4 ms·

So you could hack into any of their accounts by using password recovery mechanisms. Sounds like a bad idea.

by elcomet 6y ago

Consultant32452 6y ago
Yes, exactly. It's kind of like the obtuse password rules which result in people writing their passwords on post-it notes stuck to their monitor. The net security result is worse.
- throwaway0a5e 6y ago
  >The net security result is worse. Depends on what you're looking for. Secure password written on a monitor (or on a pad in a locked drawer) is better than using "Passw0rd" (or some other trivial to the point of uselessness password that all the scripts will try) for most use cases assuming you have some semblance of physical security. Your coworker might login as you and F up something but some guy in Nigeria or Belarus is much less likely to encrypt the network share than if you had chosen the former. Just like everything else in security it's all about what your threat model is and what the trade-offs are. Edit: do any of the people who are offended by my statement care to explain why it is so disagreeable to them?
  - leghifla 6y ago
    You think you are safe, until a TV crew broadcast your post-it worldwide. It is not made up, it happened to TV5Monde in 2015
    - throwaway0a5e 6y ago
      That's like the computer security equivalent of some rare disease that's only happened to a couple dozen people. Sure, one can win cheap virtue points by insisting it's something we need to take seriously and yes it is easy to guard against but it shouldn't be a realistic part of pretty much anyone's threat model. Given the choice of a pad of paper in a locked drawer (i.e. analog password manager) and sticky not obviously the sticky note is inferior but both are superior to having something that is trivially easy to compromise without having physical access to the workplace.
  - Consultant32452 6y ago
    Are most attacks inside jobs?

4 ms·

So you could hack into any of their accounts by using password recovery mechanisms. Sounds like a bad idea.

by elcomet 6y ago

So you could hack into any of their accounts by using password recovery mechanisms. Sounds like a bad idea.

Consultant32452 6y ago
Yes, exactly. It's kind of like the obtuse password rules which result in people writing their passwords on post-it notes stuck to their monitor. The net security result is worse.
- throwaway0a5e 6y ago
  >The net security result is worse. Depends on what you're looking for. Secure password written on a monitor (or on a pad in a locked drawer) is better than using "Passw0rd" (or some other trivial to the point of uselessness password that all the scripts will try) for most use cases assuming you have some semblance of physical security. Your coworker might login as you and F up something but some guy in Nigeria or Belarus is much less likely to encrypt the network share than if you had chosen the former. Just like everything else in security it's all about what your threat model is and what the trade-offs are. Edit: do any of the people who are offended by my statement care to explain why it is so disagreeable to them?
  - leghifla 6y ago
    You think you are safe, until a TV crew broadcast your post-it worldwide. It is not made up, it happened to TV5Monde in 2015
    - throwaway0a5e 6y ago
      That's like the computer security equivalent of some rare disease that's only happened to a couple dozen people. Sure, one can win cheap virtue points by insisting it's something we need to take seriously and yes it is easy to guard against but it shouldn't be a realistic part of pretty much anyone's threat model. Given the choice of a pad of paper in a locked drawer (i.e. analog password manager) and sticky not obviously the sticky note is inferior but both are superior to having something that is trivially easy to compromise without having physical access to the workplace.
  - Consultant32452 6y ago
    Are most attacks inside jobs?