9 ms·

> Fuck Off 45. He hates computers.’ > ‘Why forty-five?’ > ‘It’s the forty-fifth month since we signed onto that hospital’s system and one has to change the pa

> Fuck Off 45. He hates computers.’ > ‘Why forty-five?’ > ‘It’s the forty-fifth month since we signed onto that hospital’s system and one has to change the password every month,’ Caroline replied. Every month is a little aggressive of a timeline. Also, stop making users do your bizarre regex passwords. * include caps * include numbers * include symbol * eight charachters * must be recursive backronym Also, stop trying to keep password requirements secret. I am sick of this guessing game. I can relate to Mr. Johnson's total indifference to the system.

gregmac 11y ago
I have seen passwords like "Fall2013!". Bet you can't guess how often they had to change their password.. or what this user's current password is.... But yes, IT admins, go on thinking if you just finely craft and tune your password policy enough you'll make users come up with secure passwords.
- numbsafari 11y ago
  ... when the policy is to change your password every quarter, and include a mix of case and punctuation, the policy is to use the season, the year, and an exclamation point. I worked at a place where you could log in to just about anyone's account because our managers literally told us to take this approach so that we'd be less likely to forget what our password was.
serge2k 11y ago
If you don't you end up with bad passwords. Maybe we should just get rid of the damn passwords and replace them with a system that makes it easier to remember and use without compromising security. At the very least one password + a smartcard system would be way easier. You enter your password once then you just have to swipe your card when you login to another system.
- deleted 11y ago
  [deleted]
- gozo 11y ago
  Not entirely sure why you're being downvoted. Sun terminals have had smartcard access for, what, 15 years? (Yes, for hospitals). It's a good idea. Some sort of complementary directional RFID might be even better. E.g. https://www.youtube.com/watch?v=R497CzmKyVQ&t=38s https://www.youtube.com/watch?v=R497CzmKyVQ&t=38s
  - pdkl95 11y ago
    > RFID Adding radio as a primary component in a security system is always going to be a bad idea. Security is hard enough without adding in the possibility of 3rd parties hearing the protoocol - or worse. > directional A common misunderstanding of radio is the belief that it can be contained in an area. Unless you're building a proper Faraday cage (which is hard), the ability to hear a transmmission often depends on the receiving antenna. For convenience without involving radio, one simply has to get creative. Something like the (defunct) Java Ring[1] would allow most of the ease-of-use of RFID (possibly with a simple proximity sensor for auto-logout, if needed). [1] http://electronics.howstuffworks.com/gadgets/home/digital-jewelry3.htm http://electronics.howstuffworks.com/gadgets/home/digital-je... edit: fixed typo
    - jjoonathan 11y ago
      > Security is hard enough without adding in the possibility of 3rd parties hearing the protoocol Asymmetric encryption is not that hard. In fact, you were using it while complaining about the problem it solves. > Garaday Faraday. > the ability to hear a transmmission often depends on the receiving antenna So even if you somehow get past the asymmetric crypto you need RF expertise and a special antenna to mount the attack from more than a foot away? And not even a special antenna beyond a few miles? I'd call that "defense in depth," not a flaw. > http://electronics.howstuffworks.com/gadgets/home/digital-jewelry3.htm http://electronics.howstuffworks.com/gadgets/home/digital-je... Just what do you think "digital jewelry" can do that a smartcard can't?
      - pdkl95 11y ago
        > > Garady Thanks, typo fixed. > Asymmetric encryption ...doesn't protect against everything. Not letting people hear the asymmetric encryption is even better. > special antenna Cantennas are easy, and you should never underestimate the amount of technology people will throw at an attack. Consider, for example, the people that made ATM shims that captured the card data while recording the PIN being entered on the keypad. > "defense in depth" Defense in depth would be using cryto while requiring a physical connection. > smartcard A smartcard is fine - my argument is against RFID. A card that requires an electrical or inductive connection isn't going to leak everything over the radio. My suggestion of "digital jewelry" is merely an example of how the form of the smartcard is flexible. Creativity in this area could allow for some easier to use devices, which could be important in places like hospitals.
- camgunz 11y ago
  You end up with bad passwords anyway (like Fuck Off 45). Or you end up with everyone using the same account, or post-it notes with passwords, or notebooks with passwords, or an email draft with passwords. I've seen smartcards have the best impact. Yeah sure they can be swiped or forged, but compared to the real, effective security of passwords, they're much better. You also can't lock yourself out of a smartcard system. You can forget your card at home, but it's easy to just reissue a new card and invalidate the old one (throw it away when you get home, it's just a hunk of plastic now).
- Joof 11y ago
  I had this thought years ago. A smartcard coupled with a biometric seems easier to use and more secure. Even just a card. You can only have one per person (as opposed to passwords that can have infinite copies and are likely to be unknowingly compromised) and if a card is lost, it can be expected that it will be replaced shortly so long as the replacement process is painless which seals the leak.
ArcticCelt 11y ago
Having an insanely strict password policy is begging for having 60% of the passwords written on a post it near the keyboard of every user.
- bigger_cheese 11y ago
  Yes that happens at my work - most workers have a post-it notes on the side of their monitors with various passwords written down - real secure. Anything requiring permissions, passwords, group policy etc is a complete nightmare. I had this gem when I emailed Information Services this morning. My email: "XXX has left the company and I've taken over their role Can you please remove them as Owner of the following sharepoint site: YYY and make me the Owner instead." IS's reply: "Please fill out a trouble ticket *" I proceed to fill in a digital form 2 hours later I get a terse reply. "Hi ZZZZ please contact the owner of site YYY and get them to adjust your permission. We are now closing your ticket."
- unprepare 11y ago
  Unfortunately, not having a strict password policy very likely violates HIPAA. I dont think anyone wants to be the one to reduce the security of the HIPAA requirements.
  - iofj 11y ago
    Also password policy not strict -> IT manager gets blamed in case of issue password written down -> sucker who wrote it down gets blamed in case of issue Person who decides policy is IT manager... Cover your ass politics.
- scrupulusalbion 11y ago
  Assuming at least some users are going to write down their passwords, I wonder if it would be appropriate to show them more secure ways to do that. Unfortunately, my "better" way is to stuff the sticky note in my wallet. If I could find a device (w/ touch or keyboard for input) that fit into my pocket and has no wireless capabilities, then I would probably use that as a password manager.
defibrelaxing 11y ago
My smartphone has touch ID. would it be feasible to implement "touch ID on phone >> phone connects to computer >> computer automatically logs in"?
- throwaway_xgqtr 11y ago
  These things have been around forever, no need for all that complexity: http://www.amazon.com/Digital-Persona-U-are-U-4500-Fingerprint/dp/B0029MYO72 http://www.amazon.com/Digital-Persona-U-are-U-4500-Fingerpri...
- sp332 11y ago
  Fingerprints are moderately easy to forge, and you can't issue new ones once they are compromised.
- USAnum1 11y ago
  At Microsoft I can use [Azure Authenticator](https://itunes.apple.com/us/app/azure-authenticator/id983156458?mt=8 https://itunes.apple.com/us/app/azure-authenticator/id983156...) as a second factor to my password for company resources. It's got touch ID support, so frankly I find the added security super pain-free. Full disclosure: I work at Microsoft, but not on Azure Auth.
ww520 11y ago
Not sure why the bad password policies keep creeping up. May be because of regulatory compliance?
- mikeash 11y ago
  Strict password policies are easy to implement and feel secure, even if they don't actually help.
  - cema 11y ago
    I think both factors are at work: what you said (the feeling of security) and what the parent said (compliance).
grittathh 11y ago
One of the hospitals I rotate in has solved this by having you physically scan your nametag (just like unlocking any of the doors) to log in, log out, and whenever else your credentials are needed. It works pretty well, and no passwords to remember once it's set up.
- x1798DE 11y ago
  So anyone with your badge (or a copy of it) can authenticate as you? Seems a bit dangerous to me. A second factor seems like it would be prudent.
dllthomas 11y ago
"must be recursive backronym" I would be fascinated to know how you determine that with a regex. Unless it's a manually maintained list of known recursive backronyms...

gregmac 11y ago

I have seen passwords like "Fall2013!". Bet you can't guess how often they had to change their password.. or what this user's current password is.... But yes, IT admins, go on thinking if you just finely craft and tune your password policy enough you'll make users come up with secure passwords.

numbsafari 11y ago
... when the policy is to change your password every quarter, and include a mix of case and punctuation, the policy is to use the season, the year, and an exclamation point. I worked at a place where you could log in to just about anyone's account because our managers literally told us to take this approach so that we'd be less likely to forget what our password was.

serge2k 11y ago

If you don't you end up with bad passwords. Maybe we should just get rid of the damn passwords and replace them with a system that makes it easier to remember and use without compromising security. At the very least one password + a smartcard system would be way easier. You enter your password once then you just have to swipe your card when you login to another system.

deleted 11y ago
[deleted]
gozo 11y ago
Not entirely sure why you're being downvoted. Sun terminals have had smartcard access for, what, 15 years? (Yes, for hospitals). It's a good idea. Some sort of complementary directional RFID might be even better. E.g. https://www.youtube.com/watch?v=R497CzmKyVQ&t=38s https://www.youtube.com/watch?v=R497CzmKyVQ&t=38s
- pdkl95 11y ago
  > RFID Adding radio as a primary component in a security system is always going to be a bad idea. Security is hard enough without adding in the possibility of 3rd parties hearing the protoocol - or worse. > directional A common misunderstanding of radio is the belief that it can be contained in an area. Unless you're building a proper Faraday cage (which is hard), the ability to hear a transmmission often depends on the receiving antenna. For convenience without involving radio, one simply has to get creative. Something like the (defunct) Java Ring[1] would allow most of the ease-of-use of RFID (possibly with a simple proximity sensor for auto-logout, if needed). [1] http://electronics.howstuffworks.com/gadgets/home/digital-jewelry3.htm http://electronics.howstuffworks.com/gadgets/home/digital-je... edit: fixed typo
  - jjoonathan 11y ago
    > Security is hard enough without adding in the possibility of 3rd parties hearing the protoocol Asymmetric encryption is not that hard. In fact, you were using it while complaining about the problem it solves. > Garaday Faraday. > the ability to hear a transmmission often depends on the receiving antenna So even if you somehow get past the asymmetric crypto you need RF expertise and a special antenna to mount the attack from more than a foot away? And not even a special antenna beyond a few miles? I'd call that "defense in depth," not a flaw. > http://electronics.howstuffworks.com/gadgets/home/digital-jewelry3.htm http://electronics.howstuffworks.com/gadgets/home/digital-je... Just what do you think "digital jewelry" can do that a smartcard can't?
    - pdkl95 11y ago
      > > Garady Thanks, typo fixed. > Asymmetric encryption ...doesn't protect against everything. Not letting people hear the asymmetric encryption is even better. > special antenna Cantennas are easy, and you should never underestimate the amount of technology people will throw at an attack. Consider, for example, the people that made ATM shims that captured the card data while recording the PIN being entered on the keypad. > "defense in depth" Defense in depth would be using cryto while requiring a physical connection. > smartcard A smartcard is fine - my argument is against RFID. A card that requires an electrical or inductive connection isn't going to leak everything over the radio. My suggestion of "digital jewelry" is merely an example of how the form of the smartcard is flexible. Creativity in this area could allow for some easier to use devices, which could be important in places like hospitals.
camgunz 11y ago
You end up with bad passwords anyway (like Fuck Off 45). Or you end up with everyone using the same account, or post-it notes with passwords, or notebooks with passwords, or an email draft with passwords. I've seen smartcards have the best impact. Yeah sure they can be swiped or forged, but compared to the real, effective security of passwords, they're much better. You also can't lock yourself out of a smartcard system. You can forget your card at home, but it's easy to just reissue a new card and invalidate the old one (throw it away when you get home, it's just a hunk of plastic now).
Joof 11y ago
I had this thought years ago. A smartcard coupled with a biometric seems easier to use and more secure. Even just a card. You can only have one per person (as opposed to passwords that can have infinite copies and are likely to be unknowingly compromised) and if a card is lost, it can be expected that it will be replaced shortly so long as the replacement process is painless which seals the leak.

ArcticCelt 11y ago

Having an insanely strict password policy is begging for having 60% of the passwords written on a post it near the keyboard of every user.

bigger_cheese 11y ago
Yes that happens at my work - most workers have a post-it notes on the side of their monitors with various passwords written down - real secure. Anything requiring permissions, passwords, group policy etc is a complete nightmare. I had this gem when I emailed Information Services this morning. My email: "XXX has left the company and I've taken over their role Can you please remove them as Owner of the following sharepoint site: YYY and make me the Owner instead." IS's reply: "Please fill out a trouble ticket *" I proceed to fill in a digital form 2 hours later I get a terse reply. "Hi ZZZZ please contact the owner of site YYY and get them to adjust your permission. We are now closing your ticket."
unprepare 11y ago
Unfortunately, not having a strict password policy very likely violates HIPAA. I dont think anyone wants to be the one to reduce the security of the HIPAA requirements.
- iofj 11y ago
  Also password policy not strict -> IT manager gets blamed in case of issue password written down -> sucker who wrote it down gets blamed in case of issue Person who decides policy is IT manager... Cover your ass politics.
scrupulusalbion 11y ago
Assuming at least some users are going to write down their passwords, I wonder if it would be appropriate to show them more secure ways to do that. Unfortunately, my "better" way is to stuff the sticky note in my wallet. If I could find a device (w/ touch or keyboard for input) that fit into my pocket and has no wireless capabilities, then I would probably use that as a password manager.

defibrelaxing 11y ago

My smartphone has touch ID. would it be feasible to implement "touch ID on phone >> phone connects to computer >> computer automatically logs in"?

throwaway_xgqtr 11y ago
These things have been around forever, no need for all that complexity: http://www.amazon.com/Digital-Persona-U-are-U-4500-Fingerprint/dp/B0029MYO72 http://www.amazon.com/Digital-Persona-U-are-U-4500-Fingerpri...
sp332 11y ago
Fingerprints are moderately easy to forge, and you can't issue new ones once they are compromised.
USAnum1 11y ago
At Microsoft I can use [Azure Authenticator](https://itunes.apple.com/us/app/azure-authenticator/id983156458?mt=8 https://itunes.apple.com/us/app/azure-authenticator/id983156...) as a second factor to my password for company resources. It's got touch ID support, so frankly I find the added security super pain-free. Full disclosure: I work at Microsoft, but not on Azure Auth.

ww520 11y ago

Not sure why the bad password policies keep creeping up. May be because of regulatory compliance?

mikeash 11y ago
Strict password policies are easy to implement and feel secure, even if they don't actually help.
- cema 11y ago
  I think both factors are at work: what you said (the feeling of security) and what the parent said (compliance).

grittathh 11y ago

One of the hospitals I rotate in has solved this by having you physically scan your nametag (just like unlocking any of the doors) to log in, log out, and whenever else your credentials are needed. It works pretty well, and no passwords to remember once it's set up.

x1798DE 11y ago
So anyone with your badge (or a copy of it) can authenticate as you? Seems a bit dangerous to me. A second factor seems like it would be prudent.

dllthomas 11y ago

"must be recursive backronym" I would be fascinated to know how you determine that with a regex. Unless it's a manually maintained list of known recursive backronyms...