4 ms·
"password re-use across an environment is endemic..." What is the solution against this? I just can't identify with the "D’OH!". People want to get their work d
by krisoft 7y ago
"password re-use across an environment is endemic..." What is the solution against this? I just can't identify with the "D’OH!". People want to get their work done. They will use whatever gets the job done. If there is an easier, better way they will use that. So how can we provide them systems where the easier, better way is also safer? What is the current best practice in this area?
- pas 7y agoSmart cards with NFC? YubiKeys with the button? A small personal password plus the second factor should work well enough on ships.
- freeone3000 7y agoIf you can do the second factor, why bother with the password?
- PeterisP 7y agoA simple password or a pin code does mitigate quick attacks of opportunity using lost or stolen physical factor; and adds non-repudiation if someone uses someone else's token - you can't just say "oh we must have accidentally swapped our cards at lunch" if you had to enter their pin as well.
- freeone3000 7y agoGiven the existing password hygiene, I think it's more likely that any new PIN or password would be treated in the same manner as the existing ones, and would just be an additional hassle.
- yencabulator 7y agoSerious question: How often do such employees/contractors claim to have accidentally swapped keys at lunch?
- seer 7y agoI would love to know this as well. The rise of 2FA has made everything more secure for sure, but it has made usability plummet like a rock on Jupiter. Especially in a corporate environment where you have multiple layers of tokens, authenticators and passwords. Password managers do help, but you still need to click and enter and copy paste many many times a day. If only someone like apple / microsoft / google came up with a comprehensive solution to all this - as they seem to be the only entities big enough to shoulder such a monumental task. I mean Apple sorta kinda does, but only for its own services. I have an apple watch, it knows that its me and its authenticated. The proximity with my laptop unlocks it automatically - so far so good, but why can’t I use the same thing for github/google/microsoft websites? Why can’t safari send some sort of token through to then authenticating that its me? I mean if you’re afraid it might be someone else at the computer - _check the damn watch proximity again_! And if there’s a need for personas - sure but they are all still linked to me. I would imagine there could be like a system dialog where I choose which persona to send to a specific site/app. /rant
- briffle 7y agoI can't imagine 2FA on something like a ship at sea, that may or may not have a working uplink to high latency satellite internet, and probably not SMS that many 2FA providers use.
- rkangel 7y agoWhich is why your second factor would be a physical key, authenticated locally. 2FA doesn't have to require internet access, it just needs two factors!
- yjftsjthsd-h 7y agoTOTP and U2F should both work fine with no network connectivity.
- bena 7y agoSecurity and access aren't separate concerns. They are opposite sides of the spectrum. Security reduces access. That is what it is designed to do. Anything that makes a system more accessible makes it less secure.
- csours 7y agoI don't know either. If you visit any manufacturing plant, you'll see passwords written in permanent marker on pretty much every enclosure. Maybe badge swipe and personal pin? (how long until the pin gets written on the badge?)
- ISL 7y agoFor some threat models, that is okay. Indeed, for many manufacturing machines, there is no need for a login screen -- it is simply something intrinsic to modern OS design.