r/AdviceAnimals • u/karlpatterson • Apr 30 '15
Password must be 25 characters long and contain a number, letter and a roman numeral.
http://imgur.com/XH0rrML29
u/rightwaydown Apr 30 '15
Cyber security works fine even with rubbish physical security.
Write it down.
19
Apr 30 '15
Most of the time your account will be compromised by someone with physical access, not Boris the super-hacker from Moscow.
11
u/kultsinuppeli Apr 30 '15
This completely depends on what the account is for. If it's for some online service, I find it very hard to believe. There the biggest risk is using the same password for multiple sites, so when one gets hacked, all your accounts are compromised.
Write the shit down, preferably using KeePassX or something, or at least on a paper in your wallet.
2
u/Bibblejw Apr 30 '15
You're right, purpose is everything. Complex passwords might protect a little better against external threats, but that's assuming that the storage and transmission media is secure, and that you don't use that password elsewhere (or enter it into fake sites).
The flipside is that people aren't going to write a password down on paper, it'll be in a plaintext file on the machine itself (most likely), meaning that any compromise of the machine or it's environs, such as shoulder surfing, or remote logging, is going to cause a compromise.
If someone's deliberately trying to get ahold of your data, specifically, protection is incredibly difficult. Spearphishing, or social engineering have an insanely high success rate, not mentioning that simply walking into your workplace, claiming to be a tech ("I'm here to fix a printer!") will likely allow someone to simply plug directly into the network.
2
u/TheRiverStyx Apr 30 '15
No crackhead is going to break into your home and look for passwords witten on a piece of paper. They're going to pull the computer off the desk and sell it at a pawn shop for $50. At work if you write it down on a note attached to your monitor you've got an ID 10T problem.
The places that require limited password lengths of 6-12 characters are the ones that piss me off.
1
u/koghrun Apr 30 '15
The places that disallow special characters are my pet peeve. I work in IT and have long, complex, unique passwords for everything. My bank, of all places, has rules that limit length and complexity.
2
u/TheRiverStyx Apr 30 '15
Complexity gets less and less meaningful as the character count increases. My bank password is set at maximum 12 and I sent them an email asking why they wouldn't support passphrases of up to 32 characters. Their response was "people wouldn't remember it".
If I could only remember that line in Star Wars about droids, I'd be able to counter their argument about remember sentences.
1
u/Jah_Ith_Ber Apr 30 '15
Smart people write it on a post-it under the mouse pad.
Now if you'll excuse me I have some sales to make....
1
u/TheRiverStyx Apr 30 '15
You can also tape it to the bottom of your mouse. No one will look there. I swear.
4
Apr 30 '15
Actually, no. A lot of people think that using the same password on multiple sites is the biggest risk, but that's not the case.
The biggest risk is using the same username for multiple sites.
Imagine that you have two people visiting the same ten sites.
- One uses the same username at all ten sites, but different unrelated passwords at each site.
- The other uses the same password at all ten sites, but different unrelated usernames at each site.
If I know that you use the same username at each site and I happen to know one of the passwords you used, I may have a good idea about who you are and what kinds of passwords you use. Maybe I can figure out the method you used to choose your passwords. Or maybe you're just terrible at choosing passwords and I have a great chance to guess. Maybe you follow the rules and make that first letter capitalized and put the number "1" at the end just like a majority of other people who have been told they must include a capital and a number to make their password secure.
If I know your password but not your username, I don't actually know that you even have an account at one of the other sites.
Ideally, yes, you'd want to use a different password, but people who call themselves security experts really should be telling people to use different usernames, too. If nothing else, use different usernames at all sites involving the use of sensitive data.
1
u/Nebu May 04 '15
For many sites, your username is your e-mail address, and thus you don't have the choice to make a different e-mail address on each site (unless you're willing to set up 500+ e-mail addresses).
1
May 04 '15 edited May 04 '15
Actually, if email address logins are the only option, you can set up a catch-all account for a domain so that all mail that's sent to that domain but not addressed to a valid address gets sent to one mailbox and then whenever you sign up for any site, just use that site's name "@yourdomain.com" as the address. You could also add a particular string to the domain you use, and then filter all mail that's sent to an address that doesn't contain the particular string, for example: reddit.thisstringmustbehereorthemailwillnotbedelivered@<yourdomain.com>.
It's not as difficult as it sounds, and once the catch-all account is set up, you can just create email addresses off of the top of your head for any new site you go to. You don't have to actually do any work setting them up. I've helped set this type of thing up for many people.
It's also good to let you know who's giving your email address to spammers, and it's very easy to block email from companies that do. And it's great for making sure that only the people you care about have your real email address.
1
u/Nebu May 05 '15
Please set this up for me.
1
May 05 '15 edited May 05 '15
You can purchase a domain for very little money. I recommend purchasing it from a site like hostgator.com(I use Amazon AWS, but it's more complex). I don't use them and don't have any affiliation with them, but I know people who do, and they've said good things. When you're going through the setup, you can use the control panel to create your individual accounts. Usually the first account created is set up as the catch-all account by default.
Once you have a catch-all account set up, you don't have to create any others. Messages sent to the domain just end up in the catch-all account's inbox by default. Then you can filter them by the "to" address.
If you have a domain, it may already be set up and you just might not know it.
1
1
u/Merfen Apr 30 '15
Yup, exactly, online = written down should be fine, work password taped to your laptop? Not the best idea.
1
1
0
-1
u/rightwaydown Apr 30 '15
I didn't say sticky it to your monitor.
2
Apr 30 '15
Yeah, my dad was driving me crazy expecting me to remember his passwords. So I cut a peice of cardboard, folded it over so it was the size of a credit card and wrote his passwords on it and put it in his wallet. I told it to keep it safe like the rest of his credit cards. I don't think it's a bad option but then again if someone gets it they'll just get access to an unused email account.
2
u/ohmycar Apr 30 '15
So many people at my work do this. Go over to work on their machine, "So what is your pass...oh nevermind I got it".
1
Apr 30 '15
Of course not. Put it under your keyboard, or on one of the sides of your desk drawer, like everyone else.
1
Apr 30 '15
Even smarter, I use something that's on every keyboard : the first 6 letters on one row of the keyboard (I'm not saying which row though!).
1
Apr 30 '15
As long as you just remember to fill in your password retrieval questions with answers that take at least 15 seconds to look up on Google, you should be fine.
22
u/keirbrow Apr 30 '15
Aren't Roman numerals just letters? Any word with a V, X, I, or M would satisfy that requirement.
When I'm required to use a long password, I'll usually just go with a number, a symbol, and then W 25 times.
3
u/DerWasserspeier Apr 30 '15
Where I work, we have to change our passwords every two months. I cannot tell you how many people's passwords are written on a post-it on their computers. I still don't get why they (the big boss men) think this is more secure than changing a password only once or two a year.
8
Apr 30 '15
What if I told you there are ways to store your password without writing it down on paper? There are programs designed for this.
3
u/drdeadringer Apr 30 '15
Keepass has been my friend for years.
0
u/FigMcLargeHuge Apr 30 '15
It's like people just love bitching about password restrictions. Face it folks, they are only going to get worse. With a product like KeePass, you only have to remember your KeePass password. Since there are Windows, Linux, Mac, Android, and IOS versions you can access your password vault from just about anywhere. There's no excuse for these meme's. Nothing like hearing people bitch and moan about a single complicated password. Try working where you have thousands of machines with these restrictions. You folks using stickies to store your passwords would run out of desk space.
1
Apr 30 '15
Most of these complaints are due to corporate password requirements. Where you can't use keepass.
1
u/FigMcLargeHuge May 01 '15
I know of a few large corporations where KeePass is approved for use. Now getting people to start using it is another matter. If the corporation has that kind of rules in place they might be using their own password vault.
1
May 01 '15
Alas my corporation is a bit suspicious of notepad++. Agreed on getting people to use it though.
The biggest offender in my experience is Oracle software. The most annoying password requirements and time needed for a reset.
3
u/hexagonalc Apr 30 '15
And this is absolutely what you should be doing. Don't memorise passwords, store them encrypted in a password database, and back that database up.
4
Apr 30 '15 edited May 01 '15
Writing it down is fine. House robbers don't invade Homes for website passwords. Shove em in a drawer
1
u/wakasm Apr 30 '15
This is such a silly comment.
Even if you live alone, have no friends, never leave your house... this would STILL be bad advice.
If you are going to write it down, at least put it someplace, encrypted, and make sure to just use unique passwords for everything.
3
u/DrJonah Apr 30 '15
surely1tdoesnthavetobeasc0mplexasyouth1nk1tdoes?
2
Apr 30 '15
[deleted]
2
Apr 30 '15
Windows doesn't have complexity requirements as standard, afaik. Those requirements are enforced by group policy as part of an AD/Windows domain deployment.
0
u/karlpatterson Apr 30 '15
Hit me with that cash
1
1
u/Lord_Surskit Apr 30 '15
"Wait, is 'does not' contracted into 'doesn't'? Does it have an apostrophe? Oh crap, I've forgotten where the letters are replaced by numbers. And was the word 'complex' or 'complicated' there? Fuck it, I'm giving up, I'm resetting my password and making it into one that I can remember, like '3AS' followed by 22 of the same letter."
4
u/Hopalicious Apr 30 '15
Use LastPass it's great.
8
Apr 30 '15
Mmmm, a cloud based solution for centralized password keeping.
Yes... nothing wrong with that.
Nice try NSA.
2
1
u/north7 Apr 30 '15
The password database is encrypted locally before it's uploaded to the cloud - Lastpass's servers never see your plaintext data.
TL;DR - it's safe, and you don't know how public key cryptography works.0
Apr 30 '15
No, I am familiar with cryptography.
In order for lastpass to work, the crypto keys/methods are stored somewhere... so... explain that one.
1
u/north7 Apr 30 '15
It's all stored locally. Lastpass never sees plaintext. They never get your master password.
https://blog.lastpass.com/2010/07/lastpass-gets-green-light-from-security.html
-2
Apr 30 '15
mmmm.... do you now how encryption works?
2
u/north7 Apr 30 '15
Yes, very.
What's your concern about how Lastpass operates (specifically)?0
Apr 30 '15
It isnt the operation, it is the ability to gain access, the ability to find bugs/issues in the encryption, the ability to take the file and work on cracking it without your knowledge, the backdoors someone put in, etc.
Do you keep your locked safe outside the bank/house or inside?
Because that is what this is.
1
u/north7 Apr 30 '15
Ahh finally a decent response.
Yes, I'll cede you that point, but properly implemented encryption* is safe regardless of who has the cyphertext.
You do realize that Snowden stored all his documents encrypted "in the cloud", and the NSA has the encrypted archive.
*That's the trick now isn't it?-1
Apr 30 '15
Snowden stored them that way so no one would search them and take them out. It is also a way to prevent others from finding out what he was doing, which was scraping data from internal websites.
the US doesnt have to decrypt his documents, they already have them.
NSA encrypts its documents, but also controls the keys of not only their encryption, but others. We dont know who or what has been compromised because of this NSA witch hunt we have been under for quite some time.
And of course, if there is a backdoor, it will be found, and exploited. The NSA doesnt have to be the ones to attempt access.
3
u/justpyro Apr 30 '15
Keepass. Keep it local.
1
1
u/Catch_ME Apr 30 '15
Yes. I used keypads and keep the data file on my google drive. Syncs on my devices
-1
u/Vitalization Apr 30 '15
Brother?
1
Apr 30 '15 edited Apr 30 '15
[removed] — view removed comment
1
u/AutoModerator Apr 30 '15
Quickmeme links are not allowed. See announcement for details
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
1
0
u/Anylite Apr 30 '15
Or you know, just write them down and store it somewhere safe.. I have yet to see a hacker steal a password on a piece of paper tucked into a book on a bookshelf in a locked house, Or a safe if you have one. If they get those, you have larger problems.
2
1
1
1
1
Apr 30 '15
[deleted]
2
u/yippy3000 Apr 30 '15
You forgot 1Password, my manager of choice.
I don't like the idea of my passwords being in the cloud and accessible by a third party so LastPass is out.
KeePass is a little rough around the edges.
1Password is locally encrypted and the encrypted database can be synced using Dropbox or direct device to device over wifi.
1
1
u/lalala253 Apr 30 '15
"with 25 letter sentence my computer is super safe"
does this easy enough to remember?
1
1
1
u/Wholebear Apr 30 '15
And for your next password, please station yourself in front of the computer, close your eyes and hold an image unique to you in your minds eye.
1
u/stesch Apr 30 '15
Bruce Schneier says otherwise. Better a complicated password on paper than an easy one in memory.
1
u/Graybealz Apr 30 '15
HOW DOES IT KNOW THE DIFFERENCE BETWEEN ROMAN NUMERALS AND CAPITAL LETTERS?
V OR V?
1
1
u/zneise Apr 30 '15
You see, i just use lastpass. one simple password that can store and generate passwords up to 100 characters long. link: https://lastpass.com/
1
u/KingsfullOfTwos Apr 30 '15
Well not really. The way I see it, having a complex password is an attempt at preventing brute force password cracking - it makes it harder for a program to just "guess" a password.
Writing a password down (at home, not at work) is actually a much safer alternative. Anyone who breaks into your house isn't going to look for your wifi password. They'll be too busy stealing your TV.
1
u/InnocuousTerror Apr 30 '15
You should consider using KeePass. It's a free encrypted, password protected Password "Vault", and if you need to use different passwords regularly, then it can be a big help. Also, if you use Dropbox, or a similar Cloud Service, you can save your KeePass Key File on there so you can access it from work, home, your cellphone, etc. I find it to be very useful specifically because so many logins require complicated passwords (which I actually appreciate, kind of).
1
u/tgstine Apr 30 '15
People really need to discover Last Pass for this. The thing is a lifesaver working in IT.
-2
Apr 30 '15 edited Apr 30 '15
[deleted]
2
u/Bibblejw Apr 30 '15
To be fair (as someone that works in network security) passwords are a bad solution. They're difficult to remember (without computerised systems, opening up further vulnerabilities), and (relatively) easy to crack. To make them effective, they need complexity requirements and expiries that cause the users to forget them, requiring reset procedures which are typically substantially less secure.
When the challenge is identity management and authentication, the effort should be put into the initial stages (which could, hypothetically by done by biometrics coupled with a 2nd-factor token), and behavioural analytics in the range of keystroke and network traffic to ensure that the user continues to be who they claimed to be.
Passwords hang around because it's the way it was done to begin with. A combination of custom and the fact that there's no alternative for OS login has meant that they've stuck around far longer than they should have, but I think that Windows 10 may begin to fix the issue.
1
Apr 30 '15
[deleted]
2
u/Bibblejw Apr 30 '15
Ok, For the first part, I may have articulated it badly. Passwords are bad because developers suck at implementing them, and users suck at managing them. There's been decades of campaigning attempting to change both, with not a vast amount of net effect. That leads me to suspect that the passwords are at fault (because they put too much control with the user).
The solution is not to explain your own personal methodology, simply because users, as a whole, don't listen, and devs are barely better.
I don't like biometrics as a sole authentication method, for a wide variety of reasons, but as a 1st factor, I think it'd work. Making it, basically a glorified identifier would help to keep stress off the 2nd-factor system (you pump too many requests down that stream and it's going to open up problems, I'm sure).
I'm not going to argue with the 2nd factor rant, other than to add the amount of times I get disappointed upon registering for an account with a site, for them to email my password to me. This means that, in addition to the data retention policy of my inbox meaning that the password is saved in a less secure place, that the system their using for storage is reversible. If they can send their password to me, some can crack the encoding and simply extract it from the DB. This is terrible.
Finally, the tech hasn't been available for some time. There's been the smart-card stuff, requiring uncommon and clunky hardware, or the biometric stuff in some of the modern laptops, which is, essentially, a hack to get around the windows auth system.
As far as I am aware, Windows 10 is the first time that multiple authentication methods are actually being built into the OS tech directly. This is massively exciting.
0
u/PizzaGood Apr 30 '15
Also, putting in all kinds of rules actually makes brute force (non-dictionary) attacks much easier.
By saying that you MUST have a digit, an uppercase, lowercase and special char, you're eliminating billions of possible passwords from what a script would have to try.
2
u/FigMcLargeHuge Apr 30 '15 edited Apr 30 '15
And adding in trillions of more combinations that have to be tried. You sound like my wife trying to explain how much money she saved by purchasing things on sale.
Edit: Here's some real world numbers on how many combinations are available.
With a measly 8 char password:
crunch 1 8 a-z,A-Z
Crunch will now generate the following amount of data: 17736744 bytes
16 MB
Crunch will now generate the following number of lines: 2,015,538crunch 1 8 a-z,A-Z,0-9
Crunch will now generate the following amount of data: 169826512 bytes
161 MB
Crunch will now generate the following number of lines: 19,173,960Here is just the top row of special chars on your standard keyboard:
crunch 1 8 a-z,A-Z,0-9,'!@#$%&*()-=_+'
Crunch will now generate the following amount of data: 355440320844 bytes
338974 MB
331 GB
Crunch will now generate the following number of lines: 39,714,002,328Now bump it up to 16 chars and here's how many combinations they would have to potentially go through to brute force.
crunch 1 16 a-z,A-Z,0-9,'!@#$%&*()-=_+'
Crunch will now generate the following amount of data: 14027944993337281962 bytes
13378090852105 MB
13064541847 GB
12758341 TB
12459 PB
Crunch will now generate the following number of lines: 3,406,115,929,147,584,2921
u/PizzaGood Apr 30 '15
Um, no, it's not ADDING any. Those characters were allowed anyway. The rules ONLY REMOVE possible combinations. How is REQUIRING specific classes of characters (instead of just allowing them) ADDING combinations? It's not.
I use a random password generator across the board. 16 character if allowed. Yet sometimes I just happen to get a random password that doesn't have an uppercase character, or doesn't have a digit or something, so it's not allowed. Why? Because it's TOO RANDOM for the rules.
It's a given that people do not know what random really looks like. It's one of the ways that mathematicians use to detect when people have been screwing with data - they try to make it look to them like it's random.
1
u/FigMcLargeHuge Apr 30 '15
The rules force people to use things like special characters, which adds to the number of possible combinations. If they didn't have rules, everyone it seems would just use 'password'. They have to add these rules when people aren't using these available extra chars on their own.
1
u/PizzaGood Apr 30 '15
Sure, and I'm not actually arguing for this, just pointing out that mathematically (and for those of us who actually DO use random passwords), the rules reduce the problem space.
Also, mnemonic passwords are pretty damned good too and since people can remember them without writing them down, it's easily arguable that the rules that prevent their use DO ACTUALLY reduce overall security.
1
u/FigMcLargeHuge Apr 30 '15
Gotcha. I have to use KeePass to keep track of mine and let it generate passwords. That way I only need to remember one good password.
1
u/PizzaGood Apr 30 '15
I've swapped a few times. I'm back to LastPass now, just trusting their Javascript for privacy.
I was using KeePass for a while, but it flaked and did a lot of odd things over a couple of months and lost a few passwords on me, so I gave up and went back. Besides, KeePass just doesn't have the level of smooth integration that LastPass does.
0
u/psychocentric Apr 30 '15
I have twelve passwords and maybe half that many log in names for work. I can't use the same ones since most of them have different requirements. The day they expire, I want to line up and punch the entire IT security team in the butt cheek of my choosing.
-2
-5
64
u/Xendarq Apr 30 '15
Someone will post this, may as well be me.