Perimeter
1/13/2011
01:23 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Password Reset

The downside of crafting a strong password is that while it's harder to guess or crack, it's also harder to remember and then use

Forgot password? Yep.

It's 2011 and we're still relying mainly on passwords for authentication. I personally am so done with passwords -- not only because passwords are so fallible, inconvenient, and often poorly managed, but because when I create strong ones, I can't freaking remember them. Ever.

So I spend precious time engaging in the password-reset process. And if that process entails any security questions, I'm in even deeper trouble because I try to make those difficult-to-guess as well, which means they are impossible-to-recall. What was my favorite city when I set up that account?

Right now -- as I blog -- I am locked out of the "comments" section on the Dark Reading website because I can't remember the relatively complex password I concocted for it. So I've tried the password reset process at least eight times. But for some reason I'm in an endless loop that kicks me back to the original login page or the unlogged-in version of the site, and I never get a chance to create yet another forgettable password combo. My cookies are cleared, a new browser session is open, but I'm still "Guest" on my own website.

There are some passwords that I can type in my sleep. Those that I use on a daily basis, like my corporate intranet, email, Twitter, and Facebook, are no problem. It's the ones I need for occasional visits that elude me.

So rather than hack through some of the more kludgy reset processes, I just don't bother visiting those sites for a while, which might explain why my LinkedIn profile remains unfinished after three years. I know, I know: I should deploy a password manager, or write down my passwords on paper somewhere and then hide it, but with my luck, I would forget my hiding place. (Ask my kids about those late Christmas presents they get in March after I stumble across my awesome hiding places.)

A new Symantec-Forrester Research study released today illustrates just what I'm talking about. Nearly 90 percent of companies require two or more passwords to access corporate apps and resources, and close to 30 percent, six or more passwords. An average of 30 to 50 percent of calls to the help desk are for password resets. I have at least three different assigned login names among my company's various apps and software-as-a-service, Web 2.0 apps, and numerous passwords. And it never fails that we get yet another Web-based app, a new login name, and another new password every few months.

So until biometrics hits the cloud, I've decided to look at my password-recall problem as not just a short-term memory deficiency (I still blame all those headers during my soccer career), but rather my own form of strong yet inconvenient authentication. By never reusing a password and instead changing it practically every time I log in, it's a disposable strong password. Use it once, forget it (no problem!), reset it, and start all over again.

-- Kelly Jackson Higgins, Senior Editor, Dark Reading Follow Kelly (@kjhiggins) here on Twitter.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2037
Published: 2014-11-26
Openswan 2.6.40 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads. NOTE: this vulnerability exists because of an incomplete fix for CVE 2013-6466.

CVE-2014-6609
Published: 2014-11-26
The res_pjsip_pubsub module in Asterisk Open Source 12.x before 12.5.1 allows remote authenticated users to cause a denial of service (crash) via crafted headers in a SIP SUBSCRIBE request for an event package.

CVE-2014-6610
Published: 2014-11-26
Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6 before 11.6-cert6, when using the res_fax_spandsp module, allows remote authenticated users to cause a denial of service (crash) via an out of call message, which is not properly handled in the ReceiveFax dia...

CVE-2014-7141
Published: 2014-11-26
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet.

CVE-2014-7142
Published: 2014-11-26
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?