Study: 73% Use Bank Password Everywhere

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
According to a independent study, 73% of the participants in a recent poll said they use the same password for everything. The remaining 27% are obviously [H] readers. :D

"I must say I was very surprised,” said Amit Klein, chief technology officer of Trusteer. “It is surprisingly sad that such a large portion of users use their banking credentials at other sites. ... It exposes those users to attacks that would otherwise be impossible. I thought that people would take banking credentials more seriously, but it turns out that in this digital age, this is not the reality."
Click to expand...
 
with technologies like rainbow tables passwords don't matter as much as they used to. good password practices just will delay someone persistent.
 
I'd recommend trying to bank with a company that offers a verisign token. Then a person would have to steal not only your password, but also a physical possession of yours since your password would be changing every 30 seconds.
 
I use a different password at every site I use, but I keep them stored in a text file on my PC.

I keep that text file in an encrypted truecrypt container hidden on the computer in case I forget a password.

Not the best practice but it beats leaving a post it note on my monitor with all 3000 passwords on it.
 
Eickst said:
I use a different password at every site I use, but I keep them stored in a text file on my PC.

I keep that text file in an encrypted truecrypt container hidden on the computer in case I forget a password.
Click to expand...

I used to do that except with an Access database instead of a text file. Then I discovered KeePass and never looked back.
 
BloodyIron said:
with technologies like rainbow tables passwords don't matter as much as they used to. good password practices just will delay someone persistent.
Click to expand...

Can rainbow tables be used to reliably crack a 32-character, alphanumeric, seemingly random password?
 
For the last 2 months in a row my CC account has been locked from too many failed attempts to login. I'm about to raise hell, and have them change my UN.

i'm going to make some jacked up UN and PW that even I wont be able to remember!!!:cool:
 
I have a Firefox plugin which lets me use a master password and a number of parameters of my choosing to randomly generate a password for every web site I visit, based upon that master password and the web site's URL. It works extremely well and is more convenient than actually memorising them, though it's still better to write the important ones down.

I get the impression that bank account theft is one of those "it would never happen to me" things and as a result, most people just use whatever password they can remember... usually, that's one or two at most. Sad, but there's nobody to blame for a weak password but its user.
 
I would never use a program to store my passwords that some random guy on the internet wrote....
 
Well those people are dumb. However I fall into the second thing.

1 password for almost every website.
1 password for cc site, bank sites.

I bet most ppl in the 27 percent is like this too.
 
Wait a minute, bank passwords like PIN Numbers?

I have different passwords for everything...
 
BloodyIron said:
with technologies like rainbow tables passwords don't matter as much as they used to. good password practices just will delay someone persistent.
Click to expand...

I'm not sure of your point. Rainbow tables are only useful if you know the hashed password, which you won't in any normal e-banking scenario. Using good password practices doesn't protect you from rainbow tables, but it certainly does protect you from the severity of a successful attack. Consider a compromised hashed password database from [H]. They may be able to get a usable plaintext that matches the hash, but if you're using different passwords everywhere, that doesn't get them anywhere - they've already compromised [H]'s system so you haven't lost anything else. If that was also your bank password, you're at much greater risk.

Also salting the passwords in the database mitigates the attack a great deal in the first place.
 
For all of our lives we've been acclimated to using the same signature for everything: checks, bank cards, official identification documents, any contract that requires "proof" of identity... Then people are told: your password is your signature, well that's what they did: they replaced their one signature with their one password. It makes sense to me.

As for how to keep your password list: I don't write my passwords, I write clues that make sense only to me (and sometimes not even me :) ). But the truth is that, like all potential preys, we find our individual safety in numbers. One of my banks limits its customer password to 6 chars (!): if anyone was determined to break into my account, it wouldn't take that long. Fortunately, it's easier to prey on the weak (obvious passwords, phishing victims, etc), so no-one has tried to break into my particular account so far.
 
webdev511 said:
LastPass is your friend.
Click to expand...

Have to agree. Been using it for a couple of months now, love the convenience with the randomly generated character lengths.

I don't think any rainbow table (currently) would be able to crack an AES-128bit encrypted password, let alone a 256bit one anytime soon, whether by brute force or any other means. Its one algorithm that has stood the test of time and so far, as far as I can tell, has never been cracked (at least nothing has been reported anyway)

There has been some research countering this article's contention that using a password across sites is too dangerous, although the researchers point out that they were measuring the probability that this would actually happen. They surmised that the actual likelihood that a thief would get the password and actually use it across other sites is quite low - although I'm sure Bruce Schneier would probably disagree. They continue to say that that doesn't mean folks shouldn't practice better efforts at securing themselves, (longer passwords, changing them often, etc) just that, as Liton said, its a trade off: convenience and effort vs cost. Interestingly, they pointed out that its not such a bad idea anymore if one writes down their passwords, providing that the environment warrants it: its a home pc, and not shared, as opposed to a work environment, where a shared environment would likely be too risky.

Philip
 
fairlane said:
Have to agree. Been using it for a couple of months now, love the convenience with the randomly generated character lengths.

I don't think any rainbow table (currently) would be able to crack an AES-128bit encrypted password, let alone a 256bit one anytime soon, whether by brute force or any other means. Its one algorithm that has stood the test of time and so far, as far as I can tell, has never been cracked (at least nothing has been reported anyway)

There has been some research countering this article's contention that using a password across sites is too dangerous, although the researchers point out that they were measuring the probability that this would actually happen. They surmised that the actual likelihood that a thief would get the password and actually use it across other sites is quite low - although I'm sure Bruce Schneier would probably disagree. They continue to say that that doesn't mean folks shouldn't practice better efforts at securing themselves, (longer passwords, changing them often, etc) just that, as Liton said, its a trade off: convenience and effort vs cost. Interestingly, they pointed out that its not such a bad idea anymore if one writes down their passwords, providing that the environment warrants it: its a home pc, and not shared, as opposed to a work environment, where a shared environment would likely be too risky.

Philip
Click to expand...

Forgot to mention (why can't I edit my own posts?) another good way is to use a linux LiveCD, and just boot off it, and browse to your bank, and ONLY your bank. Should take care of any malware issues. :cool:
 
I only recently started changing some of my passwords over to non-dictionary strings, but there's so many sites I have passwords for...oy. Checking out KeePass now, it looks pretty solid.
 
fairlane said:
I don't think any rainbow table (currently) would be able to crack an AES-128bit encrypted password, let alone a 256bit one anytime soon, whether by brute force or any other means. Its one algorithm that has stood the test of time and so far, as far as I can tell, has never been cracked (at least nothing has been reported anyway)
Click to expand...
That is because passwords arn't stored using AES. :p AES uses the same key for encryption and decryption. Passwords are stored using one way hash functions, IE: MD5, SHA-1, SHA-2.
 
I have about ten passwords in my head. The bank password is the most difficult to remember so I had to write it down. I'll never use it on other sites.
 
fairlane said:
I don't think any rainbow table (currently) would be able to crack an AES-128bit encrypted password, let alone a 256bit one anytime soon, whether by brute force or any other means. Its one algorithm that has stood the test of time and so far, as far as I can tell, has never been cracked (at least nothing has been reported anyway)
Click to expand...

Rainbow tables are not useful to crack encryption, they are only useful for hashes.

One interesting idea I meant to mention before is PwdHash which generates a unique password for each domain automatically, based on your master password. That means no password syncing - all you need is the browser extension (or if you're away from your main PC, the javascript app) and your password to get your correct passwords.
 
secure passwords are important for some things others not. IMHO anyway. For mundane crap 1 password I've been using for ages. For anything that could threaten my money I use a descent hexadecimal password that's keep me safe from anyone but someone persistent and knows what they're doing. No password is truly safe.
 
TheBuzzer said:
Well those people are dumb. However I fall into the second thing.

1 password for almost every website.
1 password for cc site, bank sites.

I bet most ppl in the 27 percent is like this too.
Click to expand...

same, although I use 3 different, 1 for low to no threat accounts, 1 for somewhat high, and 1 for my bank's and work accounts.
 
hmm i dont write down my passwords for the same reason i no longer write down phone numbers... the ONLY time ive ever forgotten a password or phone number is after writing it down, something in my head just goes "ill forget that, ive got it wrote down" if i dont write them down i can remember them all no problem.

a few tips for those that need to write stuff down.....

Take your favourite song and sing the chorus, then take the first letter of every word in that chorus, and write it down, replace some letters: o = 0, l = 1, a = @ and so on, now use this as your password... now if you want to make it different for each site you could just take something from that site, so for hardforum you could add HF onto the end of your password.

^^ i dont use this method but it appears to help some of the less knowlegable people who i work with(im IT support)
 
No one has mentioned password generating algorithms here, and that's a bit of a disappointment.

http://www.acleandesign.com/2008/05...-remember-unique-passwords-for-every-account/

Sadly, many systems STILL don't accept symbols, or longer passwords. Some of mine reach into the 20 - 30 character range, and the algorithm that always includes symbols, numbers, and letters. Every place that uses a password that accepts what I generate in my head is unique, and usually ~ 15 characters.
 
My banks required password is 10+ characters numbers and letters, upper and lower case and they also make me answer several secret questions for authentication. I'm not complaining it's pretty decent security.
 
BloodyIron said:
Yes, all it takes is matching the hash.
Click to expand...

in theory. but if your input for that hash is 32 characters long no datacenter in the world would be able to store such a table. and that table would only be good for one specific hash algorithm.
 
I use a different password for almost all of the sites I personally use, then there are the sites for work, then there are all our users passwords. Probably have had 200 different password memorized at one point time. I rarely forget one. Yet I have co-workers and my boss complaining because they can't use their facebook password as their domain password because it is hard to remember 2 different things... lol my life is a security nightmare sometimes..
 
already mentioned, but keepass is the end-all for passwords in my opinion. i have like 100 different sites in my folder now, and all i have to do is go to whatever site and hit a hot key combo, the user name and password are automatically entered (and they are usually 16 characters long and containing symbols too, none even close to the same).

i use about 3 variations of 1 password for web forums and other things that dont matter, but keepass is a godsend for everything else.
 
Any important online service uses a strong alphanumeric password. But for forums, and other small, non-sensitive sites I use a generic password.
 
You must log in or register to reply here.
Back
Top