The Diffie-Hellman protocol was published in 1976. Why some places still rely on passwords more than 40 years later is beyond me.
49% of workers, forced to change passwords, reuse same one with minor change
281–290 of 316 posts
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#282Wonder how many % use the password reset as an effective one-time password (unless cached) as they can't be arsed to remember the password complexity rules for every single site thwarting their simple password variations scheme.
I systematically do that. I make a strong point of not remembering passwords, as a matter of personal hygiene. Every time that I need to login somewhere, I just reset the password, which often involves clicking on an email link. This is a much better user interface than remembering a password.
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#283Earlier quoted context omitted.
It would be really cool if you could plug your phone in and it appeared as a USB keyboard device and you could "type" the password from the password manager that way without ever giving the computer access to anything except that password. Maybe some sort of simple USB dongle (like a yubikey) could be fed by the phone via bluetooth or nfc to do this?
The EspUSB Tiny can pretend to be a USB keyboard and mouse, and it fits inside a USB socket. I've built prototypes already, and I've found a manufacturer for scaling up, but it's stalled since August because of certification issues. It wouldn't be hard to add encrypted password storage to the EspUSB firmware. The difficulty is that you need to know the keyboard layout of the destination computer. Keyboards don't send…
> The other problem is that it types the password as plain text, which is a bit insecure. If I have to carry a dongle and change settings on the client, why not make the dongle do some sophisticated key pair exchange with the client app?
I kinda prefer simplicity. What if the dongle breaks, gets lost, or some change in the environment makes it impossible to run the client or perform this sophisticated key pair exchange? Locked out, fun.
My keyboard can generate passwords, but I could generate the same passwords on paper (or, more likely, using a piece of software running on some other device) without ever connecting to the device where I'm going to enter that password.
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#284Earlier quoted context omitted.
It would be even cooler if I could open an app on my phone, point it at a QR code on screen, and not have anything else bother me
Make sure nobody takes a photo of you showing your qr code I guess.
As far as I understood, if somebody else scanned the same token, they would just login with their own account (if they have one).
Whoever logged in first would invalidate the hexhexhex token and the second person would need to start another browser session.
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#285Earlier quoted context omitted.
To me, there's an irony in that "Zaphod Beeblebrox's kite harasses Tuscon." is not only _more_ memorable on it's own, but is probably a _better_ password than "ZBw3hHg1tFWdhdt?Hoh2hXcrZmn" Stop using passwords, just use a "pass sentence." My last few passwords at my previous employer: "Tim, bring me chicken #15" "Mary, stop looking at me!" "Nothing you can do about 2!" "The coffee here is gross." Seriously.
There's absolutely no way a five word password is better than 32 random characters. Two plain old random words, the entropy of that is less than 16 bits each, but we'll round up. One of the biggest cities in the US is probably even less useful, but let's credit it for 16 bits. And let's rate Zaphod Beeblebrox as one-in-a-million for entropy purposes. That's 68 bits. It's somewhere between 11 and 12 random alphanumeri…
> There's absolutely no way a five word password is better than 32 random characters.
That assumes the attacker knows it's a five word password, and that there are no misspellings, and that these are specifically English dictionary words in dictionary form, how you're capitalizing it, and whether or not you snuck a number or an exclamation mark in the middle. Might as well know your password at this point..
raivoissaankoha NOKANMURIT vejatti 42 cerviidoo fjelleil??
:--)
Not a single dictionary form, and not a single word spelled "correctly", but this sort of phrase is really easy for me to memorize. If you had dictionaries for all four languages involved, you still probably wouldn't get very close unless you also know to inflect these words like spoken/slangish Finnish sans umlauts. Say what, fellow Finns?
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#286Only 49%? That's way lower than I would have expected, I wonder if there were people in the survey that weren't willing to admit it?
[deleted]
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#287This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason. Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that…
Agree.
I toyed around with the idea of a password risk score.
Password reuse across accounts (with known breach) = 100% Password reuse across account = 90% Unique external password = 30% Unique internal password = 20%
Divided by password complexity... or something similar.
In this way user is encouraged to maintain good passwords by not being penalised (changing every few months, etc).
Of course, this would require something between service and user, such as a password manager.
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#288Earlier quoted context omitted.
Somehow this reminds me of a problem my father (who is a doctor) has often complained about. Basically IT shitheads enforcing their policies on ALL computers in the hospital, including those used in operating rooms. So that means things like a screen (displaying important information) locking from X minutes of inactivity, on a computer that the surgical team is physically unable to "bump" periodically or type a passw…
Conversely, computers outside the surgery are all on one big network in a public space with random unsupervised people walking around at all hours. It's very easy for someone to utilise this in a way that violates the privacy of a patient in the worst possible way. Think nosy reporter looking for HIV status of a celebrity, or abusive parents looking for their kids to stop them having an abortion, that kind of thing.…
This sounds like EXACTLY what Sun's SunRay thin clients used to do, back when the rest of the *nix world seemed completely oblivious to this whole "hot-desking" concept.
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#289This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason. Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that…
Bruce Schneier's summarization [0] of NIST's revised recommendations: 1. Stop it with the annoying password complexity rules. They make passwords harder to remember. They increase errors because artificially complex passwords are harder to type in. And they don't help that much. It's better to allow people to use pass phrases. 2. Stop it with password expiration. That was an old idea for an old way we used computers.…
The one thing I really hate about IT security certifications is that they promulgate these ridiculous "best practices"
Just come to the dark side and learn to program and privilege escalate. You'll learn all these practices and how to circumvent them.
Re: 49% of workers, forced to change passwords, reuse same one with minor change
#290Earlier quoted context omitted.
I think he means that a password manager (PM) renders the other two points moot. Password expiry? No problem - my PM generates a new one easily. Complex rules? No problem - my PM will follow any rules you like. My response is that not everyone uses a PM, so the other two points are not moot. Also, FWIW, I find myself rather uneasy about using a PM, so the other two points aren't moot, at least for me. "One password t…
Sorry but I don’t understand how I’d use a password manager to unlock my computer. This password is for my active directory account and I hate that it expires every three months.
My login/AD password expires every month, and you can't reuse one from the last year. But in the end it's not too bad, because you just append a number to your password and that's it. Most people have a post-it on their screen with the last number they used.
It's useless, but not worth my energy to fight.