I wonder why this is not in use in about every company which is concerned about security and especially password security...anyone knows why? It can't be the costs, can it be? For a 5 people company it's expensive, but for anything more than 100 people the additional costs are next to nothing, right?
It is expensive and not so simple. Is every one of your applications LDAP aware? If not, you have to write custom code that fills in every login mask. The largest problem however is setting up the infrastructure and keep it running - you have to issue hardware tokens, renew them, usually build a PKI around it (which is either very expensive, doesnt't work as well as advertised or doesn't scale. Which will be a problem especially in orgs with >> 100 people
I completely agree. Having several account leads to using the same password for every account (in the worst case for that super secret accounting application and your telnet access); forced changes with a policy of not reusing the last n passwords leads makes most of the people cycle though n+1 passwords. That cycle is either highly predictable or written down. Having to use 20 applications with different passwords means, you are always carrying a huge password sheet with you and leave it at the cafeterie. And one can estimate the price for supporting password reset (divide the number of people in your org by how often they call the servicedesk because they are locked out, this sample will give you quite stable predictions (maybe 5% will call any given day). multiply with some cost estimate that you get from a Quija Board and compare this to some single sign on solution (Smartcard). The lowest end would probably be a mandatory password keeper (like on a PDA) with one _really_ _good_ _enforced_ Masterpassword that is rarely changed.
BTW: Castro *is* a dictator. He may be less heinous than Pol Pot or Stalin, but if he is such a great leader running such a wonderful country, why are people always trying to escape from Cuba?
Today must be the day I can't take it anymore. Some time ago I just had to accept that I really can not name one other country in which there exists an as well functioning propaganda machine, reaching almost all citizens at an almost always effective level that even *successfully* manages to deny and conceil its very own existence. Oh yea h, another paranoied government conspiracy crank, what a moron not being able to understand this fundamental common sense, that keeps our land safe from the/communist/liberals/or-whatever-bizarre-caricature -of -the-core-values non-US countries foolishly choose to implement. I don't get it. Telling cubans its they are so fucked because they dishonored the holy hand of the free market by freeing, with overwhelming support from the people actual *living* there, from the crooks, that ruled by force and with the only intent to making as much money as possible from the country and the people living there. But wait, sombebody had signed a law that actualy gave them the right to practically own this country, and the peasents there might have been a little thick or uneducated und did not completely understand that by robbing these lords of which is rightfully theirs, they were just hurting themselves, yes, even loosing their only jobs, which truly fed them at least 3 days a weak. But Uncle Sam will always comfort a hurting wound, educating the misguided fools that fell for these cynical swines Castro and Che, who sought to rob from others power and wealth (albeit living in dirtholes in the jungle, but thats just them wacky communists, they simply can't be rational). They had to be shown their erronous ways, and how better than trying to starve Cuba through sanctions, so someday - maybe after another 40 Years - they will long to the good old times when there where strict, but always correct and lawabiding American fruit companies, that owned their very bodies, but gave the security of the status quo, that is, the intent with which these property laws where passed. America, don't give in, during the next 40 Years their universial medical care system *must* break somehow, and that will make so much easier to bear, like pretending your standards of living are something every other nation on earth is craving so much (maybe except that we will get treatment when we are sick, maybe of even higher quality, and paying less for it, that I never before heard of people really needing two jobs just to get until I visited the states for the first time. I could even except this, most people in europe enjoy a very good standard of living, so I thought, of course, there must be some less fortunous nation, but they will gett better, some day. And suddenly, it was only short time ago, when someone gave the completely, stunningly imbecil explanation why they are so dislike by some muslim groups, how could anyone not aspire to the dream that America is for the dirt dwellers in their countries run not with so much self evident common sense: "THEY HATE US BECAUSE THEY ENVY THE FREEDOM WE ENJOY" *That* is working propaganda. I've met many russian, for whom state-issued propaganda was a natural and accepted part of life, maybe they agreed with the ususally good intentions behind it (think: motivational posters) but absolutely nobody in their right mind would have *actually* *believed* word-for-word the more-or-less wellmeaning advertizing which which their government showdered them. But to - i can only guess why - a really significant part of the US believes - they are the freeest individuals on this earth that god has given then, just because some guys some time ago justified their tax evasion plan with yet-another-chiseld in stone reinventions of all democratic forms of govenment, that humans have been experimenting w
Slashdot Mirror
It is expensive and not so simple. Is every one of your applications LDAP aware? If not, you have to write custom code that fills in every login mask. The largest problem however is setting up the infrastructure and keep it running - you have to issue hardware tokens, renew them, usually build a PKI around it (which is either very expensive, doesnt't work as well as advertised or doesn't scale. Which will be a problem especially in orgs with >> 100 people
I completely agree. Having several account leads to using the same password for every account (in the worst case for that super secret accounting application and your telnet access); forced changes with a policy of not reusing the last n passwords leads makes most of the people cycle though n+1 passwords. That cycle is either highly predictable or written down. Having to use 20 applications with different passwords means, you are always carrying a huge password sheet with you and leave it at the cafeterie. And one can estimate the price for supporting password reset (divide the number of people in your org by how often they call the servicedesk because they are locked out, this sample will give you quite stable predictions (maybe 5% will call any given day). multiply with some cost estimate that you get from a Quija Board and compare this to some single sign on solution (Smartcard). The lowest end would probably be a mandatory password keeper (like on a PDA) with one _really_ _good_ _enforced_ Masterpassword that is rarely changed.
Max Headroom?