It's strange to me that passwords exist in 2019. Somehow the best practice is to use a passwords manager, which is an entire layer of poorly pasted-on UI that uses hacks to intercept every login you make whether via app or website. And I'm not saying password managers are bad, they're amazing for security, it's just odd that password managers are the best thing we have because their UI is terrible. It seems like these things should be handled at the browser / device level for universal one-tap login.
49% of workers, forced to change passwords, reuse same one with minor change
131–140 of 316 posts
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#132I find that we need to reinvent passwords. If you write a long sentence of twenty words and you miss some letters the passwords should still match somehow. Currently I can't imagine using long phrases for passwords as a small change invalidates the whole thing./
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#133When will programers ever learn, that they can not program the users, no mater how intricate the rules and how insistant the harassment.
Enforced password complexity, is actually a in user space implemented algorithm:
while (passwordIsToComplex()) do
try{
if(createEasierPassword()){ goto FAILURE;} if (circumventSecurityMeasures()) { goto FAILURE;} if (hackSecurityToGetWorkDone()){ goto FAILURE;}
}
FAILURE:
Basically, you train a process-organism in your company to circumvent your security measures, for little gain.
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#134There should really be laws governing security requirements for software systems just like we have traffic laws.
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#135Earlier quoted context omitted.
Sorry, I've already been asked to memorize a 32-character string, so the slot has been filled. Coincidentally, it also starts with Z.
Joke's on you! You just cut my brute force attack time in half! Only 1 billion years left!
Wait, was that capital Z or lowercase z?
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#136Earlier quoted context omitted.
I access my manager from my phone and type them in. I would never install my LastPass on a public computer even if they let me.
It would be really cool if you could plug your phone in and it appeared as a USB keyboard device and you could "type" the password from the password manager that way without ever giving the computer access to anything except that password. Maybe some sort of simple USB dongle (like a yubikey) could be fed by the phone via bluetooth or nfc to do this?
Very doable. I also want(ed) this. There are some old kernel patches on github that extend the android USB driver to also be able to register as an HID device.
I also tried kicking the android driver and just using (iirc) usbfs or what is was called so you could implement HID in userspace and repurpose old phones while kicking android. But the vendor kernel stopped compiling :/
This woul imo be a really interesting application to repurpose old android phones.
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#137Earlier quoted context omitted.
It would be really cool if you could plug your phone in and it appeared as a USB keyboard device and you could "type" the password from the password manager that way without ever giving the computer access to anything except that password. Maybe some sort of simple USB dongle (like a yubikey) could be fed by the phone via bluetooth or nfc to do this?
It would be even cooler if I could open an app on my phone, point it at a QR code on screen, and not have anything else bother me
Oh hell that would be amazeballs if it's open source and worked on Windows, OSX, Linux, and could work with a 2FA device like Yubikey. I'd put $20 down for that in a heartbeat.
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#138Earlier quoted context omitted.
And then you've got your phone open, displaying your password to shoulder surfers, for as long as it takes to type in your password.
I have a hard enough time typing 4mfkD.Q.27cC8,'@eG}a4{\* , I am very much not worried about a "shoulder surfer" either seeing the cleartext password on my tiny phone screen, or watching all of those keystrokes without me noticing them.
I'd be more concerned about it getting caught on camera.
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#139Earlier quoted context omitted.
It would be really cool if you could plug your phone in and it appeared as a USB keyboard device and you could "type" the password from the password manager that way without ever giving the computer access to anything except that password. Maybe some sort of simple USB dongle (like a yubikey) could be fed by the phone via bluetooth or nfc to do this?
It would be even cooler if I could open an app on my phone, point it at a QR code on screen, and not have anything else bother me
Make sure nobody takes a photo of you showing your qr code I guess.
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#140I use a password generator (30 characters, numbers, upper/lower case, special chars, ...) and upon being forced to generate a new one it somehow ran afoul of $corporate-policy, probably not exactly the right mix of special characters. After several tries I gave up and just incremented the old one.
I could have looked up the exact policy and adjusted the generator. But if the policy rejects passwords with more entropy than most people memorize then I am not particularly motivated to play along.
The same corporate policy also forbids bcrypt password hashing and suggests using SHA2 instead because bcrypt is not "industry standard". Offering to use scrypt or argon2 instead so far has been met with silence.
It makes me question the expertise behind any security the company has.