Perimeter
1/13/2011
01:23 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Password Reset

The downside of crafting a strong password is that while it's harder to guess or crack, it's also harder to remember and then use

Forgot password? Yep.

It's 2011 and we're still relying mainly on passwords for authentication. I personally am so done with passwords -- not only because passwords are so fallible, inconvenient, and often poorly managed, but because when I create strong ones, I can't freaking remember them. Ever.

So I spend precious time engaging in the password-reset process. And if that process entails any security questions, I'm in even deeper trouble because I try to make those difficult-to-guess as well, which means they are impossible-to-recall. What was my favorite city when I set up that account?

Right now -- as I blog -- I am locked out of the "comments" section on the Dark Reading website because I can't remember the relatively complex password I concocted for it. So I've tried the password reset process at least eight times. But for some reason I'm in an endless loop that kicks me back to the original login page or the unlogged-in version of the site, and I never get a chance to create yet another forgettable password combo. My cookies are cleared, a new browser session is open, but I'm still "Guest" on my own website.

There are some passwords that I can type in my sleep. Those that I use on a daily basis, like my corporate intranet, email, Twitter, and Facebook, are no problem. It's the ones I need for occasional visits that elude me.

So rather than hack through some of the more kludgy reset processes, I just don't bother visiting those sites for a while, which might explain why my LinkedIn profile remains unfinished after three years. I know, I know: I should deploy a password manager, or write down my passwords on paper somewhere and then hide it, but with my luck, I would forget my hiding place. (Ask my kids about those late Christmas presents they get in March after I stumble across my awesome hiding places.)

A new Symantec-Forrester Research study released today illustrates just what I'm talking about. Nearly 90 percent of companies require two or more passwords to access corporate apps and resources, and close to 30 percent, six or more passwords. An average of 30 to 50 percent of calls to the help desk are for password resets. I have at least three different assigned login names among my company's various apps and software-as-a-service, Web 2.0 apps, and numerous passwords. And it never fails that we get yet another Web-based app, a new login name, and another new password every few months.

So until biometrics hits the cloud, I've decided to look at my password-recall problem as not just a short-term memory deficiency (I still blame all those headers during my soccer career), but rather my own form of strong yet inconvenient authentication. By never reusing a password and instead changing it practically every time I log in, it's a disposable strong password. Use it once, forget it (no problem!), reset it, and start all over again.

-- Kelly Jackson Higgins, Senior Editor, Dark Reading Follow Kelly (@kjhiggins) here on Twitter.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-2184
Published: 2015-03-27
Movable Type before 5.2.6 does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via the comment_state parameter.

CVE-2014-3619
Published: 2015-03-27
The __socket_proto_state_machine function in GlusterFS 3.5 allows remote attackers to cause a denial of service (infinite loop) via a "00000000" fragment header.

CVE-2014-8121
Published: 2015-03-27
DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up while the database is iterated over...

CVE-2014-9712
Published: 2015-03-27
Websense TRITON V-Series appliances before 7.8.3 Hotfix 03 and 7.8.4 before Hotfix 01 allows remote administrators to read arbitrary files and obtain passwords via a crafted path.

CVE-2015-0658
Published: 2015-03-27
The DHCP implementation in the PowerOn Auto Provisioning (POAP) feature in Cisco NX-OS does not properly restrict the initialization process, which allows remote attackers to execute arbitrary commands as root by sending crafted response packets on the local network, aka Bug ID CSCur14589.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.