|
Posted by nemo_outis on November 30, 2005, 7:59 pm
If you were Registered and logged in, you could reply and use other advanced thread options
> nemo_outis wrote:
>>
>> ....
>>
>>>The nice thing about such passphrases is that they can often be
>>>"assembled" in the input window just as I did above, rather than
>>>entered directly in final form.
>>
>> ....
>>
>>
>> A few things I forgot to add:
>>
>> "Assembling" a passphrase in an password input window can be severely
>> hampered if the window is blanked with asterisks. Here's a trick:
>> assemble the passphrase in the *user name* window and then cut and
>> paste it to the password window (afterwards, go back and fill in the
>> user name).
>>
>> For the theoretically inclined, the Shannon entropy of ordinary
>> English sentences is about 1.2 to 1.4 bits per character. This gives
>> an alternate method of calculating passphrase entropy.
>>
>> Regards,
>>
>>
>>
> While I agree with passphrase concept, I prefer tokens (smartcards).
>
> Some systems have limits as to usable PW length. Additionally since
> the system should lock after a short period of inactivity to prevent
> someone from entering system if a user leaves their terminal, it can
> be painful re-entering long passphrases. This does cause complaint.
> Storing very long and complex passwords on smartcards with unique
> passwords stored on the smartcard for each required system locks out
> possibility of dictionary attacks. This is further enhanced if your
> company servers lock password with 2 missed attempts (password
> "should" always be good but sometimes gurgles occur). This assists in
> log review if you see bad password attempts on accounts, as you
> shouldn't see many on any system.
>
> Meanwhile the user typically has to remember one short pin on their
> smartcard to access many systems. Of course the smart card locks with
> 3 missed pin attempts and inevitably users do lock their cards, but
> this is relatively seldom. A 128k card holds an amazing number of
> credentials, more than enough for most mortals.
>
> Winged
You raise some very valid points. I suppose (depending on particular
circumstances) security should be provided by a judicious blend of what
you know (passwords or passphrases), what you possess (smartcards or
equivalents), and who you are (biometrics).
Regards,
>
|