News for hackers. Stuff that matters.
Re:The assault on neurosurgeons’ privileges by software and ... by engi_nerd on Monday December 07, 2015 @09:38PM (#10694417)
Most working professionals who aren't software developers suffer through this in some way or another. I mean, heck, let me count up all the passwords I need to do my job:

* A password for the account request system

* A password for the internal services system

* My email password

* My password for the local network

* My password for the product management system

* Pass for the old product management system that we still use

* Pass to the online drawing and document retrieval system

* Password to control room computer systems

* Various maintenance laptop user names and passwords

* Various passwords to systems I'd rather not mention, call them about 10 in total

That's 25 to 30 passwords, total, that I need to remember and use on a regular basis. I've given up NOT writing them down. And IT won't give me any kind of secure password manager, so I resort to a password protected Excel spreadsheet. And I'm not alone.

Re:The assault on neurosurgeons’ privileges by software and ... by daveguy on Monday December 07, 2015 @10:16PM (#10694544)
Yikes. Sounds like it's time your company looked into a single sign on solution: https://en.wikipedia.org/wiki/List_of_single_sign-on_impleme...

Or at the very least you should sign up for a password storage system like https://passpack.com

Re:The assault on neurosurgeons’ privileges by software and ... by engi_nerd on Monday December 07, 2015 @10:20PM (#10694564)
Single sign on solutions don't work when some of the systems you sign on to are air-gapped and will never, ever, EVER be connected to any network. Other networks I access are completely separated from the greater internet. It would be useful, but single sign on would take my 25-30 passwords and shrink it to about 15.

Which would be useful but would still require me to keep track of them manually.

Re:The assault on neurosurgeons’ privileges by software and ... by ef4 on Monday December 07, 2015 @10:43PM (#10694642)
In those cases people should be using hardware authentication tokens. They're both more usable and more secure.
Re:The assault on neurosurgeons’ privileges by software and ... by engi_nerd on Monday December 07, 2015 @10:51PM (#10694673)
Try convincing the US government of that. I wish you luck (I really do). Trying to educate program security people on computers is one of the banes of my existence.
Re:The assault on neurosurgeons’ privileges by software and ... by ef4 on Monday December 07, 2015 @11:15PM (#10694763)
Plenty of parts of the US government do know. I've seen multiple DoD networks where hardware tokens are the required form of authentication.
Re:The assault on neurosurgeons’ privileges by software and ... by engi_nerd on Monday December 07, 2015 @11:22PM (#10694789)
So have I. CACs don't work on classified systems though.
Re:The assault on neurosurgeons’ privileges by software and ... by j_s on Monday December 07, 2015 @11:17PM (#10694769)
Re:The assault on neurosurgeons’ privileges by software and ... by engi_nerd on Monday December 07, 2015 @11:21PM (#10694787)
These don't work on all networks. Like classified networks.
Re:The assault on neurosurgeons’ privileges by software and ... by spc476 on Tuesday December 08, 2015 @02:10AM (#10695211)
I have one password for the Corporation (email, VPN, various online databases, dashboards and wikis). I have another one just for requesting vacation time, because that system is run by the Corporation that owns the Corporation I work for.

Then there's the password for timecards (outsourced to another company), goal setting and training (outsource to another company), 401k, medical insurance and just because, another company (that isn't our medical insurance) for handling prescriptions.

Our Corporation has one password expiration timeframe (90 days but not really because they start nagging two weeks prior and won't shut up until you change the password) and the Corporation that owns The Corporation has another timeframe (60 days, but again, they start bitching about two weeks prior) and of course, all these sites have their own ideas about "secure passwords."

Weren't certificates supposed to deal with all this?

Wait ... don't answer that. I don't think I want to know the answer.

Re:The assault on neurosurgeons’ privileges by software and ... by soneil on Tuesday December 08, 2015 @06:01AM (#10695743)
You know what's better than single-signon? Two SSO systems! It's fantastic. Not only do you have to remember which backend each system uses, but it actually makes it harder to remember passwords for systems that don't use SSO.

Especially the ones that are used irregularly (annually, quarterly), so SSO isn't a priority.

My passwords are all on a whiteboard by my desk.

Re:The assault on neurosurgeons’ privileges by software and ... by javajosh on Monday December 07, 2015 @10:16PM (#10694546)
Might I at least suggest using an easy-to-execute algorithm that you can apply to your note to turn it into a real password? There are many options, from adding a prefix, a suffix, adding a small integer to every number, or some combination of these. This, I think, is about as secure as you can get since a targeted attack would just install a keylogger and be done.
Re:The assault on neurosurgeons’ privileges by software and ... by pdkl95 on Monday December 07, 2015 @10:39PM (#10694631)
https://www.schneier.com/blog/archives/2005/06/write_down_yo...

Even with an algorithm, you're still relying on human memory. As Schneier and other have been recommending for a long time, write down your passwords. People already understand some amount of physical security, which is knowledge that can can utilized for password storage.

As long as human memory is the weakest link, password strength will always be de facto limited to the amount of entropy that a human can reasonably memorize. Unfortunately, brute-force password cracking capabilities flew past that limit a long time ago.

Re:The assault on neurosurgeons’ privileges by software and ... by Ntrails on Tuesday December 08, 2015 @04:31AM (#10695521)
My last work sent around a cardboard triangle "stand" thing which was supposed to remind us all about how much we loved working there and how important such and such policies were. So my password was set as the first 3 letters of the first 3 lines (inc capitalisation) followed by a fairly standard & [incrementing number]. It was written down right next to my computer for the first two weeks whilst I learnt it and then every other password was just a derivation of it.
Re:The assault on neurosurgeons’ privileges by software and ... by engi_nerd on Monday December 07, 2015 @10:21PM (#10694571)
I have a couple of things I add to each password that I don't write down. I change those things every month. That's about the best I can do.
Re:The assault on neurosurgeons’ privileges by software and ... by agumonkey on Tuesday December 08, 2015 @04:12AM (#10695470)
A friend and I do this, but there's always a few website that will not fit your alphabet.
Re:The assault on neurosurgeons’ privileges by software and ... by rabboRubble on Tuesday December 08, 2015 @02:58AM (#10695311)
Why get your own password manager and include your work items?

I have 300+ personal passwords. 30 more for work would be a trivial addition.

Re:The assault on neurosurgeons’ privileges by software and ... by engi_nerd on Tuesday December 08, 2015 @10:20AM (#10696814)
Then I'm carrying around sensitive work information on a device that I control. Sure, my password protected Excel spreadsheet isn't really protected, either, but if it gets compromised on my work machine, IT at work takes the heat, not me.