7

I'm currently thinking about a new password policy. Originally I wanted the users to choose a password that is X digits long, contains numbers, special chars, lower and upper case,... but then I did some auditing in a friends Company. There they had such a policy. I extracted the password hashes from their Active Directory and let john crack the passwords using mangling rules. Many of the passwords were cracked when I choose to use a wordlist that was tailored to the company and its employees. They all used valid passwords according to the policy but using ones firstname, birth year and a random special char in the end isn't that secure.

Now I'm thinking about issuing a random password to every user that he can not change. The password would only be 10 digits long but wouldn't have any relation to the person which I think is much more secure. Do you think this is a good solution or am I missing something?

UPDATE: Two Factor Authentication is in general a good solution but will not work for us. We are a small company and implementing Two Factor Authentication comes with relatively high initial costs.

Improve this question

4 Answers 4

Reset to default
3

Best password policies: Strong, managed, and kept secure.

Strong

  • long(12 or more characters)
  • full character set required(upper, lower, number, symbol)
  • no complete words
  • no personal information if based on a word

managed

  • kept in a secure location in case a lookup is needed
  • changed regularly
  • not the same as the previous pass
  • kept hashed in a database behind a completely random password(of insane strength) or on a non networked database that requires physical secure access

secure

  • recovery happens in person or thorough secure channels
  • passwords are reviewed before changing(either automatic or on a schedule)
  • no user knows another users password(if it's discovered they do and don't have a good reason for it, force a password change)
  • option for 2 factor authentication to make it more secure

these tips are the best for password security and often get used on an enterprise level.

About 2 factor and some problems with it:

Of course that option for 2 factor authentication often gets tossed around as a "Why not just use 2 factor authentication then". Well there's actually a reason for this: you probably should for accounts that deal with sensitive data. Oh wait yeah there's also some pitfalls:

For everyone else this adds a physical layer of authentication that costs money, time, and setup as well as running or hiring a service to generate, and keep the authentication in sync. With networked and off site locations possible, this can run into some problems if not handled correctly, and over time always needs upkeep. Worse yet loss of keygen is a common problem, so backups are needed on site to be handed out, and if on a business trip 2 factor leads to a huge problem if lost. Then there's training them in how to use it, and forcing them to still have secure passwords. This takes a long time to get running(depending on the size of the company, this could actually lead to an entire IT overhaul), and requires training and staff dedicated to just maintaining it.

TL,DR:

Implement secure passwords, and talk to the company about password policy and maintenance. Then offer the option of 2 factor(and force it in some places if needed). Also always review passwords(either manually or through a algorithm) to confirm they aren't easy to crack or contain personally identifiable information. These best practices are enough to keep many companies safe. However never forget that passwords are only 1 part of cyber security.

As for giving out random passwords... well initially this is fine, but eventually the need to be rotated, and if that's the case then you should let them choose so they can remember it easier. If they can't remember it they will keep failing to login, IT load will increase due to forgotten passwords, and then writing it own on sticky notes and losing them now becomes an attack vector, or keeping them in personal email wit ha weak password, all sort of bad stuff, etc.. It would be better to instruct them in how to create a secure, long, strong, and easily remembered password like the following:

R4nD0ms7@Pl312eM0/312 is a random staple remover. Good luck identifying that at a glance, or cracking it. But wait you've already memorized the base!

Improve this answer
3

On the surface it seems more secure - but I would be concerned that you might run into issues of people writing the random password down on a post-it and slapping it on the wall next to their computer. You can suggest people use a password manager, but at the end of the day 90% of them will just do what they want.

It could also be made less secure based on your delivery method. If you email them their password then that's obviously a problem because then it's floating around in plain text.

Also - everyone in the company might hate you. In my experience people hate auto generated passwords. This isn't really security related but might be worth considering.

In summary - I'm not sure it's a black and white answer. The passwords themselves will probably be more secure but there are the other issues I mentioned to consider.

Improve this answer
1
  • 1
    Depending on your threat model, writing it on a post-it next to your desk may be more secure than a weak password that is open to attack over the network.
    – Neil Smithline
    Oct 19, 2015 at 21:10
1

Random won't work, if there's an issue with single authentication, move to 2-factor. That way if someone is able to pass the hash, you still have the secondary protection. Long passwords, overly complex passwords, and too frequently changing passwords, will only cause users to A) Save passwords on every device they can use and B) cause them to write it down.

Keep the password policy to something the users can remember, and train them on better password use, but 2-factor is your safe bet.

Remember, if a users is grabbing user hashes, they're already on a compromised system, so random passwords will only work if you're also flushing every system of every user profile after every logoff. That'll annoy users when they have to build profiles for every logon. If you didn't do that, an attacker would still have a window to gain access even with random in use.

2-Factor for the win.

-Chase

Improve this answer
4
  • Thank you for your answer but this wont work for us... see edit.
    – davidb
    Oct 19, 2015 at 18:19
  • I would look around again as cloud-based Auth-as-a-Service can run super cheap compared to 3 years ago, it's not the RSA box in the datacenter anymore, and using the cell phone as your fob, it's super easy. Or you can go even cheaper with something like Yubi-key ($25 per key). Only bringing it up because there's no safe way around a compromised system with cached hashes, it's damage mitigation at that point.
    – user89449
    Oct 19, 2015 at 18:28
  • if you noticed: The hash was taken during an audit(common practice to verify the strength of passwords). The hashes could easily be very secure from the outside, but inside audit access is another animal.
    – Robert Mennell
    Oct 19, 2015 at 18:47
  • True, and that's where Yubi comes as an easy and super cheap solution. Merely touching the device lets the machine know you're "live" at that system, in addition to a password. "We" know that internal users are just as problematic as external, and overly-brutish password policies are more likely to be a problem than a a legitimate external attack. There's that password policy sweet spot that a users will use accept and an audit may not. 2-Factor (reasonably priced of course) solves both. Else, prepare for post-it password panic.
    – user89449
    Oct 19, 2015 at 18:56
-1

If the users are confident that their physical devices are secure, why not use token-based security instead of passwords? You could keep track of tokens and their expirations in a database table. They can start the process of migrating to such a system if you e-mail the user a message which contains a unique and random confirmation URL. When they click on the URL, they get a cryptographically secure token saved to their browser in a cookie or in local storage. That way they don't have to use passwords anymore, and you can generate the tokens with a CSPRNG. For users that don't want to assume that their devices are secure enough, and for users with expired tokens, just e-mail them a confirmation URL again. No passwords necessary.

Improve this answer
1
  • This doesn't help at all because they still have a password for email, and now it's locked down to a browser only instead of authenticating it to a computer/user level... this is a step in the wrong direction.
    – Robert Mennell
    Oct 19, 2015 at 17:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .