2 ms·

I imagine a world where governments get together and mandate that all online passwords use the same standard of password requirements and salt/hashing at the ba

I imagine a world where governments get together and mandate that all online passwords use the same standard of password requirements and salt/hashing at the backend. Penalty should be 10% of your gross revenue. While they are at it mandate some standards of customer service if your business exceeds $1M in gross revenue (must have a "get human" button and the call hold time shall not exceed 15 minutes). I know that sounds like a fantasy utopia, but I remember a time in the 70s when there was a serious push for consumer advocacy in the US.

ReactiveJelly 5y ago
And that customer service MUST NOT accept "I just typed some random words" as the answer to a """security""" question.
jasonpeacock 5y ago
We effectively have this now with PCI-DSS (requirements imposed by credit-card processing companies), and it sucks because of the bureaucracy involved in making any change. It has take literally over a decade to relax the requirement for password rotation from 3mo to 1yr for employee accounts of companies that process CC payments, despite industry knowledge and formal studies saying that frequent password rotation was detrimental and useless. Instead of defining the process, state the outcome you want and set penalties on failing to meet the outcome. E.g. "don't have password leaks, or it will cost $1k per account paid directly to the account holder" (or your percent of gross, split among leaked accounts). Let companies implement those controls however they wish, as long as they are achieving the outcome and penalties are actually being applied. I agree that failures need to have significant penalties, otherwise companies will decide that the penalty costs less than the prevention (which is true today) and minimize their investment in security.

2 ms·

I imagine a world where governments get together and mandate that all online passwords use the same standard of password requirements and salt/hashing at the ba

by wintermutestwin 5y ago

ReactiveJelly 5y ago
And that customer service MUST NOT accept "I just typed some random words" as the answer to a """security""" question.
jasonpeacock 5y ago
We effectively have this now with PCI-DSS (requirements imposed by credit-card processing companies), and it sucks because of the bureaucracy involved in making any change. It has take literally over a decade to relax the requirement for password rotation from 3mo to 1yr for employee accounts of companies that process CC payments, despite industry knowledge and formal studies saying that frequent password rotation was detrimental and useless. Instead of defining the process, state the outcome you want and set penalties on failing to meet the outcome. E.g. "don't have password leaks, or it will cost $1k per account paid directly to the account holder" (or your percent of gross, split among leaked accounts). Let companies implement those controls however they wish, as long as they are achieving the outcome and penalties are actually being applied. I agree that failures need to have significant penalties, otherwise companies will decide that the penalty costs less than the prevention (which is true today) and minimize their investment in security.