26

As part of an increase in the security measures for our company, we're moving to making sure all password logins (databases, servers, etc), are done through a password prompt and never using stored passwords. The hope here is that if a company laptop were to go missing, we wouldn't need to change all our passwords.

Is this really enough to assume we wouldn't need to change passwords? Is it not possible to recover passwords from memory or disk when they are typed in interactively?

  • 45
    How are you expecting people to remember all of their passwords? If you don't let them use a password safe program, they'll probably write them on paper, put them in unencrypted documents or choose easily crackable passwords. – Mike Scott Jan 22 '15 at 15:11
  • 1
    we're also trying out an online password store solution as well to help with that – chrismarx Jan 22 '15 at 15:19
  • 10
    Move towards two-factor authentication for the passwords, and encrypt the machines. With two-factor authentication, a user will need the password, plus a device - generally a cellphone. If you don't have both in your possession, you aren't logging in. If you leave the company, admins will change the password or invalidate the cellphone from the account (usually both), preventing logins. – PeteCon Jan 22 '15 at 20:08
  • 4
    Why do you want to not change passwords? In all cases that I have been involved with, it would be easier to change passwords than forcing everyone to never let an application remember a password. – schroeder Jan 22 '15 at 21:53
  • 2
    There are very small usb dongles that can go between your keyboard and computer and record all keystrokes and will only show up if you're specifically looking for it. Heck, the same functionality can be built in the keyboard. Relying only on a password is not of this time anymore if you want to be secure. – Pieter B Jan 23 '15 at 14:58
50

This is a fallacy on several levels.

First, you can't expect people to remember passwords that are both strong and unique to each service. It's just not gonna happen. Implementing this is just begging to have "passwords.xlsx" pinned to half the users desktops (the other half will use "passwords.docx").

Second, trying to prevent password change is a move in the completely wrong direction. Instead, you should invest in a strategy that makes it painless to change passwords as often as needed or wanted and help users (including admins) manage these passwords in a safe and efficient way.

The reason for that last statement is that if there is one thing certain with passwords, it's that at one point, you will have to change them. An administrator moves on? Change all your system passwords. A manager used the same password for the corporate network as well as his son's football team forum? Change his password. Found a post-it the payroll admin stuck to his screen? Change his password.

Use single-sign-on whenever you can, provide a convenient password manager for your users, educate them as much as possible and make it trivially easy to change their passwords. That's the only way to make password usage in an enterprise less risky.

52

This is the wrong solution for this problem. First, no, it is not safe to assume that passwords can't be recovered from on disk or in memory. On disk is the real threat...If you're up against adversary who can pull data off of RAM, you're probably up against an adversary you can't defeat in any case.

Additionally, password theft is only one of the threats that you face with a stolen laptop. Sensitive data loss is another, and generally more serious threat. Your scheme does nothing to solve this problem.

So, the correct solution is full disk encryption. This protects all of the data on the drive of a stolen laptop, solving both of these problems with a single solution. It also frees you up to use whatever mechanisms are most suitable to encourage the strongest possible passwords without worrying about the additional trade-off of requiring that passwords never be stored.

24

When users are forced to memorizes a large number of passwords, they have a few options:

  • Reuse passwords
  • Use weak passwords which are easy to remember (Password123)
  • Use passwords derived from a main password ( PasswordSQL, PasswordWin, Password1, Password2)

All of these options are bad for security. Most systems need a way to store user's passwords or values generated from these passwords (e.g. hashes). This happens for Windows (SAM files) and Linux (/etc/shadow) systems, for Databases and so on. If the passwords are weak, finding out the passwords behind the hashed/encrypted values is something relatively easy to accomplish.

On the other side, if a secure Password Manager is used, strong passwords can be used for each service and only one(or a few) complex passwords need(s) to be memorized.

A good approach would be to:

  • Encrypt the hard drives for all your systems
  • Enforce the use of complex passwords for the encrypted drives and the systems/services which are in used
  • Choose a secure Password Manager which properly encrypts the stored password and make it the only approved solution
  • Passwords should be changed periodically and password reuse should be checked and prevented - This is a very debated topic and I will leave it up to you to decide what is best
  • 8
    One software I use at work is Keepass. It is a windows-only program, but there are official ports for other operating systems. You can place the file somewhere in a share and, in case you need to change the password, all users will always access the same file with read-only permissions and always the updated file. You can also press <ctrl> + v in a password and it will auto-type it for you, avoiding clipboard attacks (or attempting to reduce them). – Ismael Miguel Jan 22 '15 at 16:22
  • 19
    I was with you until you suggested periodic password changes. Periodic changes don't improve security, and encourage the use of weak passwords. – Mark Jan 22 '15 at 23:19
  • Usign the same passowrd for an undetermined perioad of time increases the probability of the password being compromised over time. I am not suggesting the weekly change of passwords, but having the same password for years increases the succes rate of bruteforce attacks .The use of strong passwords should be also enforced by complexity checks and for each system password life may be different based on the cryptographic functions that are used and the way the system is used. – Dinu Jan 23 '15 at 5:34
  • 1
    @Mark : I have modified the response and took into account your observation – Dinu Jan 23 '15 at 8:45
  • 1
    Personally, I dislike password managers and would much rather be using Kerberos or PKI for Single Sign On. But I very much prefer either to making multiple independent passwords, because that's not really any more secure - if one is compromised by whatever mechanism, then all the others are probably vulnerable to the same mechanims or escalation attacks. Writing down passwords on a piece of paper is also not as dumb as it sounds, provided the paper is stored securely - because it requires physical rather than electronic compromise – Sobrique Jan 23 '15 at 23:18
4

OK, first we need to cover what makes a good password:

"Good" passwords are of substantial length and have the ability (often a requirement) to utilize special characters.

Why does the possible addition of special characters matter? By having more possible characters you have created a substantially larger set of combinations for each password.

Examples:

  • Passwords need to be 8 characters using lowercase letters.

    There are 26 possible characters for each position, so 26^8 = 208827064576 possible combinations.

  • Passwords need to be 8 characters. Passwords may include uppercase, lowercase, numerals, and special characters.

    26 lowercase + 26 uppercase + 10 numerals + 30(ish) various special characters = 92 possibilities for each character.

    92^8 = 5.13E15 possible combinations!

So, we can see that by increasing the possible values for each character, we have substantially increased the power required to brute force these passwords.

Why does this matter here?

Simply put, longer passwords are harder for people to remember. As a result, people are more prone to write passwords down as well as reuse them. Therefore, in answer to your first question: No, you will still need to change passwords. People may report when they lose a company laptop, but may not tell the company if their wallet was stolen (with passwords written inside) or that their Yahoo account was hacked (which conveniently used the same password... but of course the company doesn't know this.)

In regards to your second question...

It depends, key loggers aside:

  • Let's assume the laptops have password encrypted drives.

    If the laptop is turned off when stolen. you're fairly safe.

    If the laptop is on, you're in trouble - regardless of whether the machine is logged in or not. A couple quick examples:

    -Programs such as Cain & Abel could dump any passwords stored in browsers or on the local machine.

    -Additionally, some machines with firewire could be susceptible to Direct Memory Access attacks which can leak contents of the memory. (Lucky for hackers, some firewire cards are Plug-and-Play!)

    If the laptop is in sleep mode, the RAM retains just enough power to keep the memory contents alive. So any recently used passwords could theoretically be gleaned by "those with the knowledge of these things". (E.g. liquid nitrogen bath to the RAM and swapping it into an already running PC.)

  • If the laptops don't have encrypted drives...

    -Whether the laptop is on or off, data can be pulled by another OS, allowing tools like Cain & Abel to potentially work some magic.

So, in closing:

  • Require full disk encryption of laptops (e.g. TrueCrypt)
  • User passwords should be at least 8 characters and contain combinations of uppercase, lowercase, numbers, and/or special characters.
  • Passwords should change regularly (e.g. 120-180 days)
  • Use an approved password manager.
  • Last but not least educate your employees. Explain the basic risks of password loss and cover that protecting the company/network is part of every user's duty. Include basic practices like not plugging in strange USB devices, not leaving unattended systems logged in, and not writing down passwords.

***This typically doesn't have "much force" coming from the IT department. It's important that your company's executives/owners buy into this last point, understand it, and promote it company wide with their authority.

  • 3
    I don't see strong justification for requiring passwords to be changed frequeently. Arguably, that is harmful (it is bad for usability and does not lead to clear security gains). – D.W. Jan 22 '15 at 22:48
  • I thought about that before I made that suggestion. I don't see a need for changing the full-disk encryption password. However, a company can be subjected to targeted attacks over time and passwords could slowly be gathered. On that basis, if a password manager is already being implemented, it's trivial to change passwords on a regular basis. – Ramrod Jan 22 '15 at 23:59
  • 2
    Note that, in general, brute force is not the attack to worry about. Password dictionaries with sophisticated modification rules, phishing, and cracking weakly-protected passwords on one service to try the same password on others are all far more dangerous. – Nathan Tuggy Jan 23 '15 at 4:32
2

First off, Dinu S is correct that local machine passwords (e.g. the password you log into the machine with if it's not a domain login) have to have their hash actually stored on the machine. This requirement does not exist for accounts on domains or remote systems, though such systems may cache the password hash locally (Windows commonly does this with domain logins, for instance, so that you're not locked out of the computer if you're away from a domain controller.)

Beyond that, though, there's this nasty little thing that few people outside of security, file system designers, and computer forensic investigators know about: File Slack. Basically, this issue arises from the OS always writing an entire file sector to disk at a time - even at the end of a file that is not evenly divisible by a sector length. Presumably, this behavior is due to the design of the DMA engine or some similar consideration (or maybe the author of the file system driver was just lazy.) The result is that whatever happens to be in the RAM immediately following the end of the buffer that is supposed to be written to a file also gets written to disk after the end of the actual file data, filling whatever was left over of the last sector in the file. Reading the file via normal file read APIs will not let you access this data, but reading the raw disk sector data will. Forensics investigators commonly use this to recover information that just happened to be in the computer's RAM at some point. What data will be at the end of a given file is more or less random. It could be passwords that were stored in RAM (i.e. after reading from the keyboard, but before they got hashed and/or encrypted,) pieces of e-mails or documents, incriminating evidence, or anything else that ever gets stored in the computer's RAM. This was one of the especially important things we were taught to look for when I took a computer forensics course.

I should note that it's been a while since I took said forensics course, so it may be that modern operating systems actually overwrite the whole buffer that they're about to send to disk before sending it in order to avoid this issue. I'm fairly certain that there are at least some file system drivers out there that do this for security purposes, but I'm not sure how widespread their use is or which operating systems use such countermeasures by default.

1

I assume you are talking passcodes (generic passwords, unassociated with a user) rather than username/passwords because if it is the latter you would not have to change "all your passwords", only those of the user whose laptop was lost.

If a user's laptop is lost, all of their individual passwords should be changed.

If you are using passcodes, then they must be changed if a laptop is lost which used those codes.

The reason for this is that the memory of the computer is cached on the hard drive of the computer. This is called "virtual memory". By bad luck, the variable containing a passcode in clear text could be stored as part of this virtual memory on the drive and thus could be recovered.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.