passwords

passwords
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 General Computer Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
passwords Andy Fish 10-19-2007
|--> Re: passwords Sebastian G.10-19-2007
---> Re: passwords Shenan Stanley10-19-2007
---> Re: passwords Mark Trimble10-19-2007
---> Re: passwords Steve Riley [MS...10-24-2007
Posted by Sebastian G. on October 31, 2007, 7:42 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
AnthonyM wrote:

> Do you really think that having half of a 25 character password of an
> unknown number of passwords to an unknown number of sources is
> meaningful in any way other than being proud of it?


Yes. Not just that you assume the number of passwords and the corresponding
sources to the attackers to be known, you should also understand what
entropy means and how it turns the remaining 12 characters into a feasible
dictionary attack.

> What about if someone releases the sourcecode to keepass or roboform etc?


Aside from the fact that keepass already is open source, why should this be
any problem at all? Quite the contrary holds: Roboform is unacceptable
because it's not open source.
Even if you trust the vendor to not send out your passwords in a covert
channel, you cannot trust them about the crypto implementation. How sure are
you that the entropy collection does a proper job and not just takes some
well guessable or even highly choosable input? How sure are you that they
properly protect the memory region where the cryptographic key is stored
from being paged out to disc? Without the source code, you can assure that
their programmers didn't fall into at least one of the common pitfalls,
which is very likely.

> Perhaps you can easily memorize 40 25 character passwords every 30 days,

> but I can't.

Sure you can, it's very easy: It's called a "pass phrase" for a reason.
BTW, just exactly this sentence gives you an easily memorizable, fastly
typeable pass phrase with sufficient entropy.

And with using a password manager, you need to memorize only exactly *one*
pass phrase.

Posted by Ari on October 24, 2007, 6:09 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
On Wed, 24 Oct 2007 18:54:08 -0000, AnthonyM wrote:

>>> I am an IT professional and I get the impression that most people currently
>>> take a similar approach to me. If not, what's the best way to manage so many
>>> passwords?
>>
>>> Andy
>>
>> KeePass
>> --
>> "You can't trust code that you did not totally create yourself"
>> Ken Thompson "Reflections on Trusting Trust"http://www.acm.org/classics/sep95/
>
> I use a modified approach to all the solutions mentioned above. Truly
> it doesn't matter if you keep them in an excel file. If they are
> stored somewhere, there is a potential vulnerability.

The level of vulnerability is the question. if you placed KeePass in a
truecrypted container, then placed fake passwords in an "open" Excel
file, you may have the best of the best.

> So I use
> different passwords for every site, and I do store 1/2 of the password
> in a system (I won't endorse a particular one, but I've used several
> methods, Excel, RoboForm, Keepass, UltraSafe). So I put 1/2 of the
> password in the system. I usually do a random generated 8-10
> character key. Then, I memorize a 2nd 1/2 that is a keyphrase. This
> helps me feel secure that even if my method of storing passwords is
> comprimized, they still have to come up with the 2nd half of the
> password that is memorized.
>
> Just a thought.
>
> Anthony Maughan

Depending on the password, that isn't hard to do.
--
"You can't trust code that you did not totally create yourself"
Ken Thompson "Reflections on Trusting Trust"
http://www.acm.org/classics/sep95/

Posted by Steve Riley [MSFT] on October 24, 2007, 10:27 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Contrary to what a lot of others claim, it's even ok to write your passwords
down. Now, you just need to protect the piece of paper.

Your choice of password management tools is less important than your method
of protecting the storage.

--
Steve Riley
steve.riley@microsoft.com
http://blogs.technet.com/steriley
http://www.protectyourwindowsnetwork.com


> Hi,
>
> I just got a nice email from fasthosts - a UK ISP - saying that they have
> had a security breach and have lost security details including my password
> IN PLAIN TEXT !!
>
> because I use the same password for different online systems, this means
> someone who found out my email address (the real one - not the one I'm
> using to post this) and fasthosts password could potentially log on as me
> to many different sites.
>
> fortunately I use several different passwords including a separate one for
> sites who I think might store it in plain text. unfortunately I didn't
> think for a minute that an ISP would do this, so I used a relatively
> secure password for them.
>
> if I can't trust anyone to encrypt my password, it seems that the only way
> to be secure is to use a different password for every system and then
> write them all down somewhere.
>
> I am an IT professional and I get the impression that most people
> currently take a similar approach to me. If not, what's the best way to
> manage so many passwords?
>
> Andy
>
>
>

Posted by Ari on October 25, 2007, 2:30 am
If you were  Registered and logged in, you could reply and use other advanced thread options
On Wed, 24 Oct 2007 19:27:16 -0700, Steve Riley [MSFT] wrote:

> Contrary to what a lot of others claim, it's even ok to write your passwords
> down. Now, you just need to protect the piece of paper.
>
> Your choice of password management tools is less important than your method
> of protecting the storage.
>
> --
> Steve Riley
> steve.riley@microsoft.com
> http://blogs.technet.com/steriley
> http://www.protectyourwindowsnetwork.com

Accessibility, functional use come into play. A piece of paper that you
have to hide in your butthole and pull out several times a day isn't
what I would call practical.

Keepass is.
--
"You can't trust code that you did not totally create yourself"
Ken Thompson "Reflections on Trusting Trust"
http://www.acm.org/classics/sep95/

Posted by Steve Riley [MSFT] on October 25, 2007, 3:06 am
If you were  Registered and logged in, you could reply and use other advanced thread options
LOL. There would be moisture problems with that approach, as well.

Nevertheless, my point was the second paragraph. Personally, I prefer to
keep the passwords off the computer. For some folks, paper works fine. I use
a password-protected list application on my smart phone.

--
Steve Riley
steve.riley@microsoft.com
http://blogs.technet.com/steriley
http://www.protectyourwindowsnetwork.com


> On Wed, 24 Oct 2007 19:27:16 -0700, Steve Riley [MSFT] wrote:
>
>> Contrary to what a lot of others claim, it's even ok to write your
>> passwords
>> down. Now, you just need to protect the piece of paper.
>>
>> Your choice of password management tools is less important than your
>> method
>> of protecting the storage.
>>
>> --
>> Steve Riley
>> steve.riley@microsoft.com
>> http://blogs.technet.com/steriley
>> http://www.protectyourwindowsnetwork.com
>
> Accessibility, functional use come into play. A piece of paper that you
> have to hide in your butthole and pull out several times a day isn't
> what I would call practical.
>
> Keepass is.
> --
> "You can't trust code that you did not totally create yourself"
> Ken Thompson "Reflections on Trusting Trust"
> http://www.acm.org/classics/sep95/


Similar ThreadsPosted
Hashes and Passwords May 21, 2006, 5:36 am
Win passwords - transmission to server November 27, 2005, 1:36 am
Legality of decrypting passwords June 30, 2008, 8:48 am
Stored passwords vanished -- is it a bug or a virus? June 17, 2005, 6:35 pm
Stored passwords vanished -- is it a bug or a virus? June 17, 2005, 6:35 pm
how to programmatically prevent passwords being saved? November 14, 2005, 11:26 am
FAQ: How can I generate good strong passwords? December 5, 2005, 5:56 pm
FAQ: How can I generate good strong passwords? December 25, 2005, 11:33 am
FAQ: How can I generate good strong passwords? January 26, 2006, 11:35 am
FAQ: How can I generate good strong passwords? February 10, 2006, 3:26 pm

The site map in XML format XML site map

Contact Us | Privacy Policy