Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Why Relaxing Our Password Policies Might Actually Bolster User Safety
Oldest First  |  Newest First  |  Threaded View
ScottyTheMenace
50%
50%
ScottyTheMenace,
User Rank: Strategist
9/11/2017 | 5:40:16 PM
Excellent advice all around - here's a trick I use for KBA
Thanks for this great article. I'm glad NIST is leading the way on this.

My biggest complaint about well-meaning security policies is exactly what you're saying here: they're so damn complex and annoying that they actually encourage bad password practices. Stop the madness!

One trick I use (besides a password manager) is regarding KBA. As you say, most of the answers to security questions can be found on social media or simple web searches. My solution? Fake it. I created a fictional "life" and use that information. You only needed a few pieces of information (stored securely in an encrypted password manager lest you forget): male & female name (for any person variant), car model, two wild cards (one for city/school/street and one for school mascot/pet/etc.), and perhaps one random word for more obscure questions. Make them memorable but wholly unrelated to your life and I think it's a pretty secure alternative if you need to create these security questions. If you use a password manager you could even go a step further and use unique fake answers for each account. You might get a free tin foil hat for doing that. :)

Hopefully MFA will become ubiquitous very soon and make even this little trick obsolete.
galoot
50%
50%
galoot,
User Rank: Apprentice
9/12/2017 | 3:17:03 AM
The UK Government recommended similar policies in January 2016
The UK goverment recommendations for passwords https://www.ncsc.gov.uk/guidance/password-guidance-simplifying-your-approach have a lot of similarities to those in this article. 
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
9/12/2017 | 11:00:08 AM
My password advice
Hard to figure out - easy to remember, right?  So "erwnhgkjnwkj21" is not a good choice.  People have one universal weird interest -  HOBBIES - things we like and enjoy that we NEVER FORGET as individuals.  So I urge my password recommendation to be a combination of 2 hobby terms and a weird character between them.  Almost impossible to hack and easy for the user to remember.  Easy to sequence too. 
ScottyTheMenace
50%
50%
ScottyTheMenace,
User Rank: Strategist
9/12/2017 | 2:48:33 PM
Re: My password advice
The problem with using hobbies is the same problem with using any other personal information: it's not at all hard to figure out for most people and actually as easy to hack as any of the standard security questions. Hobbies are one of the things people share most on social, especially on sites like Pinterest and Instagram that are practically custom built for sharing hobbies. Any bad actor targeting someone can scan someone's social feed for hobbies, and they'd also be included in any breach dumps for purchase on the black market.

The most secure passwords have no connection to our personal lives.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
9/12/2017 | 3:23:32 PM
Re: My password advice
True to the extent that hobby interests are revealed on social media.  Still a better choice and if i could mentally manage a random password generator (they exist) === great.  I suppose a good code to use would be an MD5 HASH of a file!!!!!  Let somebody try to crack that one AS LONG AS THE FILE ITSELF is not advertised. 
REISEN1955
100%
0%
REISEN1955,
User Rank: Ninja
9/13/2017 | 3:29:36 PM
Equifax Website in Argentina
Was held secure by the totally unique and innovative user-password combo of " admin \ admin " !!!!
jenshadus
50%
50%
jenshadus,
User Rank: Strategist
9/26/2017 | 2:56:05 PM
Great Article, passed this one to Security
They want to lock down everything and lock it down with the multifactor authentication.  Easier passwords would be better and probably more security with this approach.  I don't use anything resembling my life, just passing obscure merchandise sitting on my desk.  Those come and go more frequently that the password change.
REISEN1955
100%
0%
REISEN1955,
User Rank: Ninja
9/26/2017 | 3:47:16 PM
Re: Great Article, passed this one to Security
Like it or not, 2 factor authentication is the future and it should be used NOW!!!


COVID-19: Latest Security News & Commentary
Dark Reading Staff 11/19/2020
How to Identify Cobalt Strike on Your Network
Zohar Buber, Security Analyst,  11/18/2020
New Proposed DNS Security Features Released
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: A GONG is as good as a cyber attack.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15246
PUBLISHED: 2020-11-23
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.421 and before version 1.0.469, an attacker can read local files on an October CMS server via a specially crafted request. Issue has been patched in Build 469 (v1.0.469) and v...
CVE-2020-15247
PUBLISHED: 2020-11-23
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.469, an authenticated backend user with the cms.manage_pages, cms.manage_layouts, or cms.manage_partials permissions who would normally not be permi...
CVE-2020-15248
PUBLISHED: 2020-11-23
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.470, backend users with the default "Publisher" system role have access to create & manage users where they can choose which role the ...
CVE-2020-15249
PUBLISHED: 2020-11-23
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.469, backend users with access to upload files were permitted to upload SVG files without any sanitization applied to the uploaded files. Since SVG ...
CVE-2020-28927
PUBLISHED: 2020-11-23
There is a Stored XSS in Magicpin v2.1 in the User Registration section. Each time an admin visits the manage user section from the admin panel, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload.