Slashdot Mirror
LastPass Reveals the Threats Posed By Passwords in the Workplace (betanews.com)
A reader shares a BetaNews report: A new report by LastPass -- The Password Expose -- reveals the threats posed, and the opportunities presented, by employee passwords. The report starts by pointing out that while nearly everyone (91 percent) knows that it is dangerous to reuse passwords -- with 81 percent of data breaches attributable to "weak, reused, or stolen passwords," more than half (61 percent) do reuse passwords. But the real purpose of the report is to "reveal the true gap between what IT thinks, and what's really happening." Jumping straight into the number, the report says that even in a 250-employee company, there are an average of 53,250 passwords in use -- a near-impossible number to keep track of and to know the strength of. LastPass found that people have nearly 200 passwords to remember, so it's little wonder that password reuse is an issue.
One for I don't give a shit - like a Reddit account and every other dipshit website that requires a login so that they can use their registered users for advertising and revenue - and that's why I will never register for Slashdot.
One for it'd suck if someone got a hold of it, but life goes on.
One for my money and other important shit.
My wife on the other hand, takes this password shit too seriously. She creates a new a special one for every dipshit login. And as a result, is constantly forgetting them and requesting new passwords.
And it's amazing that to get a new password, one can get that information by just looking at her facebook page and seeing who her "friends" are - and all the idiots who wish her a happy birthday on her real birthday.
I could steal any facebook user's identity and get your banking passwords.
It is a balancing act. One one hand, if someone uses weak (but memorable) passwords, that can be brute-forced, that is far more likely than a password manager getting compromised, especially a password manager with 2FA.
However, selecting a password manager is critical. LastPass is one that has had security intrusions succeed... but were mitigated. Some other PW managers which have, as of their latest versions, required cloud access (1Password, mSecure) not just don't have a proven track record... but don't even give any details on what security they actually bother with. For all we know, they could stash everything on a public S3 bucket.
I like PW managers which piggyback on existing cloud providers and have decent encryption [1], like Enpass or Codebook. That way, not all eggs are in one basket, and Google Drive provides adequate 2FA protection.
[1]: The idea would be separating the passphrase protecting the database on the cloud provider versus the encrypted copy, or even better, using public key encryption and "introducing" new devices, to make the copy sitting on the cloud provider as brute force resistant as possible.
This one in particular infuriates me. We have a finance system which demands a change every 60 days but also won't let you re-use passwords (I assume it keeps a record of the hash because it won't even let you recycle from several years ago), and locks you out on the third failed attempt. After a lockout you have to email the finance department and wait several days for someone there to manually reset it and email you a new one, at which point it immediately demands a brand new password.
We can't afford to wait several days for finance to get back to us after a lockout (of course, they'll never admit it takes this long) and we can't remember these passwords on top of all of the others, so of course it leads to us using predictable patterns of passwords and keeping records of them somewhere. By making security a pain in the ass and difficult for a user you just encourage the user to find fast and easy workarounds, and those often come at the expense of security.