Re:Dropbox employee’s password reuse led to theft of 60M+ us...
by dredmorbius on Wednesday August 31, 2016 @06:42AM
(#12397303)
This.
I think it's going to have to be legislated:
1. Mandate that all publicly disclosed passwords are collected in a compiled set.
2. Require that any Internet service vendor check against this set on password change revisions, and against different portions of the file, as maintainable, on each authentication.
Known passwords are rejected when set, and mandate changes when detected on login.
Asking a 76 year old mostly-computer-illiterate pereson to come up with a never-been-used-before password simply doesn't work.
This also means mandating password safes on all consumer-grade OSes. Apple already does, Microsoft and Android. For Linux, you might be semi- on your own, though most distros offer several options.
I'd also like to see 2FA via a keyfob generator rather than contact token (e.g., phone, email).
I think it's going to have to be legislated:
1. Mandate that all publicly disclosed passwords are collected in a compiled set.
2. Require that any Internet service vendor check against this set on password change revisions, and against different portions of the file, as maintainable, on each authentication.
Known passwords are rejected when set, and mandate changes when detected on login.
Asking a 76 year old mostly-computer-illiterate pereson to come up with a never-been-used-before password simply doesn't work.
This also means mandating password safes on all consumer-grade OSes. Apple already does, Microsoft and Android. For Linux, you might be semi- on your own, though most distros offer several options.
I'd also like to see 2FA via a keyfob generator rather than contact token (e.g., phone, email).