Well, if we are going to discuss password
generation and strength, then someone has to trot
out the two canonical references, which I do now:
http://xkcd.com/936
https://www.grc.com/haystack.htm
-- dkm
At 6/14/2012 03:58 PM Thursday, STeve Andre' wrote:
>Teach people to pick phrases from their favorite songs or poems, and
>you get great passwords:
>
> now is the time for all good men to come to the aid of their country
>
>makes
>
> nittfagmtcttaotc
>
>take an i make a 1, etc, and you've further obfuscated things. Longer
>is better and I've seen lots of people take stanzas from things and
>create truly monstrous pw's.
>
>I teach people to make their own passwords that way. Judging from
>the clackclackclack... noises when logging into things, it's been working.
>
>Use a system that generates passwords for you, and they wind up on
>postit notes. Last week I saw just that for an account which controls
>a lot of money. A LOT. I've seen this so many times when "good" pw's
>are enforced on people.
>
>Passwords certainly are a pain, but they can be managed.
>
>--STeve Andre'
>
>On 06/14/12 09:11, Hoort, Brian wrote:
>>Compared to using the same password for all
>>their websites, which is what our users do that
>>aren’t using a LastPass like service, using
>>LastPass to generate random, long strings for
>>passwords and storing them in an encrypted blob
>>(LastPass does not have the key) is far more
>>secure. This very event with LinkedIn
>>demonstrates this. LinkedIn lost their password
>>hashes. This is most dangerous to a typical
>>user (97%?) who has reused passwords across web
>>sites. Had they been using LastPass (or a
>>similar service) to generate random, different
>>passwords across sites, they would be in a far
>>more secure position. While there is the
>>theoretical problem of the encrypted blob being
>>compromised, LastPass would have had to also
>>fail in their implementation of encryption for
>>that loss to be dangerous. LastPass, used
>>properly to generate passwords, is a big
>>net-win in security for the vast majority of people.
>>
>>Brian Hoort | 517-355-3776
>>ANR Technology Services, MSU
>>
>>From: Kramer, Jack
>>[<mailto:[log in to unmask]>mailto:[log in to unmask]]
>>Sent: Wednesday, June 13, 2012 5:26 PM
>>To: <mailto:[log in to unmask]>[log in to unmask]
>>Subject: Re: [MSUNAG] LinkedIn Password hacked.
>>
>>Right, I get that. If you use them as a
>>password manager you've definitely increased
>>your attack surface. I would consider something
>>like 1Password less attackable since the
>>password database is kept local. However, this
>>LinkedIn check utility isn't giving them your
>>passwordit's just doing the SHA-1 compute on
>>it and then comparing that hash to a list of
>>hashes that are already out there. I mean, I
>>guess someone could theoretically compromise
>>the server hosting that utility and replace the
>>code with something that captures your password
>>in plaintext and sends it off to some nefarious
>>third party, but with no account name (or way
>>to capture such) I'm having trouble seeing how that's useful information.
>>
>>----
>>Jack Kramer
>>Manager of Information Technology
>>Communications and Brand Strategy
>>Michigan State University
>>w: 517-884-1231 / c: 248-635-4955
>>
>>From: STeve Andre' <<mailto:[log in to unmask]>[log in to unmask]>
>>Reply-To: STeve Andre' <<mailto:[log in to unmask]>[log in to unmask]>
>>Date: Wednesday, June 13, 2012 5:11 PM
>>To:
>>"<mailto:[log in to unmask]>[log in to unmask]
>>" <<mailto:[log in to unmask]>[log in to unmask]>
>>Subject: Re: [MSUNAG] LinkedIn Password hacked.
>>
>>My distrust stems from having some other entity get your password.
>>
>>A single point of failure, and you are trusting them to do it right, and
>>not be compromised. So yes, there *is* an increased attack surface
>>here: you are adding to the complexity of things and trusting that
>>they are secure. To me, that's increasing the attack surface. I
>>don't know what else to call it.
>>
>>--STeve Andre'
>>
>>On 06/13/12 17:05, Kramer, Jack wrote:
>>Are you objecting to the concept of a password
>>manager utility or the check site that Matt
>>posted? I agree that password managers
>>represent a single point of failure, though
>>that single point is at least easier to protect
>>than the many points of weak password we seem
>>to end up without any sort of manager; however,
>>the LinkedIn check page they have just compares
>>the SHA-1 hash of any text you enter with the
>>known leak of SHA-1 hashes and tells you if
>>there's a match. There really isn't an attack
>>surface there considering you're perfectly
>>welcome to download that hash leak yourself and
>>run all the comparisons your heart desires on it.
>>
>>----
>>Jack Kramer
>>Manager of Information Technology
>>Communications and Brand Strategy
>>Michigan State University
>>w: 517-884-1231 / c: 248-635-4955
>>
>>From: STeve Andre' <<mailto:[log in to unmask]>[log in to unmask]>
>>Reply-To: STeve Andre' <<mailto:[log in to unmask]>[log in to unmask]>
>>Date: Wednesday, June 13, 2012 4:51 PM
>>To:
>>"<mailto:[log in to unmask]>[log in to unmask]
>>" <<mailto:[log in to unmask]>[log in to unmask]>
>>Subject: Re: [MSUNAG] LinkedIn Password hacked.
>>
>>On 06/13/12 16:30, Carl Bussema III wrote:
>>Actually LastPass is a well-known and respected security tool, so I
>>would actually trust them not to compromise the password. I actually
>>tried to decipher the HTTPS session with Fiddler, but Chrome +
>>LastPass detected a man-in-the-middle and wouldn't proceed.
>>
>>And because apparently some people need to be put out of their
>>paranoia, I went ahead and just used my regular developer tools and
>>found exactly what I suspected:
>>
>>I posted the password "asdf" to their form. I then watched the AJAX
>>request (which because it happens client side is unencrypted before
>>transmission) ... and you know what they are sending to their servers?
>>THE HASHED PASSWORD. It's not like it's hard to SHA1 a string
>>in JavaScript.
>>
>>So the send the hash to the server, check the list of "known bad
>>hashes" (which is what the hackers have published) and tell you if
>>your password hash matches a known compromised hash.
>>
>>It's really about as safe as you can possibly imagine and a great
>>tool. Yes, we should be careful about inputting passwords onto strange
>>sites, but you should also do your due diligence and check if the site
>>might actually be legit.
>>
>>/rant
>>
>>
>>
>>Passwords are about as fragile a thing as there is today: users
>>pick and display idiot pw's, and system (often) have bad security
>>measures in place which don't really work.
>>
>>LastPass is likely an up-front honest entity, but that isn't the reason
>>why they shouldn't be used. Trusting another entity with your pw
>>increases the attack surface of the product you are testing. As
>>good as LastPass is, your are now trusting them to be really secure.
>>That they throw away the string you enter is good, but that means
>>that vandals know just where to look if they were trying to break
>>that system.
>>
>>This is a philosophical thing. Minimizing the places on the net that
>>have pw's is a good thing.
>>
>>--STeve Andre'
|
