Now that makes sense...though I still imagine if we move to Biometrics, Jack Bauer will cut my thumb off or kill me then steal my eye
![[H]ard|Forum](/styles/hardforum/xenforo/logo_dark.png){kind=logo}
-
Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.
Kill The Password
- Thread starter Megalith
- Start date
Now that makes sense...though I still imagine if we move to Biometrics, Jack Bauer will cut my thumb off or kill me then steal my eye
OK, so how do they get the master PW or even just the DB, without having access to my computer?
I guess, but I can't imagine memorizing 50-100 different phrases for all my the sites I have PWs for. I've got some sites that I didn't migrate and they typically use one of a handful of PW variations that I used back when I assume that was enough and I still don't remember what those PWs are.
If I had 100 variations, I'd never figure it out. Post how you'd come up with passwords using 10 or 20 sites (don't use [H]...no https=weakest link here). If it works for everyone, then you're helping your fellow [H] members
You don't, it's rediculous, but you can have a few "favorites" that you use for categories of sites. Bullshit sites get this password, sites with important stuff another one. Work related sites are different and so are sites that I do business with.
Now that makes sense...though I still imagine if we move to Biometrics, Jack Bauer will cut my thumb off or kill me then steal my eye
Well, let's hope he bothers to steal your smart card and torture your password out of you before he takes further more drastic measures
You pay $150 to replace it and then you learn from that hit to your wallet and never lose it again.
Also, for government and corporate authentication, you can get in big trouble (especially if is DOD stuff that requires security clearance) and lose your job.
There is no need for a password. Completely redundant. All you need is a PIN. https://technet.microsoft.com/en-us/library/Cc962052.aspx. The PIN is transmitted to the smart card which unlocks it and is never transmitted over the network. If anyone tries to brute force the PIN, it will lock the smart card.
All cryptography and security processes are done on the smartcard itself (it is a miniature computer) and not on the host machine. Authentication to remote servers is session specific (an authentication challenged is signed using the private key) which means that network sniffing, rootkits, and keyloggers on the host computer won't be able to compromise the system.
Yea, I have never seen anyone get into real trouble for losing their CAC card, more like a reprimand, but it happens, and if it lead to a breach I am sure the punishment would be revisited. But Damicatz is correct that the punishment could be severe. Definitly worse then forgetting your password.
You've never worked in a hospital that had to comply with HIPPA regulations. The HIPPA people would actually go around and inspect people's desks/offices to make sure they didn't have any passwords written down anywhere and that the computers weren't left unlocked.
And I don't think you've ever worked in a Sensative Compartmented Intelligence Facility, (SCIF). Your hospital and HIPPA people may be anal, but there are other levels of anal.
First comes the TS clearance with the background investigation where they even talked to my high school teachers, neighbors, etc. in order to get the job. this is redone every 5 years, I am 55 and still have to answer questions about my life from decades ago. Where I lived, my phone number, people who knew me there, etc, for everywhere I have ever lifed in my entire Army career of moving all over the world.
The anual training and refresher briefings, the restrictions on travel, the requirement to report all foreign contacts and report travel to foreign countries weeks before the visits. Must report changes in marital status, financial status, debt, a DUI is career death and don't piss hot for THT or kiss that clearance goodbye.
Some go further and need polygraphs and can't even be administered anasthesia even in an emergency unless another cleared person is there in the operating room observing everything.
All online activity is monitored, at work, and at home from your personal devices.
My sisters are nurses, it just doesn't really compare to this life.
Ur_Mom
Fully [H]
- Joined
- May 15, 2006
- Messages
- 20,912
I'm tired of one site requiring a special character and another forbids it. Or one is 8 characters and the other is 12....
I have a few different ones I use, but I have a generic one that I use for generic sites (some forums, etc. that aren't too big of a deal if compromised).
Yeah, I've never understood why they limit the password character set. I realize that some characters can have other meanings (esp in regular expression evaluation), but you either write this once, or you use an open source function to handle it. It might be more difficult for control characters, but for ASCII characters to be disallowed, it's just crazy....and limiting the length to 12 characters is just stupid.
OK, so how do they get the master PW or even just the DB, without having access to my computer?
I guess, but I can't imagine memorizing 50-100 different phrases for all my the sites I have PWs for. I've got some sites that I didn't migrate and they typically use one of a handful of PW variations that I used back when I assume that was enough and I still don't remember what those PWs are.
If I had 100 variations, I'd never figure it out. Post how you'd come up with passwords using 10 or 20 sites (don't use [H]...no https=weakest link here). If it works for everyone, then you're helping your fellow [H] members
As i said, admin policy has to change first, but lets start with a basic example.
Thisismyexamplephrase!Inthisphraseithinkaboutmypasswordforhardocp!Itismy#1favoritewebsite!
Now in this particular phrase hardocp is the designator for this specific site. The rest of the phrase including punctuation is used everywhere. Now you have a "password" that contains letters, caps, case, symbols and numbers. It is also almost 100 characters. There is nothing on the planet that is ever going to crack it. Now as i said, this is only an example of format. This reality is there are endless ways to structure your phrase. But using this example you only change your designator for different sites. That is a simplified example of how pass phrasing is both vastly more secure and easily memorized. The added benefit is it doesn't require people to use stupid programs, carry smart cards, usb dongles or anything else that is easily broken/lost/compromised, not to mention expensive to implement. The reality is, its easily deployed and easily taught. There is only one policy rule needed to force it.
Policy, all passwords must contain a minimum of 30 characters.
That value can be raised if computing hits the point where 30 isn't sufficient. Why no hard requirement on numbers etc? At 30 characters it takes care of itself. It's still smart to include which is why my example does, but unnecessary to require. It's so frignteningly simple that it blows my mind that we ever allowed shit like 1234 and s2e32d3!! To ever count as proper passwords in the first place.
It was a garunteed article 15 for me if I lost it first time and it only went upbfrom there
But these other requirements raise the bar much further. I had an RSA token for some of my jobs, it had a code that was renewed every 2 minutes. When I went to my company's website to do my timesheet I had to enter my password along with the ever changing code from this RSA token. Essentially my password changed every two minutes and I didn't have to rememeber that part that changed.
In some ways this was two factor authentication, but in practice it really was still just a password. Some of you will remember that RSA was hacked awhile back and several defense contractor companies were subsequently hacked once the RSA key infrastructure was compromised.
In short, no matter how much better your pass-phrase technique is, it is still far less secure then true multifactor authentication and if you really need to keep things secure then the expense of multifactor authentication is worth it. Bottom line, no doubt at all.
UCMJ doesn't extend to GS Civilians and Contractors.
I get what you're doing and tha'ts something you can memorize, but I don't see how that's much more secure than having a 100 characters password on KeePass, and it appears that this security blogger/researcher disagrees https://www.schneier.com/blog/archives/2014/03/choosing_secure_1.html
My search was on "Security of password managers" (but I didn't use quotes in the search). Stackexchange (which is generally solid for programming, so I'm assuming the same is true for basic security) also agrees (and mirrors my thoughts).
Note, I don't think your method is bad (though the link above indicates that those are no longer safe), but I don't think it's safer than KeePass, given that to get passwords from either DB, your system has to be compromised.
Is that a red/blue card with an LCD screen on it? I had that at my previous employer, but we didn't use it for all logins.
But the point is, even these are not enough alone for anything serious. You need a password, and these RSA keys help make those better. Then you need something like a Smart Card, and you can add somthing else like a Biometric, and then you are getting pretty secure.
Still, even all three together isn't perfect security. It just means someone has to go to far greater lengths to compromise your systems. Even then, if they do get in, at least you'll probably know it pretty fast. I mean, bob had both his eyes yesterday
Still, even all three together isn't perfect security. It just means someone has to go to far greater lengths to compromise your systems. Even then, if they do get in, at least you'll probably know it pretty fast. I mean, bob had both his eyes yesterday
Ur_Mom
Fully [H]
- Joined
- May 15, 2006
- Messages
- 20,912
So, if you have that long passphrase as part of an average domain - what happens when you're forced to change it every 90 days or 6 months or whatever? Most people take their old password and just increment.
I like two factor - password + RSA token or other. Your password can be compromised easily (be it from another site and you reuse the password, you wrote it down on a post-it under your keyboard, reused an old one just added a number, etc..), but the RSA key that is constantly changing that only you have access to the key fob? That's great for most uses. If you need more security, throw in biometrics like lcpiper suggested. After that, if you need more security, you need to look at putting the resource in a more physical secure location.
I like two factor - password + RSA token or other. Your password can be compromised easily (be it from another site and you reuse the password, you wrote it down on a post-it under your keyboard, reused an old one just added a number, etc..), but the RSA key that is constantly changing that only you have access to the key fob? That's great for most uses. If you need more security, throw in biometrics like lcpiper suggested. After that, if you need more security, you need to look at putting the resource in a more physical secure location.
If we are talking a world where everything requires passwords like I'm talking about, things like keepass are fine. The reality is there is no computer or system of computers on the planet that can break a password of that length. This isn't a debate of semantics, it's just flat technological fact. Now of course goverment institutions and places that need bulletproof security can continue using two factor ans rsa, but the reality is those are only a necessity because of bad design and people are damned stupid when it comes to password creation. Additionally stuff like that while fine at a busines level, isn't fine at a consumer level.
So that is why to me all that stuff is nothing more than a bandaid fix. Add that once the real problem of human friendly and secure passwords is resolved. At present 90% of the problems with password are the fault of us admins. We taught people wrong and have maintained bone headed policies.
That long of a pass phrase doesn't need changing every 90 days. Again, it is 100% uncrackable with present and forseeable technology. But even IF it did require changing, thats why i specified a designator. That's the only part that needs to change. As i said, the possibilities are endless on what you can do.
I don't know if it's 90%. Considering that passwords like abc123, 1234567 and derivatives of password regularly top the most common passwords, I'm going to say there's a lot of really REALLY stupid users. No admin (not even a bad one) would recommend those passwords.
The % was a clear pulled out of as percentage. The point was that we as admins allowed passwords like that to exist in the first place. Yes there are users who redefine stupid, but at the end of the day, admins wrote the policy.
- Joined
- Feb 8, 2005
- Messages
- 13,377
And if someone gets access to the CA? If someone copies the CA's backups, and sets up a duplicate CA with their credentials in it? If someone fails to maintain the CA correctly? What about if someone steals the smart card and copies it, then returns it before it's noticed to be missing?
PKI isn't perfect. It's better than what we have, but I think the best combination is to add it to existing infrastructure. Complex, lengthy, random, unique passwords - 256-byte or so, stored with one-way encryption in a file which can only be opened with your smart card and password. That's probably the best setup I can think of right now. The thief would need your password file, your smart card/token, your password... It'd just be a major PITA for him to take your credentials. Add in biometrics, and you've reached the point where a $5 wrench is necessary.
1.Any CA worth it's salt will not have the master keys for their root certificate on a computer not connected to a network and guarded with armed guards. And if a CA is compromised, the CA's root certificate can be untrusted (which also untrusts any certificates issued by them).
You can't copy a smartcard. That's the entire point. A smartcard isn't a dumb data storage device, it is a secure cryptoprocessor; there is no way to "read" the data off of it and there is no way to retrieve the private key (it is non-exportable); once the private key is stored inside the smartcard, all cryptography functions are handled by the secure cryptoprocessor. Any attempt to tamper with the card will cause it to deactivate.
Well, let's hope he bothers to steal your smart card and torture your password out of you before he takes further more drastic measures
Ain't no door got time for that. My career as a pro bowler will be over 😫