4 ms·

We simply don't need to - we use a procedural password which any of our employees can easily emulate but which still provides enough entropy. It goes something

We simply don't need to - we use a procedural password which any of our employees can easily emulate but which still provides enough entropy. It goes something like this (of course, this is slightly different): (First 2 letters of domain name) + (To01n) + (TLD) + (Last two letters of domain name) So, for instance, www.mcondalds.com would be: mc + To01n + com + ds || mcTo01ncomds This appears random to the client but is easy for us to work out once you've done it a couple of times, but of course there are exceptions: Hosted on Localhost TLD: loc .co.uk TLD: couk Once you adapt your company to a procedure like this is becomes simple and quick to log in to client sites, but also saves you the overhead in time of managing a large spreadsheet or application for it.

jere 14y ago
Wouldn't this mean ex-employees would know your password scheme indefinitely?
- shanelja 14y ago
  I suppose so, yes, but on the other hand, wouldn't it mean that every time an employee left, wouldn't you have to go through every single password (currently 436) and change them? In any case, once we sign off on a project, the client normally like to set up their own usernames and passwords for admin accounts, it gives them a sense of control.
  - estel 14y ago
    If they're random passwords, they'd need ongoing access to the password database. (If there are suitable protections against the database being exported.)
deanclatworthy 14y ago
Also the weakness here is that if two websites with weak password security are compromised (let's not forget recent history) your company password naming scheme will be completely obvious at first glance, assuming you use the same email login.
- shanelja 14y ago
  No, each website has a unique username for the admin system, thought these are normally just the company name.
jgrahamc 14y ago
Your scheme doesn't appear to provide any entropy at all (or at least hardly any). The only unknown part of is the To01n which if compromised causes the entire scheme to fail (assuming you accept Kerckhoffs's principle). If it's widely known in the company then it's an 'open secret'. If the unknown part is not compromised then I have to crack 5 characters. Assuming, best case, this is taken from the entire printable ASCII set then there are 32 bits of entropy. That's very weak.
- shanelja 14y ago
  While that may be true, an attacker would not initially know the scheme, but with a list of passwords would instantly notice the To01n so I could argue that that is in fact the weakest part of this procedure, which leaves them with the 7 letters remaining: mc ds and com - but it would not be obvious from the outset how to calculate these nor that we were even using a scheme. So assuming the shared portion of the password is compromised I assume it would be 64 bits of entropy? (I'm not overly experienced with calculating that so I assumed you did 2 x 2 ^ numberofcharacters, whereas in this case we have 6 characters, doubling the entropy.) While this may not be a massive amount, bare in mind these are temporary passwords and last only a week or two before we sign off on a project and the client has access.
  - jgrahamc 14y ago
    Ignoring the fact that I usually go by Kerckhoff's Principle and would assume that an attacker knows the scheme. Let's imagine the situation where two passwords are compromised. 1. As you say the To01n would be static and I would assume that this would be the same in both 2. If both sites are .com then I'll spot the com in both and so I'll end up assuming there are 4 characters to attack. And they appear to be lowercase. 3. Or they are not both .com and assuming I'm not smart I think there are 7 or 8 characters to attack (all lowercase). In case #2 picking 4 characters from lowercase ASCII has an bit strength of 4.7 bits per character and so 18 bits. Very weak. In case #3 picking 8 characters from lowercase ASCII has a bit strength of 38 bits. Still weak.
    - 14y ago
ScottWhigham 14y ago
I have a hard time believing that you use this system everywhere in your company. Wouldn't any employee then be able to guess the password to any company service? I'd be able to guess the company PayPal account, the company Stripe account, the company bank account, etc. I just don't believe that a real, legitimate company that is able to have enough success to have hired employees would've done something like this across the board.
- shanelja 14y ago
  You misunderstand, we use these passwords for client website logins for the admin accounts prior to the client changing them, as per the PayPal account, etc, that is taken care of by the Boss, IE, I don't have a clue what they are. Most likely his Gmail password.

jere 14y ago

Wouldn't this mean ex-employees would know your password scheme indefinitely?

shanelja 14y ago
I suppose so, yes, but on the other hand, wouldn't it mean that every time an employee left, wouldn't you have to go through every single password (currently 436) and change them? In any case, once we sign off on a project, the client normally like to set up their own usernames and passwords for admin accounts, it gives them a sense of control.
- estel 14y ago
  If they're random passwords, they'd need ongoing access to the password database. (If there are suitable protections against the database being exported.)

deanclatworthy 14y ago

Also the weakness here is that if two websites with weak password security are compromised (let's not forget recent history) your company password naming scheme will be completely obvious at first glance, assuming you use the same email login.

shanelja 14y ago
No, each website has a unique username for the admin system, thought these are normally just the company name.

jgrahamc 14y ago

Your scheme doesn't appear to provide any entropy at all (or at least hardly any). The only unknown part of is the To01n which if compromised causes the entire scheme to fail (assuming you accept Kerckhoffs's principle). If it's widely known in the company then it's an 'open secret'. If the unknown part is not compromised then I have to crack 5 characters. Assuming, best case, this is taken from the entire printable ASCII set then there are 32 bits of entropy. That's very weak.

shanelja 14y ago
While that may be true, an attacker would not initially know the scheme, but with a list of passwords would instantly notice the To01n so I could argue that that is in fact the weakest part of this procedure, which leaves them with the 7 letters remaining: mc ds and com - but it would not be obvious from the outset how to calculate these nor that we were even using a scheme. So assuming the shared portion of the password is compromised I assume it would be 64 bits of entropy? (I'm not overly experienced with calculating that so I assumed you did 2 x 2 ^ numberofcharacters, whereas in this case we have 6 characters, doubling the entropy.) While this may not be a massive amount, bare in mind these are temporary passwords and last only a week or two before we sign off on a project and the client has access.
- jgrahamc 14y ago
  Ignoring the fact that I usually go by Kerckhoff's Principle and would assume that an attacker knows the scheme. Let's imagine the situation where two passwords are compromised. 1. As you say the To01n would be static and I would assume that this would be the same in both 2. If both sites are .com then I'll spot the com in both and so I'll end up assuming there are 4 characters to attack. And they appear to be lowercase. 3. Or they are not both .com and assuming I'm not smart I think there are 7 or 8 characters to attack (all lowercase). In case #2 picking 4 characters from lowercase ASCII has an bit strength of 4.7 bits per character and so 18 bits. Very weak. In case #3 picking 8 characters from lowercase ASCII has a bit strength of 38 bits. Still weak.
  - 14y ago

ScottWhigham 14y ago

I have a hard time believing that you use this system everywhere in your company. Wouldn't any employee then be able to guess the password to any company service? I'd be able to guess the company PayPal account, the company Stripe account, the company bank account, etc. I just don't believe that a real, legitimate company that is able to have enough success to have hired employees would've done something like this across the board.

shanelja 14y ago
You misunderstand, we use these passwords for client website logins for the admin accounts prior to the client changing them, as per the PayPal account, etc, that is taken care of by the Boss, IE, I don't have a clue what they are. Most likely his Gmail password.