Poor Passwords A Worse Problem Than Poor Antivirus 247
dasButcher writes "Viruses and worms get all the headlines, but poor password management is a worse problem according to a new study by Channel Insider and CompTIA. As Larry Walsh writes in his Security Channel blog, VARs and security service providers say they find more problems with password management than antivirus applications when they do security assessments. While password problems are nothing new, Walsh and those posting on his blog correctly assert that users remain cavalier about passwords and businesses are doing too little to address this serious vulnerability."
Sunflowers aren't so bad (Score:5, Insightful)
Re:Sunflowers aren't so bad (Score:5, Insightful)
I agree completely. I generally tell people that it's far, far, far better to have a strong password which you write down than a weak one which you can remember. Simply moving the post-its from the monitor to a locked desk drawer would do a lot to decrease the security risk of writing them down.
It's also not even vaguely clear to me why people feel that regular password changes are helpful or a good idea. As far as I can see, all they do is make it tougher for users to use strong passwords (due to being unable to memorize them), thus leading to weaker passwords and less security. An uncompromised password is an uncompromised password. They don't go stale.
Regular password changes don't help decrease the likelihood of a system being compromised, they just offer some mitigation in the event that it has been compromised. However, given that an attacker probably will need only a few hours or days to slurp plenty of information or do plenty of damage, rotating passwords monthly isn't even likely to mitigate the compromise much.
So the trade-off being made is that the system is now more likely to be compromised due to weaker passwords but in return, there's small chance that an attack will be stopped after the system has been compromised due to the password changing. That doesn't seem like a good trade-off to me. My best guess is that this advice is left over from a time when some systems had shared passwords. The regular password change was so that people who had been given the password to a system to do one thing wouldn't have access forever. Some places even used daily passwords so that they could give someone access for one day, but have their access reset the next day. But that advice has been carried over to individual user passwords in systems which use better access control technologies to manage access.
These sort of reports don't stop and analyze what constitutes good password management. They just say "Passwords should be changed regularly. It must be true because everyone is saying it. This company doesn't change their passwords regularly, so they have poor password management." As such, they aren't really a good assessment of the problem.
Author parrots common fallacy (Score:5, Insightful)
Until people get over this misconception and communicate to their users: "give yourself a good password. I won't ask you to change it so you can pick a strong password that you will remember and that will be the end of memorising passwords" Then stress what makes a strong password.
No Surprise (Score:3, Insightful)
This is probably because most security assessments aren't very good and don't correlate well to an organization's actual security problems. At least the assessments help people get rid of all that extra money they have.
Re:Sunflowers aren't so bad (Score:5, Insightful)
Simply moving the post-its from the monitor to a locked desk drawer would do a lot to decrease the security risk of writing them down.
Or better yet, store it in your wallet. A place that is save enough for your money, credit cards and car keys should be save enough for a bunch of passwords. One could of course go one step further and get rid of passwords altogether and use a secure authentication device instead, with USB being commonplace everywhere that shouldn't be to hard to just use a USB device that does the authentication and encryption in a secure and easy to use manner.
The core problem isn't that users chose insecure passwords, thats just human nature, the core problem is simply that hardware and software developers haven't build systems that work well enough with this "flaw" of human nature.
Maybe not such a good idea... (Score:3, Insightful)
Turns out their form only saved the first 12 or so characters - but they hadn't limited how many characters you could type into the field, so I didn't know I'd typed too many. And guess what - the login form accepted more than 12 characters! Hence my borked login.
Fortunately I think that flaw got fixed when they upgraded their site, but I wonder how many more sites out there are broken like this...
"strong password policy" is NOT the solution (Score:3, Insightful)
You know what that does?
It forces people to write their passwords down. On paper.
With the password written down, it's very easy to "crack" because it's sitting there, "in the clear" on a dead tree.
Re:Biometrics (Score:5, Insightful)
The problem with biometrics is that they aren't secrets and they aren't changeable. As such, they're fine for low-security in-person authentication. For example, I've heard of a restaurant which had their wait staff punch in by scanning their finger prints. That's fine. But if you use it to control access to the VPN, then that's problematic due to the non-changeability.
Here's why:
Let's assume that you are an employee who runs Windows at home. You keep up with the latest patches and don't do anything stupid. You probably even run Firefox. But still, someone manages to slip through an unpatched bug and infect your system. It can happen to just about anyone. They then install a back door and start logging what's going on in your system. They notice that you connect to a VPN so they start sniffing your USB traffic so that they can appear as you (recording either your password or your fingerprint). Now they can get into your company's VPN. It's compromised. Fortunately, your IT guy is on the ball. At 11am the next day, you get a call from your network admin asking you if you are signed into the VPN because he expects that you're in the office, but you also appear to be signed in remotely. You confirm that you are not signed in and the two of you realize that you've been hacked. He temporarily disables your access. You go home, clean up your home computer (assuming that you can) or bring it in to have them clean it up, and then it's time to give you access back.
Now here's where things diverge. If you've used a password, you just have to change your password to a new one, and it's secure again. Your fingerprint isn't changeable. Obviously, you can switch to a different finger, but that's a limited strategy since you've only got 10 of them (well, maybe slightly more or less if you were born with extra fingers or have lost some in accidents). I suppose once you're out of fingers, you could use toes, but I doubt most users would be willing to. This becomes especially problematic if any non-hashed versions of things are stored (as often must be done for fuzzy matching) because if the database gets compromised, every single person would need to change to a new finger. You also wouldn't want to use the same finger for your work password as you use for your bank. So, a total of 10 may seem like a lot, but over the course of a lifetime, you're almost certain to run out. Other biometrics are even more problematic since people have at most two irises, only one voice, only two sets of hand geometry, etc.
The non-secrecy can also be a pretty big issue, although that one usually only comes up with insider attacks since they generally have to know you in person. Let's say you use the fingerprints for controlling access to the company database. Now, Alice is a supervisor in payroll accounting and can change people's salaries in the database. Eve works sales and is clever and unscrupulous. Eve invites Alice over to dinner, and after she's left, lifts her fingerprints from her wine glass or the glass table top or almost any other smooth surface she's touched. Heck, she might even be able to get it from a door knob at work if she's careful. Once Eve has the fingerprint data she can then log-in over the network to the database.
The banking situation would be even tougher because you would expose your fingerprint when you use an ATM. All an attacker would have to do is wipe the buttons and/or fingerprint scanner clean before you use it and then lift your print from the machine when you're done.
Alice can keep her password in her head, or if it's too hard to keep in her head, she can write it down and keep it in a locked drawer in the office. This isn't absolute security, especially since keys can be duplicated from pictures of them, but would at least require that Eve physical break into the office. But still, her password at least starts out as a secret unknown to anyone else. Her fingerprints are not secrets. Using your fingerprint as your password is like writing you pas
Re:Maybe not such a good idea... (Score:4, Insightful)
I use PasswordMaker [passwordmaker.org] for website passwords (as everyone should) with a 16 character password length. I've probably run into a half dozen sites which have silently removed the last 4 or 8 characters, cutting it down to 8 or 12 characters. I've also run into several which strip out "special" characters (single or double quotes, slashes, spaces, parentheses, or whatever else they feel threatened by) in an asymmetric manner. That is, they remove them from the password before they store it in the database but not when you type it in or vice versa. It's a real pain.
I've also had other sites which simply reject my password because of excessive length or because it contains "special" characters. Any place which can't accept any password I give them is doing a terrible job of securing their users accounts.
Re:It's all down to ridiculous password rules... (Score:4, Insightful)
Re:Sunflowers aren't so bad (Score:3, Insightful)
And there is no malware possible that can read what's written on a post-it note.
Security cameras. If you know what to Google you can find all sorts of security cameras on the internet.
Or just walk in and look yourself.
Seriously? No security camera will have a resolution high enough to actually read what's written on a post it note, assuming it's even in focus. It's not like on TV where you can just "zoom in, and enhance." Probably the best you could get would be to see a vaguely "sunflower" shaped monitor, as described.
Re:Sunflowers aren't so bad (Score:4, Insightful)
Or better yet, store it in your wallet. A place that is save enough for your money, credit cards and car keys should be save enough for a bunch of passwords.
Huh? That's not very good advice. If someone steals my wallet, they get access to whatever cash I have in it, and some easily-replaceable plastic. If I report the loss/theft promptly, my liability is limited.
... they're called "pickpockets."
On the other hand, if I put passwords to my important online services there (such as my bank account, 401K, etc.) I could find those assets gone forever. If I have passwords to my company's systems there, they also could be compromised, and it would be my fault for storing those passwords in such a readily accessible place. A wallet is not secure, was not intended to be secure, and is something people carry around out of necessity, and the thought of losing it is a source of constant worry. Plus which, there are people who specialize in relieving us of the burden of carrying said items, you know
Also, the problem with carrying arround a "secure authentication device" is that very few services support them. Well, not in the U.S. anyway, and that's where I live. And even if you are able to use one, you'll probably still require a PIN of some kind. Probably not a good idea to put that in your wallet either.
Regardless, you are absolutely correct that people not thinking things through and concerning themselves solely with convenience is human nature, Me, I use difficult passwords and I make the effort to a. memorize them and b. change them now and then. But that's me: few computer users are willing to work that hard, and I also agree with you that they really shouldn't have to. However, the core problem isn't so much hardware and software developers: the problem is that the people in charge of the financial systems in many countries just don't see the investment in secure transaction handling to be worth the money. It's cheaper to pay their insurance underwriters and just charge off the fraud. Of course, that fact that some number of citizens get totally fucked over every year is just acceptable collateral damage.
The United States' banking system is horribly insecure at pretty much every level, and I don't see that improving any time soon because it would cost a lot of money. A good first step might be getting rid of Diebold (I mean, come on, a Windows-based ATM?) but I don't see that happening soon either.
Re:Fingerprints? (Score:4, Insightful)
Re:Author parrots common fallacy (Score:3, Insightful)
This.
Password rotation is dumb dumb dumb dumb dumb. At least half of my users would have mentioned the annoyance of changing passwords, many tell me the exact process they use to circumvent it while doing so.
But my hands are tied, because twice a year the auditors come in, and if I don't have a password rotation policy he'll tell my boss, who'll then tell me to implement it. I've tried to reason with him, but passing the audit was more important. Beancounters in charge of IT FTW.
Re:The 1960's Called (Score:3, Insightful)
There's a reason usernames are public.
On a Unix machine, knowing someone else's username lets you send them mail. It lets you access (if they allow you to) their home directory. It lets you see if they're logged on (using "w"), see information about them (using finger), and even communicate with them (using write), and lots of other useful things.
Re:The 1960's Called (Score:2, Insightful)
Re:Sunflowers aren't so bad (Score:5, Insightful)
Regular password changes don't help decrease the likelihood of a system being compromised, they just offer some mitigation in the event that it has been compromised. However, given that an attacker probably will need only a few hours or days to slurp plenty of information or do plenty of damage, rotating passwords monthly isn't even likely to mitigate the compromise much.
Many of the really big credit card attacks (TJX, Network Solutions) took place over several months (or years), harvesting on-line transaction data. We have no way of knowing if the passwords were rotated during the course of the attack if that would have shut down the attackers. Network Solutions was PCI DSS rated, which means they had a password rotation policy in place, and their attack continued from March through June. We can probably assume the attackers seized the first opportunity to create a back door that they could use in the event the passwords were changed, so a rotating password would have had no effect on them.
Comment removed (Score:3, Insightful)
1Password (Score:3, Insightful)
Strong, weak.
Your choice.
Use 1Password t manage them all.
Re:Sunflowers aren't so bad (Score:3, Insightful)
I don't think it's really that big of a problem. First of all if you have passwords written down in your wallet and someone steals it, they're still going to have to figure out your username (unless you wrote that) and what password is for what service, what bank you use, etc. In the meantime you could just change all of your passwords to be safe.
Of course this wouldn't work if you didn't know your wallet was stolen (if they copied your passwords and returned it before you knew it was missing), but it seems like that would be a pretty targeted attack...
There's nothing wrong with ATMs running Windows, OS/2 or whatever as long as it's set up right. An ATM should NEVER be hooked up directly to the outside network (no matter what OS it is running), and should always be physically secured (in a very visible location, watched by cameras 24/7, etc).
Re:I have an idea. (Score:3, Insightful)
No, no, and no.
Stop making life hard on users for no real gain in security. Make a system that is secure with a 4-digit PIN. It's easy, and there's really no reason not to use two-factor authentication these days except (a) you don't really care about security, or (b) you actively hate your users, and a passphrase is as close as you're allow to come to hitting them with a hammer whenever they log in.
I realize (b) is common, but it still doesn't make for good security.
Re:Sunflowers aren't so bad (Score:3, Insightful)
The thing that really is a pain is the IT admin insisting on monthly changes to the password. So you might use a strong passphrase (say 20 characters long) but in the end you use the minimum, and put it on a post-it note so you don't lock yourself out of the system. (And, since most IT admin think their related to god, asking them for help is like grovelling in shit, something very few people enjoy!)