4 ms·

Most working professionals who aren't software developers suffer through this in some way or another. I mean, heck, let me count up all the passwords I need to

Most working professionals who aren't software developers suffer through this in some way or another. I mean, heck, let me count up all the passwords I need to do my job: * A password for the account request system * A password for the internal services system * My email password * My password for the local network * My password for the product management system * Pass for the old product management system that we still use * Pass to the online drawing and document retrieval system * Password to control room computer systems * Various maintenance laptop user names and passwords * Various passwords to systems I'd rather not mention, call them about 10 in total That's 25 to 30 passwords, total, that I need to remember and use on a regular basis. I've given up NOT writing them down. And IT won't give me any kind of secure password manager, so I resort to a password protected Excel spreadsheet. And I'm not alone.

daveguy 11y ago
Yikes. Sounds like it's time your company looked into a single sign on solution: https://en.wikipedia.org/wiki/List_of_single_sign-on_implementations https://en.wikipedia.org/wiki/List_of_single_sign-on_impleme... Or at the very least you should sign up for a password storage system like https://passpack.com https://passpack.com
- engi_nerd 11y ago
  Single sign on solutions don't work when some of the systems you sign on to are air-gapped and will never, ever, EVER be connected to any network. Other networks I access are completely separated from the greater internet. It would be useful, but single sign on would take my 25-30 passwords and shrink it to about 15. Which would be useful but would still require me to keep track of them manually.
  - ef4 11y ago
    In those cases people should be using hardware authentication tokens. They're both more usable and more secure.
    - engi_nerd 11y ago
      Try convincing the US government of that. I wish you luck (I really do). Trying to educate program security people on computers is one of the banes of my existence.
      - ef4 11y ago
        Plenty of parts of the US government do know. I've seen multiple DoD networks where hardware tokens are the required form of authentication.
        engi_nerd 11y ago
        So have I. CACs don't work on classified systems though.
      - j_s 11y ago
        https://en.wikipedia.org/wiki/Common_Access_Card https://en.wikipedia.org/wiki/Common_Access_Card
        engi_nerd 11y ago
        These don't work on all networks. Like classified networks.
- spc476 11y ago
  I have one password for the Corporation (email, VPN, various online databases, dashboards and wikis). I have another one just for requesting vacation time, because that system is run by the Corporation that owns the Corporation I work for. Then there's the password for timecards (outsourced to another company), goal setting and training (outsource to another company), 401k, medical insurance and just because, another company (that isn't our medical insurance) for handling prescriptions. Our Corporation has one password expiration timeframe (90 days but not really because they start nagging two weeks prior and won't shut up until you change the password) and the Corporation that owns The Corporation has another timeframe (60 days, but again, they start bitching about two weeks prior) and of course, all these sites have their own ideas about "secure passwords." Weren't certificates supposed to deal with all this? Wait ... don't answer that. I don't think I want to know the answer.
- soneil 11y ago
  You know what's better than single-signon? Two SSO systems! It's fantastic. Not only do you have to remember which backend each system uses, but it actually makes it harder to remember passwords for systems that don't use SSO. Especially the ones that are used irregularly (annually, quarterly), so SSO isn't a priority. My passwords are all on a whiteboard by my desk.
javajosh 11y ago
Might I at least suggest using an easy-to-execute algorithm that you can apply to your note to turn it into a real password? There are many options, from adding a prefix, a suffix, adding a small integer to every number, or some combination of these. This, I think, is about as secure as you can get since a targeted attack would just install a keylogger and be done.
- engi_nerd 11y ago
  I have a couple of things I add to each password that I don't write down. I change those things every month. That's about the best I can do.
- pdkl95 11y ago
  https://www.schneier.com/blog/archives/2005/06/write_down_your.html https://www.schneier.com/blog/archives/2005/06/write_down_yo... Even with an algorithm, you're still relying on human memory. As Schneier and other have been recommending for a long time, write down your passwords. People already understand some amount of physical security, which is knowledge that can can utilized for password storage. As long as human memory is the weakest link, password strength will always be de facto limited to the amount of entropy that a human can reasonably memorize. Unfortunately, brute-force password cracking capabilities flew past that limit a long time ago.
- agumonkey 11y ago
  A friend and I do this, but there's always a few website that will not fit your alphabet.
- Ntrails 11y ago
  My last work sent around a cardboard triangle "stand" thing which was supposed to remind us all about how much we loved working there and how important such and such policies were. So my password was set as the first 3 letters of the first 3 lines (inc capitalisation) followed by a fairly standard & [incrementing number]. It was written down right next to my computer for the first two weeks whilst I learnt it and then every other password was just a derivation of it.
rabboRubble 11y ago
Why get your own password manager and include your work items? I have 300+ personal passwords. 30 more for work would be a trivial addition.
- engi_nerd 11y ago
  Then I'm carrying around sensitive work information on a device that I control. Sure, my password protected Excel spreadsheet isn't really protected, either, but if it gets compromised on my work machine, IT at work takes the heat, not me.

daveguy 11y ago

Yikes. Sounds like it's time your company looked into a single sign on solution: https://en.wikipedia.org/wiki/List_of_single_sign-on_implementations https://en.wikipedia.org/wiki/List_of_single_sign-on_impleme... Or at the very least you should sign up for a password storage system like https://passpack.com https://passpack.com

engi_nerd 11y ago
Single sign on solutions don't work when some of the systems you sign on to are air-gapped and will never, ever, EVER be connected to any network. Other networks I access are completely separated from the greater internet. It would be useful, but single sign on would take my 25-30 passwords and shrink it to about 15. Which would be useful but would still require me to keep track of them manually.
- ef4 11y ago
  In those cases people should be using hardware authentication tokens. They're both more usable and more secure.
  - engi_nerd 11y ago
    Try convincing the US government of that. I wish you luck (I really do). Trying to educate program security people on computers is one of the banes of my existence.
    - ef4 11y ago
      Plenty of parts of the US government do know. I've seen multiple DoD networks where hardware tokens are the required form of authentication.
      - engi_nerd 11y ago
        So have I. CACs don't work on classified systems though.
    - j_s 11y ago
      https://en.wikipedia.org/wiki/Common_Access_Card https://en.wikipedia.org/wiki/Common_Access_Card
      - engi_nerd 11y ago
        These don't work on all networks. Like classified networks.
spc476 11y ago
I have one password for the Corporation (email, VPN, various online databases, dashboards and wikis). I have another one just for requesting vacation time, because that system is run by the Corporation that owns the Corporation I work for. Then there's the password for timecards (outsourced to another company), goal setting and training (outsource to another company), 401k, medical insurance and just because, another company (that isn't our medical insurance) for handling prescriptions. Our Corporation has one password expiration timeframe (90 days but not really because they start nagging two weeks prior and won't shut up until you change the password) and the Corporation that owns The Corporation has another timeframe (60 days, but again, they start bitching about two weeks prior) and of course, all these sites have their own ideas about "secure passwords." Weren't certificates supposed to deal with all this? Wait ... don't answer that. I don't think I want to know the answer.
soneil 11y ago
You know what's better than single-signon? Two SSO systems! It's fantastic. Not only do you have to remember which backend each system uses, but it actually makes it harder to remember passwords for systems that don't use SSO. Especially the ones that are used irregularly (annually, quarterly), so SSO isn't a priority. My passwords are all on a whiteboard by my desk.

javajosh 11y ago

Might I at least suggest using an easy-to-execute algorithm that you can apply to your note to turn it into a real password? There are many options, from adding a prefix, a suffix, adding a small integer to every number, or some combination of these. This, I think, is about as secure as you can get since a targeted attack would just install a keylogger and be done.

engi_nerd 11y ago
I have a couple of things I add to each password that I don't write down. I change those things every month. That's about the best I can do.
pdkl95 11y ago
https://www.schneier.com/blog/archives/2005/06/write_down_your.html https://www.schneier.com/blog/archives/2005/06/write_down_yo... Even with an algorithm, you're still relying on human memory. As Schneier and other have been recommending for a long time, write down your passwords. People already understand some amount of physical security, which is knowledge that can can utilized for password storage. As long as human memory is the weakest link, password strength will always be de facto limited to the amount of entropy that a human can reasonably memorize. Unfortunately, brute-force password cracking capabilities flew past that limit a long time ago.
agumonkey 11y ago
A friend and I do this, but there's always a few website that will not fit your alphabet.
Ntrails 11y ago
My last work sent around a cardboard triangle "stand" thing which was supposed to remind us all about how much we loved working there and how important such and such policies were. So my password was set as the first 3 letters of the first 3 lines (inc capitalisation) followed by a fairly standard & [incrementing number]. It was written down right next to my computer for the first two weeks whilst I learnt it and then every other password was just a derivation of it.

rabboRubble 11y ago

Why get your own password manager and include your work items? I have 300+ personal passwords. 30 more for work would be a trivial addition.

engi_nerd 11y ago
Then I'm carrying around sensitive work information on a device that I control. Sure, my password protected Excel spreadsheet isn't really protected, either, but if it gets compromised on my work machine, IT at work takes the heat, not me.