4 ms·

I argue that most compromises are effectively instantaneous. There’s usually little value in being a persistent threat when it takes only a moment to, for examp

I argue that most compromises are effectively instantaneous. There’s usually little value in being a persistent threat when it takes only a moment to, for example, dump a database or an IMAP folder. Forcing rapid rotations just encourages people to choose weak passwords or store them on post it notes on their screen.

snowwrestler 8y ago
And groups that value persistence (like APTs) rarely depend on passwords to provide it. Instead they map the environment and find a local vulnerability to exploit and create a place to hang out. One of my employers had the Chinese in their networks for years. We all dutifully changed our passwords every 90 days and it made no difference at all to the Chinese persistence.
- RL_Quine 8y ago
  Right. The classic is an email account is compromised, a forward to rule is added, and nobody ever notices. It’s a false sense of security if preventing persistence is the goal. Usually instantaneous access is going to be the most disastrous effect anyway.
tialaramex 8y ago
I don't buy the first part of what you wrote. For the second part, I agree but we need to cut it out with the band-aids. Passwords are not good enough, whatever the policies. One of the few things I miss from my old job was the very intimate view of how much personal data is being stolen (or obtained through phishing) by crooks. If you imagine HIBP as a normal two storey house, and then imagine the data I was looking at and that's an Eiffel tower, or more. And although some fraction of the feed every day was new (in the sense that we'd not seen it in the last 90 days, we deliberately destroyed it after 90 days so who knows before that) there was also lots of recycling. There are crooks still selling a SQL dump they got in early August by October, maybe they aren't getting top dollar for it, but it's shifting. And the data people are buying for those "We know your password and if you don't pay us a Bitcoin we'll release webcam images of you masturbating" scams is much older. One of my bait accounts still gets those every few weeks, I used it for bait in a system that we know was broken into (though it isn't public in HIBP or whatever) by 2013. So while those bitcoin scam people aren't using it for account break-ins, it's still out there and represents a threat.

snowwrestler 8y ago

And groups that value persistence (like APTs) rarely depend on passwords to provide it. Instead they map the environment and find a local vulnerability to exploit and create a place to hang out. One of my employers had the Chinese in their networks for years. We all dutifully changed our passwords every 90 days and it made no difference at all to the Chinese persistence.

RL_Quine 8y ago
Right. The classic is an email account is compromised, a forward to rule is added, and nobody ever notices. It’s a false sense of security if preventing persistence is the goal. Usually instantaneous access is going to be the most disastrous effect anyway.

tialaramex 8y ago

I don't buy the first part of what you wrote. For the second part, I agree but we need to cut it out with the band-aids. Passwords are not good enough, whatever the policies. One of the few things I miss from my old job was the very intimate view of how much personal data is being stolen (or obtained through phishing) by crooks. If you imagine HIBP as a normal two storey house, and then imagine the data I was looking at and that's an Eiffel tower, or more. And although some fraction of the feed every day was new (in the sense that we'd not seen it in the last 90 days, we deliberately destroyed it after 90 days so who knows before that) there was also lots of recycling. There are crooks still selling a SQL dump they got in early August by October, maybe they aren't getting top dollar for it, but it's shifting. And the data people are buying for those "We know your password and if you don't pay us a Bitcoin we'll release webcam images of you masturbating" scams is much older. One of my bait accounts still gets those every few weeks, I used it for bait in a system that we know was broken into (though it isn't public in HIBP or whatever) by 2013. So while those bitcoin scam people aren't using it for account break-ins, it's still out there and represents a threat.