Slashdot Mirror
LastPass Reveals the Threats Posed By Passwords in the Workplace (betanews.com)
A reader shares a BetaNews report: A new report by LastPass -- The Password Expose -- reveals the threats posed, and the opportunities presented, by employee passwords. The report starts by pointing out that while nearly everyone (91 percent) knows that it is dangerous to reuse passwords -- with 81 percent of data breaches attributable to "weak, reused, or stolen passwords," more than half (61 percent) do reuse passwords. But the real purpose of the report is to "reveal the true gap between what IT thinks, and what's really happening." Jumping straight into the number, the report says that even in a 250-employee company, there are an average of 53,250 passwords in use -- a near-impossible number to keep track of and to know the strength of. LastPass found that people have nearly 200 passwords to remember, so it's little wonder that password reuse is an issue.
extolling the virtues of using a password manager
threat revealed, thanks lastpass
I only have to remember the vault password. The three keys to making it work in the long run are backup, backup, and backup.
I assume they're encrypted, but they can easily tell if they're the same. It doesn't say they have statistics in complexity, only reuse.
I suppose this would mean that they're not salted though, or the same salt is used for every password in an account.
Wow, sent an e-mail as suggested when clicking on "use classic" banner, and got a fast response that addressed my msg
One for I don't give a shit - like a Reddit account and every other dipshit website that requires a login so that they can use their registered users for advertising and revenue - and that's why I will never register for Slashdot.
One for it'd suck if someone got a hold of it, but life goes on.
One for my money and other important shit.
My wife on the other hand, takes this password shit too seriously. She creates a new a special one for every dipshit login. And as a result, is constantly forgetting them and requesting new passwords.
And it's amazing that to get a new password, one can get that information by just looking at her facebook page and seeing who her "friends" are - and all the idiots who wish her a happy birthday on her real birthday.
I could steal any facebook user's identity and get your banking passwords.
Now after we go through the painful microsoft applications access panel, we click on any thing, it pops up the same password dialog. The only thing has changed is now we can not directly log in to the third party service. First we sing on here and then sign on again. Single Sign on ended up being One More Sign On.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
If everyone had a password manager, then IT would spend all their time replacing passwords for people who forgot the password to their password manager.
And if the passwords are stored in the cloud, they are almost guaranteed to not be secure.
"First they came for the slanderers and i said nothing."
And Ramps it up to LUDICROUS! Why go small? LoL :-P
When the rules are "must contain 1 lower case, 1 upper case, 1 number, 1 special character, cannot reuse any of the past 20 passwords, must change every 30 days, etc etc etc", no shit we end up picking a pattern and recycling old passwords.
You shouldn't be able to tell if two encrypted strings are the same unless they are encrypted with the same key. And they should not be for that reason among many others.
You appear to be talking about hashing which is not what a password manager does.
is a brilliant expose on the dangers of Slashvertisements.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
I'm not going to register to read the full report. But, based on the article, it seems likely they're using two sources of data: 1) a survey (which probably has an item asking about password re-use), and data from the corporate version of the app that shows, in aggregate, how many passwords a person has stored.
Even hashed passwords should be salted, preventing you from knowing which ones are the same.
Seriously, I'd be really interested to know how they arrived at their 200/user figure. I'm assuming that includes service accounts whose passwords never need to be remembered by an individual.
Now, by all accounts (zing!) their software is pretty user friendly and better than a not using a vault... but this is just marketing. Why slashvertise it?
The Daddy casts sleep on the Baby. The Baby resists!
Not all passwords are created equal. For example, my Facebook password is probably a very weak one, for I use Facebook only when I am forced to register to some site where I want to write a comment. I don't really know (or care) about the contents of this account, which I opened under false credentials long ago. You see, Facebook can be useful, after all. This aside, the truth is that the bad guys all too often obtain passwords simply by asking for them. Well, not so simply, for the theater involved to get the victim to relinquish their password can be quite elaborated. But, this seems to work pretty well; having seen the process in action a few times, I couldn't help but feeling impressed. Articles like this amount to little more than marketing for someone (LastPass, in this case) or mental masturbation. The people who select easy-to-crack passwords are, most likely, those who are going to relinquish their password when properly asked to do so, anyway. And, quite frankly, I for one couldn't care less if somebody gains knowledge of my Facebook password. Which I have forgotten, at any rate - only my browser knows it.
Given LastPass' track record, perhaps we need a companion article:
"LastPass Reveals the Threats Posed By Using LastPass in the Workplace"
#DeleteChrome
My personal KeePass database has 260 entries. Some are defunct, but not many.
You think 200 is unreasonable? I currently have 265 logins listed in my password manager, and I'd wager that I'm not even in the top quartile here. I had over 300 of them just a few months back, but then I went through and cleaned out several dozen. Oh, and that list is missing dozens more, such as:
- Logins to my numerous home and work computers
- Passcodes for numerous mobile devices
- PINs to credit and debit cards (not so numerous)
- PINs to parental settingsand the like on gaming consoles and other set-top boxes
All-in-all, I'd estimate that I had over 400 logins to various services and systems prior to the cleanup a few months back, and I'm by no means as heavy of a user as some, such as teens who're willing to create new accounts with new services every other week. To say the least, it's not at all unreasonable that someone might be expected to be able to login to 200 different systems, hence why password reuse is as much of a problem as it is.
source?
I'd have to check, but I've probably got over 1000 passwords. Most of them are defunct, but sometimes I'm surprised that one I haven't used for a decade will still work. Some of them predate commercial access on the internet. Some of them are from when I was sysadmining a multi-user CP/M machine (with 16 processors!). But there are far too many to remember, especially for sites that I haven't accessed in a decade...and, surprise!, sometimes I need access again, and it's really nice if the old password still works. And you can't predict which ones.
I think we've pushed this "anyone can grow up to be president" thing too far.
You're right, I was thinking of one way hashing, which would be pretty stupid for a password manager.
Wow, sent an e-mail as suggested when clicking on "use classic" banner, and got a fast response that addressed my msg
... there was some product that could help solve this problem!
IT tries to implement decent security, then Management cries because they can't handle remembering 4 different passwords and refuse to purchase licenses for password management software.
We are SSO and use LastPass. Many of our systems are SSO - and LastPass thinks that each is a different site, but happily records my SSO password. And then LastPass puts up a warning "you have reused the same password at multiple sites - this is bad"
But wait -- they are all the same system, or at least have SSO integration. I wonder if that skews their results at all?!
Which is the pitfall of SSO: - one password to remember -- and only one to guess.