Re:Kill the Password: Why a String of Characters Can't Prote...
by danso on Thursday November 15, 2012 @09:10AM
(#4788573)
> What I think should happen is an improvement in terms of how we store password (for starters, don't write them down and put them next to your pc),
Actually, given today's attack vectors, this would be an improvement. Remote attackers have greater and greater ability to compromise an account, but if the "key" is physically hidden away then it becomes an unreachable needle in a the massive haystack that is our physical world.
(I'm speaking theoretically, of course, this does nothing to protect the user from the kind of attacks that are most common: phishing and social engineering)
When the password is a stickie next to your computer, then the most imminent risk is that the janitor or a coworker will filch from you. Then have your password be something you put on a sticky save for a memorable number that you prepend to it (but not something too guessable, like your birthday). The chances that this acquaintance who goes snooping around your physical cubicle is going to also run a brute force crack is pretty slim...because such a person will likely have an easier way to violate your privacy/thieve from you.
Actually, given today's attack vectors, this would be an improvement. Remote attackers have greater and greater ability to compromise an account, but if the "key" is physically hidden away then it becomes an unreachable needle in a the massive haystack that is our physical world.
(I'm speaking theoretically, of course, this does nothing to protect the user from the kind of attacks that are most common: phishing and social engineering)
When the password is a stickie next to your computer, then the most imminent risk is that the janitor or a coworker will filch from you. Then have your password be something you put on a sticky save for a memorable number that you prepend to it (but not something too guessable, like your birthday). The chances that this acquaintance who goes snooping around your physical cubicle is going to also run a brute force crack is pretty slim...because such a person will likely have an easier way to violate your privacy/thieve from you.