Perimeter
1/13/2011
01:23 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Password Reset

The downside of crafting a strong password is that while it's harder to guess or crack, it's also harder to remember and then use

Forgot password? Yep.

It's 2011 and we're still relying mainly on passwords for authentication. I personally am so done with passwords -- not only because passwords are so fallible, inconvenient, and often poorly managed, but because when I create strong ones, I can't freaking remember them. Ever.

So I spend precious time engaging in the password-reset process. And if that process entails any security questions, I'm in even deeper trouble because I try to make those difficult-to-guess as well, which means they are impossible-to-recall. What was my favorite city when I set up that account?

Right now -- as I blog -- I am locked out of the "comments" section on the Dark Reading website because I can't remember the relatively complex password I concocted for it. So I've tried the password reset process at least eight times. But for some reason I'm in an endless loop that kicks me back to the original login page or the unlogged-in version of the site, and I never get a chance to create yet another forgettable password combo. My cookies are cleared, a new browser session is open, but I'm still "Guest" on my own website.

There are some passwords that I can type in my sleep. Those that I use on a daily basis, like my corporate intranet, email, Twitter, and Facebook, are no problem. It's the ones I need for occasional visits that elude me.

So rather than hack through some of the more kludgy reset processes, I just don't bother visiting those sites for a while, which might explain why my LinkedIn profile remains unfinished after three years. I know, I know: I should deploy a password manager, or write down my passwords on paper somewhere and then hide it, but with my luck, I would forget my hiding place. (Ask my kids about those late Christmas presents they get in March after I stumble across my awesome hiding places.)

A new Symantec-Forrester Research study released today illustrates just what I'm talking about. Nearly 90 percent of companies require two or more passwords to access corporate apps and resources, and close to 30 percent, six or more passwords. An average of 30 to 50 percent of calls to the help desk are for password resets. I have at least three different assigned login names among my company's various apps and software-as-a-service, Web 2.0 apps, and numerous passwords. And it never fails that we get yet another Web-based app, a new login name, and another new password every few months.

So until biometrics hits the cloud, I've decided to look at my password-recall problem as not just a short-term memory deficiency (I still blame all those headers during my soccer career), but rather my own form of strong yet inconvenient authentication. By never reusing a password and instead changing it practically every time I log in, it's a disposable strong password. Use it once, forget it (no problem!), reset it, and start all over again.

-- Kelly Jackson Higgins, Senior Editor, Dark Reading Follow Kelly (@kjhiggins) here on Twitter.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3345
Published: 2014-08-28
The web framework in Cisco Transport Gateway for Smart Call Home (aka TG-SCH or Transport Gateway Installation Software) 4.0 does not properly check authorization for administrative web pages, which allows remote attackers to modify the product via a crafted URL, aka Bug ID CSCuq31503.

CVE-2014-3347
Published: 2014-08-28
Cisco IOS 15.1(4)M2 on Cisco 1800 ISR devices, when the ISDN Basic Rate Interface is enabled, allows remote attackers to cause a denial of service (device hang) by leveraging knowledge of the ISDN phone number to trigger an interrupt timer collision during entropy collection, leading to an invalid s...

CVE-2014-4199
Published: 2014-08-28
vm-support 0.88 in VMware Tools, as distributed with VMware Workstation through 10.0.3 and other products, allows local users to write to arbitrary files via a symlink attack on a file in /tmp.

CVE-2014-4200
Published: 2014-08-28
vm-support 0.88 in VMware Tools, as distributed with VMware Workstation through 10.0.3 and other products, uses 0644 permissions for the vm-support archive, which allows local users to obtain sensitive information by extracting files from this archive.

CVE-2014-0761
Published: 2014-08-27
The DNP3 driver in CG Automation ePAQ-9410 Substation Gateway allows remote attackers to cause a denial of service (infinite loop or process crash) via a crafted TCP packet.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.