Are your passwords as "secure" as you think?

[JamesW]

Actually, why are we worrying? Most of the things I use which need a password have a 3 chance rule (SAP, Email, Work PC, Online Banking). If you don't get it right in 3 tries then it locks you out and you have to call the IT people.

Surely most important systems have a similar rule, meaning they will never be hacked.

 

[litrelord]

Actually, why are we worrying? Most of the things I use which need a password have a 3 chance rule (SAP, Email, Work PC, Online Banking). If you don't get it right in 3 tries then it locks you out and you have to call the IT people.

Surely most important systems have a similar rule, meaning they will never be hacked.

This is where the other aspect of protecting yourself comes in and you keep yourself aware of people using social engineering to try and get you to disclose your passwords or the answers to the forgotten password questions (though I'm sure that used to just be called conning people rather than social engineering?!?)

The Google and Adobe hacks last year were due to holes in the software but these were only activated by clicking a link in an email. The emails were sent to individuals in the company rather than everyone and were specifically targeted towards those people which made them much more believable.

I don't think the perpetrators of the google hack are coming afetr my MrExcel password though so hopefully I'm safe for now.

Nick

 

[MrKowz]

This comic strip is actually somewhat relevant to this topic - and pretty funny!

Password Validation

 

[Auracle]

Actually, why are we worrying? Most of the things I use which need a password have a 3 chance rule (SAP, Email, Work PC, Online Banking). If you don't get it right in 3 tries then it locks you out and you have to call the IT people.

Surely most important systems have a similar rule, meaning they will never be hacked.

Unless of course you've got a situation like at work here where my supervisor told us that if we have such a complicated and/or hard to type password that we keep getting locked out of systems, she is going to come over and make a password for us... well, you know at that point it's not going to be anything terribly complex...

 

[MrKowz]

Interesting read on how GPUs are being used to crack passwords in a FRACTION of the time:

http://www.zdnet.com/blog/hardware/cheap-gpus-are-rendering-strong-passwords-useless/13125

 

[Darren Bartrup]

Schrödinger's cpu?

I didn't get the salt joke, but giggled at this one.
So your passwords secure, but is instantly cracked as soon as you use it?

 

[arkusM]

Anybody heard of this method of password generation called Diceware?
Basically they have come of with a dictionary of words based on 5 digit values.

Then you roll a dice five times per word and as many words as you like (25 rolls for a five word password) then you concatenate the words as your password. Interesting, but thoughts from this group?

http://world.std.com/~reinhold/diceware.html

 

[sous2817]

For our company, the weakest link is the help desk. We have network log ins, so I can go to any laptop and type my employee ID number and password and get access to my desktop, outlook email, etc.

Get it wrong 3 or 5 times and I'm locked out and have to call IT. There is no identity validation when I call IT, just give them my employee number and tell them I'm locked out. They'll reset it w/ a generic password that I then have to reset on your next log in.

Do you know what's freely available on our corporate directory? People's employee id! So if I was the type, I could do to one of the computers in one of the workrooms and type in some employee's ID, get it locked, call the help desk and get it reset, and relog in and have access to their email account as well as anything they've put on their network drive allocation.

 

[Oaktree]

This thread makes me think of this recent comic from xkcd:

http://xkcd.com/936/

 

[arkusM]

This thread makes me think of this recent comic from xkcd:

http://xkcd.com/936/

That comic is what Diceware is supposed to do.
Is it really a valid method?
Of course there is the proverbial character limit...