91–100 of 145 posts
The truth is the password is just another failed security concept- because those that work, cant be remembered by the users. So ones security researches terrible, is a neurologists reasonable. The actually embarrassing part is that after years of research- we still do not have a alternative.
> because those that work, cant be remembered by the users Remind me what's wrong with "correct horse battery staple" again?
Just generate a random password on the server side and tell the user to store it in their password manager or in a plain text file.
Do not let users enter their own password under any circumstance.
All password issues solved instantly (yeah, if the client is compromised the password is too, but the attacker can install a keylogger and accomplish the same task anyway).
Plus it's much more user friendly, since the user just needs to follow instructions and is not required to somehow "invent" a password.
86% of my passwords are for low consequence sites. How much should I care if someone hacks my handle and posts ads on a chat site? Or reads registration-required articles under my registration? Or etc etc.
If you ever reuse that password anywhere else, then you should care A LOT. If you go "i only reuse passwords on low-consequence sites", then I have to ask you 1) why reuse at all? and 2) are you sure? I bet that that's not true, I bet you think that's true but it turns out that your Uber password is the same as your RandomSite password. Just use a password manager. It's easier and it's safer, and you never have to th…
>why reuse at all?
Because it's easy. There's many sites I create an account for once or twice and I never use again, mainly e-commerce. I don't care if someone logs in, at best they get an address and maybe a few card details. That's all practically public information.
>are you sure? I bet that that's not true
Yup, 100%. And even if a few get missed, anything super important has 2fa, on top of using semi-unique passwords that adhere to a format so I can guess them in >Just use a password manager.
I agree this is good advice in general but even with decently designed password managers, like dashlane and lastpass, people often don't like to use them for various reasons. My parents get confused by new software. I tell them "use a very strong password for google, amazon, ebay etc, and if any other site asks you for a password use a weaker one". If they used a password manager I guarantee they'd get overwhelmed when it comes to using it on different devices and give up, reverting to worse security than before.
Also in the end, people are astronomically more likely to fall for phishing emails than be the victim of a security breach from password re-use. Seriously the whole "use a password manager with a RNG upper/lower/symbol/number combination" trend is overhyped and honestly a distraction from more pressing security issues. Google estimated phishing victims are 400x more likely to have their accounts compromised than anything else[1]. And as someone who is currently dealing 90% with phishing attacks over any kind of password related incidents I'm very inclined to agree. If you're a public figure and therefore an actual individual target for motivated attackers then yes, use RNG passwords and a password manager with 2fa and only ever store the db on a memory stick which you keep on a chain around your neck, otherwise it's not really necessary.
[1] https://www.bleepingcomputer.com/news/security/google-ranks-...
86% of my passwords are for low consequence sites. How much should I care if someone hacks my handle and posts ads on a chat site? Or reads registration-required articles under my registration? Or etc etc.
Maybe it's not such a big deal if someone hacks your account on one 'inconsequential' site, but what if they do it across 10, 20 'inconsequential' sites? You may not give much away on one site, but combine all that data across multiple sites, and maybe I can start building a profile on you, identify you, impersonate you, steal your identity, etc.
Why would someone go through that much effort on one person when they can end out a million phishing emails with two minutes of work, get a few thousand replies, get a few hundred people buying their scam and walk away with a six figure payout? The chance of you getting your identity stolen because of password reuse is about as low as getting killed in a terrorist attack: it's not really worth thinking about or putting too much effort into preventing when you're more likely to get hit by a car.
Almost no bank website allows login with just email/password - there's always some extra field required such as a User ID with random characters, an account number, a PIN number or a code from a second device. The reason is simple: if the bank accepted just email/password there would be a lot more fraud and the bank would lose money.
When I feel like a security goon's arbitrary and capricious password policy is irrational and counterproductive, I make my passwords worse in the hopes that I have to someday read it to someone, or perhaps it gets spilt outin the open, and then everyone will see how forcing me to pick a password that adheres to certain characteristics solved nothing. Just wait. Someday you will see dumps of pwnt password that look li…
Just recently Estonian Information System Authority published a new report (including new guidelines for passwords) basically telling: "Drop password requirements, allow long passwords and restrict the use of short and top-n passwords". Why I'm mentioning this is because now I have an actual official document I can send to Estonian companies in addition to my own words (that weren't previously believed, ugh) why thei…
Letting users choose passwords is the default behavior of websites, but it's incredibly dumb. Just generate a random password on the server side and tell the user to store it in their password manager or in a plain text file. Do not let users enter their own password under any circumstance. All password issues solved instantly (yeah, if the client is compromised the password is too, but the attacker can install a key…
Also, I use a password manager on my machines (for websites I use privately: amazon, taxes, etc.), a different one at work (for corporate tools). I also use my own passwords + 2FA(if available) for things I use at both places (like my own gmail, HackerNews, etc.).
Forcing users to remember/write down something is just a bad idea. Chances are your "reset password" feature will be DDoS-ed into oblivion by your legitimate users.
Much better alternatives:
* the Google push notification: [0];
* a YubiKey or similar U2F token [1];
* a way to turn my smartphone into an automated keyboard that holds my secrets.
[0] https://www.howtogeek.com/260369/how-to-set-up-google%E2%80%...
Aside from the thought that a portion of these bad passwords may be for throwaway accounts, I think what we really need is a "Beyond Passwords" movement similar to the push for Let's Encrypt. I use KeePass 2.x on my laptop and it's been great for having complex passwords, but the few seconds it consumes to load it up every time just to log into a site is annoying. Worth the trade off, of course, but can't we do bette…
Keepass only takes 1-2 seconds to open the database. Once that's done, no more delay...
Ctrl-Alt-K on Windows brings the window to focus, click on password entry, Ctrl-V and poof, auto-typed in!
My concern is with faulty code when checking this list. if (isPwInBlackList(propossedPw)) throw new Exception("Proppossed pw is in black list"); logger.info("Password {} is OK.", propposedPw); //<-- faulty code here
[0] https://www.bleepingcomputer.com/news/security/github-accide... dated 2018-05-01