Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint //

Authentication

9/16/2014
12:15 PM
Sara Peters
Sara Peters
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
50%
50%

DR Radio: A Grown-Up Conversation About Passwords

Cormac Herley of Microsoft Research will challenge everything you think you know about password management.

We all know the rules. At least eight characters; combination of lowercase, uppercase, numerals, and special characters; different for every account; changed periodically; and never stored in plain text anywhere, not even on a Post-it note. Those are the golden rules for password management we all know, advise, and (probably) follow... but maybe we're wrong.

Over the past few months, the public has been hammered with data breaches, including those that exposed passwords. Security experts have been thrust into the public eye, in newspapers and on television, urging, begging, and warning users to improve their password practices. Yet Cormac Herley, principal researcher at Microsoft Research, says that it's time to stop putting all the responsibility on end users -- time to stop the blaming and shaming. Not only is following the rules too difficult, says Herley, but it isn't even worth the effort.

Herley's recent work on passwords, with Dinei Florencio and Paul C. van Oorschot, includes statements like "a [password] portfolio strategy ruling out weak passwords or password re-use is sub-optimal," and if the IT department doesn't do its job well, "there is no attack scenario where the [user's] extra effort protects the account."

Sound crazy? Want to know how they came to those conclusions? Then don't miss the next episode of Dark Reading Radio, "A Grown-Up Conversation About Passwords," tomorrow, Wednesday, Sept. 17 at 1:00 p.m. ET/10:00 am PT, with our guest, Cormac Herley.

Have questions you want us to ask? Let us know in the comments below. If we can't get to those questions during the audio interview, never fear -- you'll have the chance to ask him questions yourself, during the live chat session happening alongside the broadcast.

Don't miss this chance to challenge all your assumptions about password management. Register now.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
HAnatomi
50%
50%
HAnatomi,
User Rank: Apprentice
9/19/2014 | 8:51:12 PM
Re: Not only texts but also images
I wonderif you will have a look at the document posted by a Japanese company Mnemonic Security at

 " mneme.blog.eonet.jp/default/files/outline_of_mnemonic_security.pdf "  Add h t t p / /

and a blogsite

 " mnemonicguard.blogspot.jp/ " Add h t t p / /

 that I am following.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
9/19/2014 | 9:51:26 AM
Re: Not only texts but also images
HAnatomi -- What would be an example of a known versus unkown image? and how would that work as an authentication factor?
HAnatomi
50%
50%
HAnatomi,
User Rank: Apprentice
9/19/2014 | 3:19:29 AM
Re: Not only texts but also images
It is perhaps impossible for anyone to remember 100 UNKNOWN images afresh.  The images to be used for passwords should be the KNOWN images of our episodic/autobiographic images, which are said to be the least vulerable to the cognitive phenomenon named "interference of memory".

 
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
9/18/2014 | 9:58:50 AM
Re: Not only texts but also images
That's intereting about images. But is the human brain capable of remembering 100 images, one unique authenticator for each app or web site? Or won't that be necessary with images?
HAnatomi
50%
50%
HAnatomi,
User Rank: Apprentice
9/18/2014 | 1:31:34 AM
Not only texts but also images
At the root of the password problem is the cognitive phenomena called "interference of memory", by which we cannot firmly remember more than 5 text passwords on average.  What worries us is not the password, but the textual password.  The textual memory is only a small part of what we remember.  We could think of making use of the larger part of our memory that is less subject to interference of memory.  More attention could be paid to the efforts of expanding the password system to include images, particularly KNOWN images, as well as conventional texts.

 

Most of the humans are thousands times better at dealing with image memories than text memories. The former dates back to hundreds of millions of years ago while the latter's history is less than a fraction of it.I wonder what merits we have in confining ourselves in the narrow corridor of text memories when CPUs are fast enough, bandwidth broad enough, memory storage cheap enough, and cameras built in mobile devices.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
9/17/2014 | 3:15:04 PM
Re: No shortage of opinions on this topic!
Really great interview and discussion with Cormac, Sara. His provocative perspective on passwords really generated some great discussion and debate. And of course, there's no good answer for authentication. =)
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
9/16/2014 | 3:54:56 PM
No shortage of opinions on this topic!
This should be lively discussion, Sara. Everyone has an opinion on passwords - and we've had our share of them on Dark Reading! Andrey Dulkin of CyberArk Research Labs weighed in in July on "Weak Password Advice From Microsoft" (http://www.darkreading.com/operations/identity-and-access-management/weak-password-advice-from-microsoft/a/d-id/1297592) and today,  Corey Nachreiner, of WatchGuard Technologies, gave a qualified "Defense of Passwords" -- as long as you use them correctly along with something else (http://www.darkreading.com/operations/in-defense-of-passwords/a/d-id/1315719?). 

Let the debate begin! 
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Active Directory Needs an Update: Here's Why
Raz Rafaeli, CEO and Co-Founder at Secret Double Octopus,  1/16/2020
New Attack Campaigns Suggest Emotet Threat Is Far From Over
Jai Vijayan, Contributing Writer,  1/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: I've never actually seen the corporate ladder before.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5216
PUBLISHED: 2020-01-23
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seei...
CVE-2020-5217
PUBLISHED: 2020-01-23
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection. This could b...
CVE-2020-5223
PUBLISHED: 2020-01-23
In PrivateBin versions 1.2.0 before 1.2.2, and 1.3.0 before 1.3.2, a persistent XSS attack is possible. Under certain conditions, a user provided attachment file name can inject HTML leading to a persistent Cross-site scripting (XSS) vulnerability. The vulnerability has been fixed in PrivateBin v1.3...
CVE-2019-20399
PUBLISHED: 2020-01-23
A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak information via a side-channel attack.
CVE-2020-7915
PUBLISHED: 2020-01-22
An issue was discovered on Eaton 5P 850 devices. The Ubicacion SAI field allows XSS attacks by an administrator.