Username and password
Discussion
It seems a good old rant is no longer allowed.
I find usernames and passwords frustrating- especially with the lack of consistency.
someone suggested lastpass.com. I am not sure whether putting all of my passwords on a website as opposed to writing them down makes them more secure. It does look good though.
I apologise for the lack of punch. The original was much punchier.
Comments.
I find usernames and passwords frustrating- especially with the lack of consistency.
someone suggested lastpass.com. I am not sure whether putting all of my passwords on a website as opposed to writing them down makes them more secure. It does look good though.
I apologise for the lack of punch. The original was much punchier.
Comments.
Rather than use Lastpass, use Keepass.
It's free and open source software, it interfaces with browsers fairly well by extensions (keefox, chromeipass etc) and the password vault is kept on your local machine as an encrypted .kdbx file, which you can either use a password to unlock at your PC startup, or you can use a key file on a USB stick or similar (or even just link it to your Windows system account, so when you log in to your PC - everything is decrypted and ready to go). It will also generate passwords for you, either basic ones, or horrifically complex 64+ character ones using uppercase/lowercase/symbols/spaces/high ANSI characters...
It's free and open source software, it interfaces with browsers fairly well by extensions (keefox, chromeipass etc) and the password vault is kept on your local machine as an encrypted .kdbx file, which you can either use a password to unlock at your PC startup, or you can use a key file on a USB stick or similar (or even just link it to your Windows system account, so when you log in to your PC - everything is decrypted and ready to go). It will also generate passwords for you, either basic ones, or horrifically complex 64+ character ones using uppercase/lowercase/symbols/spaces/high ANSI characters...
Edited by Mr Happy on Monday 27th February 23:15
thenetwork said:
I work for a big company and we have to change out passwords every 6 weeks.
It's mountains of fun.
Six weeks? What crappy security It's mountains of fun.
. We have to change our passwords every 28 dasys.I used to try and keep passwords broadly similar using a word starting with the third letter of the website (e.g. Pistonheads would have been Skyfall)13?! - didn't last long).
Now I just use ridiculously long passwords to prevent against brute force entry and also to wind people up. I was once asked to change my password at work because it was "Ireallydontlikeusinglongpasswordsbutitmakessensebecausenobodyremembersthewordslightningdeityballsnovemberjointpsdontforget6615050!!"
Password policy for someone with cognitive disfunction ('er indoors has MS)
Take your first and last initials and spell them phonetically.
Fred Bloggs would be
Foxtrot_Bravo (note the caps and underscore)
Write a list of all the accounts you need passwords e.g.
Facebook
First Email
Second Email
Twitter
Etc
Etc
Number from the top, first password would be Foxtrot_Bravo100, then Foxtrot_Bravo200, Foxtrot_Bravo300 etc. etc.
Meets minimum length, special character, obligatory caps, obligatory numbers that a lot of sites require, and all she needs is to carry the list of accounts in her diary, and be able to count. Anytime she creates a new account anywhere, she just adds the name to the list and continues the number sequence. The actual passwords never need to be written down, and no two are the same.
Take your first and last initials and spell them phonetically.
Fred Bloggs would be
Foxtrot_Bravo (note the caps and underscore)
Write a list of all the accounts you need passwords e.g.
First Email
Second Email
Etc
Etc
Number from the top, first password would be Foxtrot_Bravo100, then Foxtrot_Bravo200, Foxtrot_Bravo300 etc. etc.
Meets minimum length, special character, obligatory caps, obligatory numbers that a lot of sites require, and all she needs is to carry the list of accounts in her diary, and be able to count. Anytime she creates a new account anywhere, she just adds the name to the list and continues the number sequence. The actual passwords never need to be written down, and no two are the same.
thenetwork said:
I work for a big company and we have to change out passwords every 6 weeks.
It's mountains of fun.
Might be worth sending them this if you want a constructive way of pointing out they're doing it wrong.It's mountains of fun.
NIST said:
Verifiers SHOULD NOT impose other composition rules (e.g., mixtures of different character types) on memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically) and SHOULD only require a change if the subscriber requests a change or there is evidence of compromise of the authenticator.
karona said:
Password policy for someone with cognitive disfunction ('er indoors has MS)
Take your first and last initials and spell them phonetically.
Fred Bloggs would be
Foxtrot_Bravo (note the caps and underscore)
Write a list of all the accounts you need passwords e.g.
Facebook
First Email
Second Email
Twitter
Etc
Etc
Number from the top, first password would be Foxtrot_Bravo100, then Foxtrot_Bravo200, Foxtrot_Bravo300 etc. etc.
Meets minimum length, special character, obligatory caps, obligatory numbers that a lot of sites require, and all she needs is to carry the list of accounts in her diary, and be able to count. Anytime she creates a new account anywhere, she just adds the name to the list and continues the number sequence. The actual passwords never need to be written down, and no two are the same.
Good tip.Take your first and last initials and spell them phonetically.
Fred Bloggs would be
Foxtrot_Bravo (note the caps and underscore)
Write a list of all the accounts you need passwords e.g.
First Email
Second Email
Etc
Etc
Number from the top, first password would be Foxtrot_Bravo100, then Foxtrot_Bravo200, Foxtrot_Bravo300 etc. etc.
Meets minimum length, special character, obligatory caps, obligatory numbers that a lot of sites require, and all she needs is to carry the list of accounts in her diary, and be able to count. Anytime she creates a new account anywhere, she just adds the name to the list and continues the number sequence. The actual passwords never need to be written down, and no two are the same.
I'm a driver on the railway and use the phonetic alphabet all the bloody time, but never thought about using it for this tbh.
thenetwork said:
I work for a big company and we have to change out passwords every 6 weeks.
It's mountains of fun.
So do we, fortunately - though possibly insecurely - it allows you just to change any special characters. So month 1 its !password!, month 2 "password". Work across the keyboard to + then rinse and repeat.It's mountains of fun.
Personally, I use Lastpass. It works on Firefox, Chrome and Android (and probably iOS, don't know, I don't have any). Was £10 a year for multi-platform but is now free I believe. Frustratingly, work blocks the browser add ons otherwise I'd use it for that too
I use Lastpass (only started recently) and it's great.
Takes a few weeks to get set up correctly (i.e. normal browsing = entering usernames and passwords) but once you're done with that you don't have to do anything else. I only have to remember one password now (the master password to log into Lastpass - forget this and you are fooked). It even works off of fingerprint recognition and syncs with Chrome on my laptops (work and personal) and Android phone.
The app will even create passwords for you and identify your passwords that are at most risk from hacking.
Bite the bullet!
Takes a few weeks to get set up correctly (i.e. normal browsing = entering usernames and passwords) but once you're done with that you don't have to do anything else. I only have to remember one password now (the master password to log into Lastpass - forget this and you are fooked). It even works off of fingerprint recognition and syncs with Chrome on my laptops (work and personal) and Android phone.
The app will even create passwords for you and identify your passwords that are at most risk from hacking.
Bite the bullet!
0000 said:
thenetwork said:
I work for a big company and we have to change out passwords every 6 weeks.
It's mountains of fun.
Might be worth sending them this if you want a constructive way of pointing out they're doing it wrong.It's mountains of fun.
NIST said:
Verifiers SHOULD NOT impose other composition rules (e.g., mixtures of different character types) on memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically) and SHOULD only require a change if the subscriber requests a change or there is evidence of compromise of the authenticator.
So they're encouraging the use of dictionary words and not limiting the exposure to any leaked passwords?
Getting rid of passwords I can understand, abandoning all rules around them in bonkers.
Imposing a minimum length instead of complexity I'd agree with.
Would be interesting to see what the auditor said about NISTs recommended strategy.
Edited by yajeed on Tuesday 28th February 08:57
Or we can do all the security we like and then have the website pass the data in clear, like pistonheads. That way it doesn't matter two hoots what password you use as it isn't encrypted.
I store all my passwords in a note on my iPhone. I'm led to believe it takes US government budgets to crack an iPhone. I'm no expert but it works for me.
I store all my passwords in a note on my iPhone. I'm led to believe it takes US government budgets to crack an iPhone. I'm no expert but it works for me.
Gassing Station | The Lounge | Top of Page | What's New | My Stuff