4 ms·
Except it doesn't help with that, at all. Many people use predictable rotations (incrementing number, date appended), so if you know one, you know them all. A
by gregmac 10y ago
Except it doesn't help with that, at all.
Many people use predictable rotations (incrementing number, date appended), so if you know one, you know them all.
Also if they've shared it once, why would they not share it again? Put another way: why is making them regularly reset their password going to make them suddenly follow security protocol, when it didn't the last n times they had to change their password?
If the office thinks it's okay to share their password it's also a symptom of several things:
* Lax security environment, with not enough emphasis on security training and importance.
* Poor senior management. There should be reprimands for violating security rules, as severe as losing your job for repeat offenders, and obviously IT can't do this on their own.
* Bad work environment provided by IT. Why are they sharing passwords to begin with? Maybe the environment is overly locked-down with too many restrictions, or maybe the collaboration tools are just bad or missing.
Fix those, the password sharing stops.
- vbezhenar 10y agoIt's trivially solved by comparing new password to all previous passwords and decline if they are similar. And if they wrote their passwords on the stickers, they should be explained that it's not appropriate. I agree that this approach is not very user-friendly.
- gregmac 10y agoI don't think it's trivial to find similar password for multiple reasons. Comparing old passwords without plaintext is really hard and at best inexact. Storing them plaintext (or even reversibly encrypted) is completely stupid, of course. Even if these technical problems could be solved, sequences like: November6, December7, January8 are not "similar" but easily predictable. Even this sequence is probably not hard to figure out if you look at a keyboard: Secret1 Drvtry2 Ftbytu3 Deeper though, what security threat is this actually mitigating? Bad passwords caused by rotation requirements that are needed because of bad company policies, training and practices? Is there a security equivalent of "yak shaving"?
- vmarsy 10y agoHow would you do the comparison? Wouldn't it require storing all the previous passwords in plaintext? If only the hash and salted password is stored, as recommended, how would you know that "myOldPassword21" and "myOldPassword22" are similar ?
- apk17 10y agoYou make the modifications and store those hashes as well. Can't have a new 'similar' algo for past pws, obviously.
- xamuel 10y agoIf you store N variations, a random guess has N chances to hit one. Once an attacker knows a variation, they may be able to use it to narrow down on the real password.
- ascorbic 10y agoSame way you check if the password is correct. Check against the old hashes. When the user sets the new password, if it looks like it matches an iterative pattern (i.e. if it ends in a number) then test the previous few from that sequence against the old hashes. Note, this is still a terrible idea.
- Spooky23 10y agoI didn't say it solved all problems. I said it was there to address that issue. It does help to limit the scope of who has passwords. Certainly not a perfect solution, but it isn't completely ineffective either.
- vidarh 10y ago> It does help to limit the scope of who has passwords. Only if the rotation isn't predictable. If I receive "password3" and it doesn't work and Joe who shared it with me isn't available, I probably wouldn't think twice about trying "password4".