4 ms·
Passwords need to go away. The same techniques from War Games still work of finding a password written down or not changed. Systems need to move to role based
by ec109685 4y ago
Passwords need to go away. The same techniques from War Games still work of finding a password written down or not changed.
Systems need to move to role based security, where you are logging as user X who can do Y. Then the effort can spent securing the central log in system.
- themoonisachees 4y agoI wholeheartedly agree, but as a sysadmin for mutualized clients, at some point in the process i need to interact with a generic elevated accout. Would it be possible to forgo that? Sure, some of our clients have implemented robust password sync through ldap or general federation, but doing that has a cost, and doing that also means that an admins password is now a single point of failure, MFA being unrealistic specifically because those accounts generally have to log in a lot of times. An admins password (not our team) being leaked is exactly what hapened to our client with the most effective federation, and the consequences were disastrous. They have now recovered, but are considering other options and potentially going back to machine-specific passwords to ensure only one gets compromised at a time.
- ec109685 4y agoA user level mTLS certificate can provide time limited access to a system. A federated identity system can issue these certificates that convey what a person can do. There does need to be a bootstrap phase to register the device the first time, but beyond that, access should be time limited and device specific.
- marssaxman 4y agoHow do you propose that one might log in "as user X who can do Y" in a future where passwords have gone away?