Earlier quoted context omitted.
I'd be more inclined to do a "drinks" option.
Solid milk chocolate! ;-)
A new take on "jinx you owe me a soda"
SaaS CTO Security Checklist
91–100 of 114 posts
Re: SaaS CTO Security Checklist
#92> Enforce a password policy > (links to https://www.digicert.com/blog/creating-password-policy-best-... ) where they give the usual (at least 2 special characters, but not " or \) advice This is counterproductive and is actually discouraged by the latest NIST guidelines, that prefer passwords that are easy to remember, but still hard to guess [1]. [1] https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...
fourwordsalluppercase
ONE WORD ALL LOWERCASE
Re: SaaS CTO Security Checklist
#93> Enforce a password policy > (links to https://www.digicert.com/blog/creating-password-policy-best-... ) where they give the usual (at least 2 special characters, but not " or \) advice This is counterproductive and is actually discouraged by the latest NIST guidelines, that prefer passwords that are easy to remember, but still hard to guess [1]. [1] https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...
Yeah but when you partner with companies, they sometimes force your company to adhere to those ancient guidelines. I’ve worked for companies where they ask for the out of date NIST stuff you mention and it’s either you follow what they ask or you lose out on a deal to fund your company.
If you require PCI DSS compliance it won't fly either.
https://pcipolicyportal.com/blog/pci-compliance-password-req...
Re: SaaS CTO Security Checklist
#94Re: SaaS CTO Security Checklist
#95Lots of talk about passwords, but fewer about password managers. The password managers listed in this do not protect against backdoors. Lastpass, for example keeps all your passwords in plain text once you've unlocked it. Passwords stored in Apples Keychain can be synced across devices and a remote attacker can do something like a sim port, gain access to your iCloud account and then sync to their computer leaving yo…
I think you need to provide approval from one of your other devices, or enter your iCloud security code before the sync can occur.
Re: SaaS CTO Security Checklist
#96Earlier quoted context omitted.
Even if you knew the pattern, four random lowercase dictionary words (assuming a dictionary size of 50,000 words) would take longer to crack than a randomly generated 10 digit password with letters, numbers, and special characters. 50,000^4 > (26+26+10+10)^10
It would be very interesting to see the results of a study asking people to come up with a list of random words. I really doubt that the actual dictionary size would be anywhere near 50k, and probably would have a high frequency of common words like 'apple', 'house', 'food' etc, making them easier to crack, and almost no frequency of less common words.
And - of course - Randall has us covered here too:
A 1000 word vocabulary is quite understandable, though a little awkward.
A random word might be as few at 10 bits of entropy. If a person is picking them out of their head, I'd bet it's unlikely to be as many as 12 or 13 bits. Most of the words we "know" aren't ones that come to mind when we're "randomly choosing words"...
Re: SaaS CTO Security Checklist
#97Earlier quoted context omitted.
I'm not sure I agree with that assumption, as the entire purpose of a passphrase of words rather than a password of random characters is that the passphrase should be easier to remember. If you're randomly picking words like 'gargarize-youster-noctivagant-axilla', it's not exactly accomplishing that purpose very well. It's also a huge PITA to type in, which based on my experience in the IAM space, is an immediate dea…
I’d rather pick from obscure words I know than at random. In my case the words might lean tech/business/news/sports, but I’m sure I could come up with a good list. It might be interesting to try and generate passwords from a corpus of email and/or browsing history... assuming you blacklist sensitive subjects.
I let my password manager pick words for me, and I keep hitting refresh until I get one that I think I'm likely to get the spelling correct when needed.
1Password just gave me this: land convolve witchery bequest
Having said that, since I use 1Password, these are rare and almost exclusively used for things where I need very-short-term memorable passphrases for things that won't let me copy/paste from 1Password (like my Apple ID or the passwords my bank ask me for over the phone...) Everything else just gets 25 random chars (or the maximum number of chars the input will allow).
Re: SaaS CTO Security Checklist
#98I really like this idea - alot. But aimed perhaps at everyone, not just the CTO. In fact the CTO probably needs one thing on their checklist. Checklist item 1: Hire an outside security auditing firm to report on the state of this checklist quarterly". And if the company has the financial resources: Checklist item 2: Hire a second, independent outside security auditing firm to report on the state of this checklist qua…
Quarterly audits are very much out of the norm among SAAS startups. Checklists that don't reflect reality don't help anybody --- but then, I guess I don't think this checklist does, either.
> but then, I guess I don't think this checklist does, either.
Why do you say that? Do you think the items on the list are not useful/well prioritized? Or that most companies are not positioned/incentivized to follow most of this advice?
Re: SaaS CTO Security Checklist
#99Lots of talk about passwords, but fewer about password managers. The password managers listed in this do not protect against backdoors. Lastpass, for example keeps all your passwords in plain text once you've unlocked it. Passwords stored in Apples Keychain can be synced across devices and a remote attacker can do something like a sim port, gain access to your iCloud account and then sync to their computer leaving yo…
I think you need to provide approval from one of your other devices, or enter your iCloud security code before the sync can occur.
iCloud security code can come over SMS if your account is configured as such, therefore the above example of a SIM port applies
Re: SaaS CTO Security Checklist
#100Earlier quoted context omitted.
I think you need to provide approval from one of your other devices, or enter your iCloud security code before the sync can occur.
iCloud security code can come over SMS if your account is configured as such, therefore the above example of a SIM port applies
I'm not 100% sure about this, since it's been a while since I've added a device to my iCloud account, but IIRC the prompt is not the standard 2FA one: it basically asks you to approve the addition from another device, or forces you to use your security code.