Slashdot Mirror
51% of Computer Users Share Passwords
An anonymous reader writes Consumers are inadvertently leaving back doors open to attackers as they share login details and sign up for automatic log on to mobile apps and services, according to new research by Intercede. While 52% of respondents stated that security was a top priority when choosing a mobile device, 51% are putting their personal data at risk by sharing usernames and passwords with friends, family and colleagues. The research revealed that consumers are not only sharing passwords but also potentially putting their personal and sensitive information at risk by leaving themselves logged in to applications on their mobile devices, with over half of those using social media applications and email admitting that they leave themselves logged in on their mobile device.
No. It's THE code breaker. No more secrets...
I am one of the 49% percent...
The research revealed that consumers are not only sharing passwords but also potentially putting their personal and sensitive information at risk by leaving themselves logged in to applications on their mobile devices, with over half of those using social media applications and email admitting that they leave themselves logged in on their mobile device.
Yes, god forbid people "leave themselves logged in" to their email accounts on their mobile device. I guess we're not supposed to use push email but instead enter our email passwords into our phones every few seconds to get timely email alerts?
It's too bad that the cell network itself lacks any meaningful security mechanisms. I mean, if someone gets a hold of your phone, they can just start texting and calling without having to "log in" on the network at all. It's amazing that the world hasn't collapsed as a result.
Chuuch. Preach. Tabernacle.
Whilst technically correct that this increases risk of the password being revealed, it is an absolute necessary of an overall risk reduction strategy for online accounts (cancelling bills etc.).
the overwhelming amount of real danger is from database compromises, which this has almost (almost!) nothing to do with.
smells like fud to keep people from sharing their paid services with friends and family. fuck that.
"They were pure niggers." – Noam Chomsky
Android's especially annoying how a single tablet is linked tightly to a single google account. To have a table that's shared among all people living together, you practically have to set up a shared google acccount.
So are you really surprised? Honestly I'm surprised it's not higher.
51% of people on the internet are stupid, details at 11....
Of course I leave the apps on my phone "logged in"; that's how they're supposed to work. Obviously this only makes sense if there's a password to access my phone (or on my account if the device supports them), but if not, it's the lack of password on my phone that marks me as a security-oblivious idiot, not the fact that I'm using the apps as they were designed to work.
http://alternatives.rzero.com/
The purpose of security is to prevent unauthorized people from accessing the account. There are tons of accounts that are legitimately shared, and there is nothing wrong with sharing passwords in those situations, if the account doesn't have any technical mechanism to allow for multiple users/profiles on a single account. For example bank accounts, utilities, Netflix, Hulu, wireless router administration, all have been shared accounts with my wife (some have since added profiles, but not all).
Furthermore, even with accounts that we keep separate, like email, there are useful reasons to share the password, like when my wife is away from internet at work and wants me to print a boarding pass that was emailed to her. Sure I could snoop through her email, but I don't just like I could snoop through her purse or journal, but I don't.
Let us imagine for a moment, that we do everything exactly the way, security advisors are telling us:
* have a different password for every website and every account we got
* never write down a password
* log out (from every social site) whenever we stop using a mobile or desktop device
* change all of our passwords every 30 days (to unique new and complex ones (at least 11 characters with different rules (letters, cases, numbers, punctuation symbols) for every system)
* never share a password with anyone
Now, for how many services are you able to do that?
How much of your time does it take?
How often do you check your emails or social sites a day?
How often do you require to reset passwords?
But how many accounts do you really have?
How much time do you want spend in password management?
A lot of the bigger, more frequently-used services actually encourage this. The best example I can think of is Netflix, which allows you to have separate profiles for family members but requires that everyone use the same user/pass to log in. I don't know why they couldn't just have individual passwords for the same account - at least that way I could avoid my mom trying to get everyone in the family to watch Sherlock ("Oh, I didn't see it on your watched list! You should try it!").
Amazon's Kindle app does pretty much the same thing, though it's not directly encouraged - you can log into your Kindle account from several different devices at once, effectively allowing people to share their books with anyone they trust enough. I think this is actually worse than Netflix, because most of the time you're using the Kindle app on a mobile device that can easily be lost or stolen.
The only company I've seen do sharing well is Valve, which has Steam Family Sharing that allows you to "lend" people your account without actually needing to tell them your password.
Societies need trust. You need to be able to trust your family and friends. If you think that your cellphone password is more important than, say, the keys to your house or your heart, then maybe you don't need family and friends?
Wikipedia has a lot to say about trust: http://en.wikipedia.org/wiki/Trust_%28social_sciences%29
and 49% of people lie about sharing their passwords
51% of Computer Users Share Passwords
In other words, "49% of Computer Users Aren't Stupid." (I suspect that's grossly overoptimistic, however.)
I blame windows. Since users and even administrators can not use commands like sudo or su, people resort to sharing password. It is absolutely impossible in windows to run a process as another user without knowing his or her password. In the real world, even IT people that should know better share their passwords.
Microsoft claims that the way runas works is for increased security by preventing admins from masquarading as another user but in practice it's a security nightmare. Admins fix problems, they don't mess with user accounts for fun. Someone with domain admins credentials should be able to run stuff as any user.
Also, it's a seperate issue but policies that force password changes are just as stupid. In my org. about half the users have their password on a postit or in a notebook near their computers.
Imho, the windows security model is just smoke and mirrors. It actually creates more problems than it solves.
And the average person is not very smart in the first place. This news item just describes one of the consequences.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Sometimes sharing the passwords of those less technically savvy with those with better skills is necessary and would skew these numbers. Knowing Grandpa's gmail password has helped a lot.
"Consumers are inadvertently leaving back doors open to attackers as they share login details and sign up for automatic log on to mobile apps and services" - You mean like automatically logging on to GMail on their phones? Ummm...isn't that the way it's supposed to work? I can't see anyone logging in and out of email every time they want to use it. Totally impractical, especially if you have a long and complex password. Like you would if you were concerned about, um, security.
"51% are putting their personal data at risk by sharing usernames and passwords with friends, family and colleagues." - And how did they arrive at this number, exactly? I call BS on this one, particularly given that Intercede just happens to be a company that sells security software for mobile devices. Coincidence? I think not. I'm not disputing that it's a bad idea to share passwords with friends and colleagues (family I'm ok with). What I am questioning are the motives behind it. Obviously, Intercede is trying to get people to panic and buy their software. Typical security industry scare tactics.
"The research revealed that consumers are not only sharing passwords but also potentially putting their personal and sensitive information at risk by leaving themselves logged in to applications on their mobile devices, with over half of those using social media applications and email admitting that they leave themselves logged in on their mobile device." - The solution is to lock the device. You basically have three choices: use a pattern, a PIN or a password. The pattern could probably be guessed easily enough by someone determined to do so but it's better than nothing. PIN is better, password is best. But it's the age old problem of security vs convenience. I used to put an encrypted passphrase on my phone until it became a complete PITA to use it. So there has to be a balance between safety and convenience. I like what Apple is doing with the fingerprint authentication. It's not perfect but it seems to me that it strikes a nice balance. Simply putting some sort of lock on your device (even a simple swipe pattern) will mitigate a lot of issues. Maybe it should be the factory default for devices?
This article is hysterical in tone. What percentage of husbands and wives (or other people in relationships) share keys? I mean physical keys to your house and how about actual kitchen knives. I guess it is risky but in the real world people will do it. We do have to trust each other. pavon's (30274) comment above expresses the situation well. On the other hand not putting a PIN or better still a password on your phone, tablet, or laptop is just moronic. And you may as well use full disk encryption while you are at it.
this is just more blaming the user. see credit cards.
News at 11... idiots are IDIOTS!!!!!
Shock Horror!!!
just because family members share passwords doesn't mean its insecure. I know the password to most of my parents email and accounts. But so what... I won't do anything they wouldn't approve of and know them well enough to know what they would and would not approve of... so who cares.
And as to companies... most of them are small and medium sized businesses that have overlapping responsibilities. In those cases, SOME people know some passwords. But rarely does everyone in the office know all the passwords.
Its not unreasonable.
I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
Seatec Astronomy
People are good at evaluating the risks of sharing personal info with other people.
The real problem is people sharing the same password between multiple sites. People are really bad at evaluating the risks of any given website being hacked and thus making all other sites that use that password hacked as well.
The best thing we can do for security is encourage to write their site-unique passwords on sticky notes and post them clearly and legibly on their monitors. We'd go from millions of people being compromised every day by malicious hackers with a means of really messing you up, to one or two being hacked a day by someone's brother wanting to pull a prank.
Once people make 10 unique passwords, they'll switch to a password manager. But even if they don't, you're safer printing your username and password on a t-shirt than you are re-using the same password on both google.com and adobe.com.
Passwords/security inherently get in the way of ease of use. Having to enter your password every time is a risk too: easier for people to look over your shoulder and figure out what you are typing, easier to hit max attempts and accidentally lock yourself out etc.
Not an easy thing but it shouldn't just be password but context. We need a way of saying: "my wife can check my email for that important piece of info I need while driving now, but not later". A one time use code. Germany (and probably others) have a similar system for banks. You have your code and confirmation numbers mailed to you. When you start a transaction it asks you for the corresponding code from the list. You could then at least for your bank account only give someone the one code that they are currently being asked for and not have to worry about them running away and doing more transactions later.
How else am I supposed to watch HBO?
In other news, 95% of people surveyed are putting their identities at risk by sharing their house and car keys with friends, family and colleagues. "As we lead more and more of our lives in houses and cars, our identities need to be effectively protected – worryingly, it appears that this is not the case at the moment", he continued. "It's not surprising consumers are taking shortcuts such as putting all of their identity cards into a single "wallet" or "purse" that is easily lost, stolen or hacked. It's time for stronger authentication and more sophisticated forms of identity."
The research revealed that consumers are not only sharing keys, but also potentially putting their personal and sensitive information at risk by leaving these "wallets" in easily-visible locations with over half of those who take showers admitting that they leave their wallet on a dresser or table while they do so.
There are two people who have access to all of my passwords: My wife and my lawyer.
These are the only two people on this planet with whom my communications are protected by legal privilege.
Should the thinkable happen (let's face it, calling untimely death unthinkable is stupid, as it is entirely thinkable), there should be someone left who can access everything to put my affairs in order.
Almost everyone shares at least some passwords.
There's always a wife/husband or a friend that we ask to do something from.
Even more - at work places IT is instructed not to ask for passwords, and people are instructed not to give them.
BUT - there's always some good reason that makes us give a password to the IT guys. (we'll change it right away... right).
This is an example of a good password at my company "m7Rx2NqU" -- that's an unrecognizable jumble of characters that only a computer could love, but never a human.
I'd prefer to use "correcthorsebatterystaple" (ala XKCD), but my company's password policies do not let me use a pass phrase, but a jumble of numbers, letters and uppercase.
If telephones are outlawed, then only outlaws will have telephones.
Which means it's rock solid secure!
1-2-3-4 nobody will ever guess it!
-- Tigger warning: This post may contain tiggers! --
Mine is 1d10t. ;)
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).