Why passwords are important...

RE: Why passwords are important...

BigG — Thu, 24 Oct 2019 17:19:48 GMT

I just so happened to request a new password on Microchip.com. My password choice failed.

Talk about a bad password rule. Has to be one of the weakest security rule I've seen in a very long time... someone to speak to them... [View:/resized-image/__size/16x16/__key/commentfiles/f7d226abd59f475c9d224a79e3f0ec07-a77f6fa2-95f4-4284-8c87-34dd3de3f24e/contentimage_5F00_4751.png:16:16]

[View:/resized-image/__size/458x136/__key/commentfiles/f7d226abd59f475c9d224a79e3f0ec07-a77f6fa2-95f4-4284-8c87-34dd3de3f24e/contentimage_5F00_204760.png:458:136]

RE: Why passwords are important...

clem57 — Fri, 11 Oct 2019 18:16:35 GMT

I wish to propose the following:

Traditionally, authentication procedures are divided into two stages: identification and secret password. Note identification with longer strings helps make the password space large...
To date, research on password security and the usability of these mechanisms has rarely been investigated. But more has been done since news of hacker attempts hits the public raising awareness.
Since security mechanisms are designed, implemented, applied and breached by people, human factors should be considered in their design. Too often we neglect this using simple techniques.
It seems that currently, hackers pay more attention to the human link in the security chain than security designers do, by using social engineering techniques to obtain passwords. This means Facebook, twitter and other places can help a hacker get into the mind of the user...
The key element in password security is the crackablity of a password combination. But often the length of the password is too little.
System-generated passwords are essentially the optimal security approach; user-generated passwords are potentially more memorable and thus less likely to be disclosed.
Password composition, alphanumeric password is more secure than one composed of letters alone. But the use of all elements like symbols and caps is better.

RE: Why passwords are important...

Gough Lui — Sat, 05 Oct 2019 02:08:18 GMT

Users need complex passwords - we know that much. Users need to avoid reuse as well - in case any password is compromised.

But on the server side, administrators need to do their part as well. For one, there are still probably some sites with plain-text password storage ... when the best practice is to salt and hash the password, with the choice of salt and hash having a significant impact on offline cracking time (and resources necessary to validate the password). Sometimes users are asked to change their passwords not because the password itself is vulnerable, but perhaps it was salted and hashed with an algorithm which has become "weak" in the face of increased computing power and discovered vulnerabilities, whereas re-setting it will allow for a new salt-hash record using the latest settings to be made.

But as usual, security is only as good as the weakest point ...

- Gough

RE: Why passwords are important...

dougw — Fri, 04 Oct 2019 16:15:02 GMT

It is all very confusing to me.

I assume the quoted time is related to the maximum number of possible different passwords or the maximum number of tries it would take to ensure the password was tried, but presumably it could get it right on the first try. In practice, it will never take the maximum possible time to guess a password.

Also every password system has a minimum time allowed between tries, even if it is just communications bandwidth, which would make fast computers irrelevant in computing more possible passwords. And some systems increase the time after every try or every few tries, sometimes the minimum time gets to be a very long period. Sometimes it goes to infinity.

These extending times are often used when the password is a 4 digit pin.

Without knowing the timing of allowed tries, computing a time to crack a password seems a bit arbitrary.

RE: Why passwords are important...

glennvanderveer — Fri, 04 Oct 2019 15:58:39 GMT

At some point, that password has to be entered in by typing it, whether or not autotype is used. And it is all for nothing if you have to type in the password to open your keepass database either upon creation or upon use.

RE: Why passwords are important...

glennvanderveer — Fri, 04 Oct 2019 15:40:55 GMT

Although the article does not say how the first break in happened, it could have been as simple as a visualbasic script that installed a key logger. It doesn't matter what password rules you follow, key loggers record everything. At the time of the article, VB scripts where a plague on Microsoft Windows and Office platforms.

RE: Why passwords are important...

clem57 — Fri, 04 Oct 2019 14:28:37 GMT

If you think about it, getting into systems by even youth happens. So why make the password too easy? I have the following example:

https://www.nytimes.com/2000/09/23/us/youth-sentenced-in-government-hacking-case.html

Enjoy the read and then ask why did they get in so easily, could it have been lax password withing the affected organisations?

Clem

RE: Why passwords are important...

gadget.iom — Fri, 04 Oct 2019 13:32:04 GMT

Here are results for the passwords I use for two of my more secure services. Both I know and type from memory.

[View:/resized-image/__size/620x195/__key/commentfiles/f7d226abd59f475c9d224a79e3f0ec07-a77f6fa2-95f4-4284-8c87-34dd3de3f24e/4682.contentimage_5F00_204758.png:620:195]

[View:/resized-image/__size/620x187/__key/commentfiles/f7d226abd59f475c9d224a79e3f0ec07-a77f6fa2-95f4-4284-8c87-34dd3de3f24e/3286.contentimage_5F00_204759.png:620:187]

RE: Why passwords are important...

koudelad — Fri, 04 Oct 2019 08:33:10 GMT

My recommendation is using certificates wherever possible: SSH, remote desktops, etc.

If I can't use a certificate, I use a strong generated password and store it locally in something like KeePass. I wouldn't trust cloud password managers, there have been security breaches.

Use two factor authentication for all publicly available services. Nice and open-source application for mobile phones is FreeOTP. Or hardware modules like Yubikey, which [mention:aa6deffed12746e1bb75f89ce3d88178:e9ed411860ed4f2ba0265705b8793d05] mentioned.

Encrypt data storage on computers and mobile phone. Not for an illusion of being unbreakable for secret services, but for common situations when device gets lost or stolen by a random guy.

RE: Why passwords are important...

glennvanderveer — Thu, 03 Oct 2019 20:10:08 GMT

I would also argue that for brute force password cracking, the length of time that a password is valid should also be a factor. If it takes 3 months to brute force guess a password, but the password life is only 1 month, then that password is secure enough to use.

RE: Why passwords are important...

Jan Cumps — Thu, 03 Oct 2019 19:24:25 GMT

For an alternative opinion, search this term online: “do strong passwords accomplish anything”

RE: Why passwords are important...

mudz — Thu, 03 Oct 2019 19:07:45 GMT

Well you guys want to end this or not?

[View:/resized-image/__size/16x16/__key/commentfiles/f7d226abd59f475c9d224a79e3f0ec07-a77f6fa2-95f4-4284-8c87-34dd3de3f24e/contentimage_5F00_938.png:16:16][View:/resized-image/__size/719x222/__key/commentfiles/f7d226abd59f475c9d224a79e3f0ec07-a77f6fa2-95f4-4284-8c87-34dd3de3f24e/contentimage_5F00_204757.png:719:222]

RE: Why passwords are important...

three-phase — Thu, 03 Oct 2019 19:00:01 GMT

My first one is the format I use for my works computer;

[View:/resized-image/__size/620x353/__key/commentfiles/f7d226abd59f475c9d224a79e3f0ec07-a77f6fa2-95f4-4284-8c87-34dd3de3f24e/2047.contentimage_5F00_204755.png:620:353]

Second one is the format I use on my personal USB drives;

[View:/resized-image/__size/620x346/__key/commentfiles/f7d226abd59f475c9d224a79e3f0ec07-a77f6fa2-95f4-4284-8c87-34dd3de3f24e/0804.contentimage_5F00_204756.png:620:346]

RE: Why passwords are important...

e14 Contributor — Thu, 03 Oct 2019 18:22:03 GMT

[View:/resized-image/__size/778x229/__key/commentfiles/f7d226abd59f475c9d224a79e3f0ec07-a77f6fa2-95f4-4284-8c87-34dd3de3f24e/contentimage_5F00_204754.png:778:229]

I confess that the word parts were not in English!

RE: Why passwords are important...

neilk — Thu, 03 Oct 2019 15:14:02 GMT

Pleased to say that the password I use to access my password manager would take a computer 23 years to crack [View:/resized-image/__size/16x16/__key/commentfiles/f7d226abd59f475c9d224a79e3f0ec07-a77f6fa2-95f4-4284-8c87-34dd3de3f24e/7737.contentimage_5F00_1.png:16:16]

Neil