Slashdot Mirror
Poor Passwords A Worse Problem Than Poor Antivirus
dasButcher writes "Viruses and worms get all the headlines, but poor password management is a worse problem according to a new study by Channel Insider and CompTIA. As Larry Walsh writes in his Security Channel blog, VARs and security service providers say they find more problems with password management than antivirus applications when they do security assessments. While password problems are nothing new, Walsh and those posting on his blog correctly assert that users remain cavalier about passwords and businesses are doing too little to address this serious vulnerability."
In TFA the author complains about "sunflowers", people who have passwords on post-its stuck around their monitor frame. The thing about post-its is that 89% of last year's credit-card breaches originated from sources outside the companies. And there is no malware possible that can read what's written on a post-it note.
John
I think one day, we'll look back at this period of needing umpteen different 8-16 character one capital letter one alphanumeric character passwords (changed each month!) with the same horror we now regard the times when the best solution to a serious leg injury was to cut the freaking thing off. With no anasthetic. Maybe it's not directly analogous, but it's just as barbaric and wrong and crazy!
It's password! How ingenious is that?
Oh, wait...
"The difference between genius and stupidity is that genius has it's limits" - Albert Einstein
Comment removed based on user account deletion
It's good to see Arora getting some more attention now. I've been using it now for more than half a year and I must say it's the first webbrowser I have actually liked in several. I would definetly consider it the best OSS webbrowser on linux right now, particularly if you're running KDE (although Arora is desktop agnostic, it is Qt). I've been fed up with Firefox's bloat (ever try comparing Firefox and Seamonkey these days? Guess which is heavier...) for some time and Arora is a nice change from that.
"linux is just DOS with a UNIX like syntax" -- Galactic Dominator (944134)
What's wrong with biometrics? Maybe somebody could explain to me why more keyboards don't ship with biometrics built in? Instead of remembering 25 different passwords each with their own ridiculous rules you could just scan your finger. It could even work when you want to make CC purchase or login to your email.
I'd like to make a proposition to everyone on slashdot.
For the greater good of humanity, we need to employ some social engineering. I suggest that all of us stop referring to it as a "password" and start referring to it as a "passphrase". With a little luck, it'll catch on and people will start using phrases instead of just words. This tiny change should cause people to create easily remembered passes that are in excess of 10 characters long.
+1 IDisagreeSoHeMustBeATrollOrAnAstroturferOrAShill
Until people get over this misconception and communicate to their users: "give yourself a good password. I won't ask you to change it so you can pick a strong password that you will remember and that will be the end of memorising passwords" Then stress what makes a strong password.
The real "Libtards" are the Libertarians!
When the password is the name of the computer owner's son, daughter, or significant other, why is it that the main character never has to fiddle around altering names by replacing random letters with 1337 or @, $, and # signs?
The article repeats the same Myths of password security that we have been repeating for the last thirty years. Let me review them for you:
- Password Length is important
- Password Complexity is key (e.g. A-Z with at least one special, one number)
- Password Expiration is important
Like all good myths these have elements of truth in them but fail to really hit the nail on what the problems actually are, or namely:
- Strong login auditing is important (failed attempts, unusual patterns, etc)
- Login speed should be throttled (e.g. No 60/guesses per minute)
- Failed logins should be capped (e.g. Login wrong five times? Consult technical support)
Now we are talking about password security. You can also throw on a five length minimum. Now even if your password was "password" they would still find it extremely difficult to compromise the system since it would be slow and would break after the first five. If you tried to spread out the attempts over several weeks (making it slower still) the audit logs should be alerting the administrator to 14/failed attempts per week from China.
This is probably because most security assessments aren't very good and don't correlate well to an organization's actual security problems. At least the assessments help people get rid of all that extra money they have.
I remember when working for a major financial firm in Boston, they had the most ridiculous password policies for each password. We had to have at least four or five different passwords according to what you needed to access, each with their own rules and limitations (size, characters allowed etc...). Not only that, but each password expired in different intervals. So basically every week, you'd have to change at least one password making the whole damn thing impossible to remember.So, what did people do? They wrote them down in little sticky-notes. Sure, I came up with my own schemes to facilitate remembering them, but nevertheless a forgotten password was bound to happen. It amazes me how paranoid firms are about some policies, yet leave the back door wide open due to such stupidity
Due to a recent identity-theft scare I had the other day, it made me realize the importance of safe-guarding the data with good passwords. Since then, I've used KeePass to generate and store all my 20-digit random passwords that I've since never have to remember (a backup, of course, is constantly made and stored in a safe place). Either way, I'm no security expert, but it seems to me an approach like this would be much more sensible than inconsistent password policies that expire randomly. Just my $0.02
I've come accross one (badly coded) site where that stategy backfired on me. I typed my standard use-it-for-non-critical-sites 15 character passphrase - all seemed well and good. But then, when I tried to log in, it kept telling me I had the wrong password.
Turns out their form only saved the first 12 or so characters - but they hadn't limited how many characters you could type into the field, so I didn't know I'd typed too many. And guess what - the login form accepted more than 12 characters! Hence my borked login.
Fortunately I think that flaw got fixed when they upgraded their site, but I wonder how many more sites out there are broken like this...
That's ok. Compared to the typical post these days it's refreshingly informative.
We all know most people will never use "proper" passwords, let alone "properly", quite aside from offices in which ridiculous password management policies drive people to drink^h^h^h^h^h simply writing their passwords on Post-it notes stuck to their monitors. Why not make the best of a bad situation by only insisting on reasonable passwords changed no more than once per six months, complete with freely available "wallet-sized password booklets", but which are accompanied by other methods such as once-per-session typing pattern analysis verifications or cheap magnetic stripe cards? (The obvious security problem with a magnetic stripe card in the same wallet as a password booklet, for example, can be ameliorated by insisting that the magnetic stripe cards be kept in small employee lockers, and never allowed off-premises).
The point is that a little imagination is all that is needed to make security reasonably good or at least acceptable, given that the weak link will always be the kind of muppets who insist on shoving bricks between doorjambs and ultra-high-security triple-locked doors if they are at all allowed. Sure, any security method can be defeated, but it's far easier to educate (okay, frighten) people into not removing stuff from company premises (the magnetic stripe cards) or to make them perform once-a-day monkey tricks (the typing pattern analysis verifications) than it is to make them stop writing stuff down in very insecure ways. Security will tend to be more even, and problem employees will be easier to spot.
The old saying comes to mind, "The perfect is the enemy of the good."
A truly excellent pizza parlor is a delight unto the heavens. Treasure the sauce and the toppings!
Listen up, paranoid policy people everywhere: setting up a "strong password policy" is NOT the solution. Typically this involves forcing the user to choose a password that's more than ten characters, has punctuation and numbers and mixed case in it, and forces a password change every 30 days.
You know what that does?
It forces people to write their passwords down. On paper.
With the password written down, it's very easy to "crack" because it's sitting there, "in the clear" on a dead tree.
Tired of FB/Google censorship? Visit UNCENSORED!
Biometrics work fine for in-person authentication, but they are terrible for network authentication because they are not secrets and because they cannot be changed. In person, they might be hard to fake (depending on the technology), but over the network, it's just data like any other and, as such, trivial to fake. I have a longer comment about this further down if you want more detail.
Fingerprints, great... Might as well get a permanent marker and scrawl my password all over my laptop!
There's a reason usernames are public.
On a Unix machine, knowing someone else's username lets you send them mail. It lets you access (if they allow you to) their home directory. It lets you see if they're logged on (using "w"), see information about them (using finger), and even communicate with them (using write), and lots of other useful things.
What are you talking about? What good would asterisking the username do? It would result in a longer unkown string, but you should use strong passwords anyway so it shouldn't provide any extra security.
My Etrade accounts have a traditional password with the requirement of an RSA token. This seems to be a great solution to the password problem.
The first part of the password is easy to remember, the second is changed every 60 seconds by the token.
It is a bit less convenient than a standard password, but that is the price to be paid to secure a bank account.
-ted
Strong, weak.
Your choice.
Use 1Password t manage them all.
Dave Barnes 9 breweries within walking distance of my house
that's something an idiot would have on his luggage!!!
I'm surprised no one has mentioned this yet, but Mac OS X has an application called "Keychain Access." Keychains store private keys, certificates, and arbitrary notes securely. I use one to store my passwords to all my e-mail and web accounts. They're encrypted using Triple DES.
Not only that, but it can generate passwords for you. Tell it how many characters you want, and whether the password should be memorable (comprised of dictionary words and a short string of numbers), letters and numbers, numbers only, something called "FIPS-181 compliant," or random. You can choose from the ones it generates from a pop-up menu, and if you don't like any of them, it can generate some more. Whatever password you choose, there's a gauge that tells you how strong it is.
I have to use it occasionally to look up a password to an infrequently visited web page. Entering my user password (that is, the one for my account on my computer) will unlock any one that is stored on the keychain.
Is it easy to use? Kind of, sort of; it takes a few seconds and more than a few mouse clicks to retrieve a password. Safari (perhaps Firefox as well, but I don't know) can be configured to remember your login information for a given page, and though it stores this information in the login keychain, the problem with Safari's implementation is that it works for some pages and not others, and doesn't require you to provide your user password--not exactly the most secure arrangement.
No one's ever compromised this scheme, as far as I know. Yet. Meanwhile, it works pretty well for me.
Those who can, do. Those who can't, write technology blogs.
I'm surprised no one has mentioned this yet, but Mac OS X has an application called "Keychain Access.........
word of warning from experience, used to work for apple, make sure you have another copy of your passwords because as you say the keychain is encrypted and if the keychain gets corrupted you may have to reset the keychain.
I would get a keychain access issue about once a week and the person on the other end of the phone used to get very upset as they were unable to do there banking.