2

Passwords get discussed a lot on this site, and there's quite a lot for both users and sites to do, to stay in line with "best practice".

Web sites need a password strength policy, account lockout policy, and secure password storage with a slow, salted hash. Some of these requirements have usability impacts, denial of service risks, and other drawbacks. And it's generally not possible for users to tell whether a site actually does all this (hence plaintextoffenders.com).

Users are supposed to pick a strong password that is unique to every site, change it regularly, and never write it down. And carefully verify the identity of the site every time you enter your password. I don't think anyone actually follows this, but it is the supposed "best practice".

In enterprise environments there's usually a pretty comprehensive single sign-on system, which helps massively, as users only need one good work password. And with just one authentication to protect, using multi-factor is more practical. But on the web we do not have single sign-on; every attempt from Passport, through SAML, OpenID and OAuth has failed to gain a critical mass.

But there is a technology that presents to users just like single sign-on, and that is a password manager with browser integration. Most of these can be told to generate a unique, strong password for every site, and rotate it periodically. This keeps you safe even in the event that a particular web site is not following best practice. And the browser integration ties a password to a particular domain, making phishing all but impossible To be fair, there are risks with password managers "putting all your eggs in one basket" and they are particularly vulnerable to malware, which is the greatest threat at present.

But if we look at the technology available to us, it's pretty clear that the current advice is barking up the wrong tree. We should be telling users to use a password manager, not remember loads of complex passwords. And sites could simply store an unsalted fast hash of the password, forget password strength rules and account lockouts.

|improve this question
  • 1
    Oh I think most people that are serious about security would be agreeing with you and all the pros recommend password managers. Thus the password strategy from amateurs may be wrong, but for me I'll be using a password manager for the rest of my life. – Andrew Hoffman Jun 17 '14 at 19:24
  • Also its worth noting that the most popular password manager out there allows you to require google authenticator whenever logging into it, either once per device, or every time if you so wish. In that way even if you use a weaker password to log into your password manager, you're using MFA, so you're solid. – Andrew Hoffman Jun 17 '14 at 19:29
  • 8
    Interesting blog post. So what's your question? – Philipp Jun 17 '14 at 20:33
  • Should be converted into a Sec.SE blog post; too broad and has no definitive answer. – Deer Hunter Jun 17 '14 at 20:43
  • 1
    paj - this actually could make for an excellent blog post. Would you be up for that? I have a feeling it will be closed as a question, but I think as a post it encapsulates a few essentials and would be useful. – Rory Alsop♦ Jun 18 '14 at 7:24
5

I'd dispute that changing passwords regularly is really a "best practice". It is more a "widespread practice" which can be traced to military procedures dating from, at least, the times of Julius Caesar. Applicability to computer systems is, at best, questionable.

Password managers are all fine and dandy, but they are actually at odds with the core principle of passwords: a password is something that fits in the brain of the user. Relying on a password manager is a paradigm shift. To state things simply, you no longer authenticate the human user, you authenticate the user's smartphone. This may be considered as befitting modern times; indeed, it seems that the square technological appendices have fused with their hosts, and many humans can no longer be considered as completely defined, let alone happy, if deprived of their favourite gadget. Yet this is a shift that we shall be aware of, and which requires some thorough thinking.

From a pure security point of view, the password manager implies an extension of the user's responsibilities: with a password, the user must keep the password secret and not write it down or reveal it; with a password manager, the user must maintain the integrity of the password manager hosting system as well. In many cases, this does not change much (if the user's machine is infected, a keylogger will grab all the data anyway), but the shift is not completely negligible either. This can be seen from a usability point of view: a password-in-brain naturally travels with the user; a password manager implies a dependency with some software and synchronization procedures.

Besides, as @schroeder explains, recommending an actual product is a delicate matter; this would look like an endorsement, and it complicate things when the product disappears, either through lack of support, or more spectacularly like TrueCrypt.

|improve this answer
  • I agree, we are changing the model from "user authenticates to site" to "user authenticates to trusted software which authenticates to site". And yes, at that point, they should probably be called tokens not passwords. – paj28 Jun 17 '14 at 22:00
3

I am not sure why you are under the impression that password safes are not recommended. For example, Microsoft has Credential Manager in Windows, Bruce Schneier open-sourced "Password Safe", McAfee sells LiveSafe, and Norton markets Identity Safe. These are all security savvy entities, and there are many other password safe options if one were to search the Internet.

However, password safes have their own challenges, including the one you mentioned (i.e. If someone compromises your machine, all the passwords are compromised.) My personal aversion is because I have multiple devices and I lack trust in secure sync between those devices. Neither do I want to be stuck on an airport terminal unable to logon to one of my accounts to pull out my itinerary because I do not know my password anymore.

|improve this answer
  • How would you feel about a physical token that you carried your passwords on - maybe just a USB stick with a password safe file? – paj28 Jun 17 '14 at 21:57
  • And if I lose that physical token? Btw, phone comes closest, i.e. one is always carrying it and it could contain passwords securely. But, then, I have broken phones while out of town and hurriedly purchased cheap phones to get by. – Omer Iqbal Jun 17 '14 at 23:36
  • If you lose it, encryption on the token with a master password protects you from whoever finds it. And you recover your data from backups. But maybe if you don't trust any online sync at all, maybe you are better off just remembering your passwords. – paj28 Jun 18 '14 at 14:04
  • I do remember my passwords and they are unique for high impact accounts, like banks. The problem is not that others will get them or not, the problem is that if I lose the fob or device containing them, I am locked out too, and then need to rest all account passwords. – Omer Iqbal Jun 18 '14 at 15:09
2

You are correct that a fully-integrated password manager works as a de facto SSO solution for an individual, but the risks are also the same. Once someone gains access to the password manager, they have the keys to the kingdom.

Also, it is difficult to recommend a certain product for this implementation. It is easy to suggest an approach, but once you start the discussion of, "you need a product," then you have to be able to answer the follow up of, "which product?" Every product introduces its own risks and there isn't a standardized way of dealing with them. What might be a better discussion is a standardized method of designing and implementing a personal password manager, just like we have for SSO frameworks. I'm personally in favor of the security community doing this.

Because of this extra liability introduced by recommending specific products, it is perhaps 'better' to recommend a complex password for each site and have users gravitate to password managers on their own.

|improve this answer
  • Yeah, product recommendations are a bitch! Perhaps we need to define a "framework for password manager assessment" and give quantitative, unbiased rankings for each one. – paj28 Jun 17 '14 at 22:03
2

I see a question "Should we rethink our entire password strategy?" If the answer is 'use a password manager' I'd say yes, but that does not classify as 'rethink' for me.

On PW managers: "putting all your eggs in one basket" can be defeated by postfixing. For all my financial and other high risk sites my passwords have 2 parts: 1 'strong part' that is stored in and filled out by the PW manager and a postfix that I memorize and is the same for all sites that need this. So Yes, I have to memorize 2 passphrases: one for the vault and the postfix for some.

I would add 'app integration' in addition to "browser integration" : more and more passwords are required by apps, also apps like Skype on windows. And above all: support for email clients when downloading/reading email. (if someone gets hold of your email password ('finds' your laptop or phone), many passwords in your vault can be reset by a reset email procedure). Integration with apps is still a challenge, I think.

|improve this answer
  • If you google for "how to stay secure online" or similar, the kind of introductory guidance you find never mentions passwords managers. I think this is wrong. Beginners should be advised to use password managers right from the start. – paj28 Jun 17 '14 at 22:02
  • In our company all employees followed an information security workshop. A PW manager is installed during the workshop. All new laptops have a password manager installed by the IT department. That might have influenced my judgement. I'm glad I said 'for me'. – Dick99999 Jun 18 '14 at 7:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.