]]> http://security.blogoverflow.com/2014/06/should-we-rethink-our-entire-password-strategy/#comment-477390 Tue, 18 Nov 2014 03:42:40 +0000 http://security.blogoverflow.com/?p=1153#comment-477390

password manager

To me this is a big no no, you’re relying on only one password, the one you’re using to unlock your password manager. If this password would come to leak then all your passwords would be compromised.

A good solution would be to: * use a password manager (that does all the work for you) for websites you don’t really care. * use passwords you memorise for websites you care about (You could hash the name of the website in your head to make a password with what one of the Blum proposed (http://www.scilogs.com/hlf/mental-cryptography-and-good-passwords/)) * use multi-factor auth (I like the yubikey) for critical websites.

Further, with new breaches happening all the time, the black list will continue to grow, presumably for ever until all possible passwords are no longer valid.

This combination frees a user from the need to pick strong passwords. It is also safer than just having password manager, because a hardware device plays a second factor. At the same time if the device is lost – no problem, it can be revoked and the credential data is safe.

Hardware devices come in deveral different types. Some just store master password, some are basic OTP tokens, others store your credentials encrypted in the cloud, so you can never really lose them. I think the latter is the best option provided that credentials are encrypted and handled wisely.

There’s one more important point which is often forgotten: not only users should care about login security. Websites’ task is even harder. And you’re right – user can never know for sure that the website is reliable. The suffering can be mitigated if websites make more use of 3rd party secure login or OpenID technologies. Most work about storing credentials could be done by a reliable authentication provider.

There is a technology called WWPass that combines safe password handling, hardware device and added security on the sebsite side. I guess this is a technology to keep an eye on, it is potentially game-changing.

]]> http://security.blogoverflow.com/2014/06/should-we-rethink-our-entire-password-strategy/#comment-439262 Sat, 21 Jun 2014 16:01:25 +0000 http://security.blogoverflow.com/?p=1153#comment-439262 I believe we need an ISO standard interface established between Password Managers and Websites. You would have one strong password for the password manager (from whatever company(ies) that create the app(s)). The password manager will automatically change/update passwords based on whatever new security protocols available.

]]> http://security.blogoverflow.com/2014/06/should-we-rethink-our-entire-password-strategy/#comment-438179 Fri, 20 Jun 2014 16:04:19 +0000 http://security.blogoverflow.com/?p=1153#comment-438179 “A problem we have though is that banks tell customers never to write down passwords” – yeah, banks are a real shining light. Are they the same banks using HTML5/CSS/Javascript with the web security model? Or the picture as the second authentication factor?

The threat is unauthorized network access and facilitated by weak, memorable passwords. Writing down my password and then losing my wallet or desk drawer is down at the bottom of the list. Hell, even password reuse is a greater threat.

]]>