14 ms·

The Secret Life of Passwords

127 points by r0h1n 12y ago

john_b 12y ago
> "Cantor Fitzgerald did have extensive contingency plans in place, including a requirement that all employees tell their work passwords to four nearby colleagues." This baffles my mind. Is this common practice in finance? What would stop a malicious actor from impersonating someone whose password they knew? Even if these passwords aren't tied to someone's identity in any way, they presumably exist to secure sensitive data and/or systems, but then they're shared with officemates like Dilbert comics?
- ryan-c 12y ago
  Secret sharing systems are a good solution to this. I wrote a basic command line only one[1] a few years ago, but command line UI doesn't really make for "usable by everyone". It would be nice if there were something like this that had a good UI. 1. https://github.com/ryancdotorg/threshcrypt https://github.com/ryancdotorg/threshcrypt
  - pwnna 12y ago
    For the purpose at hand, having some secrets accessible by multiple parties without sharing the same password comes in handy[1]. I'm surprised that this is not a feature of a lot of software that relies on encryption with keys based on passphrases. [1]: example: https://code.google.com/p/cryptsetup/ https://code.google.com/p/cryptsetup/. I believe that the way it works is it encrypts the actual decryption key for data with keys derived from passphrases multiple times, so any one of the those passphrases can decrypt the key, which then can access the data.
- peter303 12y ago
  Our company has interesting contradiction in this regards. On one hand all accounts, files and digital communication belong to the company. Assume you could instantly lose access in a sudden layoff. On the other hand the annual IT security video course tells you encrypt like crazy and leave no digital assets in public.
  - hackuser 12y ago
    They don't have a master cryptographic key?
- hackuser 12y ago
  Agreed. They might as have everyone use the same password. Aren't there regulations for security of financial information? It's hard to believe this passes muster. If it's a 'reasonable precautions' regulation, this fails badly.
- perlgeek 12y ago
  It provides perfect deniability. Whatever you do in the computer system, there were four others who might have done it in your stead.
towelguy 12y ago
Couldn't they just access the data directly from the databases? Something they couldn't access then. Are they talking about passwords for 3rd party services? Or perhaps passwords for encrypted hard drives?
- mlrtime 12y ago
  Imaging your entire IT department being wiped out instantly overnight, managers included. How quickly would it take you to restore access to your infrastructure?
comrh 12y ago
If someone from my loved one's job called me 24 hours after they were killed in a horrific terrorist attack to talk about passwords I don't think I would be able to contain my vitriol.
- mikeash 12y ago
  Why even try to contain it? I'd let loose upon the caller with the fury of a thousand suns.
- gumby 12y ago
  If someone from my loved one's (and family's sole breadwinner's) job called me 24 hours after they were killed in a horrific terrorist attack to talk about passwords because the company was in a crisis I think I would be relieved that someone was working to make sure I could continue to feed my kids while I figured out what to do next. And if you see how Cantor Fitzgerald treated its employees and their families in the wake of that crisis, you'd see that helping them was the right thing. The banking industry may have metastasized from a service industry to a giant vampire squid, but that doesn't mean every company turned into slimy blood-sucking leeches. (And maybe C-F were heartless leeches before the attack and reformed due to their literal near-death experience -- I really paid little attention to them until that day. But they are famous for how they responded and rebuilt the business).
  - comrh 12y ago
    I'm a little confused how them getting their passwords help feed your kids after the employee is gone. I think what they did afterwards was definitely great, but that doesn't change my opinion that if that happened to me some passwords would be the last thing I would want to talk about. Money, finance, jobs, passwords, it all seems so pointless when I think of it against that loss.
    - cowsandmilk 12y ago
      They gave $180 million to the families of the deceased in the 5 years after the attacks. If they went out of business due to September 11, none of that money would have been there. They also provided health care to the families for 10 years. Again, if they went out of business, none of that would have been there. Losing someone who is earning a salary often drives families into a downward spiral. Having to sell your house and move because you suddenly are choosing between mortgage payments and food for your kids is not easy. The survival of the company prevented this from being a sudden financial adjustment for many of these families.
akkartik 12y ago
I didn't realize lambda was a motif in gay culture too. Makes me love it even more.
qq66 12y ago
Will Fitzsimons had better change his debit card password immediately.
seanieb 12y ago
Whats terrifying is that they are referring to "their password" and not their passwords. Password reuse is much worse that having a weak password. Hackers only brute force high value targets, everyone else should just aim to have unique passwords for every service they use. However, the average person can only remember 5-10 unique passwords and they have many many accounts...password reuse. For the average person password managers aren't an option for normal people, so we have a big problem.
- deleted 12y ago
  [deleted]
  - ihaveajob 12y ago
    This. Or a similar pattern thereof that's harder to guess even by the administrator of a malicious site with access to one such password. Like your random string followed by the first and third letter of the domain.
    - valarauca1 12y ago
      That would lead to shorter passwords. Normally domain names are pretty long, and just containing a common string like .com doesn't make inverting hashes any easier.
  - r00fus 12y ago
    The problem with the 2nd approach is password restrictions (some of which, stupidly, reduce the key space rather than increase it - all uppercase required on some banks? yes it happens). Another annoying but logical constraint is the one where sites query your pwd for references to the site itself and tell you not to include that - another strike against that appending approach. The requirements vary, are conflicting and change over time. I tried your approach, but then gave up after repeatedly forgetting what restrictions applied for which site - altering my specific password and making it non-memorable. Enter 1Password.
  - hackuser 12y ago
    > Create a simple random character string "tjxmvg123" that you can remember easily. Append the name of the website you are using to the end of this. I.E.: tjxmvg123hackernews.com Am I missing something? I'm surprised to be the first to point out that this is very dangerous advice (to the extent bad passwords are dangerous). All it does is add one, easily guessable bit of information -- for the first password the attacker seeks. And after someone has the first password, this method adds zero security; the attacker then has the passwords for every other website.
iamleppert 12y ago
What is wrong with these companies that they are having to brute force passwords? Passwords to business-critical systems should be stored in a safe, in an off-site location (preferably multiple offsite locations).
- varikin 12y ago
  Like their offsite location in the other tower that was also destroyed? I don't mean to say you are wrong, but many times contingency plans rarely consider such devastating circumstances. Once heard a rumor that a large defense contractor had a backup plan that included flying disk drives from one coast to the other to safe guard against nuclear strikes on either coast or both by having a day old backup in the air. Do you have a plan for nuclear strikes on both coasts?
  - mey 12y ago
    I've considered it, but it really comes down to what the business needs. Does the business need to continue to operate in the face of a nuclear winter? The government sure, but most day-day operations of a retail chain would be out the window at that point. Taking this to another extreme, does a DR plan need to account for the earth no longer being viable? Do you need system/data backups in space?
danielweber 12y ago
I like the mouse-over effects here. They aren't obtrusive, messing with the normal functioning of a webpage.
ddebernardy 12y ago
> "Even in America, old habits, like his KGB-induced skepticism of the police lingered." [Cough]. Even in America? More like especially nowadays, no? Beautifully written piece, otherwise.
- dredmorbius 12y ago
  See Greenwald's recent (past day or so) Intercept piece on trust in the US since Snowden, worldwide. Massive declines.
  - ddebernardy 12y ago
    I'd imagine so, yeah. It's hardly a new trend though. There also was a massive decline when George W Bush decided to head to Irak. And before that, there was enough mistrust -- indeed hatred -- in US policy to prompt nutjobs to conduct 9/11.
hammock 12y ago
Side comment about the web design- very cool and clear way of integrating audiovisual stories into the article. Lots of people try to find novel ways to share interviews/first-person accounts that they've recorded, with mixed results. This piece strikes me as best in class.
zarify 12y ago
Well I guess talking to people and telling them you're writing an article about "The Secret Life of Passwords" is more novel than giving them a call pretending to be from their bank or telco. I dearly hope that those people who actually told passwords to the author were either no longer using them or immediately changed them to something better on reflection of just how terrible they were. My mother kept a door from her parents' first house (which they built after emigrating after WW2) for sentimental reasons, that doesn't mean she relied on the old antique lock to secure her current house.
nly 12y ago
I found the part about passwords being personal mementos quite charming. I hope I'm not the only one. Does anyone feel like sharing?
- divegeek 12y ago
  Sure, I will. I just retired this little gem, after six months of faithful service: ahbag6uWXa0aj0ee Ahh, the memories.
hlfcoding 12y ago
Goes to show 'password' is a total misnomer that encourages bad security practice.

127 points by r0h1n 12y ago

> "Cantor Fitzgerald did have extensive contingency plans in place, including a requirement that all employees tell their work passwords to four nearby colleagues." This baffles my mind. Is this common practice in finance? What would stop a malicious actor from impersonating someone whose password they knew? Even if these passwords aren't tied to someone's identity in any way, they presumably exist to secure sensitive data and/or systems, but then they're shared with officemates like Dilbert comics?

ryan-c 12y ago
Secret sharing systems are a good solution to this. I wrote a basic command line only one[1] a few years ago, but command line UI doesn't really make for "usable by everyone". It would be nice if there were something like this that had a good UI. 1. https://github.com/ryancdotorg/threshcrypt https://github.com/ryancdotorg/threshcrypt
- pwnna 12y ago
  For the purpose at hand, having some secrets accessible by multiple parties without sharing the same password comes in handy[1]. I'm surprised that this is not a feature of a lot of software that relies on encryption with keys based on passphrases. [1]: example: https://code.google.com/p/cryptsetup/ https://code.google.com/p/cryptsetup/. I believe that the way it works is it encrypts the actual decryption key for data with keys derived from passphrases multiple times, so any one of the those passphrases can decrypt the key, which then can access the data.
peter303 12y ago
Our company has interesting contradiction in this regards. On one hand all accounts, files and digital communication belong to the company. Assume you could instantly lose access in a sudden layoff. On the other hand the annual IT security video course tells you encrypt like crazy and leave no digital assets in public.
- hackuser 12y ago
  They don't have a master cryptographic key?
hackuser 12y ago
Agreed. They might as have everyone use the same password. Aren't there regulations for security of financial information? It's hard to believe this passes muster. If it's a 'reasonable precautions' regulation, this fails badly.
perlgeek 12y ago
It provides perfect deniability. Whatever you do in the computer system, there were four others who might have done it in your stead.

towelguy 12y ago

Couldn't they just access the data directly from the databases? Something they couldn't access then. Are they talking about passwords for 3rd party services? Or perhaps passwords for encrypted hard drives?

mlrtime 12y ago
Imaging your entire IT department being wiped out instantly overnight, managers included. How quickly would it take you to restore access to your infrastructure?

comrh 12y ago

If someone from my loved one's job called me 24 hours after they were killed in a horrific terrorist attack to talk about passwords I don't think I would be able to contain my vitriol.

mikeash 12y ago
Why even try to contain it? I'd let loose upon the caller with the fury of a thousand suns.
gumby 12y ago
If someone from my loved one's (and family's sole breadwinner's) job called me 24 hours after they were killed in a horrific terrorist attack to talk about passwords because the company was in a crisis I think I would be relieved that someone was working to make sure I could continue to feed my kids while I figured out what to do next. And if you see how Cantor Fitzgerald treated its employees and their families in the wake of that crisis, you'd see that helping them was the right thing. The banking industry may have metastasized from a service industry to a giant vampire squid, but that doesn't mean every company turned into slimy blood-sucking leeches. (And maybe C-F were heartless leeches before the attack and reformed due to their literal near-death experience -- I really paid little attention to them until that day. But they are famous for how they responded and rebuilt the business).
- comrh 12y ago
  I'm a little confused how them getting their passwords help feed your kids after the employee is gone. I think what they did afterwards was definitely great, but that doesn't change my opinion that if that happened to me some passwords would be the last thing I would want to talk about. Money, finance, jobs, passwords, it all seems so pointless when I think of it against that loss.
  - cowsandmilk 12y ago
    They gave $180 million to the families of the deceased in the 5 years after the attacks. If they went out of business due to September 11, none of that money would have been there. They also provided health care to the families for 10 years. Again, if they went out of business, none of that would have been there. Losing someone who is earning a salary often drives families into a downward spiral. Having to sell your house and move because you suddenly are choosing between mortgage payments and food for your kids is not easy. The survival of the company prevented this from being a sudden financial adjustment for many of these families.

akkartik 12y ago

I didn't realize lambda was a motif in gay culture too. Makes me love it even more.

qq66 12y ago

Will Fitzsimons had better change his debit card password immediately.

seanieb 12y ago

Whats terrifying is that they are referring to "their password" and not their passwords. Password reuse is much worse that having a weak password. Hackers only brute force high value targets, everyone else should just aim to have unique passwords for every service they use. However, the average person can only remember 5-10 unique passwords and they have many many accounts...password reuse. For the average person password managers aren't an option for normal people, so we have a big problem.

deleted 12y ago
[deleted]
- ihaveajob 12y ago
  This. Or a similar pattern thereof that's harder to guess even by the administrator of a malicious site with access to one such password. Like your random string followed by the first and third letter of the domain.
  - valarauca1 12y ago
    That would lead to shorter passwords. Normally domain names are pretty long, and just containing a common string like .com doesn't make inverting hashes any easier.
- r00fus 12y ago
  The problem with the 2nd approach is password restrictions (some of which, stupidly, reduce the key space rather than increase it - all uppercase required on some banks? yes it happens). Another annoying but logical constraint is the one where sites query your pwd for references to the site itself and tell you not to include that - another strike against that appending approach. The requirements vary, are conflicting and change over time. I tried your approach, but then gave up after repeatedly forgetting what restrictions applied for which site - altering my specific password and making it non-memorable. Enter 1Password.
- hackuser 12y ago
  > Create a simple random character string "tjxmvg123" that you can remember easily. Append the name of the website you are using to the end of this. I.E.: tjxmvg123hackernews.com Am I missing something? I'm surprised to be the first to point out that this is very dangerous advice (to the extent bad passwords are dangerous). All it does is add one, easily guessable bit of information -- for the first password the attacker seeks. And after someone has the first password, this method adds zero security; the attacker then has the passwords for every other website.

iamleppert 12y ago

What is wrong with these companies that they are having to brute force passwords? Passwords to business-critical systems should be stored in a safe, in an off-site location (preferably multiple offsite locations).

varikin 12y ago
Like their offsite location in the other tower that was also destroyed? I don't mean to say you are wrong, but many times contingency plans rarely consider such devastating circumstances. Once heard a rumor that a large defense contractor had a backup plan that included flying disk drives from one coast to the other to safe guard against nuclear strikes on either coast or both by having a day old backup in the air. Do you have a plan for nuclear strikes on both coasts?
- mey 12y ago
  I've considered it, but it really comes down to what the business needs. Does the business need to continue to operate in the face of a nuclear winter? The government sure, but most day-day operations of a retail chain would be out the window at that point. Taking this to another extreme, does a DR plan need to account for the earth no longer being viable? Do you need system/data backups in space?

danielweber 12y ago

I like the mouse-over effects here. They aren't obtrusive, messing with the normal functioning of a webpage.

ddebernardy 12y ago

> "Even in America, old habits, like his KGB-induced skepticism of the police lingered." [Cough]. Even in America? More like especially nowadays, no? Beautifully written piece, otherwise.

dredmorbius 12y ago
See Greenwald's recent (past day or so) Intercept piece on trust in the US since Snowden, worldwide. Massive declines.
- ddebernardy 12y ago
  I'd imagine so, yeah. It's hardly a new trend though. There also was a massive decline when George W Bush decided to head to Irak. And before that, there was enough mistrust -- indeed hatred -- in US policy to prompt nutjobs to conduct 9/11.

hammock 12y ago

Side comment about the web design- very cool and clear way of integrating audiovisual stories into the article. Lots of people try to find novel ways to share interviews/first-person accounts that they've recorded, with mixed results. This piece strikes me as best in class.

zarify 12y ago

Well I guess talking to people and telling them you're writing an article about "The Secret Life of Passwords" is more novel than giving them a call pretending to be from their bank or telco. I dearly hope that those people who actually told passwords to the author were either no longer using them or immediately changed them to something better on reflection of just how terrible they were. My mother kept a door from her parents' first house (which they built after emigrating after WW2) for sentimental reasons, that doesn't mean she relied on the old antique lock to secure her current house.

nly 12y ago

I found the part about passwords being personal mementos quite charming. I hope I'm not the only one. Does anyone feel like sharing?

divegeek 12y ago
Sure, I will. I just retired this little gem, after six months of faithful service: ahbag6uWXa0aj0ee Ahh, the memories.

hlfcoding 12y ago

Goes to show 'password' is a total misnomer that encourages bad security practice.