Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
The Real Reasons Why Users Stink At Passwords
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
jfontana
jfontana,
 User Rank: Author
9/7/2018 | 7:25:49 PM
Two-years on and this story still relevant
This is why authentication is getting a facelift.
RyanSepe
RyanSepe,
 User Rank: Ninja
9/30/2016 | 3:17:52 PM
Re: Passwords and user behavior
I very much agree. I'm thinking this cost pertains more to the laptop, desktop, and server environments. Mobile phones have evolved to the point where touch is the major interface point, making fingerprinting a logical premise. Laptops and other devices outside of the handheld realm haven't been as quick to make that transition. Now with the laptops being touch screen on many of the newer models I can definitely see an integration in the near future. The main question is, on devices that don't have this consistent touch interface what is the cost to create a biometric interface?
T Sweeney
T Sweeney,
 User Rank: Moderator
9/30/2016 | 12:31:18 PM
Re: Passwords and user behavior
I hear you on the issue of cost and multi-factor authentication, RyanSepe. Still, smartphone makers have been able to incorporate fingerprint technology into their gear without any apparent increase in the cost of the phones. So it leaves me wondering, how hard (okay, expensive) can it really be?
RyanSepe
RyanSepe,
 User Rank: Ninja
9/30/2016 | 9:24:11 AM
Re: Changing password often
I would think the potential benefit is random when changing passwords. Meaning if someone is trying to bruteforce it either via dictionary or rainbow tables if you change to a password that was previously attempted then the security principle of changes passwords benefited you. If not, then your password is just a new password that has yet to be attempted.

Can you elaborate to how changing passwords would have a negative effect? Not sure how that plays out. Thanks,
RyanSepe
RyanSepe,
 User Rank: Ninja
9/30/2016 | 9:21:54 AM
Re: Passwords and user behavior
Yes depending on your method of biometrics privacy concerns are relevant. IE retina scans can identify potential health issues which is private information.
RyanSepe
RyanSepe,
 User Rank: Ninja
9/30/2016 | 9:19:47 AM
Re: Passwords and user behavior
Yes there needs to be consistency. I believe there are laptops that open via fingerprint I am just not sure as to the efficacy of that mechanism for laptops.
Dr.T
Dr.T,
 User Rank: Ninja
9/29/2016 | 6:12:29 PM
Re: Passwords and user behavior
"... fingerprint ..." For some reason fingerprints do not pickup on other devices other than mobile phones. I always use it on my iPhone but not on my laptop. It needs to be stable and easy to use across devices.
Dr.T
Dr.T,
 User Rank: Ninja
9/29/2016 | 6:09:34 PM
Re: Passwords and user behavior
"... additional parameter is cost ..." Agree. There is cost and there is privacy issues in the alternative solutions. Our DNA clearly indnetifies us uniquelly, of course we are not allowed to use it.
Dr.T
Dr.T,
 User Rank: Ninja
9/29/2016 | 6:06:39 PM
Re: Passwords and user behavior
"... the human factor ..." Agree. We want things that are simple and not forcing us to remember things in our busy daily lives.
Dr.T
Dr.T,
 User Rank: Ninja
9/29/2016 | 6:04:33 PM
Re: Passwords and user behavior
"... Awareness and training will help marginally, ..." Mainly agree but password being the credentialing is a main problem. Not secure by nature.
Page 1 / 2   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Everything You Need to Know About DNS Attacks
It's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask. Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted. Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-33196
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
CVE-2023-33185
PUBLISHED: 2023-05-26
Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...
CVE-2023-33187
PUBLISHED: 2023-05-26
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `ty...
CVE-2023-33194
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was...
CVE-2023-2879
PUBLISHED: 2023-05-26
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file