Slashdot Mirror
New UK Security Guidelines: Password Re-Use OK, Frequent Changing a Waste
isoloisti writes: New UK government guidance on how to handle passwords (PDF) "advocates a dramatic simplification of the current approach." "Unlike previous guidance, this doesn't focus on trying to get ever more entropy into passwords." For example: "Regular password changing harms rather than improves security, so avoid placing this burden on users." And "given the infeasibility of memorising multiple passwords, many are likely to be re-used. Users should only do this where the compromise of one password does not result in the compromise of more valuable data protected by the same password on a different system."
yeah
The fact is, most of the accounts I have passwords for don't really matter. I don't give a shit if someone gets access to my slashdot account. Or if they get access to an old video game forum or two. So there's no reason to give those things really secure passwords. The things that need secure, unique passwords are your email, your bank/broker, and anything that would truly upset you if you lost access to. Give the rest some default password and stop caring.
I still have more fans than freaks. WTF is wrong with you people?
If you make it too hard for them, they either use weak passwords or they tape them next to the monitor so that you can human engineer the security with a camera enabled pen or purse or water bottle you "forget". Or they type into the notes feature on their easily guessed cell phone.
(caveat: I used to be the acting regional security officer for a military region, so I have absolutely no idea what security measures get defeated and will deny knowing such information)
(extra caveat: facial recognition is pretty useless and easy to defeat, as are most biometrics)
-- Tigger warning: This post may contain tiggers! --
As an American, I have longed viewed our tendency to be unconcerned with security as a bit odd. The British seemed to take it more seriously, and be smarter about it. This is part of why their human intelligence generally seemed superior to ours. Today, the new British government seems keen on sacrificing the security of its people on the altar of the false religion of national security. This will clearly leave the government in charge of the people if taken to its full conclusion. It is hard to reconcile the best interests of the citizenry with the current behavior of their authorities.
Let's ask former Ashley Madison members.
A portable hardware device that generates one-time-only passwords. The master keys never leave the device and can be revoked in the event of the device getting lost. Hacking any individual device provides no clues that can be used to hack the other devices.
It generates complex and long passwords and it stores them in an encrypted form on your computer.
Must have a mix of upper case, lower case, numbers, and special characters. And it can't be any of my last eleventy-six passwords. "It's been a while since you've logged in from the mobile application. Please change your password." What the flying fuck?!? I just wanted to check my balance and now I have to change my password.
Users should only [reuse passwords] where the compromise of one password does not result in the compromise of more valuable data protected by the same password on a different system.
So if I have access to a highly sensitive system, it's OK to reuse that password on a system with lower value data.
OK - got it.
That's what I do now, I basically classify things as low, medium, or high security. I don't want to remember a thousand different passwords and don't care to use a password manager for sites like Slashdot or other news sites I comment on. So low-impact sites all get the annual password when I register.
I change passwords every year or two, generally adding complexity (length) to the previous password. By now, they are pretty good passwords, but I've memorized them a piece at a time.
For a while I did something that might be better. I had an algorithm and a little utility program which generated a unique password based on my master password and the domain name. So something like sha1(mypassword, 'slashdot.org'). That gave me different passwords, without remembering them all, and without being tied to one specific password manager. I could "recall " my password on any device at any time. Actually, I chose an algorithm that I COULD compute in my head, though with considerable difficulty.
The British seemed to take it more seriously, and be smarter about it. This is part of why their human intelligence generally seemed superior to ours. Today, the new British government seems keen on sacrificing the security of its people on the altar of the false religion of national security.
I think it's the movies.
British intelligence had a string of high-profile successes, culminating in dropping that evil guy into the smokestack.
At least, that's what the public was led to believe.
In the modern world, the internet has a way of making the reality of the situation more plain.
Perceptions change.
Does this mean I won't have to change my password from password01 to password02, password03 ect?
You require people to change it every 90 days and expect them to remember it what do you think people are going to do? It is going to be S!mp1e as can be.
Simple1! fulfills most companys password requirements.
If you insist on my password looking like: 6B=1X8Vg+Bxqfs=2oPEy
It will have to stop changing on a arbitrary basis.
Minimum threshold fixed. Thanks!
RootPassword!1
RootPassword!2
RootPassword!3
and so on.
This just in ...
Governments around the world agree; just use your name or '1234567'. It is estimated that governments (and taxpayers) will save billions on expensive technology used to decrypt worldwide communications. Garth Grunt (not his real name), representing an anonymous spy agency in an anonymous country says "Do the patriotic thing. Loosen up your security so that we can protect you better."
That's today's headline, now for the rumors behind the news...
...omphaloskepsis often...
Microsoft Research found that the maximum times people could change a password and have it secure is twice a year. This was the absolute limit where they suggested that a more realistic limit was once a year. Any more than twice a year and people had to start writing them down, or use insecure passwords that were easy to remember. A common one being an easy to guess word with an incrementing number after it.
The irony is that Windows Server defaults to having you change your password every 42 days. 8-9 times a year.
How do I know this? I studied for the Microsoft Security Test. They had one required book for studying and one recommended book for studying. The required book would help you pass the test. The recommended book was written by Michael Howard, Microsoft's top secure code specialist. In the book, Writing Secure Code, he would reference the research division's work. Basically the book said that everything on the test and the other book was wrong. I have taken courses in security which matched what Microsoft Research and what Michael Howard said. I would highly recommend reading Writing Secure Code, as even with taking courses on it, I learned a lot from that book.
For the record, I didn't pass the security test. I got 1 question "wrong." I don't know about now, or if the test still exists, but you used to have to 100% it.
Microsoft, Apple, Google, Amazon what's the difference? All steal money from devs and control with walled gardens.
...so the authorities don't have to bother with warrants.
Here is my advice for passwords:
1) Two-factor authentication for everything that matters;
2) Your e-mail account matters a lot, because it can be used to reset passwords;
3) But nothing important should have a password resettable by clicking on an e-mail link;
4) When I say "password", I mean passphrase. Less of th15_$h1t and more of "and your husband wants to be a girl be glad there's one place in the world where everybody knows your name";
5) With some per-site adjustment for insignificant sites by remembering a simple algorithm, e.g. derived from first letter of the domain name, to prevent automated break-in attempts when passwords are stolen from one site;
6) If you have trouble remembering passwords, WRITE THEM DOWN rather than simplifying them. But with pen and paper only. The least likely way you'll have anything stolen (by public or private entities) is physically;
7) If you're going to change passwords regularly, see 5;
8) For fuck's sake don't use federated login e.g. Facebook.
Things are monsterously bad out there. Individuals here often personally talk about their chosen steps. Thats fine. But real world the asshats handling your data very likely don't do a good job of it. At work the directors and senior money people won;t be doing a good job with your personal shit. They won't be putting your passport picture, number, and other stuff in suitable safe places with correct treatment. They all thing security is irrelevant.
And in the rest of the world - huge sites and business hoover up creds and then store them like asshats in poorly designed, badly secured DBs and systems with either old, broken, poor or non existent salting and encryption. Even if they do initially protect it well, the devops bullshit thats raping the world will mean the smart guys who originally did stuff are long gone and some useless goon who doesn't care about sec or isn't trained in it ends up 'administrating it'.
I used to lean towards the idea of full disclosure. But I've moved away from that. All thats actually done is blown open the pandora's box. The vendors now, and the users are left trailing in the fucking infosec tornado wars between the releasers, the vendors, the underresourced IT people and victims. Every lunatic has their own arsenal in their backpocket now and metasploit and its ilk mean the automation of attacks and footprinting is legion. And thats just the bedroom amataurs. The middle layers, goons, gangsters, crims, gov and the rest are way ahead.
I fucking work at a PLC. When I went into a sub company I found 19000 viruses. Machines updates wrecked by said viruses. OSs unplatched and out of support. The PLC goons originally blamed the last guy - and from what I see he was just hugely under resourced. But it just kept getting better and better. They had 6 years ago opened a Chinese office. I'm not even gonna say how rancid that is. And the PLC itself has inbound malware and viruses on a scale I'd not seen before. it was at that point I found the much vaughted PLC IT 'dept' had inbound mail scanning, and the scanning was so bad that they allowed mail in from internet domains that had no fucking MX record. WTF.. I rolled F-secure into the whole desktop environment, and I at least put something in on mail (Sophos pure message) and I'm scrambling back towards what I would say is desperately average and certainly no better.
The guy who left and I have taken over from is about to take a new job at the Parliamentary Standards bunch. While I can see he was wayy understaffed, the idea he would get a billion miles inside anything requiring securty pretty much speaks volumes.
Fuck this new advice. Protect yourself however you can. Stay away from what you can, where you can and good fucking luck!
Now I don't always remember it 99.9% of the times but what I do is have a pattern that I use to extract 4 letters from a sites name and use 4 or so selected 4 number combos which I combine into a password. At least it gives me different passwords for different sites.
by TheSpoom (715771) Uncaring Linux user here. I have nothing to add to this but please continue. *munches popcorn*
Indeed, I have reached Hunter239 on my password now. It sucks having to change it every week.
Changing your passwords every so often is important, most password breaches go undisclosed, not all 'crackers' are releasing their findings.
Your Karma sucks so bad?
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
https://xkcd.com/936/
Right, they are absolutely not saying password reuse is okay for sites that have "valuable data." Whoever wrote the slashdot post really distorted the meaning.
I change passwords every year or two, generally adding complexity (length) to the previous password. By now, they are pretty good passwords, but I've memorized them a piece at a time.
That's actually a nice idea
CLI paste? paste.pr0.tips!
You memorize a single strong password for a key storage program like Keepass, and only bother with 1 strong password being changed at your recommended frequency. I can change all of my other passwords randomly as often as I want and don't need to remember them all. I keep the encrypted DBs on a Thumb drive in my pocket, and a backup in a safe.
While not perfect this setup is safer due to the lack of a keylogger picking things up. No system is perfect so I go for "better" and "best practices". I would much rather have a 20+ character password for my DB I change every 9-12 months than try and remember dozens and dozens of various passwords I have for everything else.
Oh, I should add that I use multiple databases for multiple purposes. I don't mix business and pleasure.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
You know the IT state is pretty bad when they still require passwords in 2015.
They caught onto us at our workplace. Now passwords have to be significantly different by some secret algorithm and incrementing a number is not different enough. Of course, that just means people think up other schemes.
You, sir, are the least annoying troll in history. That one was actually pretty good.
UK Govt: "Use less passwords. And BTW: don't encrypt things'n stuff. It just makes a mess of the data".
Yeah, right.
That's what I do now, I basically classify things as low, medium, or high security.
Me too so I set all my passwords to 'low', 'medium' and 'high' depending on security level so I won't forget which is which.
Damned websites keep complaining that my password has to be longer than three characters though - and I have no way to say 'but your site doesn't matter to me so three is just fine'.
blindly antisocialist = antisocial
PassHash
Hey! That's the combination to my luggage!
I've been saying this for years... by frequently forcing people to change their passwords, they're going to be way less secure. I could train myself to remember a decent-sized random mix of letters and numbers, but if I had to change it every 30 days, I'd much rather stick to something more basic, or just toss an incrementing number at the end.
Some sort of minimum security standard across the damn board would be greatly appreciated.
Set minimum password strength, length, type requirements. Set standards for hashing and storing login credentials, etc. You adhere to the standard and become certified to do business out on the web. No certification, no web business for you. Though, we sorely need the same standards applied to corporate networks that carry customer information as well. ( Eg: Home Depot, Target, etc )
Every site has different requirements. Password length, characters used, characters that cannot be used, password reuse, etc. etc. Password change day absolutely SUCKS because the password I choose to use for site X may or may not work for site Y. Like most of you, I have to keep a list of all the sites that are on the password rotation schedule because there are so damn many.
Related:
Passwords and encryption keys can be pretty strong but upon reaching a certain strength, will no longer be the focus of an attack. Keyloggers and the like pretty much negate the strongest encryption key or passwords you can come up with ( if using single factor authentication ) so I'm not sure what the charade by the government is about decrying strong encryption when all they have to do ( and they know it ) is exploit a bug or deploy malware into the software that drives your keyboard.
Encryption by default on the latest $smartphone is nice, but when the NSA's greatest buddy is responsible for updating your software ( say . . . AT&T ) then it's a pretty good chance your device is nowhere near as secure as you might like to think it is.
With all the password hacks/cracks/thefts, my cynicism has led me to believe that password policies are not about protecting the user, they are about protecting the company. With every damn website and store loyalty program asking you to create an account, it's to the point of absurdity. But they tell you that you need to create a unique password, of course. The uniqueness is not there to protect the user, it's to protect the company from liability when their crappy data policies (storing passwords in plain text in a file protected by changing the robots.txt rules, etc) lead to a data breach. "Oh, the password that was stolen from our yahoo storefront for customized puppy faced iphone cases, and allowed Elbonian hackers to drain your bank account and charge child porn to your credit card? We told you not to reuse passwords- it isn't our fault you're now a felon on a sexual predator list."
ding ding ding.
I have sat in meetings where precisely this was discussed as part of our password policies.
Of course it works both way, We also don't want a PuppyFacePhone.com breach to grant access to our systems. C.Y.A coming AND going.