Perimeter
1/13/2011
01:23 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Password Reset

The downside of crafting a strong password is that while it's harder to guess or crack, it's also harder to remember and then use

Forgot password? Yep.

It's 2011 and we're still relying mainly on passwords for authentication. I personally am so done with passwords -- not only because passwords are so fallible, inconvenient, and often poorly managed, but because when I create strong ones, I can't freaking remember them. Ever.

So I spend precious time engaging in the password-reset process. And if that process entails any security questions, I'm in even deeper trouble because I try to make those difficult-to-guess as well, which means they are impossible-to-recall. What was my favorite city when I set up that account?

Right now -- as I blog -- I am locked out of the "comments" section on the Dark Reading website because I can't remember the relatively complex password I concocted for it. So I've tried the password reset process at least eight times. But for some reason I'm in an endless loop that kicks me back to the original login page or the unlogged-in version of the site, and I never get a chance to create yet another forgettable password combo. My cookies are cleared, a new browser session is open, but I'm still "Guest" on my own website.

There are some passwords that I can type in my sleep. Those that I use on a daily basis, like my corporate intranet, email, Twitter, and Facebook, are no problem. It's the ones I need for occasional visits that elude me.

So rather than hack through some of the more kludgy reset processes, I just don't bother visiting those sites for a while, which might explain why my LinkedIn profile remains unfinished after three years. I know, I know: I should deploy a password manager, or write down my passwords on paper somewhere and then hide it, but with my luck, I would forget my hiding place. (Ask my kids about those late Christmas presents they get in March after I stumble across my awesome hiding places.)

A new Symantec-Forrester Research study released today illustrates just what I'm talking about. Nearly 90 percent of companies require two or more passwords to access corporate apps and resources, and close to 30 percent, six or more passwords. An average of 30 to 50 percent of calls to the help desk are for password resets. I have at least three different assigned login names among my company's various apps and software-as-a-service, Web 2.0 apps, and numerous passwords. And it never fails that we get yet another Web-based app, a new login name, and another new password every few months.

So until biometrics hits the cloud, I've decided to look at my password-recall problem as not just a short-term memory deficiency (I still blame all those headers during my soccer career), but rather my own form of strong yet inconvenient authentication. By never reusing a password and instead changing it practically every time I log in, it's a disposable strong password. Use it once, forget it (no problem!), reset it, and start all over again.

-- Kelly Jackson Higgins, Senior Editor, Dark Reading Follow Kelly (@kjhiggins) here on Twitter.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Latest Comment: nice one
Current Issue
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-0845
Published: 2015-04-17
Format string vulnerability in Movable Type Pro, Open Source, and Advanced before 5.2.13 and Pro and Advanced 6.0.x before 6.0.8 allows remote attackers to execute arbitrary code via vectors related to localization of templates.

CVE-2015-1318
Published: 2015-04-17
The crash reporting feature in Apport 2.13 through 2.17.x before 2.17.1 allows local users to gain privileges via a crafted usr/share/apport/apport file in a namespace (container).

CVE-2015-1852
Published: 2015-04-17
The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-mid...

CVE-2015-1856
Published: 2015-04-17
OpenStack Object Storage (Swift) before 2.3.0, when allow_version is configured, allows remote authenticated users to delete the latest version of an object by leveraging listing access to the x-versions-location container.

CVE-2013-4866
Published: 2015-04-16
The LIXIL Corporation My SATIS Genius Toilet application for Android has a hardcoded Bluetooth PIN, which allows physically proximate attackers to trigger physical resource consumption (water or heat) or user discomfort.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.