Slashdot Mirror
Poor Passwords A Worse Problem Than Poor Antivirus
dasButcher writes "Viruses and worms get all the headlines, but poor password management is a worse problem according to a new study by Channel Insider and CompTIA. As Larry Walsh writes in his Security Channel blog, VARs and security service providers say they find more problems with password management than antivirus applications when they do security assessments. While password problems are nothing new, Walsh and those posting on his blog correctly assert that users remain cavalier about passwords and businesses are doing too little to address this serious vulnerability."
In TFA the author complains about "sunflowers", people who have passwords on post-its stuck around their monitor frame. The thing about post-its is that 89% of last year's credit-card breaches originated from sources outside the companies. And there is no malware possible that can read what's written on a post-it note.
John
Until people get over this misconception and communicate to their users: "give yourself a good password. I won't ask you to change it so you can pick a strong password that you will remember and that will be the end of memorising passwords" Then stress what makes a strong password.
The real "Libtards" are the Libertarians!
This is probably because most security assessments aren't very good and don't correlate well to an organization's actual security problems. At least the assessments help people get rid of all that extra money they have.
I've come accross one (badly coded) site where that stategy backfired on me. I typed my standard use-it-for-non-critical-sites 15 character passphrase - all seemed well and good. But then, when I tried to log in, it kept telling me I had the wrong password.
Turns out their form only saved the first 12 or so characters - but they hadn't limited how many characters you could type into the field, so I didn't know I'd typed too many. And guess what - the login form accepted more than 12 characters! Hence my borked login.
Fortunately I think that flaw got fixed when they upgraded their site, but I wonder how many more sites out there are broken like this...
Listen up, paranoid policy people everywhere: setting up a "strong password policy" is NOT the solution. Typically this involves forcing the user to choose a password that's more than ten characters, has punctuation and numbers and mixed case in it, and forces a password change every 30 days.
You know what that does?
It forces people to write their passwords down. On paper.
With the password written down, it's very easy to "crack" because it's sitting there, "in the clear" on a dead tree.
Tired of FB/Google censorship? Visit UNCENSORED!
The problem with biometrics is that they aren't secrets and they aren't changeable. As such, they're fine for low-security in-person authentication. For example, I've heard of a restaurant which had their wait staff punch in by scanning their finger prints. That's fine. But if you use it to control access to the VPN, then that's problematic due to the non-changeability.
Here's why:
Let's assume that you are an employee who runs Windows at home. You keep up with the latest patches and don't do anything stupid. You probably even run Firefox. But still, someone manages to slip through an unpatched bug and infect your system. It can happen to just about anyone. They then install a back door and start logging what's going on in your system. They notice that you connect to a VPN so they start sniffing your USB traffic so that they can appear as you (recording either your password or your fingerprint). Now they can get into your company's VPN. It's compromised. Fortunately, your IT guy is on the ball. At 11am the next day, you get a call from your network admin asking you if you are signed into the VPN because he expects that you're in the office, but you also appear to be signed in remotely. You confirm that you are not signed in and the two of you realize that you've been hacked. He temporarily disables your access. You go home, clean up your home computer (assuming that you can) or bring it in to have them clean it up, and then it's time to give you access back.
Now here's where things diverge. If you've used a password, you just have to change your password to a new one, and it's secure again. Your fingerprint isn't changeable. Obviously, you can switch to a different finger, but that's a limited strategy since you've only got 10 of them (well, maybe slightly more or less if you were born with extra fingers or have lost some in accidents). I suppose once you're out of fingers, you could use toes, but I doubt most users would be willing to. This becomes especially problematic if any non-hashed versions of things are stored (as often must be done for fuzzy matching) because if the database gets compromised, every single person would need to change to a new finger. You also wouldn't want to use the same finger for your work password as you use for your bank. So, a total of 10 may seem like a lot, but over the course of a lifetime, you're almost certain to run out. Other biometrics are even more problematic since people have at most two irises, only one voice, only two sets of hand geometry, etc.
The non-secrecy can also be a pretty big issue, although that one usually only comes up with insider attacks since they generally have to know you in person. Let's say you use the fingerprints for controlling access to the company database. Now, Alice is a supervisor in payroll accounting and can change people's salaries in the database. Eve works sales and is clever and unscrupulous. Eve invites Alice over to dinner, and after she's left, lifts her fingerprints from her wine glass or the glass table top or almost any other smooth surface she's touched. Heck, she might even be able to get it from a door knob at work if she's careful. Once Eve has the fingerprint data she can then log-in over the network to the database.
The banking situation would be even tougher because you would expose your fingerprint when you use an ATM. All an attacker would have to do is wipe the buttons and/or fingerprint scanner clean before you use it and then lift your print from the machine when you're done.
Alice can keep her password in her head, or if it's too hard to keep in her head, she can write it down and keep it in a locked drawer in the office. This isn't absolute security, especially since keys can be duplicated from pictures of them, but would at least require that Eve physical break into the office. But still, her password at least starts out as a secret unknown to anyone else. Her fingerprints are not secrets. Using your fingerprint as your password is like writing you pas
And Linux has had Pluggable Authentication Modules since 1996. It currently supports, among other things, smart cards, fingerprints, passwords and and a bunch of different hardware crypto devices.
# cat
Damn, my RAM is full of llamas.
Fingerprints, great... Might as well get a permanent marker and scrawl my password all over my laptop!
There's a reason usernames are public.
On a Unix machine, knowing someone else's username lets you send them mail. It lets you access (if they allow you to) their home directory. It lets you see if they're logged on (using "w"), see information about them (using finger), and even communicate with them (using write), and lots of other useful things.
What are you talking about? What good would asterisking the username do? It would result in a longer unkown string, but you should use strong passwords anyway so it shouldn't provide any extra security.
My Etrade accounts have a traditional password with the requirement of an RSA token. This seems to be a great solution to the password problem.
The first part of the password is easy to remember, the second is changed every 60 seconds by the token.
It is a bit less convenient than a standard password, but that is the price to be paid to secure a bank account.
-ted
Strong, weak.
Your choice.
Use 1Password t manage them all.
Dave Barnes 9 breweries within walking distance of my house
No, no, and no.
Stop making life hard on users for no real gain in security. Make a system that is secure with a 4-digit PIN. It's easy, and there's really no reason not to use two-factor authentication these days except (a) you don't really care about security, or (b) you actively hate your users, and a passphrase is as close as you're allow to come to hitting them with a hammer whenever they log in.
I realize (b) is common, but it still doesn't make for good security.
Socialism: a lie told by totalitarians and believed by fools.