Comments
Why Relaxing Our Password Policies Might Actually Bolster User Safety
Newest First  |  Oldest First  |  Threaded View
REISEN1955
100%
0%
REISEN1955,
User Rank: Ninja
9/26/2017 | 3:47:16 PM
Re: Great Article, passed this one to Security
Like it or not, 2 factor authentication is the future and it should be used NOW!!!
jenshadus
50%
50%
jenshadus,
User Rank: Strategist
9/26/2017 | 2:56:05 PM
Great Article, passed this one to Security
They want to lock down everything and lock it down with the multifactor authentication.  Easier passwords would be better and probably more security with this approach.  I don't use anything resembling my life, just passing obscure merchandise sitting on my desk.  Those come and go more frequently that the password change.
REISEN1955
100%
0%
REISEN1955,
User Rank: Ninja
9/13/2017 | 3:29:36 PM
Equifax Website in Argentina
Was held secure by the totally unique and innovative user-password combo of " admin \ admin " !!!!
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
9/12/2017 | 3:23:32 PM
Re: My password advice
True to the extent that hobby interests are revealed on social media.  Still a better choice and if i could mentally manage a random password generator (they exist) === great.  I suppose a good code to use would be an MD5 HASH of a file!!!!!  Let somebody try to crack that one AS LONG AS THE FILE ITSELF is not advertised. 
ScottyTheMenace
50%
50%
ScottyTheMenace,
User Rank: Apprentice
9/12/2017 | 2:48:33 PM
Re: My password advice
The problem with using hobbies is the same problem with using any other personal information: it's not at all hard to figure out for most people and actually as easy to hack as any of the standard security questions. Hobbies are one of the things people share most on social, especially on sites like Pinterest and Instagram that are practically custom built for sharing hobbies. Any bad actor targeting someone can scan someone's social feed for hobbies, and they'd also be included in any breach dumps for purchase on the black market.

The most secure passwords have no connection to our personal lives.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
9/12/2017 | 11:00:08 AM
My password advice
Hard to figure out - easy to remember, right?  So "erwnhgkjnwkj21" is not a good choice.  People have one universal weird interest -  HOBBIES - things we like and enjoy that we NEVER FORGET as individuals.  So I urge my password recommendation to be a combination of 2 hobby terms and a weird character between them.  Almost impossible to hack and easy for the user to remember.  Easy to sequence too. 
galoot
50%
50%
galoot,
User Rank: Apprentice
9/12/2017 | 3:17:03 AM
The UK Government recommended similar policies in January 2016
The UK goverment recommendations for passwords https://www.ncsc.gov.uk/guidance/password-guidance-simplifying-your-approach have a lot of similarities to those in this article. 
ScottyTheMenace
50%
50%
ScottyTheMenace,
User Rank: Apprentice
9/11/2017 | 5:40:16 PM
Excellent advice all around - here's a trick I use for KBA
Thanks for this great article. I'm glad NIST is leading the way on this.

My biggest complaint about well-meaning security policies is exactly what you're saying here: they're so damn complex and annoying that they actually encourage bad password practices. Stop the madness!

One trick I use (besides a password manager) is regarding KBA. As you say, most of the answers to security questions can be found on social media or simple web searches. My solution? Fake it. I created a fictional "life" and use that information. You only needed a few pieces of information (stored securely in an encrypted password manager lest you forget): male & female name (for any person variant), car model, two wild cards (one for city/school/street and one for school mascot/pet/etc.), and perhaps one random word for more obscure questions. Make them memorable but wholly unrelated to your life and I think it's a pretty secure alternative if you need to create these security questions. If you use a password manager you could even go a step further and use unique fake answers for each account. You might get a free tin foil hat for doing that. :)

Hopefully MFA will become ubiquitous very soon and make even this little trick obsolete.


Why Security Leaders Can't Afford to Be Just 'Left-Brained'
Bill Bradley, SVP, Cyber Engineering and Technical Services, CenturyLink,  10/17/2017
Secure Wifi Hijacked by KRACK Vulns in WPA2
Jai Vijayan, Freelance writer,  10/16/2017
Game Change: Meet the Mach37 Fall Startups
Ericka Chickowski, Contributing Writer, Dark Reading,  10/18/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.