Slashdot Mirror
Password Complexity in the Enterprise?
andrewa asks: "What's the deal with passwords in a corporate environment these days? The company I work for has introduced layer upon layer of complexity on passwords over the years, and now it is simply ridiculous. We have to enter a 16 character password each month that cannot compare in any digits to the previous twelve passwords, nor can it be a simple string -- it has to be a mixture of upper- and lower-case characters including numerals and non-alphanumerical characters. What's next? A mixture of non-keyboard accessible characters and several varieties of DNA? It's not like we are even a government institute -- we are a software company that does telecom stuff, for goodness sake. Anyway ... you know what this makes me do? Write it down somewhere. How secure is that? The question is, I think my company is completely anal with the password requirements, what other security policies are in place in other companies that either completely exceed the banality of my company, or -- God forbid -- have a security system that makes sense?"
I work at a call center. The password I was given, was "apple123". After 6 months I was prompted to change it. So now my password is "apple456". If I were to work here for another 6 months, I would change it back to "apple123" but I quit because I value my sanity.
"0123456789aBcDeF"
That's amazing. I've got the same password on my 6-piece luggage set!
Those requirements don't sound too tough, though 16 charaters is a little long.
As for remembering strong passwords, my method is this: think of a phrase, take the first letter of every word, substitute in some h4x0r numbers for letters, and make a few letters uppercase. It takes an afternoon or so before I can type it without thinking.
Example:
Slashdot is full of bad grammer,misspellings and inaccuracy
=
s1F0bgMaI
The phrase is easy to remember; the number and uppercase substitutions come with repetition.
Jan: 0123456789abcDE_
Feb: 123456789abcDE_0
Mar: 23456789abcDE_01
You get the idea
No digit will ever be the same as the same digit in any previous 15 passwords. It contains numbers, lower and upper case letters, and a non-alphanumeric character.
One of the best I'd seen was to take first letters (or last, or second, etc.) from words in a song that you know the lyrics well. They have a decent amount of randomness and each album you buy will supply a couple of years' worth of passwords.
Writing them down in a safe location is a helpful aide-memoir. You could just have a lyrics file saved to a thumb drive or scrawled in a diary.
I know a few...
"Theta alpha two seven three seven blue"
"One one A"
"One one A two B"
"One B two B 3"
"Zero zero zero destruct zero"
But usually, voice identification is enough.
Make the passwords to hard to remember and people write them down because thay have to.
Some advice Bruce Schneider once gave: there is nothing so terribly wrong with writing your password down on a piece of paper and putting it into your wallet. Your wallet is a security mechanism that you already use, and you are very practiced at keeping it secure.
Myself, I use muscle memory to store mine. I make up an entierley random password and spend 20 minutes typing it over and over again until my hands remember how to make that sequence of twitches. Works great; and no risk of me acidentally telling someone my password because I don't know what it is.
~~~~~ BigLig2? You mean there's another one of me?
Every company has some information that needs to be secure. With a network, you're only as secure as the weakest link--one machine is all it takes for someone to infiltrate it.
While your company's password policy is much more stringant than my company's, it doesn't sound too paranoid at all. As far as remembering the password, you should write it down and carry it with you if you're having trouble remembering it. It should only take a couple days of logging in before you have it down, so then make sure you destroy the paper it's written on.
The thing is, you really need to worry about someone hacking your password remotely and a simple password of only lower-case letters and maybe some digits is a heck of a lot quicker to hack than mixed upper/lowercase, digits, and symbols. If someone got the piece of paper in your wallet, they probably would also get your keycard into your office, too. Once they had physical entry into your office, the password wouldn't be that big a deal. They could just steal your data drive and take all the time in the world to hack into it.
Picture Password: A visual login technique for mobile devices
"16 character password each month that cannot compare in any digits to the previous twelve passwords, nor can it be a simple string"
this is an exaggeration. I can believe 8-character password every 45 days that cannot be the same as any of the previous 6, but there's no way that the stated requirements are correct. every user would have sticky notes on the bottom of their keyboard or phone or on their laptops in order to remember their password.
no real enterprise security shop would condone such a moronic password policy.
if a company were that paranoid, they'd have invested in PKI or use SecurID.
tell us what the real requirements are and maybe we can offer some concrete suggestions.
Mind the gap...
The key is not how complex you can make a password.
... 288 a day ... 864 over a 3 day weekend. Round that up to a thousand and it's still a "one chance in a million" to guess the password over 3 days of trying.
The key is how will an attacker defeat it.
So, a simple password is sufficient if the attacker will not have enough chances (statistically) to defeat it. This is easy to accomplish by having a time delay between authentication attempts or a lock-out period. But this is only sufficient if you have a person actively monitoring the authentication logs.
Example: Suppose you have a list of 10,000 common words. You take a random word, a digit (0-9) and another word, that will give you 10,000 x 10 x 10,000 possible combinations (1,000,000,000 or "one billion"). So, if you get 3 guesses before you're locked out for 15 minutes, then you can guess 12 passwords an hour
As long as there is someone reviewing the logs, the attempts will be noticed and actions can be taken before there is any real chance of your password being cracked.
And WordNumberWord is not that difficult to remember.
Now, this is NOT a good practice for passwords for encrypted files or anything else that can be cracked off-line.
A lot of co-workers just rotate through all 8 or 12 iterations of passwords and then restore their original password, as well. Fucktarded password policies decrease security, but you'll never convince management of that fact.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
I would have just written them on a piece of paper on my desk, but their policy is not to -- and nothing in their policy seems to say I can't email them --- after all, they emailed some of them to me.
Password security actually doesn't bother me that much.
Physical access to systems is a much more pressing concern. I work in a college, and there is no way I'd be able to enforce a strict password scheme in such an enviroment. Students can't remember a simple password, let alone something designed to beat a determined attacker.
So, rooms are locked, laptops are secured, and accounts are locked down so that any attacker hacking an account is left with nowhere to go.
Obviously, I enforce strict password schemes for myself and the rest of the ICT Support team. But for the entire user-base? Sadly, I don't have the time.
I use two complementary password generation schemes:
e ! (Uppercase I intentional; exclemation point included.)
(1) I pick a word or pair of words and convert them to 31337. Example: supersecure->sp3rs3cur3. This is 10 chars long, which is Good Enough for a commonly rotated password, easy to remember but hard to guess.
(2) I choose a phrase, such as a quote I like, and use the whole thing, For a while my root password was: myvoiceismypasswordverifyme. Now, technically that's not very secure because it's all lower case letters. But due to the length the amount of time it would take to crack is quite high. Again, good for a commonly rotated password.
For added security I use method 2 with method 1. Here's a secure password I no longer use: Iseemt0behavingtremend0usdifficultywithmylifestyl
You get the idea.
I want my Cowboyneal
Unless there's some flaw that I don't know about, I've always liked the password method where it's two random English words (DoorAsphalt or MessHeave). It's easy to remember, and assuming, say, a 40,000 word dictionary, that gives 1.6 billion combinations.
Sometimes it's best to just let stupid people be stupid.
I've always found it a total pain to remember passwords for different resources, so I came up (probably stole the idea from someone, too long ago) with a method of using the keyboard as a sort of encoder/decoder. What I do is I have a memorable word or phrase, but I always type in the letters above or below the actual characters. This means I can turn a memorable phrase, say, "slashdot.org", into gibberish, like "woqwye95l94t". (No, that isn't my Slashdot login, so don't even think about it :).)
I've found that, while you need to think about it at the start, it doesn't take too long before you're used to using it. Of course you can (as I have) obfuscate it even more. For example, you could change the case (upper/lower) on alternate letters, type your memorable word/phrase in backwards, alternate above and below keys, etc.
Just an idea, real good for the corporate logins... you can easily remember a word or name, and quickly turn it into something the IT Dept. would approve of.
Columns.
<xml><I><am><so><damn>Web 2.0</damn></so></am></I></xml>
Get yourself a Lexar JumpDrive with TouchGuard
I think the password complexity on the Enterprise was very weak. Recall the episode where Data finds the individuals from the 20th century? They started causing havoc because the Enterprise relied more on trust than password protection. One idiot even walked onto the bridge.
I think that people who work with this should work with a password cracker at least once. They generally work by taking in a wordlist (which may contain many things not quite like "words", such as keyboard runs-12345, !@#$%, asdf, etc.) and applying many rules to them (e.g. take two short words and add a number to the end). They also have "brute force" rules that can, say, try every password containing only lowercase letters & numbers. The brute force of lowercase letters + numbers took, for the DES passwords I cracked on an old Pentium 166 MHz (not even a Pentium Pro), about a few days, IIRC.
So you can see why they want you to have long passwords with a balanced diet from the "four food groups" for passwords (lowercase, UPPERCASE, 1234567890, and #$@$@%). They make you change them because your lazy ass is very likely to reuse the same passwords elsewhere (and yes, the shady porn site operator you registered with might very well have added your username & password for the site to their "word list" as per the above). And they don't let you reuse it because if they discovered it once and added it to their wordlist (this happens by default with crackers like JTR), their rules will certainly find a trivially modified one.
Of course, that still doesn't fix user-education problems like the lusers who write the password down under the keyboard/monitor/chair/tower/desk or in their desk drawer, etc. Nor the lusers who use unencrypted services and have it sniffed off the wire (or via the spyware they have installed).
And, naturally, they generally only get to brute force it to begin with if they steal the password's hash somehow. If they're storing unhashed passwords (they'd damn well better not be), the crackability of your password won't matter, save that it shouldn't be guessable.
So what I'm trying to say here is that, if you want to make your admin happier, generate a long, random phrase, condense it into 12 chars or so with a healthy mix from those food groups, and write it on a card in your wallet (the phrase, not the password). Most people take care of their wallets and the cash inside pretty well. You should do the same with your password instead of complaining.
Take a simple phrase or word, and apply your own standard cipher.
I take input (like "frankenfurter") and apply:
- reverse letters "retrufneknarf"
- substitute numbers for vowels "r1tr2fn3kn4rf" or "r4tr3fn2kn1rf"
I can write this original word right on my monitor, or in my wallet, and it still doesn't give my folks enough to hack in quickly. Each time i need a new password, I pick a new input word, but keep the cipher the same.
Pick your own cipher, but there are lots of standards morphs for words.
or -- God forbid -- have a security system that makes sense?
The first person to suggest a system that both makes sense and is actually secure will be rich overnight. Don't ask for something if you don't know anyone who can provide it, and can't say how yourself. It's like whining that GM hasn't made a car that gets a bujillion miles per gallon and has pretzels for exhaust.
StoneCypher is Full of BS
Anyway ... you know what this makes me do? Write it down somewhere. How secure is that?
If you have an easy to guess password, anyone with an Internet connection is a threat. If you have a hard one (not guessed in one month) and have to write it down, the only people who could log in as you are people with physical access to your piece of paper.
Yes, you do have a right to complain as that system seems to be a bit overkill, but writing down a hard password is infinitely better than having to use an easy one so you can remember.
Next, I create a pgp-encrypted (symetric -- with a good password) text file with the account info for all my accounts. I email that to my gmail account for online backup and to have it accessible.
So, for hitting slashdot, I "gpg -d /path/passwords.txt.asc", punch in my password, and cut-n-paste. Not only is this easier than I expected it to be, it's far more secure, as I now have *really* safe passwords for all of the many sites I visit.
(WTF is up with the first paragraph tag of my posts being eaten?)
Method of processing duck feet
This is surprisingly secure, as long as you write it somewhere safe. Security pioneer Dorothy Denning does this, as do a number of other "security professionals". There are simply too many places a password is needed now to follow good security rules for all of them. The human-factor limitations lead to the obvious conclusions that people must either:
Writing down a password is safe if nobody can get hold of what it's written on. Storing it online is pretty much just like writing it down, except there are opportunities to make it safer. There's really no safe way to use the same password lots of different places or a really simple password.
Use a password generator to create some truly horrific 20-character monster and write it down. Keep that paper safe!
At our company, we have a password bank containing 1000 or so english words, like "drive," "window," or "shelf." Users are tasked with choosing one word from the password database to use, then recording it in a text file on their computers. This has been highly effective, especially considering our military contracts which often require security clearances. I suggest this method as an efficient new paradigm of corporate password management. It's a proactive move towards the future of secure computing.
How many times have banks/people lost money due to weak passwords?
vs
How many times have backs/people lost money due to social engineering?
Forcing people to have crazy passwords may reduce the number of
times that password is cracked (from near zero to nearer zero).
But stopping social engineering will have a *far* greater impact -
because its actually pretty common for people to hand over their
passwords and account details to nigerians or email from pay pal.
So its not about the size of your password. For example: PIN codes
are pretty secure, but they are only 4 digits. The reason: You need the card
and you get 3 tries before the card is swallowed. 16 digit pins with
alpha numeric would *reduce* the security because many people will write
their pin on their card or keep it with their card.
For a bank - any simple 8 letter word will do for a password. A bank just needs
to be sure you can't have more than 3 tries before your account is locked
out.
And that holds true for any authentication system.
Lock your users out (so they have to come to you) after 3 tries.
One time our CEO was in a meeting with clients, and she had to tell them the password so they could access a page on our website. She told me she embarassed having to tell them the password was "nachomama".
She was lucky she didn't use the other password "sofakingwetodddid".
That's how you ensure your passwords don't get around.
From my customers, and it's a very valid complaint.
My big blue employer sells a nifty little piece of client software that not only creates and stores these random-assed passwords for you, it also plugs them in with your username when apps/sites prompt you for them. It's a clever little product, but my only complaint with it is that it's for Windoze only, and I've been running a Linux desktop for quite some time now.
Two-factor authentication has been recommended over passwords for quite some time. And with good reason: passwords are static. Draconian password policies are intended to prevent password guessing, but when a password can somehow be intercepted without guessing, the password can be trivially replayed. Passwords often can be intercepted in other ways; anyone who has ever had a trojan or virus on a PC could potentially have lost every password accessed from the PC. Viruses and trojans can install a keystroke logger, so even a randomly-generated 500-character password can be intercepted. Similarly, if you use the same password on more than one system, and one system is compromised, the compromise can be leveraged to attack other systems. In the real world, passwords are bad. Policies like the one described above are somewhat inane attempts to workaround the problem with password guessability, but they cannot solve the other inherent problems of passwords.
Then combine this with the fact that humans themselves are a weak point in any password scheme. If you require letters and numbers, people will try to use words and numbers that are meaningful to them -- names and birthdays, for examples -- even if the policies forbid them. Ot they will write passwords down and tape them to their monitors, or under their keyboards, or inside a desk drawer. Or they will http://news.bbc.co.uk/1/hi/technology/3639679.stm
give away their passwords for chocolate.
Two-factor systems work around the "replay" problem. They are not perfect because they are still subject to session hijacking. And they cost more money to implement -- you need to buy extra hardware. But they beat passwords any day.
One-time passwords are another solution to some of the problems, but IME, are harder for users to deal with.
Since when are passwords an issue? Who needs a password when the idiot leaves his computer unlocked? I work in a call center environment and its standard practice (and openly accepted and promoted by supervisors) to create chaos for those who leave their computers unlocked. I'm talking adjusting regional settings, reversing mouse buttons, lowering mouse sensitivity to the lowest possible value, customizing appearance so EVERYTHING is the same color... a good 30 minutes to fix... less if you can navigate Windows blindfolded. With the number of people relying on IE/FF to save passwords and forms... leave that terminal open and I can pretty much view and navigate to what I want by opening IE/FF and browsing through the history.
so basically, passwords are irrelevant, but are a tangible element to everyone. so when the boss asks for better security, the IT admin implements greater password complexity, the boss notices because he has to type the damn password every day, and the IT admin get kudos. because of course, if user convenience decreased, security obviously increased. yay.
what is the value of having a complex password? it should be complex enough an attacker can not guess it. everything else relates to an attacker's ability to *crack* passwords, which is irrelevant in the world of windows these days. in a few years, NTLM will have died and kerberos will rule the day. then things might be different.
You should keep a dollar folded up in a safe place in your wallet, and just use the serial number on it as your password.
Did you ever notice that *nix doesn't even cover Linux?
Most people have responded with their experiences in keeping track of their passwords, but I was wondering if it would be possible to implement a system where the password expiry would be based on the complexity of your password. So when you enter your passowrd, the system could analyse the length, number of repeated characters, digits, and symbols. Then with the complexity, it could calculate the exipry time. So people who have passwords of length 8-12 would have to change their passwords every month, those who have 20+ length passwords could keep theirs for 6 months (depending on how you calculate the complexity). This way people could 'buy' a longer expiry time by adding symbols or length.
My personal favorite way of generating secure passwords is to use a Passphrase. You can use Diceware to generate some passphrases for you http://world.std.com/~reinhold/diceware.html and it also has instructions for adding symbols/numbers to the passphrase.
Other slashdotters have mentioned Password Safe by Bruice Schneier. I strongly recommend this as well. I keep a copy of these at home encrypted using my master passphrase just in case I forget them.
Yeah, we have similar requirements in the place I work. How it began is a tale similar to how the pile of sh*t became a growth promoting product that has a pleasant smell.
/etc/shadow or /etc/passwd or some other hash database). Many of these are still crypt'ed which is pretty trivial to break.. That's the reality.. But what people hear is that crypt is just a certain bit length and that's trivial to break. So maybe they specify that passwords need to be longer. This doesn't change the bit length of the hash, nor does it really help security, but people think it does. Why? Well, when you hash a 5 letter password or a 10 letter password it will still generate an x-bit length hash. The misconception is based on the assumption that a password cracker will first try "aaaaa", then "aaaab" then "aaaac" or some variation of a rote search. A shorter password will then be found sooner than a longer one. In reality what happens is that all possible passwords are pre-hashed in a dictionary. So say someone gets a hold of the password hash file. It doesn't the password per se, but you can use the dictionary and lookup the hash and with a second or two find a password that generates the appropriate hash (i.e., you don't need the actual password, just a password that hashes to the same value). Solution - don't let the hash table out.
Passwords can be easily guessable. In many cases you can brute-force accounts if given enough time and access. This works more often than you'd think because many accounts are not attempt limited and people tend to use simple passwords.
Simple passwords? By this I mean common words, spouses names, team names. In places that force periodic changes of the password, use the month followed by a number, etc.. But if you lock the account after three failures then that helps to limit that threat. But what people hear is that common words are guessable so these are disallowed.
But then, someone could get their hands on the password file (i.e.,
Then there's this requirement for non-alphabetic characters in the password. When password strengths are calculated (i.e., the number of possible hashes for a given hash length), the first thing that people take into account is the bit-size of the hash. This is often immense. However, most people use a small fraction of the available input variation. I.e., they tend to use all lowercase, no spaces, no punctuation, rarely numbers. And the letter-only passwords tend to follow English letter distributions to the tee (i.e., e used most often, then t, etc.) This makes it super easy to construct a dictionary. Or so you'd think. The truth is that machines are so fast today that the difference in time for coding to use the frequent letters first, versus the infrequent is not worth the time so everything is pre-hashed. But this is somehow lost and we end up enforcing stupid symbol and capitalization requirements. Solution - don't let the hashes out so that people can compare the known hash against the dictionary.
Then there's a requirement that the new password be significantly different from the old. This came about because people were using buffy01, then buffy02, then buffy03, etc.. People do this because thinking of interesting passwords every month is a nuisance so they developed a system to make it easier. Horrors! It doesn't matter that the buffy01 and buffy02 hashes would look completely different and do not appear in sequence in the hash dictionary. In other words, changing a single character will generate a completely different hash.
There are tons of other issues, but the point is that enforcing a few select rules is as good as forcing twenty complex ones.
"Long Passwords Are Easy as 1, 2, 3!" There's a good example of an easy to remember 'password'. It's not a word really, it's a phrase, but it is what I use all the time. They're easy to remember ("I HATE THIS STUPID JOB!!11!1"), fairly secure, and pretty buff against brute force attacks. What about something like "This is my Password for 6/1/2006"? I understand where you are coming from, being forced to use a 16 character password is a bit unwieldly, but it's not as bad as you are making it out to be.
Love sees no species.
Am I the only person who saw the subject and immediatly thought Star Trek?
Get a bloody SecurID token (or similar) already.
We allow pretty insecure passwords, all things considered. "password,1" would be valid, for instance, because it's longer than 8 characters and has punctuation and a number.
At the same time, we lockout after three unsuccessful attempts, and we don't allow password reuse for more than 2 years. So while the passwords tend to be on the simple side for the average user, the danger for brute forcing is nonexistent because of the low lockout.
I myself believe in obscene passwords. "Strong" password validators light up when I'm half done typing it in. But since I can fit the obscene things into my head, that's my privledge.
ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
Though probably unethical, it was very interesting to see what everyone used as passwords - very reflective of their personalities. Many were things like their children's names followed by "123". In one case, it was a pilot who used names of aircraft like "Cessna" - but most people seemed to take the 123 route in order to satisfy the password filter's insistence on numbers.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
> What's the deal with passwords in a corporate environment these days?
0 03950.html
There's a good chance it's because of Sarbanes-Oxley (SOX). There were rules about financial fraud that others (seems to be mostly consultants) have used to push for more restrictive password policies.
An interesting article I found:
http://blog.seattlepi.nwsource.com/buzz/archives/
I've started using what I think is a great was to create what appear to be rather secure passwords that are easy to remember and recoverable (that's a highly qualified statement as I am in no way a security expert). Go to:
http://www.hashapass.com/
and enter your "parameter" (e.g. "march2006") and "master password" (e.g. "mysecretpassword") and you get a password (e.g. "K0u4CUXG") generated from the two. Of course you still have to remember the password, but at least if you forget it you can recover it from wherever you are, without having to write it down. It's all local JavaScript on the browser, so there's no network exposure...
t.
It's much easier to remember your thumb or forefinger than it is to remember a 16+ character alphanumeric/special characterpassword. The military makes us have that type of password also, it can't relate to anything in your name, profile, history, or anywhere else easily accessible.
Just get a simple fingerprint scanner, make have a primary and a backup print...just in case someone severs or severely damages a finger beyond the point of recognition. They're not overly expensive and they're much more difficult to get around without lopping off the user's finger.
They make USB, PCI, and other variants that are easy to come by and relatively cheap. Isn't this really the way to go, until retinal scanners become equally inexpensive?
What else can happen when an unstoppable force collides with an immovable object?
Once you sign up your thumb, you just swipe your thumb and youre logged in. With further swipes, you can make it remember passwords to various websites and the likes.
So get a complex password, and put it in a piece of paper in your wallet. Then use the thumb device to 'remember' it and just use your thumb. Its faster than typing the password, and breaking it is currently hard (not enough hacker culture knowledge out there to break it quickly).
My friend spent a little while yesterday trying to break it and failed. I dont know why he even tried.
IBM has standard PC keyboards with the scanner built in. I'm getting one of those for my desktop, its addictive!
"Give orange me give eat orange me eat orange give me eat orange give me you." -Nim Chimpsky
They're easy to remember and extremely difficult to brute force. Just tell your users "Write a snippet of something which is meaningful to you". We can all type at 30+ words a minute so entering a 30 character password in natural English (perhaps without spaces) goes supringly fast. For example, supposing I liked classical literature, I could use socaesarmaythenlesthemayprevent (this is part of Brutus' soliliquy in Act 2 Scene 1 of Julius Caesar, which I had to memorize way back in high school). If you want to be reaaaaally anal you can obfuscate it a bit (l33tify, what have you). There is no convinient dictionary of "meaningful phrases in English" out there, although I suppose it would be somewhat less than secure if someone were able to find out you were, e.g., a Star Trek fan. And they're guaranteed to be easy to remember -- humans are a lot better remembering natural language they have an emotional connection to than remembering arbitrary alphanumeric strings. In fairness, I stole this tip from a Slashdot discussion about a year back sparked by advice from Microsoft, and have been using rediculously long passphrases since for all my "if that breaks, I'm "#$"#"#$%ed" logins (I still go with crazy insecure for trivial things like my slashdot login). I've got about 12 of them at the moment and have no problems with remembering them and changing with the security policy, whereas beforehand I had a discrete post-it.
Help poke pirates in the eyepatch, arr.
People won't brute force your 96 bit passwords, but that doesn't make you secure. I'm betting you have plenty of bigger security problems that have been ignored/overlooked.
Passwords suck. They always have, and they always will. Unlike smartcards, they don't protect against man-in-the-middle atttacks. They are easy to forget, easy to guess (in many cases), and, with a bit of social engineering, easy to steal. Many sites (Slashdot included) don't even bother to use SSL for logins. That's just sloppy.
"Every company has some information that needs to be secure."
Like the fact that Subacultcha wears a dress.
Which is real practical in a 24 hour operation where you work bankers hours and take a long lunch. And no one on the night shift speak Hindi.
Someone hates these cans.
I have a few different password systems, but one I started using more recently involves just using an alternate keyboard layout. That way, I can have a nice, easy password like, say, "MyComputer'sAwesomePassword". Then I type it as if the keyboard was a DVORAK layout. Or, if it's a DVORAK keyboard, type as if it were QWERTY. Throw in a few numbers for good measure, and you got a decent password.
Whenever this topic comes up, I always refer people to this classic Dilbert strip:h p?day=10&month=09&year=2005/
http://pag.csail.mit.edu/~adonovan/dilbert/show.p
-Sarkoon
s1F0bgMaI becomes s!F0bgMaI
I worked at a place a couple years back that had a dodgy .php script on a web server. And wouldn't you know it, there was a ginourmous .htpasswd file sitting in the docroot. And, as luck would have it, some of those passwords were also system passwords (yes, this was against policy, but the terminally obstinate could and would get around the rule).
Since I don't have access to his hardware, I can't say how easy it was for the cracker to push a few billion letter combinations at that file. But after looking into writing some automated security checking stuff, I can tell you that john the ripper makes quick work of a passwords like MessHeave, so I'm not sure he had to examine the entire space. All the "hard to guess" passwords were safe. The two-word combos, words with numbers after them, and some of the 133t-ish ones were pretty much all broken.
It probably shouldn't be possible to brute force a password attack, but in some cases that can happen. So why trust umpteen other mechansisms to prop up an inherently weak password scheme? There are more points of failure that way for sure.
It's good to assume every other part of the system is secure, but I think that is (at best) shirking responsibility. Reminds me of that Russian proverb: Trust in God, but keep rowing to shore. It's better to use good passwords to begin with, I think.
-B
Ash and Hickory, straight-grained and true, make excellent bludgeons, dandy for the cudgeling of vegetarians.
My company has a similar password policy (except for the "cannot compare in any digits" part). It used to be marginally saner but they've recently made it much more anal.
The funny part is, it's a newspaper. ANYTHING on ANY of the operations computers is either useless or published nationally within 24 hours (except the vary rare embargoed material, which has a shelf life of a week or less).
But that's just to log on to the network. However, you can access our publishing system over the internet, without connecting to the corporate network. On our old publishing package one password was good forever, but I'm not sure about the new (web-accessible) one - it's still quite recent so all you need to log in is a user name (which is invariably the same as the username portion of our e-mail addresses).
Having just gone through this, I can commiserate. We have to change passwords every 6 months. Here are the criteria:
at least 8 characters
both upper and lower case letters
at least one number or symbol
can't contain a dictionary word of 4 characters or longer
none of your last 6 passwords
not any account name
no date or year
no sequentially repeating characters
no space, editing, field-separator or quote marks
no letters in forward/reverse alphabetic sequence
no letters in forward/reverse keyboard pattern
no dictionary words with "1337" substitutions
no only numbers or only punctuation
Try coming up with one of those that's *also* easy to remember and fast to type. It's a pain.
I'm hoping you're not using Windows. I happened upon a nice little tool that allows me to blank all Windows passwords under 2K/XP (Must be using the NTFS file system, however,) if you give me physical access to the computer.
Gain access to PC
Blank all passwords
Tell someone
???
Profit!
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
you forgot to tell us your ip address
-- Segmentation fault. Core dumped
Even remembering a password that changes every month isn't too bad. But remembering 50 passwords that have different rules, and have to be changed at different intervals is almost impossible.
Slow down, cowboy! It has been 4 hours since you last posted. You must wait another few hours.
Yes, That is a bit over the edge...sounds like you got one of those Policitaly correct consulting firms who talked your company into some kinda shit that is archiac, and silly. If that high of a security level is needed, they should switch to using either your employee badge system to do the login via a card reader attached to your PC, or biometrics, or both. Simply swipe your badge, and scan your finger/thumb, and you don't have anything to write down, or forget...unless you are one of us who forgets his/her badge on occasion :o)
----- I have bad karma for a reason! -----
American English words, a couple of digits, mixed capitalization without looking too much like l33tspeak and it doesn't look like line noise. Someone running a password cracker would have to try every combination of words in their dictionary file with multiple attempts for capitalization and numeric sequences mixed in, a data set that contains too many permutations to feasibly try.
Just don't write it down anywhere. It would be easier to steal the little sticky-note under the keyboard than it would to brute-force it.
Proteus' Child
Doko ni datte; hito wa, tsunagette iru.
I work for a defense contractor (aerospace) and password complexity depends on the system it's applied too. Some systems, like older mainframes need a security exception because they were not designed to meet complexity requirements. Others however, like simple workstations need only be a minimum of 8 alphanumeric characters and changed every 90 days. Some ID's, like service and generic utility IDs need to be 16 characters, (alphanumeric mixed case and sepcial characters) and changed every 120 days. Again, it all depends on the system the ID/password is for. Obviously a workstation that accesses TS/SCI material will require stricter password complexity requirements than a workstation that creates company wide information...
in your situation though, you're security admin is crazy.
Obvious current candidates for obvious-password-cracking are things like MS-SQL, which allows you to send a whole request with a single UDP packet (as demonstrated by the old SQL-Slammer worm in 2003...)
So yes, cracking poor password choices has lead to signifigant breakin and security woes through the years.
On the other hand, rules like "Include mixed case and special symbols" doesn't particularly solve the problem. toggling the case of letters and appending digits on obvious words has been a feature of programs like "crack" for decades, and that's what those rules promote. When user Fred Jones makes his password "FredJonesFredJones123!" to pass the rules check, it still isn't a terribly secure password. Or the user just writes down their password and PostitNotes it to the screen...
A much better approach would be one like one posted here to Slashdot a while back, Inkblot Passwords, where you show a user a series of randomly generated images which are associated with their account, and they enter a two-word phrase associated with each inkblot.
- "History shows again and again how nature points out the folly of men" -- Blue Oyster Cult, 'Godzilla'
Passwords should not be considered security, but as authentication to resources. Network security should be applied by the admin through rights.
If you are concerned with the security of your passwords, admin should use a password management system and encrypt. Two part authentication can be considered security and USB flash drives are cheap. You then could use something you know and something you have.
I have used the same 6 letter admin password for about 20 years. It was stolen once by a student looking over my shoulder. I caught him within a half hour of trying to use it and had the logs to prove it and everything (nothing, looked around) which he had done. I had him pulled out of class by security. I have set up passwords by department (in specific situations) where whole departments used the same passwords, but employees only used "their" PCs and accessed the same accounting information. Using static ips and logs you can tell what each user in doing.
In my previous job as a network security guy, I used to write down fake passwords on post-it notes and leave them in places like on the bottom of my keyboard, CRT etc. I even had a fake combination written on the back of the lock gaurding my document safe so that anyone that found it would think me an idiot and waste time trying to figure if it was right or left on the first of the more than three numbers.
My PHB came by to warn me about the need for security, so I grabbed a passing by clueful intern and asked him what the post-it note on the back of the lock was.
Without missing a beat, he turned to my boss and told him it was a decoy.
The PHB was unamused.
Occasionally I would have worksation accounts set up that would make use of these fake passwords that would email my blackberry if used, and then shut down the machine. It never happened, but it was fun setting it up.
Current corp policy here is minimum 8 characters, characters are classified as "upper case", "lower case", "numbers", and "special characters", and we must use at least 3 different classes of character in the password. Password changes every month, and we cannot repeat any of the previous 10 passwords.... :-)
Simple solution is to use a pass phrase that's easy to remember, and add numbers to the end of it. Like:
"I hate our dumbass security policy01"
"I hate our dumbass security policy02"
"I hate our dumbass security policy03"
"I hate our dumbass security policy04"
"I hate our dumbass security policy05"
"I hate our dumbass security policy06"
"I hate our dumbass security policy07"
"I hate our dumbass security policy08"
"I hate our dumbass security policy09"
"I hate our dumbass security policy10"
"I hate our dumbass security policy11"
at this point I can either start the sequence over again, or keep counting upwards.... how many months has it been since this dumbass security policy took effect?
Nothing to see here. Move along.
I simply store the passwords that I have trouble remembering on my camera's compact flash card: Added with steganography (http://en.wikipedia.org/wiki/Steganography) to some pictures. They're also backed up on a photo sharing site online, though I have it set so no one can view them but me.
Go for a Single Sign On system. Syncronize all your system to have a single password (and a single username if your systems are relatively full and flexible) and then make the password as hard as you can. PS: If you go for a corporate closed source solution, just make sure it's not Computer Associates' eTrust SSO. Novell is the best.
Also consider that this attack will only work if the attacker knows your account number. If they're both secret--the ATM card example--it's a nonissue.
Laws do not persuade just because they threaten. --Seneca
Passwords are almost irrelevant these days. In order to comply with U.S. export laws, businesses usually use crap encryption so that they are not required to collect+submit names & addresses of each end user outside U.S. and Canada to the government. Examples of companies unwilling to sacrifice your security just so they can sell to more countries are rare. I only know of one, Innersafe Corporation, and that is because I know someone at there. I think they're going live this month. Any bets on how long it'll take for them to be pressured by the govt. into weakening their products?
Just remember, even if your password is 100 characters long, a keylogger can still grab it.
I suspect you've misunderstood what I'd heard recommended: picking the 'n'th letter from each word in line of a song. It may be pride-before-a-fall but a near-random string of letters strikes me as immune to dictionary attacks. This fails google: stuff with this kind of lettering doesn't score well on page rank.