What is the origin of passwords submitted to honeypots?
1–10 of 44 posts
Re: What is the origin of passwords submitted to honeypots?
#2Originally submitted this[1], but refreshing replaces with this[2].
[1] https://isc.sans.edu/diary/Potential+Weaponizing+of+Honeypot...
Re: What is the origin of passwords submitted to honeypots?
#3TL;DR: `cat` was a mistake, never pipe files to your terminal, use a text editor or viewer instead.
Re: What is the origin of passwords submitted to honeypots?
#4Originally submitted this[1], but refreshing replaces with this[2]. [1] https://isc.sans.edu/diary/Potential+Weaponizing+of+Honeypot... [2] https://isc.sans.edu/diary/0
Our software swapped [1] for [2] because [2] is listed as the canonical URL in [1].
Which article is better? They both seem pretty good and I'm unclear on the difference.
Re: What is the origin of passwords submitted to honeypots?
#5Originally submitted this[1], but refreshing replaces with this[2]. [1] https://isc.sans.edu/diary/Potential+Weaponizing+of+Honeypot... [2] https://isc.sans.edu/diary/0
Our software swapped [1] for [2] because [2] is listed as the canonical URL in [1]. Which article is better? They both seem pretty good and I'm unclear on the difference.
Contents of the canonical URL appears to change over time by showing the latest blog post, which is currently this[1] that was just published today, not what was originally submitted.
[1] https://isc.sans.edu/diary/What+is+the+origin+of+passwords+s...
Re: What is the origin of passwords submitted to honeypots?
#6Earlier quoted context omitted.
Our software swapped [1] for [2] because [2] is listed as the canonical URL in [1]. Which article is better? They both seem pretty good and I'm unclear on the difference.
Contents of the canonical URL appears to change over time by showing the latest blog post, which is currently this[1] that was just published today, not what was originally submitted. [1] https://isc.sans.edu/diary/What+is+the+origin+of+passwords+s...
Ah thanks - let's change to that above instead of https://isc.sans.edu/diary/0.
Re: What is the origin of passwords submitted to honeypots?
#7It's an interesting optimization problem for the attacker.
The most common passwords are problematic. They will frequently work, but they will work for the other guy, too. So then the question is "how do you pull up the ladder?"
Changing the password is simple, but likely to get the machine reimaged.
Looking at the login history would give an allowlist of subnets, which can be used to deny other attackers access, but hopefully without inconveniencing the owner into reimaging.
Re: What is the origin of passwords submitted to honeypots?
#8Passwords should be dead soon and this article should be irrelevant soon after.
PSA: For most basic and routine websites/apps of low-value, please, please use the FaceID/TouchID protected platform authenticators for passwordless authentication.
And for those archaic sites that still insist on passwords (why? tell them about passwordless by writing feedback/app reviews), use the platform built-in password managers. Don't do passwords by memory.
For higher value things like banks, please use a different user-id/e-mail-id and passwords stored in password-manager (or write down the password in a book kept safely at your home – this is so much safer than weak passwords you try to scheme up and remember). And, always use 2FA – preferably a hardware FIDO key that you can enroll at least 2 of them and keep them safe. In India, regulator insists banks use mobile SMS OTP. In such case, keeping your phone secure from SMS sniffing malicious apps is critical. If you are really paranoid, get the simplest modern feature phone with a phone number dedicated for receiving such critical SMS! The day when all financial institutions use passwordless auth with FIDO2 MFA cannot come soon enough!
Re: What is the origin of passwords submitted to honeypots?
#9Passwords should be dead soon and this article should be irrelevant soon after. PSA: For most basic and routine websites/apps of low-value, please, please use the FaceID/TouchID protected platform authenticators for passwordless authentication. And for those archaic sites that still insist on passwords (why? tell them about passwordless by writing feedback/app reviews), use the platform built-in password managers. Do…
Define soon. Passwords, for all their annoyances, will probably be around for a long time.
While they are not brilliant at anything, they are good enough on many dimensions. Some disadvantages of the things you mention are:
* They don't require specialised hardware * They don't require complicated recovery mechanisms if that hardware is lost, stolen or broken. * Arguably, biometrics should not be used for authentication. Once a biometric system is compromised, you have no way to recover. You can't change your biometrics.
Re: What is the origin of passwords submitted to honeypots?
#10Passwords should be dead soon and this article should be irrelevant soon after. PSA: For most basic and routine websites/apps of low-value, please, please use the FaceID/TouchID protected platform authenticators for passwordless authentication. And for those archaic sites that still insist on passwords (why? tell them about passwordless by writing feedback/app reviews), use the platform built-in password managers. Do…
I don't trust Face ID/Touch ID, so for me passwords will not be dead soon. Especially because on my device there's nor Face ID, nor Touch ID.