Re:Study: Frequent password changes are useless
by DilipJ on Tuesday April 20, 2010 @05:42PM
(#1280688)
Personally, I've lost access to more accounts due to forgetting the password rather than having those accounts be accessed by outsiders. So I agree with this study's conclusions.
Re:Study: Frequent password changes are useless
by j_baker on Tuesday April 20, 2010 @04:48PM
(#1280549)
The most odd thing is that Microsoft undertook this study. My experience has been that Active Directory can be made to enforce the most sadistic of password policies.
Re:Study: Frequent password changes are useless
by sriramk on Tuesday April 20, 2010 @07:15PM
(#1280882)
I think a lot of that is what companies want to do with AD. I doubt MSFT is in the business of deciding what people's password policies should be (apart from picking a sane default).
I do think passwords today fail basic usability tests. Having people remember random long, frequently changing strings of letters and numbers is a recipe for disaster. Its sad that we as an industry haven't thought of something better.
Re:Study: Frequent password changes are useless
by dreaming on Tuesday April 20, 2010 @08:52PM
(#1281057)
This makes me wonder what would happen if you could have a company 'salt' which is known internally throughout and organisation and added to the end of your password, each month it changes... everybody would know the extension to their password (no forgetting) but it would make it difficult for outside brute force attacks, while making your password no less secure internally... or so my half asleep thoughts appear to suggest (of course, if somebody internal had already compromised your password it wouldn't help, but presumably at that stage its game over)
Re:Study: Frequent password changes are useless
by TallGuyShort on Tuesday April 20, 2010 @05:28PM
(#1280651)
I disagree
>> someone who obtains your password will use it immediately, not sit on it for weeks until you have a chance to change it
True, but I've personally seen several cases where someone's email or facebook account was being used for unsolicited advertising and pornography, and they didn't even know it. They may use your password immediately, but they may also use it for a long time before the average person realizes it.
Furthermore, their conclusion was justified purely by economic motives - about how much financial damage is done by cyberattacks, versus time spent changing passwords. There's no mention of the obvious privacy concern when a spammer has your password - regardless of the financial damage they may or may not do.
Re:Study: Frequent password changes are useless
by Qz on Tuesday April 20, 2010 @08:30PM
(#1281025)
...regardless of the financial damage they may or may not do.
From what I remember from another article on here, most of the time it is the banks/etc that are liable when someone is the victim of identity fraud, not the victim (like a 50$ maximum liability or something). The banks don't give a crap about keeping your money safe, it's about keeping their money safe.
Re:Study: Frequent password changes are useless
by robobenjie on Tuesday April 20, 2010 @08:19PM
(#1281005)
"writing them on sticky notes attached to their monitor, about the worst possible computer security behavior you can undertake."
Really? The way I understood it, if a person has physical access to your machine it is game over. How often does a would be hacker come wandering past your cube? Maybe I'm missing something but I keep all my passwords in a little book in my home, and feel pretty safe from hackers. I suppose a thief could break in and get them but why not just take my physical stuff then?
Re:Study: Frequent password changes are useless
by daemin on Wednesday April 21, 2010 @05:59PM
(#1283329)
The other difference is that the password on the sticky note is not actually for the computer, but is used to access network resources which probably are a more tempting target for someone to get at. So even though they have physical access to your machine, they will still need to get the password to access the resources on the network.
Still regardless having the password there on the monitor is an utter failure.
Re:Study: Frequent password changes are useless
by bluesmoon on Wednesday April 21, 2010 @08:57PM
(#1283720)
you get a random person tailgate you into your office building, and then they just walk around from cube to cube looking for passwords on postit notes, note them down and walk away. They can't just pick up the hardware, both because it's locked down, and also that looks really suspicious.
Just make your password very complex and the brute force is not much of an issue. Of course, not many people will go for that idea... Probably the best compromise is to review the advancement of password cracking technology over cost and compare that to the required complexity of a password to survive for at least 120 days without being cracked, and make your password complexity at least stronger than that. You can attempt relying on things like bcrypt (if your whole infrastructure happens to support such algorithms) but I think password complexity is enough to thwart most/all attacks.
I do think passwords today fail basic usability tests. Having people remember random long, frequently changing strings of letters and numbers is a recipe for disaster. Its sad that we as an industry haven't thought of something better.
>> someone who obtains your password will use it immediately, not sit on it for weeks until you have a chance to change it
True, but I've personally seen several cases where someone's email or facebook account was being used for unsolicited advertising and pornography, and they didn't even know it. They may use your password immediately, but they may also use it for a long time before the average person realizes it.
Furthermore, their conclusion was justified purely by economic motives - about how much financial damage is done by cyberattacks, versus time spent changing passwords. There's no mention of the obvious privacy concern when a spammer has your password - regardless of the financial damage they may or may not do.
From what I remember from another article on here, most of the time it is the banks/etc that are liable when someone is the victim of identity fraud, not the victim (like a 50$ maximum liability or something). The banks don't give a crap about keeping your money safe, it's about keeping their money safe.
Really? The way I understood it, if a person has physical access to your machine it is game over. How often does a would be hacker come wandering past your cube? Maybe I'm missing something but I keep all my passwords in a little book in my home, and feel pretty safe from hackers. I suppose a thief could break in and get them but why not just take my physical stuff then?
Still regardless having the password there on the monitor is an utter failure.
Just make your password very complex and the brute force is not much of an issue. Of course, not many people will go for that idea... Probably the best compromise is to review the advancement of password cracking technology over cost and compare that to the required complexity of a password to survive for at least 120 days without being cracked, and make your password complexity at least stronger than that. You can attempt relying on things like bcrypt (if your whole infrastructure happens to support such algorithms) but I think password complexity is enough to thwart most/all attacks.