News for hackers. Stuff that matters.

A comment on German university issues 38k passwords by hand after malware infection. Parent comment

Re:German university issues 38k passwords by hand after malw... by angry_octet on Wednesday December 18, 2019 @10:01AM (#21825494)
Given the inevitable slow and steady loss of such credentials to adversaries, it seems like they need more than a single factor. Like, a backup password (on paper) that can be used to reset the account password, or similarly a TOTP seed (2D barcode). Otherwise rolling passwords becomes incredibly expensive.

I'm almost surprised they haven't gone the same route as Estonia, but there are lots of federated systems so it might just be inertia.

[ Parent | on HN ]
Re:German university issues 38k passwords by hand after malw... by Tomte on Wednesday December 18, 2019 @10:42AM (#21825936)
I love what Estonia is doing, but we need to keep in mind that

(a) Estonia is a very young country, so they could start from scratch

(b) Estonia has very few citizens. At a guided tour in Tallinn the guide said that many of us came from cities more populous than their country. :-)

(c) Estonia is more... adventurous in some regards. They have a National DNA Database, for example. Try selling that in the country of the Gestapo and the Stasi.

(d) But first and foremost, it is great that there is a smallish country experimenting with all kinds of new stuff. The rest of Europe will benefit a lot, just by watching them and picking some of the things they already implemented and tested.

[ Parent | on HN ]
Re:German university issues 38k passwords by hand after malw... by angry_octet on Wednesday December 18, 2019 @10:53PM (#21831911)
I ought to have googled! Of course they have an electronic ID card project, they have just been testing it from 2006-2010 and slowly issuing it since 2010 with 'turn on' in 2017 with a goal of 2020.

The Gemalto overview is fantastic: https://www.gemalto.com/govt/inspired/eid-in-germany

https://www.bsi.bund.de/EN/Topics/ElectrIDDocuments/German-e...

Edit: trying to submit the Gemalto Dec 2019 update as a new story but I seem to be banned from submitting stories. Merry xmas HN.

[ Parent | on HN ]