Slashdot Mirror
51% of Computer Users Share Passwords
An anonymous reader writes Consumers are inadvertently leaving back doors open to attackers as they share login details and sign up for automatic log on to mobile apps and services, according to new research by Intercede. While 52% of respondents stated that security was a top priority when choosing a mobile device, 51% are putting their personal data at risk by sharing usernames and passwords with friends, family and colleagues. The research revealed that consumers are not only sharing passwords but also potentially putting their personal and sensitive information at risk by leaving themselves logged in to applications on their mobile devices, with over half of those using social media applications and email admitting that they leave themselves logged in on their mobile device.
The research revealed that consumers are not only sharing passwords but also potentially putting their personal and sensitive information at risk by leaving themselves logged in to applications on their mobile devices, with over half of those using social media applications and email admitting that they leave themselves logged in on their mobile device.
Yes, god forbid people "leave themselves logged in" to their email accounts on their mobile device. I guess we're not supposed to use push email but instead enter our email passwords into our phones every few seconds to get timely email alerts?
It's too bad that the cell network itself lacks any meaningful security mechanisms. I mean, if someone gets a hold of your phone, they can just start texting and calling without having to "log in" on the network at all. It's amazing that the world hasn't collapsed as a result.
Chuuch. Preach. Tabernacle.
Whilst technically correct that this increases risk of the password being revealed, it is an absolute necessary of an overall risk reduction strategy for online accounts (cancelling bills etc.).
the overwhelming amount of real danger is from database compromises, which this has almost (almost!) nothing to do with.
smells like fud to keep people from sharing their paid services with friends and family. fuck that.
"They were pure niggers." – Noam Chomsky
49percent
That's my password...
When the foot seeks the place of the head, the line is crossed. Know your place. Keep your place. Be a shoe.
Android's especially annoying how a single tablet is linked tightly to a single google account. To have a table that's shared among all people living together, you practically have to set up a shared google acccount.
51% of people on the internet are stupid, details at 11....
Of course I leave the apps on my phone "logged in"; that's how they're supposed to work. Obviously this only makes sense if there's a password to access my phone (or on my account if the device supports them), but if not, it's the lack of password on my phone that marks me as a security-oblivious idiot, not the fact that I'm using the apps as they were designed to work.
http://alternatives.rzero.com/
The purpose of security is to prevent unauthorized people from accessing the account. There are tons of accounts that are legitimately shared, and there is nothing wrong with sharing passwords in those situations, if the account doesn't have any technical mechanism to allow for multiple users/profiles on a single account. For example bank accounts, utilities, Netflix, Hulu, wireless router administration, all have been shared accounts with my wife (some have since added profiles, but not all).
Furthermore, even with accounts that we keep separate, like email, there are useful reasons to share the password, like when my wife is away from internet at work and wants me to print a boarding pass that was emailed to her. Sure I could snoop through her email, but I don't just like I could snoop through her purse or journal, but I don't.
Let us imagine for a moment, that we do everything exactly the way, security advisors are telling us:
* have a different password for every website and every account we got
* never write down a password
* log out (from every social site) whenever we stop using a mobile or desktop device
* change all of our passwords every 30 days (to unique new and complex ones (at least 11 characters with different rules (letters, cases, numbers, punctuation symbols) for every system)
* never share a password with anyone
Now, for how many services are you able to do that?
How much of your time does it take?
How often do you check your emails or social sites a day?
How often do you require to reset passwords?
But how many accounts do you really have?
How much time do you want spend in password management?
A lot of the bigger, more frequently-used services actually encourage this. The best example I can think of is Netflix, which allows you to have separate profiles for family members but requires that everyone use the same user/pass to log in. I don't know why they couldn't just have individual passwords for the same account - at least that way I could avoid my mom trying to get everyone in the family to watch Sherlock ("Oh, I didn't see it on your watched list! You should try it!").
Amazon's Kindle app does pretty much the same thing, though it's not directly encouraged - you can log into your Kindle account from several different devices at once, effectively allowing people to share their books with anyone they trust enough. I think this is actually worse than Netflix, because most of the time you're using the Kindle app on a mobile device that can easily be lost or stolen.
The only company I've seen do sharing well is Valve, which has Steam Family Sharing that allows you to "lend" people your account without actually needing to tell them your password.
I'm also surprised it's not higher but not because people are stupid but because there are a bunch of different use cases.
Even if the bank allows it, what advantage does a husband/wife have to create separate logins for a joint account?
There are plenty of people that share accounts. There might be a sales email address that multiple people in an office take turns checking.
I know quite a few husband/wife pairs that share a single facebook account and I even know a few that share a single email address.
It's not because they're stupid but rather if one or both of them is a light user then it's easier to just have everything in one place.
There are also plenty of not-so-important accounts that people don't really care about and leave the password on a post it note or use 123123 as
the password because there is nothing of importance there and even if someone bothered to hack it, they wouldn't really care.
and 49% of people lie about sharing their passwords
51% of Computer Users Share Passwords
In other words, "49% of Computer Users Aren't Stupid." (I suspect that's grossly overoptimistic, however.)
And the average person is not very smart in the first place. This news item just describes one of the consequences.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Sometimes sharing the passwords of those less technically savvy with those with better skills is necessary and would skew these numbers. Knowing Grandpa's gmail password has helped a lot.
"Consumers are inadvertently leaving back doors open to attackers as they share login details and sign up for automatic log on to mobile apps and services" - You mean like automatically logging on to GMail on their phones? Ummm...isn't that the way it's supposed to work? I can't see anyone logging in and out of email every time they want to use it. Totally impractical, especially if you have a long and complex password. Like you would if you were concerned about, um, security.
"51% are putting their personal data at risk by sharing usernames and passwords with friends, family and colleagues." - And how did they arrive at this number, exactly? I call BS on this one, particularly given that Intercede just happens to be a company that sells security software for mobile devices. Coincidence? I think not. I'm not disputing that it's a bad idea to share passwords with friends and colleagues (family I'm ok with). What I am questioning are the motives behind it. Obviously, Intercede is trying to get people to panic and buy their software. Typical security industry scare tactics.
"The research revealed that consumers are not only sharing passwords but also potentially putting their personal and sensitive information at risk by leaving themselves logged in to applications on their mobile devices, with over half of those using social media applications and email admitting that they leave themselves logged in on their mobile device." - The solution is to lock the device. You basically have three choices: use a pattern, a PIN or a password. The pattern could probably be guessed easily enough by someone determined to do so but it's better than nothing. PIN is better, password is best. But it's the age old problem of security vs convenience. I used to put an encrypted passphrase on my phone until it became a complete PITA to use it. So there has to be a balance between safety and convenience. I like what Apple is doing with the fingerprint authentication. It's not perfect but it seems to me that it strikes a nice balance. Simply putting some sort of lock on your device (even a simple swipe pattern) will mitigate a lot of issues. Maybe it should be the factory default for devices?
This article is hysterical in tone. What percentage of husbands and wives (or other people in relationships) share keys? I mean physical keys to your house and how about actual kitchen knives. I guess it is risky but in the real world people will do it. We do have to trust each other. pavon's (30274) comment above expresses the situation well. On the other hand not putting a PIN or better still a password on your phone, tablet, or laptop is just moronic. And you may as well use full disk encryption while you are at it.
What happens when the inevitable divorce comes along? Flip a coin, your odds of getting in a divorce are the same. Are you make the facebook account part of the divorce court?? I can see it now - "She gets ownership of the pictures, but you get to keep the gaming high scores!" Simply put, it's pretty stupid to share any account, even if you are "forever in love".
just because family members share passwords doesn't mean its insecure. I know the password to most of my parents email and accounts. But so what... I won't do anything they wouldn't approve of and know them well enough to know what they would and would not approve of... so who cares.
And as to companies... most of them are small and medium sized businesses that have overlapping responsibilities. In those cases, SOME people know some passwords. But rarely does everyone in the office know all the passwords.
Its not unreasonable.
I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
By "people" do you mean anyone not you? What kind of person are you if you're not "people"?
If a divorce happens, then having a joint login isn't really a problem as you already
both have access to the money. So you both can log in and see that the other person
already emptied the account. No need to worry about changing the password.
Same with mortage accounts. The fact that the login/password is shared is less
important that the fact that you own a house together. The login/password is
usually only useful for paying the bill and not much else anyways.
It seems pointless to have 2 separate login/passwords and even stupider if
those 2 separate login/passwords can't see each other's payment histories.
People are good at evaluating the risks of sharing personal info with other people.
The real problem is people sharing the same password between multiple sites. People are really bad at evaluating the risks of any given website being hacked and thus making all other sites that use that password hacked as well.
The best thing we can do for security is encourage to write their site-unique passwords on sticky notes and post them clearly and legibly on their monitors. We'd go from millions of people being compromised every day by malicious hackers with a means of really messing you up, to one or two being hacked a day by someone's brother wanting to pull a prank.
Once people make 10 unique passwords, they'll switch to a password manager. But even if they don't, you're safer printing your username and password on a t-shirt than you are re-using the same password on both google.com and adobe.com.
49percent
That's my password...
That's not your password. I tried logging in. You lied.
Passwords/security inherently get in the way of ease of use. Having to enter your password every time is a risk too: easier for people to look over your shoulder and figure out what you are typing, easier to hit max attempts and accidentally lock yourself out etc.
Not an easy thing but it shouldn't just be password but context. We need a way of saying: "my wife can check my email for that important piece of info I need while driving now, but not later". A one time use code. Germany (and probably others) have a similar system for banks. You have your code and confirmation numbers mailed to you. When you start a transaction it asks you for the corresponding code from the list. You could then at least for your bank account only give someone the one code that they are currently being asked for and not have to worry about them running away and doing more transactions later.
How else am I supposed to watch HBO?
What an idoitic statement. First, if something has a 50% chance of happening then it is certainly not 'inevitable'. Second, divorce is not a random event, so comparing it to a coin toss is exceedingly stupid. Passwords aside, we already 'share accounts'. We have joint checking and savings accounts, a joint mortgage, joint ownership of the house, joint ownership of a timeshare, file joint tax returns, etc. What is so different about joint online accounts? Nothing.
The rate increases when looking only at the subset of the population who post as AC.
Jesus was all right but his disciples were thick and ordinary. -John Lennon
In other news, 95% of people surveyed are putting their identities at risk by sharing their house and car keys with friends, family and colleagues. "As we lead more and more of our lives in houses and cars, our identities need to be effectively protected – worryingly, it appears that this is not the case at the moment", he continued. "It's not surprising consumers are taking shortcuts such as putting all of their identity cards into a single "wallet" or "purse" that is easily lost, stolen or hacked. It's time for stronger authentication and more sophisticated forms of identity."
The research revealed that consumers are not only sharing keys, but also potentially putting their personal and sensitive information at risk by leaving these "wallets" in easily-visible locations with over half of those who take showers admitting that they leave their wallet on a dresser or table while they do so.
There are two people who have access to all of my passwords: My wife and my lawyer.
These are the only two people on this planet with whom my communications are protected by legal privilege.
Should the thinkable happen (let's face it, calling untimely death unthinkable is stupid, as it is entirely thinkable), there should be someone left who can access everything to put my affairs in order.
This is an example of a good password at my company "m7Rx2NqU" -- that's an unrecognizable jumble of characters that only a computer could love, but never a human.
I'd prefer to use "correcthorsebatterystaple" (ala XKCD), but my company's password policies do not let me use a pass phrase, but a jumble of numbers, letters and uppercase.
If telephones are outlawed, then only outlaws will have telephones.
Which means it's rock solid secure!
1-2-3-4 nobody will ever guess it!
-- Tigger warning: This post may contain tiggers! --
I am one of the 51%. I don't see things changing, the computer is a convenience device for most of the world. It needs to be convenient. As per usual, attention must be called to the fact that stolen and misused passwords constitute a crime and examples should be made. I would recommend cutting off the arms of computer criminals at the elbow, so they still have something to scratch their ass with. Enforcement is the answer, failing that, vigilance. Too much money has been spent for personal computers/devices to have every Tom , Dick or Harry trying to make a name for themselves finding and publishing weaknesses. Yes, I am glad bugs are worked out, but, publishing them causes more crime than it prevents and puts black hats on to the right trail. Simply remove the human designation, mistakenly given to the scrubby bastards and open a trophy hunting season.
*Repent!Quit Your Job!Slack Off!The World Ends Tomorrow and You May Die!
Sharing passwords in itself is not so much of an issue. People have trust relations with one another; this is only normal and natural. We should not advise against this.
There are however a few things we can do to make this sharing match our expectations better.
1. Use different passwords for everything. Sharing your netflix account with your friend is a big issue when that same password will let him into your paypal.
2. Use opaque passwords. Passwords should not reveal anything and be truly random. Non-opaque passwords reveal other things and can be used to derive other passwords.
3. Throw away passwords. Don't treat them as valuable property because you managed to memorize it. CHANGE your passwords when a trust relation changes.
I personally recommend Master Password to make this easy; in which case: NEVER share the master password. http://masterpasswordapp.com
Mine is 1d10t. ;)
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
Convenience is a subjective quantity. It is much handier to just leave your keys in your ignition switch than to have to keep track of them or fish around in your pockets every time you want to do something as routine as open your car door or start the engine. (Don't we all just love car-computer analogies?)
Full disclosure has been shown to be the most reliable way to get companies to fix security problems in their software..
Bugs will be found and exploited privately whether public disclosure takes place or not. There is a thriving market for zero-day exploits--exploits that are then used either by governments of criminal organizations to render computing systems to be less reliable and/or secure than their owners would expect them to be.
Some convenience will always have to be sacrificed in the interest of security, whether the system in question is a computer, a car, or a house. The only way to absolutely maximize convenience is to absolutely sacrifice security. (and privacy)
Yes, I want to live in a world where I can leave my keys in the car. Amputee ex-car thieves are a good idea.
I'm willing to let competitiveness between companies decide the quality of any product. Amputee criminal hackers are a good idea.
Bugs ARE found and exploited privately with/without disclosure. These zero day groups could easily be providing support for each other in an amputee support group.
Security exists to protect the interests of the customer, who, is always right. No sacrifice except the offending limbs of the guilty is necessary for this scenario.
The only way to maximize security and therefore convenience is to remove the problem from our midst. Let starvation do the rest.
*Repent!Quit Your Job!Slack Off!The World Ends Tomorrow and You May Die!
That explains those odd posts with my U.I.D.....
I thought it meant I had blacked out and one of the others took over...
*Repent!Quit Your Job!Slack Off!The World Ends Tomorrow and You May Die!