New answers tagged password-policy
-1
Something a lot of people seem to forget.
Using a huge password is better then confusing the user.
eg
the password:
mySuperSecurePasswordKeepsMeSecuredAgainstHackersCrackersAutomatedToolsAndMoreStuff
is more secure than:
P@S$W0rD
I can support with this numbers/math etc if required.
0
I believe what they are implying is a compliance issue. Granted ALL of you are suggesting much stronger passwords and ARE TOTALLY RIGHT.
However, normal human beings don't comply. And won't comply. And if they don't and won't comply they will find a way to cheat back to something simple that breaks badly.
So if it is going to break badly anyway, at least ...
0
I skimmed the majority of comments and I think as IT Security people we tend to over react when we see a password that appears to be simple, but isn't really. While there are many techniques for password attacking I actually somewhat agree with Intel in their thinking.
Using My 1st Password!: Twitr according to GRC's Interactive Brute Force Password ...
0
I realize this is way late. Steve Gibson at GRC has this: https://www.grc.com/ppp.htm
Perhaps it would solve your problem.
6
I think the general advice about starting with a base password and embellishing it with different characters based on the site (or computer name) you're visiting is good. This can provide the benefit of being easy to remember and still being secure because it would probably stop most automated methods of checking a compromised password list against multiple ...
5
Intel should know better - but this seems to be a recurring theme: how can we get end users, especially non-technical users, to improve aspects of their behaviour without alienating them completely.
Here, and on other security communities, we already know all this stuff, and hopefully our families get some of the guidance that rubs off, but how do you get ...
3
Totally agree - using ANY predictable pattern, no matter how complex it is, would undermine the whole idea of strong passwords.
I am doing it this way:
- Random passwords generated in Keepass (and stored there) for 99% of the passwords
- Very few passwords generated with the help of Gasser generator, i.e. passwords that are pronounceable, but still not from ...
6
The short answer is yes. However, human beings tend to be a creature of habit. Therefore they tend to use the same password for multiple accounts. I believe this article is trying to make it a little more palatable for those who don't want to change passwords.
Just using "My 1st Password!" on every site is less secure than using "My 1st Password! FB" ...
21
Yes you are right. Using a pool of passwords is definitely recommended but the passwords should not follow a pattern (at least not the one suggested by intel) but that is how we think (we are security guys). May be the writer was thinking from a common user's point of view because most common users simply don't want to take the headache of remembering ...
7
Not the best advice ever, true, but I guess we should be grateful for any help from the big players in trying to raise public awareness regarding password security.
Your concern regarding the 3rd step is justified, though. We should expect better from names like Intel. If you'd take their advice too literally, all that is needed for all your passwords to ...
8
Yes, using different passwords for different sites is a good idea.
Yes, having a common theme which you use to generate your passwords is ok. With two caveats. It must not be so stupidly easy to guess as the one suggested by the Intel site. You MUST keep is a secret.
The best solution of course is to just remember one long, highly random password which ...
2
This is an entirely subjective question and there is no single answer for it. The simplest answer is simply to say that the longest and most complex password that you can remember is the best.
Microsoft Complex Password Group Policy requires the following be met:
The password is at least six characters long.
The password contains characters from ...
0
If you maintain a Web site in which users can sign up and protect their account with a password, then you should edict a policy of minimal password length -- and, please, nothing else. Stricter rules, more often than not, backfire. For proper security, you need to enlist user cooperation, which will exist only on a voluntary basis. The more you enforce, the ...
0
No. You should use federated logon and avoid the entire problem. Select an identity provider who matches or exceeds the risk level of the information you're protecting. Let them worry about passwords.
5
CAPTCHA systems are in no way a replacement for a good password policy. They aren't tackling the same problems.
CAPTCHA systems only help when someone is attempting an online attack against your system. If your application has some hole that allows an attacker to dump a database full of password hashes, placing a CAPTCHA on every page won't do anything.
...
0
Captchas can be cracked using automated tools. Complex passwords make it harder for attackers to brute-force password attempts and helps to reduce the number of 'common' passwords.
Password policies should be in place for web sites, no question. Work with your users to determine a policy that makes sense.
Sometimes a super-secure password policy can give ...
1
I would think that you should enforce some level of password requirements. If your password hashes get compromised and some unfortunate soul used password123 as his password, his account could be compromised very quickly even if the passwords are hashed and salted. A human attacker with the plaintext password and the username could easily just fill in the ...
2
Fraud management. The bank's website may be using Geo-location and device fingerprinting.from Wikipedia
Geo-location is the identification of the real-world geographic
location of an object, such as a mobile phone or an
Internet-connected computer terminal.
Device fingerprinting is information collected about a remote computing device for the ...
3
The scenario that this is designed to prevent is keylogging. It is fairly easy to get a keylogger that will report back but somewhat more complex to make a program that will actually execute an attack remotely on another computer. Since you don't regularly enter your security question answers, if an attacker obtains your password via a key logger, they ...
-1
I can try to give my view of the problem above as a UI interface designer and not a programmer: the key point here is that the login requirement is partly a UI interface design problem and not a programming only problem.
There's an excellent book "Apress - User Interface Design for Programmers" which shows an analogous problem related to window sizes which ...
1
Simply because exponential growth is much faster than polynomial growth.
For a password which has a fixed length n, where the number of characters in your character set (x) is variable will give you a complexity of xn.
This is a polynomial function, and grows accordingly as x is increased.
On the other hand, fixing the character set to n and keeping the ...
2
I have to disagree with Tom on "there is no need to change your password because it is old...".
In and of itself, that is reasonably true, however the pragmatics of real life interfere with theory and make that not so true. Since we are oftentimes asked to enter our passwords in many different environments and places - some of which we do not always ...
4
The brute force attack can be described as such: the attacker tries a lot of random potential passwords, until the right one is found. Forcing a password change for the user, i.e. changing from one potential password to another, does not substantially lower the success rate of the attacker (indeed, it changes anything only if the spaceof possible passwords ...
Top 50 recent answers are included
