regards to accounting and IT here in the USA (Sarbanes-Oxley, in particular)... I do believe I understand the purpose and spirit behind the rules, and that is why people get in trouble for sharing passwords. I might not fire them (that's not my decision), but their accounts will certainly be locked out and they will have to explain themselves to management, who thanks to all of the scandals surrounding Enron et al take Sarbanes-Oxley compliance VERY seriously...
Just my $.02...
So any computer which an attacker can perform an account escalation on, or has physical access to, is vulnerable.
Who said anything about physical access? In a lot of environments, like your average office setup, you won't have access to the machine that stores the passwords (in whatever format). You have to access through the API. Even if you have root (or whatever) on a local machine, it doesn't give you any special benefit in cracking someone's network password. So if the password server locks the account after 500 invalid attempts, you're still fine.
I'm not arguing about local machine passwords, but that's not the type of environment we've been discussing anyway.
You're special forces then? That's great! I just love your olympics!