Perimeter
1/13/2011
01:23 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%
Repost This

Password Reset

The downside of crafting a strong password is that while it's harder to guess or crack, it's also harder to remember and then use

Forgot password? Yep.

It's 2011 and we're still relying mainly on passwords for authentication. I personally am so done with passwords -- not only because passwords are so fallible, inconvenient, and often poorly managed, but because when I create strong ones, I can't freaking remember them. Ever.

So I spend precious time engaging in the password-reset process. And if that process entails any security questions, I'm in even deeper trouble because I try to make those difficult-to-guess as well, which means they are impossible-to-recall. What was my favorite city when I set up that account?

Right now -- as I blog -- I am locked out of the "comments" section on the Dark Reading website because I can't remember the relatively complex password I concocted for it. So I've tried the password reset process at least eight times. But for some reason I'm in an endless loop that kicks me back to the original login page or the unlogged-in version of the site, and I never get a chance to create yet another forgettable password combo. My cookies are cleared, a new browser session is open, but I'm still "Guest" on my own website.

There are some passwords that I can type in my sleep. Those that I use on a daily basis, like my corporate intranet, email, Twitter, and Facebook, are no problem. It's the ones I need for occasional visits that elude me.

So rather than hack through some of the more kludgy reset processes, I just don't bother visiting those sites for a while, which might explain why my LinkedIn profile remains unfinished after three years. I know, I know: I should deploy a password manager, or write down my passwords on paper somewhere and then hide it, but with my luck, I would forget my hiding place. (Ask my kids about those late Christmas presents they get in March after I stumble across my awesome hiding places.)

A new Symantec-Forrester Research study released today illustrates just what I'm talking about. Nearly 90 percent of companies require two or more passwords to access corporate apps and resources, and close to 30 percent, six or more passwords. An average of 30 to 50 percent of calls to the help desk are for password resets. I have at least three different assigned login names among my company's various apps and software-as-a-service, Web 2.0 apps, and numerous passwords. And it never fails that we get yet another Web-based app, a new login name, and another new password every few months.

So until biometrics hits the cloud, I've decided to look at my password-recall problem as not just a short-term memory deficiency (I still blame all those headers during my soccer career), but rather my own form of strong yet inconvenient authentication. By never reusing a password and instead changing it practically every time I log in, it's a disposable strong password. Use it once, forget it (no problem!), reset it, and start all over again.

-- Kelly Jackson Higgins, Senior Editor, Dark Reading Follow Kelly (@kjhiggins) here on Twitter.

Kelly Jackson Higgins is Senior Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-0188
Published: 2014-04-24
The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to...

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

Best of the Web