0

I am evaluating security benefits of requiring employees (in enterprise context) to use multiple passwords (or passphrases) vs single strong randomly generated passphrase (minimum of 8 words) when paired with FIDO U2F (using YubiKey).

Option 1: multiple passwords (or passphrases) 👉 one password or passphrase for device unlock and another for password manager.

Option 2: single strong randomly generated passphrase (minimum of 8 words) 👉 same passphrase for both device unlock and password manager.

Both options would be paired with FIDO U2F (using YubiKey).

My gut feeling is that the more passwords we ask employees to create (and memorize), the weaker they tend to be, especially when enforcing regular password rotations.

I presume many would likely write them on a piece of paper resulting is increased opsec attack surface.

Are there significant security benefits to using option 1 vs option 2?

Would love to read you guys on this!

0

Answer

Not much added benefit to strong passwords when yubi (strong mfa) is in place.

But you still have areas where passwords need to be strong and areas where the risk for a weak pw is mitigated by yubi.

Credential Risk-wise

Passwords that grant access over the internet are more risky versus passwords that grant access to local accounts (laptop).

Passwords with mfa are less risky.

Passwords for internal services that you’d use after you connect to the Corp network (ie vpn) are less risky than internet accessible accounts. However, not by much. Most attacks these days get a foothold into your Corp network somehow and you’re better off assuming an attacker is already in.

PW quality matters little when paired with MFA.

Yubi is one of the safest MFA options.

Impact

Some things are more important than others. Example: Servers and infra may always need a yubi vpn, device carts, and passwords.

But, the employee lunch system is less risky (assuming no credit card).

Putting it together

  • Focus on getting MFA in the right places first.

  • Buy everyone a pw manager to store their PWs and other secret stuff.

  • The laptop password should be strong. (It protects the encrypted disk if the device is stolen. )

  • for Corp stuff - Invest in SSO (not for infra but for Corp stuff). They add protections to detect account takeover to mitigate one PW for lots of stuff

  • For infra - Get MFA in place too, where you can. Some things though will never get done. Databases, routers, etc. Use a needs based access system like Trustle.com to grant and revoke temp access to important stuff like infra so that no standing privileged permissions exist.

How many passwords

The rule of thumb is to make a unique PW for everything. This is because different authentication systems have different threat models.

Take a laptop versus one password. One password is cloud based and requires a key kept on the device plus a password in the cloud and can enforce rate limits on brute forcing.

A laptop is local and not necessarily tied to a TPM or Secure Enclave so brute forcing is more likely.

Even with a key logger on a laptop - the laptop credential might be stolen but without physical access it is hard to utilize unless the same password is used else where. Meanwhile the one password password wouldnt include the key and is useless from a key logger.

If an attacker gains access in real time to a laptop then given enough time, they can access anything the user can access including one password. That’s where MFA comes into play again.

You’re gut is right

Many passwords force employees to take shortcuts.

When NIST published SP 800-63B, they pulled in research showing when users are required to rotate PWs periodically (every 90 days), that they use predictable passwords. They decided to instead focus on making passwords easier (remove complexity, remove rotation requirements) but to require MFA and verifying the PW isn’t on a known bad pw list like haveibeenpwned.

2
  • Thanks for weighing in! “In practice an employee should have 2 strong passwords - pw manager and laptop.”. I’ve been reading NIST research. Have you stumbled upon any NIST recommendations or research that addresses pros and cons of using separate passwords vs single one?
    – sunknudsen
    Jul 16 at 16:13
  • Added a section to the answer but yeah, IMO it’s better to have a different pw for everything. Since you have to type the laptop and pw manager passwords often, you have to memorize them. Ideally those are the only two you have to memorize.
    – Jonathan
    Jul 16 at 19:37
0

My gut feeling is that the more passwords we ask employees to create (and memorize), the weaker they tend to be, especially when enforcing regular password rotations.

The short (and easy) answer is to simply use a password manager, so your employees don't have to remember them. I couldn't remember mine, they are too long and too complex and I have dozens. Using 2FA does not invalidate the use of strong passwords.

Yes, using a password manager may be a slight inconvenience, but so is the Yubi key.

If your employees already have to deal with many passwords in their daily routine (which is normal in an IT role for example) they should already be using a password manager anyway.

The problem with a shared password (or passphrase) is that employees will succumb to convenience and reuse the same password also for other services that are not coupled with 2FA, quite possibly the same passwords will be used not just for their professional use but their personal needs too.

Besides: maintaining weak/shared passwords increases the pressure to rotate them on a regular basis because the risk of leak is higher, and if people have to remember them, then they will make it easy for themselves and change the password a little bit while keeping a common, even predictable pattern.

1
  • Thanks for weighing in. I improved question… both options I had in mind involved using password manager.
    – sunknudsen
    Jul 16 at 23:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.