271–280 of 447 posts
NIST best practice recommendations state: * Require more than 8 characters * Don't require special characters * Don't force the user to reset their password * Do check for compromised passwords * Require MFA * ... All very sensible. https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...
Earlier quoted context omitted.
> * Require MFA Using some kind of OTP authenticator app or device and __NOT__ SMS!
SMS is perfectly good as an additional authentication factor. i.e. When you log in on a new device using your user name and password, you also need to type in the text message code you were sent. It is a convenient way to strictly increase the security of an account. What SMS is terrible for is as a single point of account recovery. This is unfortunately how it is often used. "Multi factor authentication" in practice…
It's better than just having "secret" as your password, but not by nearly enough that you should feel particularly secure with it.
The issue with with all multi factor authentication is dealing with the likely situation that one of your users locks themselves out of their account and needs to have the factors reset so they can get back in. The secure way to deal with that would be to go, "Sorry, we don't know you and you've lost all your data. Goodbye!". But of course with important accounts that usually escalates pretty quickly with upset users hogging your helpdesk employees and not giving up that easily. So, most companies have help desks that are easily talked into "helping you". That's what they are incentivized to do. Companies with tight margins are the worst. Like most operators for example.
A few years back, not too long ago, I started working on a new contract assignment at a medium size aerospace manufacturer. I show up and check in with IT department. The system administrator shows me to my desk, and hands me a post it note with my password. Well pass phrase is more like it. It was something like “sliding down the tall building”. I was quite impressed that they encouraged the use of long pass phrases…
So I ask: "Okay, how do I log in?"
The IT guy: "What do you mean, you just log in using your personal domain account and then sudo su -. You know what sudo is?" (followed by loud sigh)
Me: "You mean like production domain, same that we use for our desktop?"
IT guy: "Of course! What do you mean, what other domain would you like?"
Me: "Can I at least change my password to something else just for the dev environment? Can I log in with SSH key?"
IT guy: "No, no, no. Per our SECURITY policy, SSH keys are disabled and you have to use our domain login and password". (another sigh... of course)
Me: "Are you aware that when somebody has root access to the box they can do whatever they want including intercepting passwords of all users that log in to that box? In this case, every single developer that ever needs access to dev environment?"
IT guy: "That's not true. SSH is encrypted protocol and it is not possible to access passwords".
Me: after many tries to explain this to various people from IT, I gave up and set out to intercept all passwords of all IT employees. After I had passwords of almost everybody, I put them all in an excel and sent to IT for "verification".
There were a lot of angry people that day wanting me fired... fortunately they came to their senses.
Unfortunately, my development box access privileges were revoked.
Earlier quoted context omitted.
Citibank is particularly egregious. 8 character MAXIMUM length, lots of special characters not permitted while requiring numbers and letters, forced password changing every few months, I absolutely hate it.
Are you speaking as an employee or a customer? I just checked my password db for a few Citibank accounts and all of them were far longer than 8 characters.
Worse than password rules, are when sites disable the ability to paste in the password in the 'confirm your password' field. Forces users to reduce the 50 chars crazy password they wanted to set using their preferred password manager with a less secure version.
I've had this in my AutoHotkey file for a long time now: ; Type in the clipboard ^!v:: MyClip = %clipboard% StringReplace, MyClip, MyClip, `r, , All SendRaw %MyClip% return So I can hit Ctrl-Alt-V and have it type in whatever's in my clipboard. I use it to scrub the text and deal with stupid sites and forms that don't allow paste. I also have a variant that adds a Sleep so I can do the same thing when something like…
A few years back, not too long ago, I started working on a new contract assignment at a medium size aerospace manufacturer. I show up and check in with IT department. The system administrator shows me to my desk, and hands me a post it note with my password. Well pass phrase is more like it. It was something like “sliding down the tall building”. I was quite impressed that they encouraged the use of long pass phrases…
This level of negligence should be criminal.
Things are already horrendously bad. Basically every American's identity could stolen at this point. If any nation state or other actor decided to operationalize any of the big leaks -- eg OPM or EquiFax -- the ramifications would be catastrophic. Imagine millions of people losing their retirement accounts and all their savings. Even if you could correct everything -- and that's a big if -- the process might take years and the intervening panic would be deafening. The amount of anger might even elicit a hot response.
To say nothing of more serious vulnerabilities. We really dodged a bullet on the pipeline ransomware.
I'm morbidly curious how bad of a "Cyber 9/11" we'll need before software starts being taken seriously as an engineering field in which practitioners have professional responsibility.
A few years back, not too long ago, I started working on a new contract assignment at a medium size aerospace manufacturer. I show up and check in with IT department. The system administrator shows me to my desk, and hands me a post it note with my password. Well pass phrase is more like it. It was something like “sliding down the tall building”. I was quite impressed that they encouraged the use of long pass phrases…
A few years back, on day 1 of my new job I was given root access to one of the development boxes. So I ask: "Okay, how do I log in?" The IT guy: "What do you mean, you just log in using your personal domain account and then sudo su -. You know what sudo is?" (followed by loud sigh) Me: "You mean like production domain, same that we use for our desktop?" IT guy: "Of course! What do you mean, what other domain would yo…
Earlier quoted context omitted.
I've had this in my AutoHotkey file for a long time now: ; Type in the clipboard ^!v:: MyClip = %clipboard% StringReplace, MyClip, MyClip, `r, , All SendRaw %MyClip% return So I can hit Ctrl-Alt-V and have it type in whatever's in my clipboard. I use it to scrub the text and deal with stupid sites and forms that don't allow paste. I also have a variant that adds a Sleep so I can do the same thing when something like…
Argh, if only AHK used some mainstream scripting language, at least in addition to its leetspeak. I will never learn it by practicing once in a year.
AHK has a v2 that attempts to clean up its scripting language, but it's been in beta for a long time.
1. Why don't passworded websites provide their own password generators? There's "secure" entropy generation available to JavaScript, e.g. `Crypto.getRandomValues(Uint8Array)`. 2. Shouldn't the only variable for password generation be entropy/information? Here's a 256 bit password: 1NH8O3C3GH33FNQHM3B7VFKIQ95EMD-QLPOFPPYJ54NCFXMOB3 How could you know? An easy way is to take the character set and convert the input stri…
I had a talk with the head of security at my credit union and told him I was within this much distance of ending my relationship with them over the fact that their password rules were so tough. I pointed out that there were some banks that had let me keep the same (securely generated) password for 15 years. American Express tried to sell me on a deposit account to go with my card but they told me I'd need to make a n…
And I can't imagine someone memorizing a password for a bank login only, and never using that in other locations. The internet requires so many accounts to manage... If you did reuse your password then your bank login would be very vulnerable to credential stuffing.