Timeline for Is the NHS wrong about passwords?
Current License: CC BY-SA 4.0
28 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| S Nov 16, 2021 at 8:09 | history | suggested | stefan | CC BY-SA 4.0 |
grammatical errors
|
| Nov 16, 2021 at 7:52 | review | Suggested edits | |||
| S Nov 16, 2021 at 8:09 | |||||
| S Sep 12, 2018 at 4:53 | history | suggested | user184001 | CC BY-SA 4.0 |
a few mistake is corected
|
| Sep 12, 2018 at 4:34 | review | Suggested edits | |||
| S Sep 12, 2018 at 4:53 | |||||
| Mar 17, 2017 at 13:14 | history | edited | CommunityBot |
replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
|
|
| Oct 16, 2016 at 2:21 | comment | added | Wayne Werner |
I have to say, it's delightful the number of systems that I've logged into where *light| is not a secure password, but Password1! is.
|
|
| Oct 12, 2016 at 17:18 | comment | added | HopefullyHelpful | Passwords are far more secure than password managers or they require passwords themselves. A doctor may use more than 1 computer and giving unauthorized personal who find a stick or such full access is really really bad. | |
| Oct 11, 2016 at 11:13 | history | edited | Anders | CC BY-SA 3.0 |
added 395 characters in body
|
| Oct 9, 2016 at 17:01 | comment | added | athena | Sorry: I anticipated wrongly what you wanted to write :). [return] I don't like password managers because what you trust in the password model is the memory of the physical owner of the password (authentification based on what you know). By introducing a software within this trust path, you add many risks. [return] I made the error to think that most security specialists shared this risk analysis. | |
| Oct 9, 2016 at 16:43 | history | edited | Anders | CC BY-SA 3.0 |
deleted 2 characters in body
|
| Oct 8, 2016 at 13:41 | comment | added | Dennis Jaheruddin | Edited in a higher amount of special characters, of course this only strengthens the conclusion. -- For those interested, you need more than 282 unique characters in a random password of length 7 to beat a random password of length 10 which is made up of 52 unique characters. | |
| Oct 8, 2016 at 13:36 | review | Suggested edits | |||
| Oct 8, 2016 at 15:09 | |||||
| Oct 8, 2016 at 9:33 | comment | added | Koshinae | @TobySpeight Are you sure all keyboards are equal? That all kind of desktop/gamer/notepad/OSD/&c keyboards have the very same specials? | |
| Oct 8, 2016 at 9:15 | history | edited | athena | CC BY-SA 3.0 |
a generator avoid most storage protection risks + typo
|
| Oct 8, 2016 at 2:11 | comment | added | Periata Breatta | @MaciejPiechotka - as far as I can tell, the UK does not have any specific legislation similar to HIPA. That would mean that there is only a general duty under the Data Protection Act that controllers of confidential information should follow best practices in order to ensure that the information is not incorrectly disclosed, but which does not have any specific legislative requirements on actual technologies used. | |
| Oct 7, 2016 at 22:27 | comment | added | jpmc26 | @DanLowe That would be an argument for 2 factor auth. But then we're talking about mitigating the risk of a weak password by using an additional mechanism instead of just "password strength," which again makes the question bad. +1 to this excellent answer. | |
| Oct 7, 2016 at 18:12 | comment | added | Luis Casillas | Excellent answer, but I subtly disagree with the conclusion in your last section ("What they should have asked"). Not because "Generate your passwords randomly with a password manager" is bad advice, but rather because it's good advice for end users, and less so for institutions like NHS, who, if they're really serious about password security they ought to be taking a hard look at two-factor authentication instead. | |
| Oct 7, 2016 at 17:16 | comment | added | Anders | @MaciejPiechotka Good point. I will rewrite the last past of the answer to be more nuanced later, but no time right now. Thanks for the input. | |
| Oct 7, 2016 at 16:50 | comment | added | Maja Piechotka | Also password manager may be illegal (I don't know) as I don't think LastPass was created with whatever HIPA storage requirements there are in UK. | |
| Oct 7, 2016 at 16:34 | review | Suggested edits | |||
| Oct 7, 2016 at 16:37 | |||||
| Oct 7, 2016 at 14:50 | comment | added | Anders | @DavidStarkey The point you make in the comment is sort of the same I make in the answer. I do not say you can take for granted that the attacker will user letters only first - in fact, I suggest the opposit. | |
| Oct 7, 2016 at 14:48 | comment | added | David Starkey | Your "practical perspective" bit assumes the dictionary attack would exhaust all letter-only variations first. If the attacker knows a number of special characters and numbers is required, then they would likely be trying variations of words as they go. Even if not, users are still likely to use words and replace letters with visually similar characters (like E to 3 or T to 7). This would add a limited set of numbers or special characters against allowing for longer words or phrases, which I'm not convinced would push it into "more secure" territory. | |
| Oct 7, 2016 at 14:19 | comment | added | Dan Lowe | Password manager is not realistic in a medical setting. Doctors and other staff are logging into shared terminals in office spaces, hallways, patient rooms, etc. Not just on their own computer or device. | |
| Oct 7, 2016 at 11:20 | history | edited | Anders | CC BY-SA 3.0 |
edited body
|
| Oct 7, 2016 at 11:11 | history | edited | Anders | CC BY-SA 3.0 |
added 813 characters in body
|
| Oct 7, 2016 at 8:52 | comment | added | Anders | @TobySpeight Thanks for the input - did not expect there to be so many! I quess it is a question about wheater it is "available special chars" or "special chars people on average actually use". And then we are back to the fact that the original NHS question is to vague to be answered. | |
| Oct 7, 2016 at 8:41 | comment | added | Toby Speight | Looking at an English-language keyboard near me (one that actually has engravings!) I found just over thirty avalailable non-alphanumerics (using only Shift as modifier - not Compose/Super/etc); same on a medical device touchscreen. So you can probably increase the score for C a bit (it's still never going to win!). | |
| Oct 6, 2016 at 21:04 | history | answered | Anders | CC BY-SA 3.0 |