Slashdot Mirror
LastPass Reveals the Threats Posed By Passwords in the Workplace (betanews.com)
A reader shares a BetaNews report: A new report by LastPass -- The Password Expose -- reveals the threats posed, and the opportunities presented, by employee passwords. The report starts by pointing out that while nearly everyone (91 percent) knows that it is dangerous to reuse passwords -- with 81 percent of data breaches attributable to "weak, reused, or stolen passwords," more than half (61 percent) do reuse passwords. But the real purpose of the report is to "reveal the true gap between what IT thinks, and what's really happening." Jumping straight into the number, the report says that even in a 250-employee company, there are an average of 53,250 passwords in use -- a near-impossible number to keep track of and to know the strength of. LastPass found that people have nearly 200 passwords to remember, so it's little wonder that password reuse is an issue.
extolling the virtues of using a password manager
threat revealed, thanks lastpass
I assume they're encrypted, but they can easily tell if they're the same. It doesn't say they have statistics in complexity, only reuse.
I suppose this would mean that they're not salted though, or the same salt is used for every password in an account.
Wow, sent an e-mail as suggested when clicking on "use classic" banner, and got a fast response that addressed my msg
One for I don't give a shit - like a Reddit account and every other dipshit website that requires a login so that they can use their registered users for advertising and revenue - and that's why I will never register for Slashdot.
One for it'd suck if someone got a hold of it, but life goes on.
One for my money and other important shit.
My wife on the other hand, takes this password shit too seriously. She creates a new a special one for every dipshit login. And as a result, is constantly forgetting them and requesting new passwords.
And it's amazing that to get a new password, one can get that information by just looking at her facebook page and seeing who her "friends" are - and all the idiots who wish her a happy birthday on her real birthday.
I could steal any facebook user's identity and get your banking passwords.
When the rules are "must contain 1 lower case, 1 upper case, 1 number, 1 special character, cannot reuse any of the past 20 passwords, must change every 30 days, etc etc etc", no shit we end up picking a pattern and recycling old passwords.
I'm not going to register to read the full report. But, based on the article, it seems likely they're using two sources of data: 1) a survey (which probably has an item asking about password re-use), and data from the corporate version of the app that shows, in aggregate, how many passwords a person has stored.
In fairness, it's much easier to remember one password for your password manager than 150 unique strong passwords, so IT would be getting fewer calls. Plus, a big part of the problem is that people won't remember hundreds of unique passwords, so they instead reuse passwords, which is one of the major ways that accounts get compromised.
I'm not saying that this isn't an advertisement in disguise, but they're not wrong.
Not all passwords are created equal. For example, my Facebook password is probably a very weak one, for I use Facebook only when I am forced to register to some site where I want to write a comment. I don't really know (or care) about the contents of this account, which I opened under false credentials long ago. You see, Facebook can be useful, after all. This aside, the truth is that the bad guys all too often obtain passwords simply by asking for them. Well, not so simply, for the theater involved to get the victim to relinquish their password can be quite elaborated. But, this seems to work pretty well; having seen the process in action a few times, I couldn't help but feeling impressed. Articles like this amount to little more than marketing for someone (LastPass, in this case) or mental masturbation. The people who select easy-to-crack passwords are, most likely, those who are going to relinquish their password when properly asked to do so, anyway. And, quite frankly, I for one couldn't care less if somebody gains knowledge of my Facebook password. Which I have forgotten, at any rate - only my browser knows it.
You think 200 is unreasonable? I currently have 265 logins listed in my password manager, and I'd wager that I'm not even in the top quartile here. I had over 300 of them just a few months back, but then I went through and cleaned out several dozen. Oh, and that list is missing dozens more, such as:
- Logins to my numerous home and work computers
- Passcodes for numerous mobile devices
- PINs to credit and debit cards (not so numerous)
- PINs to parental settingsand the like on gaming consoles and other set-top boxes
All-in-all, I'd estimate that I had over 400 logins to various services and systems prior to the cleanup a few months back, and I'm by no means as heavy of a user as some, such as teens who're willing to create new accounts with new services every other week. To say the least, it's not at all unreasonable that someone might be expected to be able to login to 200 different systems, hence why password reuse is as much of a problem as it is.