5 ms·

It is really interesting how long we have collectively tolerated, and continue to tolerate, many counterproductive password policies and password-related softwa

by triska 5y ago

It is really interesting how long we have collectively tolerated, and continue to tolerate, many counterproductive password policies and password-related software problems and limitations that are explained in the linked talk and that affect many different software products, such as not being able to enter very long passwords in many applications, or having to change the password periodically. The xkcd quote mentioned in the talk sums it up nicely: Through 20 years of effort, we've successfully trained everyone to use passwords that are hard for humans to remember, but easy for computers to guess. Relatedly, YouTube - where the talk is hosted - informs me that it will require 2-factor authentication starting on Nov. 1st for accessing YouTube Studio: Action required: Turn on 2-Step Verification by November 1, 2021 or you will lose access to YouTube Studio I wonder whether this would be necessary if better password practices were established, so that more secure passwords can be more readily used. The linked NIST guidelines are interesting, and include pertaining recommendations such as "Do not require that memorized secrets be changed arbitrarily (e.g., periodically) unless there is a user request or evidence of authenticator compromise.": https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html

dheera 5y ago
And sometimes their 2FA is SMS based. I don't use SMS. I don't use hardware phones in my workflow. For Microsoft Teams I have no choice but to direct the call to a Twilio number and use a script to answer it and automatically hit #. If you want 2FA, have support for hardware keys. Period.
- brendoelfrendo 5y ago
  I recently bought a second Yubikey and wanted to go through my accounts to add it as a backup; you know, have one locked up so that if I ever break my primary, I'm not SOL. Not only do only about half a dozen services I use actively support hardware security keys, even fewer support enrolling more than one. Worse, many only support SMS 2FA as the backup option, which I just can't abide.
  - dheera 5y ago
    Right, AWS is the biggest offender of this. Also, Coinbase, Kraken, and several others. Seriously, deprecate SMS already. I deprecated it 10 years ago.
- Closi 5y ago
  Sounds like your organisation has just limited the 2FA options in the auth settings. Hardware keys are supported on Teams, along with software phones (that have a static number / extension) and a linked desktop/mobile app. In fact FIDO2 hardware keys like Yubikey are part of what Microsoft refers to as ‘passwordless’ - see https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-passwordless https://docs.microsoft.com/en-us/azure/active-directory/auth... I assume you aren’t an admin on the account just because otherwise you could just disable 2FA properly rather than disabling it with a weird twillio workaround, although I have to give you credit, this is the most effort I have seen someone put in to subvert a security policy.
  - dheera 5y ago
    Yeah I'm not an admin on the account and have no control over it. An app doesn't work for me either, When I have a big rack-mounted immobile desktop that should if anything BE the 2FA device, if anything, not a 6-inch easily-stealable device.
    - hirsin 5y ago
      Which gets you back to the problem OP has - trusting that device enough to make it a secure root of trust. Windows lets you do it, so do Android and iOS. But your admin, maybe not (or you're not on windows, which is more likely I guess).
  - eikenberry 5y ago
    FIDO2 keys still lack one of the main features of physical keys that make them great... you can have many copies. FIDO2 makes it impossible to copy a key, saying instead to always use multiple FIDO2 keys in all cases. This pretty much kills the idea for it to replace passwords as no one is going to set up 3+ keys for every site they login to. So it will only be of use to lock your password manager where registering multiple keys would be feasible. You could use it to unlock a single oauth account that you could then use to login to other places. Problem with those systems is trading privacy for convenience.
    - 5y ago
rkeene2 5y ago
Not everyone has tolerated passwords. US President George W. Bush signed a Presidential Directive directing all parts of the US Government to make and implement plans for getting rid of passwords in August of 2004.
- meowtimemania 5y ago
  I’m looking on google for more information but struggling to formulate a query that yields good results. What were the results of this directive? Does the government no longer use passwords?
  - hunter-gatherer 5y ago
    I left the IC just over a year ago and we were still using passwords. Although, the RSA tokens had just been rolled out. Most likely everyone on JWICS (if someone still in the space can correct me, please do) has now moved to a PIN+RSA token. The government moves ever so slowly on some issues. I wouldn't be surprised if a directive on password policy signed in 2004 took 15 years to implement.
    - nonameiguess 5y ago
      IC users on JWICS use IC ITE PKI. You get issued a client cert and key when you get an account, and that is used to authenticate you to all web-based services. Additionally, it links directly to your clearance, so it automatically redacts content based on the portion label, meaning you can do something like load Intellipedia and it will not show you parts of pages containing information you have inadequate clearance to see, but still show you everything else. 2FA is implemented by requiring you to unlock your private key with a 8-digit pin. It is light years ahead of the public world wide web. But, of course, the problem is a lot easier to solve when you have a single source of identity for every user and every user only has a single identity. Something like this is impossible if you want any level of anonymity, but users of government systems have no expectation of anonymity.
  - Jtsummers 5y ago
    My experience was with DOD. They made major strides by 2010 to use smart cards (CAC) for access control to all the major systems. Some systems still had passwords, but everything new was supposed to use CAC and everything old was being migrated to support CAC in addition to passwords, ideally dropping passwords (not always possible due to how some things were accessed).
ncphil 5y ago
This is a major change from the original NIST guidance that MS & dog previously followed. It turns out the author of that guidance admitted not so long ago that it was basically rubbish: just like the half dozen or more boxes that security managers have been mindlessly checking since 2004 (to be sure many of those misguided policies had become canon long before being enshrined in NIST's standards). It was the snakeoil press that made millions (billions?) for the producers and actors engaged in over a decade of security theater. The independent genius and intellectual courage of XKCD's author can only be fully appreciated against that background. https://www.engadget.com/2017-08-08-nist-new-password-guidelines.html https://www.engadget.com/2017-08-08-nist-new-password-guidel...
varenc 5y ago
2FA is necessary because users still consistently fall for phishing attacks. Password policies wouldn’t effect that. There’s also the password reuse problem, though better policies might discourage reuse, it’ll still happen.

by triska 5y ago

dheera 5y ago

And sometimes their 2FA is SMS based. I don't use SMS. I don't use hardware phones in my workflow. For Microsoft Teams I have no choice but to direct the call to a Twilio number and use a script to answer it and automatically hit #. If you want 2FA, have support for hardware keys. Period.

brendoelfrendo 5y ago
I recently bought a second Yubikey and wanted to go through my accounts to add it as a backup; you know, have one locked up so that if I ever break my primary, I'm not SOL. Not only do only about half a dozen services I use actively support hardware security keys, even fewer support enrolling more than one. Worse, many only support SMS 2FA as the backup option, which I just can't abide.
- dheera 5y ago
  Right, AWS is the biggest offender of this. Also, Coinbase, Kraken, and several others. Seriously, deprecate SMS already. I deprecated it 10 years ago.
Closi 5y ago
Sounds like your organisation has just limited the 2FA options in the auth settings. Hardware keys are supported on Teams, along with software phones (that have a static number / extension) and a linked desktop/mobile app. In fact FIDO2 hardware keys like Yubikey are part of what Microsoft refers to as ‘passwordless’ - see https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-passwordless https://docs.microsoft.com/en-us/azure/active-directory/auth... I assume you aren’t an admin on the account just because otherwise you could just disable 2FA properly rather than disabling it with a weird twillio workaround, although I have to give you credit, this is the most effort I have seen someone put in to subvert a security policy.
- dheera 5y ago
  Yeah I'm not an admin on the account and have no control over it. An app doesn't work for me either, When I have a big rack-mounted immobile desktop that should if anything BE the 2FA device, if anything, not a 6-inch easily-stealable device.
  - hirsin 5y ago
    Which gets you back to the problem OP has - trusting that device enough to make it a secure root of trust. Windows lets you do it, so do Android and iOS. But your admin, maybe not (or you're not on windows, which is more likely I guess).
- eikenberry 5y ago
  FIDO2 keys still lack one of the main features of physical keys that make them great... you can have many copies. FIDO2 makes it impossible to copy a key, saying instead to always use multiple FIDO2 keys in all cases. This pretty much kills the idea for it to replace passwords as no one is going to set up 3+ keys for every site they login to. So it will only be of use to lock your password manager where registering multiple keys would be feasible. You could use it to unlock a single oauth account that you could then use to login to other places. Problem with those systems is trading privacy for convenience.
  - 5y ago

rkeene2 5y ago

Not everyone has tolerated passwords. US President George W. Bush signed a Presidential Directive directing all parts of the US Government to make and implement plans for getting rid of passwords in August of 2004.

meowtimemania 5y ago
I’m looking on google for more information but struggling to formulate a query that yields good results. What were the results of this directive? Does the government no longer use passwords?
- hunter-gatherer 5y ago
  I left the IC just over a year ago and we were still using passwords. Although, the RSA tokens had just been rolled out. Most likely everyone on JWICS (if someone still in the space can correct me, please do) has now moved to a PIN+RSA token. The government moves ever so slowly on some issues. I wouldn't be surprised if a directive on password policy signed in 2004 took 15 years to implement.
  - nonameiguess 5y ago
    IC users on JWICS use IC ITE PKI. You get issued a client cert and key when you get an account, and that is used to authenticate you to all web-based services. Additionally, it links directly to your clearance, so it automatically redacts content based on the portion label, meaning you can do something like load Intellipedia and it will not show you parts of pages containing information you have inadequate clearance to see, but still show you everything else. 2FA is implemented by requiring you to unlock your private key with a 8-digit pin. It is light years ahead of the public world wide web. But, of course, the problem is a lot easier to solve when you have a single source of identity for every user and every user only has a single identity. Something like this is impossible if you want any level of anonymity, but users of government systems have no expectation of anonymity.
- Jtsummers 5y ago
  My experience was with DOD. They made major strides by 2010 to use smart cards (CAC) for access control to all the major systems. Some systems still had passwords, but everything new was supposed to use CAC and everything old was being migrated to support CAC in addition to passwords, ideally dropping passwords (not always possible due to how some things were accessed).

ncphil 5y ago

This is a major change from the original NIST guidance that MS & dog previously followed. It turns out the author of that guidance admitted not so long ago that it was basically rubbish: just like the half dozen or more boxes that security managers have been mindlessly checking since 2004 (to be sure many of those misguided policies had become canon long before being enshrined in NIST's standards). It was the snakeoil press that made millions (billions?) for the producers and actors engaged in over a decade of security theater. The independent genius and intellectual courage of XKCD's author can only be fully appreciated against that background. https://www.engadget.com/2017-08-08-nist-new-password-guidelines.html https://www.engadget.com/2017-08-08-nist-new-password-guidel...

varenc 5y ago

2FA is necessary because users still consistently fall for phishing attacks. Password policies wouldn’t effect that. There’s also the password reuse problem, though better policies might discourage reuse, it’ll still happen.