4 ms·

Prima facie it is wrong because it's victim blaming. But using weak and/or compromised passwords is a bad idea in exactly the same way that it's a bad idea to

Prima facie it is wrong because it's victim blaming. But using weak and/or compromised passwords is a bad idea in exactly the same way that it's a bad idea to leave your front door unlocked. Legally, we do assign fault for negligence. If absentmindedly leave your kitchen tap open with the drain stopped and then go on vacation, your flood insurance is probably not going to pay for repairs, even if you didn't deserve to have your house destroyed. From a policy perspective, I think the most appropriate thing would be a middle ground. It is good for everyone's peace of mind to be sure that your entire bank balance won't vanish without recourse, but if you leave your banking "front door" unlocked, the bank covers 90% of the actual unrecoverable loss, but you're on the hook for the other 10%. That eliminates perverse incentives to use weak passwords without being cruel to victims.

to11mtm 4y ago
> But using weak and/or compromised passwords is a bad idea in exactly the same way that it's a bad idea to leave your front door unlocked. I'd argue it's not quite the same... using weak passwords is more like using a lock that can be 'raked'; your security is just lax. Re-using passwords is like using the same key for your front door, back door, garage, car... If someone finds it and makes a copy of it, they have full access. Compromised passwords, it's when you know a key is lost or stolen and you don't re-key. > From a policy perspective, I think the most appropriate thing would be a middle ground. It is good for everyone's peace of mind to be sure that your entire bank balance won't vanish without recourse, but if you leave your banking "front door" unlocked, the bank covers 90% of the actual unrecoverable loss, but you're on the hook for the other 10%. That eliminates perverse incentives to use weak passwords without being cruel to victims. Both of my main financial institutions have 'pretty dang good' security measures on one level or another. One, has forced password changes at 6 month intervals (not as good as 90 days, but better than many!) The other does not have forced password changes but I know their internal security is... pretty crazy. Losing your badge 3 times is enough to get you fired, and any contractors who do work must be under a very specific specification of video surveillance while working with their clients.
- clcaev 4y ago
  > One, has forced password changes at 6 month intervals (not as good as 90 days, but better than many!) Forcing password changes reduces overall security, especially for infrequently accessed services. It only normalizes the reset workflow, and enables easier social engineering. The NIST standard (800-53?) was updated to reflect this reality, and it no longer requires periodic password rotation.
  - rdtwo 4y ago
    Yeah not forcing password changes allows having a unique bank only password and reduces temptation to reuse
secabeen 4y ago
> Legally, we do assign fault for negligence. If absentmindedly leave your kitchen tap open with the drain stopped and then go on vacation, your flood insurance is probably not going to pay for repairs, even if you didn't deserve to have your house destroyed. This is not generally true. Insurers are forbidden to pay out claims for intentional bad acts, or fraud, but ordinary negligence is usually covered: > The good thing is your homeowner's policy usually covers you and your family's negligent behavior no matter where it happens. https://www.nolo.com/legal-encyclopedia/does-my-homeowners-insurance-cover-accidents-that-occur-off-my-property.html https://www.nolo.com/legal-encyclopedia/does-my-homeowners-i...

to11mtm 4y ago

> But using weak and/or compromised passwords is a bad idea in exactly the same way that it's a bad idea to leave your front door unlocked. I'd argue it's not quite the same... using weak passwords is more like using a lock that can be 'raked'; your security is just lax. Re-using passwords is like using the same key for your front door, back door, garage, car... If someone finds it and makes a copy of it, they have full access. Compromised passwords, it's when you know a key is lost or stolen and you don't re-key. > From a policy perspective, I think the most appropriate thing would be a middle ground. It is good for everyone's peace of mind to be sure that your entire bank balance won't vanish without recourse, but if you leave your banking "front door" unlocked, the bank covers 90% of the actual unrecoverable loss, but you're on the hook for the other 10%. That eliminates perverse incentives to use weak passwords without being cruel to victims. Both of my main financial institutions have 'pretty dang good' security measures on one level or another. One, has forced password changes at 6 month intervals (not as good as 90 days, but better than many!) The other does not have forced password changes but I know their internal security is... pretty crazy. Losing your badge 3 times is enough to get you fired, and any contractors who do work must be under a very specific specification of video surveillance while working with their clients.

clcaev 4y ago
> One, has forced password changes at 6 month intervals (not as good as 90 days, but better than many!) Forcing password changes reduces overall security, especially for infrequently accessed services. It only normalizes the reset workflow, and enables easier social engineering. The NIST standard (800-53?) was updated to reflect this reality, and it no longer requires periodic password rotation.
- rdtwo 4y ago
  Yeah not forcing password changes allows having a unique bank only password and reduces temptation to reuse

secabeen 4y ago

> Legally, we do assign fault for negligence. If absentmindedly leave your kitchen tap open with the drain stopped and then go on vacation, your flood insurance is probably not going to pay for repairs, even if you didn't deserve to have your house destroyed. This is not generally true. Insurers are forbidden to pay out claims for intentional bad acts, or fraud, but ordinary negligence is usually covered: > The good thing is your homeowner's policy usually covers you and your family's negligent behavior no matter where it happens. https://www.nolo.com/legal-encyclopedia/does-my-homeowners-insurance-cover-accidents-that-occur-off-my-property.html https://www.nolo.com/legal-encyclopedia/does-my-homeowners-i...