4 ms·

I thought the second part of his conclusion was a bit hasty: "... and change all your logins every six months at least." Does he have any idea how impractical

I thought the second part of his conclusion was a bit hasty: "... and change all your logins every six months at least." Does he have any idea how impractical this is? If I could even remember every login I ever made, it would probably take more than 12 hours to do the manual labor of changing the password for them. No thank you!

keeperofdakeys 15y ago
I think it is more for your important services. Also, if you are using a password manager, you DO have every password you ever made.
city41 15y ago
Forced changing of passwords every x months is pretty common in the workplace, especially if the company is Windows based. The problem is it's so easy to make your passwords be <root>+1, then <root>+2, etc. I've worked at places that detected that pattern and didn't allow it, so I would just hold down the shift key and iterate anyway, yielding <root>+!, then <root>+@, <root>+#, etc. So even forcing your users to change their passwords will most likely cause them to find a way around it. IMO the problem is passwords are inherently a flawed concept. We need something better. Hopefully biometrics can truly solve this problem one day.
- bluesmoon 15y ago
  biometrics will still require a fallback for any general purpose system. For example, you can't require fingerprints because there's a chance you'll get users without fingers. You can't require retinal scans because there's a chance you'll get users without eyes. You could probably ask the user to spit and check their DNA, but there's a higher chance of spreading disease that way. Eventually you'll need a fallback of a password/key, and if I were an attacker, I'd always attack the fallback (it's often the least well thought out part of auth).
  - sesqu 15y ago
    Also, fingerprints erode with certain professions and are susceptible to environmental things like sweat and dirt. Retinas change with disease and pregnancy. DNA is far too expensive to use daily, unless you restrict their accuracy to populations.
    - JoeAltmaier 15y ago
      ...and biometrics are not authentication, just simple access control. Many, many of us have the same biometrics - its a hash. Its hardly better than a garage door opener.
- iaskwhy 15y ago
  There's always a really simple solution to those rules: post-its.

keeperofdakeys 15y ago

I think it is more for your important services. Also, if you are using a password manager, you DO have every password you ever made.

city41 15y ago

Forced changing of passwords every x months is pretty common in the workplace, especially if the company is Windows based. The problem is it's so easy to make your passwords be <root>+1, then <root>+2, etc. I've worked at places that detected that pattern and didn't allow it, so I would just hold down the shift key and iterate anyway, yielding <root>+!, then <root>+@, <root>+#, etc. So even forcing your users to change their passwords will most likely cause them to find a way around it. IMO the problem is passwords are inherently a flawed concept. We need something better. Hopefully biometrics can truly solve this problem one day.

bluesmoon 15y ago
biometrics will still require a fallback for any general purpose system. For example, you can't require fingerprints because there's a chance you'll get users without fingers. You can't require retinal scans because there's a chance you'll get users without eyes. You could probably ask the user to spit and check their DNA, but there's a higher chance of spreading disease that way. Eventually you'll need a fallback of a password/key, and if I were an attacker, I'd always attack the fallback (it's often the least well thought out part of auth).
- sesqu 15y ago
  Also, fingerprints erode with certain professions and are susceptible to environmental things like sweat and dirt. Retinas change with disease and pregnancy. DNA is far too expensive to use daily, unless you restrict their accuracy to populations.
  - JoeAltmaier 15y ago
    ...and biometrics are not authentication, just simple access control. Many, many of us have the same biometrics - its a hash. Its hardly better than a garage door opener.
iaskwhy 15y ago
There's always a really simple solution to those rules: post-its.