LastPass Reveals the Threats Posed By Passwords in the Workplace (betanews.com) 72
A reader shares a BetaNews report: A new report by LastPass -- The Password Expose -- reveals the threats posed, and the opportunities presented, by employee passwords. The report starts by pointing out that while nearly everyone (91 percent) knows that it is dangerous to reuse passwords -- with 81 percent of data breaches attributable to "weak, reused, or stolen passwords," more than half (61 percent) do reuse passwords. But the real purpose of the report is to "reveal the true gap between what IT thinks, and what's really happening." Jumping straight into the number, the report says that even in a 250-employee company, there are an average of 53,250 passwords in use -- a near-impossible number to keep track of and to know the strength of. LastPass found that people have nearly 200 passwords to remember, so it's little wonder that password reuse is an issue.
password management company publishes report... (Score:2, Insightful)
extolling the virtues of using a password manager
threat revealed, thanks lastpass
Re:password management company publishes report... (Score:4, Interesting)
It is a balancing act. One one hand, if someone uses weak (but memorable) passwords, that can be brute-forced, that is far more likely than a password manager getting compromised, especially a password manager with 2FA.
However, selecting a password manager is critical. LastPass is one that has had security intrusions succeed... but were mitigated. Some other PW managers which have, as of their latest versions, required cloud access (1Password, mSecure) not just don't have a proven track record... but don't even give any details on what security they actually bother with. For all we know, they could stash everything on a public S3 bucket.
I like PW managers which piggyback on existing cloud providers and have decent encryption [1], like Enpass or Codebook. That way, not all eggs are in one basket, and Google Drive provides adequate 2FA protection.
[1]: The idea would be separating the passphrase protecting the database on the cloud provider versus the encrypted copy, or even better, using public key encryption and "introducing" new devices, to make the copy sitting on the cloud provider as brute force resistant as possible.
Re:password management company publishes report... (Score:5, Informative)
I can't recommend PasswordStore (passwordstore.org) highly enough. ~400 lines of (quite readable) Bash. GPG. Git. That's the extent of it.
Combined with my GPG credentials being on a smartcard, I feel like I'm doing the best I can.
Re: (Score:2)
1password used to work that way, and it is still possible to purchase the standalone version that lets you store your passwords on other cloud services, but I don't know how much longer that will be. As it is, they don't advertise the standalone version anymore. You have to specifically ask them for it.
I am currently looking at Enpass as a possible alternative, however there are several dealbreakers that I am waiting to be resolved:
1. It doesn't support multiple password vaults. Supposed to be in the ne
Re: (Score:2)
I assume they're encrypted, but they can easily tell if they're the same. It doesn't say they have statistics in complexity, only reuse.
I suppose this would mean that they're not salted though, or the same salt is used for every password in an account.
Re: (Score:2)
You shouldn't be able to tell if two encrypted strings are the same unless they are encrypted with the same key. And they should not be for that reason among many others.
You appear to be talking about hashing which is not what a password manager does.
Re: (Score:1)
Even hashed passwords should be salted, preventing you from knowing which ones are the same.
Re: (Score:1)
You're right, I was thinking of one way hashing, which would be pretty stupid for a password manager.
Re: (Score:2)
Re: (Score:2)
source?
THAT is exactly why I have a password vault. (Score:1)
I only have to remember the vault password. The three keys to making it work in the long run are backup, backup, and backup.
Re: (Score:2)
I only have to remember the vault password. The three keys to making it work in the long run are backup, backup, and backup.
I use Acerose password manager. It's weak spot is any back-up of the database is readable with any text editor. I've used it for so long, having many log-ins I stick with it.
Re: (Score:1)
I use KeePass. The database (including backup copies) are encrypted. The password is in a sealed envelope inside our family safe deposit box, and both my wife and son have access.
Re: (Score:2)
I use KeePass. The database (including backup copies) are encrypted. The password is in a sealed envelope inside our family safe deposit box, and both my wife and son have access.
Good to see you have a plan. So few do.
I have 3+ passwords. (Score:2, Interesting)
One for I don't give a shit - like a Reddit account and every other dipshit website that requires a login so that they can use their registered users for advertising and revenue - and that's why I will never register for Slashdot.
One for it'd suck if someone got a hold of it, but life goes on.
One for my money and other important shit.
My wife on the other hand, takes this password shit too seriously. She creates a new a special one for every dipshit login. And as a result, is constantly forgetting them and r
Re: (Score:3)
One for I don't give a shit - like a Reddit account and every other dipshit website that requires a login so that they can use their registered users for advertising and revenue - and that's why I will never register for Slashdot.
I don't get it-- why don't you use your "I don't give a shit" account password, here, too, if you use it on Reddit?
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
My bank would require you have access to my e-mail or phone.
My e-mail would require you have access to my phone.
I don't think it'd be as easy as you think in general.
Single Sign On Fiasco (Score:2)
Now after we go through the painful microsoft applications access panel, we click on any thing, it pops up the same password dialog. The only thing has changed is now we can not directly log in to the third party service. First we sing on here and then sign on again. Single Sign on e
Might SSO be the password reuse stats? (Score:2)
We are SSO and use LastPass. Many of our systems are SSO - and LastPass thinks that each is a different site, but happily records my SSO password. And then LastPass puts up a warning "you have reused the same password at multiple sites - this is bad"
But wait -- they are all the same system, or at least have SSO integration. I wonder if that skews their results at all?!
Which is the pitfall of SSO: - one password to remember -- and only one to guess.
advertisement is an advertisement (Score:2)
And if the passwords are stored in the cloud, they are almost guaranteed to not be secure.
Re: (Score:3)
In fairness, it's much easier to remember one password for your password manager than 150 unique strong passwords, so IT would be getting fewer calls. Plus, a big part of the problem is that people won't remember hundreds of unique passwords, so they instead reuse passwords, which is one of the major ways that accounts get compromised.
I'm not saying that this isn't an advertisement in disguise, but they're not wrong.
Re: (Score:2)
For example, in moderately large places (greater than 100 people) where passwords are required to change every quarter, you can be fairly certain that someone will use the password scheme "Spring2017"
Re: (Score:2)
Re: (Score:2)
Passwords are not good security, even with a password manager.
Re: (Score:2)
Password managers have the problem that if you are compromised, every password is lost. So which is the more likely scenario?
Passwords are not good security, even with a password manager.
If your password manager is compromised, you have a neat and tidy list of every password you need to reset. Hopefully you do it after figuring out how your password manager was compromised. Hint: You either used the wrong password manager (i.e., anything other than KeePass), you used a shitty master password, or you opened your password database on a compromised box.
Re: (Score:2)
Re: (Score:2)
but..... you can store the keepass database file in the cloud if you wish. I sync mine with dropbox and access through multiple devices. and store a backup copy in a safe.
Lastpass takes dangerous... (Score:1)
Stupid Password Rules (Score:5, Insightful)
Re: (Score:2, Interesting)
This one in particular infuriates me. We have a finance system which demands a change every 60 days but also won't let you re-use passwords (I assume it keeps a record of the hash because it won't even let you recycle from several years ago), and locks you out on the third failed attempt. After a lockout you have to email the finance department and wait several days for someone there to manually reset it and email you a new one, at which point it immediately demands a brand new pa
Re: (Score:2)
They've actually, sort of officially, decided that you are correct and constantly changing them is a bad idea. I totally agree.
https://qz.com/981941/the-us-s... [qz.com]
Re: (Score:2)
Pretty easy to remember, long enough, and meets complexity requirements. Sometimes my AD Linux integration chokes on special characters, so I'll simplify it to something like this "Dune_is_0verated".
What I really want to read today (Score:2)
Re: (Score:2)
My personal KeePass database has 260 entries. Some are defunct, but not many.
Re: (Score:3)
You think 200 is unreasonable? I currently have 265 logins listed in my password manager, and I'd wager that I'm not even in the top quartile here. I had over 300 of them just a few months back, but then I went through and cleaned out several dozen. Oh, and that list is missing dozens more, such as:
- Logins to my numerous home and work computers
- Passcodes for numerous mobile devices
- PINs to credit and debit cards (not so numerous)
- PINs to parental settingsand the like on gaming consoles and other set-top
Re: (Score:2)
I'd have to check, but I've probably got over 1000 passwords. Most of them are defunct, but sometimes I'm surprised that one I haven't used for a decade will still work. Some of them predate commercial access on the internet. Some of them are from when I was sysadmining a multi-user CP/M machine (with 16 processors!). But there are far too many to remember, especially for sites that I haven't accessed in a decade...and, surprise!, sometimes I need access again, and it's really nice if the old password s
Alternate Headline: LastPass Reveals Marketing (Score:2)
Now, by all accounts (zing!) their software is pretty user friendly and better than a not using a vault... but this is just marketing. Why slashvertise it?
There are passwords, and passwords (Score:3)
Re: (Score:2)
Let me understand this ...
You use your Facebook account solely as a method of authenticating yourself into multiple accounts all over the web? And for that reason you chose weak credentials for your Facebook account?
Re: (Score:2)
Can you elaborate on the "process in action"?
Title correction (Score:2)
Given LastPass' track record, perhaps we need a companion article:
"LastPass Reveals the Threats Posed By Using LastPass in the Workplace"
If only.... (Score:1)
IT isn't the problem - it's Management. (Score:2)
IT tries to implement decent security, then Management cries because they can't handle remembering 4 different passwords and refuse to purchase licenses for password management software.