171–180 of 257 posts
Earlier quoted context omitted.
And what do you do when your key is broken or lost? Because that will happen.
Backups! Copy of key at friends house.
Proving your identity when you lost your proof of identity is still an unsolved problem if you ask me. At least in general, it seems that there is no one solution that works for everyone.
> You cannot enter a password with more than X chars I've seen this from banks , for access to my money & credit... Both FirstDirect and HSBC used to have a 9 character password for their "digital secure key"s (basically their apps on my phone, in the direct use use-case). 9. Just 9. Though at least alpha-numeric & case-sensitive, so some room for reasonable entropy. Worse: for some reason HSBC recently changed their…
- The usual login + password, the password length is limited of course
- The "secret questions" to confirm some actions. In reality these are just three extra passwords
- The code generator in the mobile app to confirm some other actions, for access to which you need a 4-digit pin code
Another bank is much more sensible in this regard but requires me to change my password every year. I hate it with a burning passion when there's any time component at all in user authentication.
Earlier quoted context omitted.
Backups! Copy of key at friends house.
So that the friend, or someone who steals from the friend can impersonate me? Proving your identity when you lost your proof of identity is still an unsolved problem if you ask me. At least in general, it seems that there is no one solution that works for everyone.
In the b2b world it's basically impossible to improve password policies. Most of the onerous examples only exist because some other entity (a customer, insurance company, parent company, etc) has demanded them. The problem is that the demand isn't being made by security professionals, it's being made by risk management people who are only interested in a simple way to mitigate risk - it's simply much easier for them…
You might be able to appeal to NIST standards, which now recommend against some of the bad practices like special characters.
In the b2b world it's basically impossible to improve password policies. Most of the onerous examples only exist because some other entity (a customer, insurance company, parent company, etc) has demanded them. The problem is that the demand isn't being made by security professionals, it's being made by risk management people who are only interested in a simple way to mitigate risk - it's simply much easier for them…
You might be able to appeal to NIST standards, which now recommend against some of the bad practices like special characters.
I came across the most humorous password entry view blocking scenario on a firestick trying to login to netflix the other day. You are visually moving the cursor around a graphically displayed keyboard... pressing enter when you are on the letter or number desired, at which point the hidden password entry form immediately increases by 1 in length. Hrmmm... I wonder what that character was?!?
A bank in France, "Societe Generale de Banque" still shows me a little visual keyboard (with digits only). The digits are shuffled. Then it's similar: I need to hover the digit I want to pick, click, it blinks, then the hidden password entry increase by one. Repeat 5 more times.
I can then wire up to 100 K EUR if I want. Insanity.
Now, to be honest, all my other banks in Europe are using an actual hardware 2FA which they sent me.
I lead Security in a quite large bank. I love this article, I’ve been advocating for this line of thoughts for more time that I can remember. I have spoken to regulators hundreds of times, over this and a bunch other security topics that are definitely obsolete. Security policies that just don’t make sense… The most important thing for this kind of things to advance is to have the correct people in the correct places…
In most of my banks in Europe, all but one, I cannot log without using an actual physical 2FA device the bank sent me. One of them, Deutsche Bank, sent me a specific hardware 2FA which works "by itself" (and is protected by a PIN). No password to log in: only the user account ID and that 2FA device.
The others require my Java SmartCard / national ID card to be inserted in a 2FA reader they sent me (it's a standalone reader with its own display: it is not a Java SmartCard reader hooked to the computer).
Do you guys hand out your customers physical 2FA devices?
Earlier quoted context omitted.
Expiring passwords are the bane of my existence. My current job does that. It was originally a requirement by Microsoft and they've been recommending against it, but it catches up slowly.
My former company required not to use one of the last 10 passwords. So every 3 months, employees did the 11-password dance, setting the password back to the original one.
Even the head of information security tried changing this and failed to get the change through.
Earlier quoted context omitted.
I know passphrases are better. But, the problem is there's much more to type every time you want to unlock your computer. And thus also many more chances to make a typo. Of course there's TouchID and Windows hello but they don't work if your laptop is closed in a dock. Or in my case a Mac mini at home. This is why I still stick to the truly random sorry password, I have no issues remembering arbitrary strings for som…
Typing a passphrase is so much easier. You already have muscle memory for typing English (or whatever your first language) words. I can type probably type a 60 character passphrase consisting of real words at least as quickly as than I can type a 15 character password with special characters, if not faster.