Odo Head Spa offered by Odo Beauty Care Limited

Odo Beauty Care Limited Welcome to our first Odo Head Spa Salon located at 9F Pennington Com Bldg., 17 Pennington Street, Causeway Bay (Near to Regal Hotel, Hong Kong and above 7-11) 香港铜锣湾边寧顿亍 17号 边寧顿商业大厅厦电梯 9字 鄰近香港富豪酒店,7-11 樓上 TEL: 9010-1586 English and Japanese only (英/日语) Email: info@odo.com.hk BY APPOINTMENT ONLY 完全予約制 敬请电約

網頁

Powered By Blogger

2024年1月19日星期五

Change Passwords Regularly - A Myth And A Lie, Don'T Be Fooled, Part 2

In the previous blog post, I have covered the different passwords you have to protect, the attackers and attack methods. Now let's look at how we want to solve the issue.

Password requirements

So far we have learned we have to use long, complex, true random passwords. In theory, this is easy.
Now, this is my password advice for 2014:

Password character classes
Use upper-lower-digit-special characters in general cases.
If you don't understand what I just write, choose from this:
qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM0123456789-=[];'\,./<>?:"|{}_+!@#$%^&* ()`~
If you are a CISO, and say: use 3 out of 4 character class, everyone will use Password12 or Welcome12 as their password (after the 12th enforced password change).

Password length
This is basically the only thing which changes whether the password is in the very high/high/medium/low level. Check the previous blog post for the details about very high/high/medium/low level.

Password length: Very high level class (including work-related/enterprise passwords)
15 character (or 20 if you are really paranoid). Making true random passwords longer than 20 characters usually does not make any sense, even in high security scenarios (e.g. military, spy agencies, etc.). 15 character in Windows environment is a right choice, as LM hash is incompatible with 15 character passwords, thus one (effective) attack won't work. Beware, there might be bugs with using 15 character passwords, with a low probability.

Password length: High-level class
12 character, upper-lower-special characters

Password length: Medium class
10 character, upper-lower-special characters, still TRUE random

Password length: Low-level class
9 character. Why less?

Pin codes
Always choose the longest provided, but a maximum of 8. Usually, more is pretty impractical.

Password randomness
True random, generated by a (local) computer. Avoid Debian. Avoid random generated by your brain. Do not use l33tsp33k. Do not append or prepend the current month, season or year to a word. Do not use Star Wars/Star Trek/(your favorite movie/series here) characters or terminology. In general, avoid any pattern like the above ones. The chances that a true random password generator generates SkyWalker12 is very-very low. And believe me, it is not that hard to crack those. Every algorithm that you would come up with; the bad guys have already thought of it. Use true random. Let the computer do it for you. See details later in this post.

Password history
Never-ever reuse passwords. NEVER!

Password change period
If it is not enforced otherwise, don't bother to change it twice in a year. But! Check if the password cracking speed made your current ones obsolete. If yes, change the obsolete passwords. Immediately change the password if you have been notified that the service you use has been compromised. Immediately change all of your recently used passwords if you suspect malware was running on your computer (do this on a known clean computer). Immediately change your password if you have used it on a computer you don't own, or there is a small chance malware is running on it. Change it if you really had to give your password to someone. Otherwise, goodbye regular password change. We will miss you...

If you are a CISO, and writing security policies, you should have to enforce the password change period based on: do you allow LM hashes? What is the password length requirement for users and administrators? What is the current hash cracking speed, and the forecast for the next 2 years? I think people would be happy to increase their passwords with 1-2 characters, if they are not forced to change it frequently (e.g. every month).
Now after I was sooo smart giving advises people still hate to implement, let's see the practical implementations. At least some people might like me, because I told them not to change the passwords regularly. Next time someone tells you to change all your important passwords regularly, put a lie detector on him, and check if he changes all of his passwords regularly. If he lies, feel free to use the wrench algorithm to crack his passwords. If he was not lying, call 911, to put a straitjacket on him. Only insane paranoid people do that in reality. Others are just too scared to say "what everyone recommended so far is bullshit". Comments are welcome ;) Other people might hate me for telling them using true random passwords. Don't panic, keep reading.
And don't forget to use 2 factor authentication. It might seem a bit of an overkill at the beginning, but after months, you won't notice using it.

(Bad and good) solutions

I will use the same password everywhere

This is a pretty bad idea. If one of the passwords are compromised, either the attackers can access your other sites, or you have to change all of your passwords. There are better ways to spend your life on earth than changing all of your passwords.

I will remember it

Good luck remembering 250 different, complex passwords. Don't forget to change them regularly! ;)

I will use the password recovery all the time

Not a very user-friendly solution. And because the security answer has to be as complicated as the password itself, the problem has not been solved.

I will write it down into my super-secret notebook and put it in my drawer

Although it might work in some cases, it won't work in others. I don't recommend it.





I will use an algorithm, like a base password, and add the websites first letters to the end of the password

Still better than using the same password everywhere, but believe me, if this is a targeted attack, it is not that hard to guess your password generation algorithm.

I will use the advice from XKCD, and use the password correcthorsebatterystaple

Still a lot better than simple passwords, but unfortunately, people are still bad at choosing random words with random order, so it is not the best solution. And again, you can't memorize 250 different passwords ... Even 10 is impossible. Only use this method in special corner cases (see details later), and use a passphrase generator!

I will use a password manager

This is the very first good idea. It solves the problem of remembering 250 different complex and random passwords. Some people might complain about using a password manager, here are those complaints. And my answers:

If someone gets access to this one password store, all is lost.
Answer: If someone accessed your password store, and the master password, you can be pretty damn sure that most of your passwords are already stolen. For extra paranoids, you can use multiple password stores, one for daily use, one for rare cases. Beware not to forget the password for the second one ;)

What if I don't have access to the password store when I need it?
Answer: In the age of cheap notebooks, tablets, and smartphones, in 99% of the cases you should not use that important password on any other device than yours. In the rare cases when you must, you can use either your smartphone to get the password, or use a browser extension like Password hasher to generate different passwords to different websites, with one password. For extra paranoids, you can have different master passwords for the different security levels. And don't forget to change the password after you are back at your own computer.

What if I forgot the one password to the password store?
Answer: If you use your password manager daily, it has the same odds to forget that one password as it is to forget every one of your passwords.

Password managers make phishing attacks easier.
Answer: Who started this nonsense? Good password managers decrease the risk of phishing.

Password managers have the same vulnerabilities as other websites or software.
Answer: Well, this is partially true. There are at least 3 types of password managers, from most secure to least: offline, browser built-in, online. Online password managers give better user experience, with a sacrifice in security. But if you choose one of the leading password managers, and you are a simple home user, the risks are negligible. If you try to store your work password in an online password store, you might violate your internal security policy. For paranoids, use offline password managers, and back them up regularly. If you choose an online password manager, at least use 2-factor authentication. And don't forget, your Chrome password can be easily synchronized to the cloud, shifting it to the online category.

In some cases, like Full Disc Encryption, OS login, smartphone login, or password manager login, the auto-type of password from the password manager is not available, thus choosing a true random password is a pain in the a$$.
Answer: True. Generate pronounceable passwords or passphrases in these corner cases, e.g. with the Linux tool apg you can generate pronounceable passwords. For easy and fast type, don't use capital letters (only lower-alpha - digit - special) in the original password, but increase the length of the password. Add 1 extra character because you don't use upper case letters, add 3 other because it is a pronounceable password, and you are good to go. For extra paranoids change one or two of the letters to uppercase where it is convenient. 
apg -M SNL -m 15 is your friend.
If you want to check what I write here (always a good idea), test the entropy of a true random 10 character password with all character classes, and check it with 14 characters, without uppercase. I recommend KeePass for that. If you comment on this that "Keepass can not measure that it is a pronounceable password, thus the entropy is lower in reality", my answer is: "Check out the current passwords used by users, and current password advises, and tell me if this password is a lot better or not ..." . You have been warned.
 

For the high-level password class, I don't recommend anything your brain generated. There are also suitable offline passphrase generators. Use at least 5-6 words for passphrases.

Password managers are not user-friendly, it takes more time to log in.
Answer: If you set auto-type/auto-fill, and the password manager is opened once a day (and you lock your computer when you leave it), in this case, logging in takes less time than typing it! It is more convenient to use it, rather than typing the passwords every time.

I like to create new unique passwords every time I create a new account, and password managers take the fun away from it.
Answer: Said no one, ever! "38 percent of people think it sounds more appealing to tackle household chores – from folding the laundry to scrubbing toilets – than to try and come up with another new user name or password."

To summarize things. Use a password manager.

General advise

Never use your essential passwords on other computers. They might be infected with a password stealer. If you really have to use it, change the password as soon as possible on a trusted (your) computer.

Don't fool yourself by phishing sites. If you go to the local flea market, and there is a strange looking guy with "Superbank deposit here" logo above his head, will you put your money?

Protect yourself against malware. Use a recent operating system, and even if you use OSX or Linux, it is not a bad thing to have an AV as a "last line of defense". Or to check your pendrive for Windows USB worms.

Never-ever use online web sites to "generate your password", "measure the complexity of your password" or "check if it has been breached". Never! (Except if it is your password manager :) ... )

Update: Sign up on the https://haveibeenpwned.com/ for notification if your e-mail is found in a leak.

Changing passwords frequently is bad advice. It is not effective. Put more energy in other right password advise. 

More articles


  1. Hacking Tools For Pc
  2. What Are Hacking Tools
  3. Pentest Tools
  4. Hacker Tools Software
  5. Hacking App
  6. Pentest Box Tools Download
  7. Hacking Tools For Games
  8. Hacker Tools Apk Download
  9. Hacker Tools Windows
  10. Hackers Toolbox
  11. Pentest Tools Framework
  12. Pentest Tools Android
  13. Pentest Tools Kali Linux
  14. Hack Tools For Windows
  15. Hacker Tools Apk Download
  16. Pentest Tools For Ubuntu
  17. Hacking Tools And Software
  18. Hak5 Tools
  19. Pentest Tools Website
  20. Easy Hack Tools
  21. Pentest Tools Review
  22. Pentest Tools Free
  23. Hack Tools Download
  24. Hack Rom Tools
  25. Nsa Hacker Tools
  26. Pentest Box Tools Download
  27. Pentest Tools Github
  28. Hack Tools For Ubuntu
  29. Hack App
  30. Hack Tools 2019
  31. Kik Hack Tools
  32. Pentest Tools Find Subdomains
  33. Hacker Tools Windows
  34. World No 1 Hacker Software
  35. Best Hacking Tools 2020
  36. Hack Tools Mac
  37. Pentest Tools Free
  38. Hacker Tools
  39. Hacker Tools Hardware
  40. Hack Tools Pc
  41. Physical Pentest Tools
  42. Hacker Tools List
  43. Hacking Tools For Windows
  44. How To Hack
  45. Hacker Tools Software
  46. Top Pentest Tools
  47. Easy Hack Tools
  48. Hacker Tools For Ios
  49. Hack Tools For Mac
  50. Pentest Tools Bluekeep
  51. Pentest Tools Open Source
  52. Hacking Tools And Software
  53. Hack Tools For Pc
  54. Pentest Box Tools Download
  55. Hacker Tools Apk
  56. World No 1 Hacker Software
  57. Hacker Tools Apk
  58. Hacking Tools Pc
  59. Hacking Tools Software
  60. Hacker Tools For Mac
  61. Pentest Box Tools Download
  62. Github Hacking Tools
  63. Hacker Tools
  64. Pentest Tools Website Vulnerability
  65. Hacker Tools Apk
  66. Bluetooth Hacking Tools Kali
  67. Black Hat Hacker Tools
  68. Pentest Tools Alternative
  69. Pentest Tools Android
  70. Usb Pentest Tools
  71. Hacking Tools For Mac
  72. Hacker Tools For Mac
  73. Hacker Tools List
  74. Hacking Tools
  75. Hacking Tools Github
  76. Hacking Tools Github
  77. Free Pentest Tools For Windows
  78. Pentest Tools Url Fuzzer
  79. Hacking Apps
  80. Hacker Tool Kit
  81. Usb Pentest Tools
  82. Install Pentest Tools Ubuntu
  83. Hack Tools Github
  84. Hacker Tools List
  85. Termux Hacking Tools 2019
  86. Hacker Search Tools
  87. Pentest Tools
  88. Kik Hack Tools
  89. Hacking Tools Kit
  90. Hacker Tools Free Download
  91. Hacker Security Tools
  92. Hack Rom Tools
  93. Github Hacking Tools
  94. Tools 4 Hack
  95. Hacking Tools Download
  96. Tools For Hacker
  97. Hacking Tools For Games
  98. Hack Tool Apk
  99. Hacking Tools Github
  100. Hacker Security Tools
  101. Computer Hacker
  102. Bluetooth Hacking Tools Kali
  103. Hacker Search Tools
  104. Hacker Search Tools
  105. Pentest Tools Windows
  106. Hack Tools Download
  107. Hack Tools Pc
  108. Hacking Tools Online
  109. Pentest Tools Review
  110. Hacking Tools Usb
  111. Hack Apps
  112. Pentest Reporting Tools
  113. Pentest Tools Apk
  114. Black Hat Hacker Tools
  115. Pentest Tools Github
  116. Bluetooth Hacking Tools Kali
  117. How To Install Pentest Tools In Ubuntu
  118. Pentest Automation Tools
  119. Tools For Hacker
  120. Hacker Techniques Tools And Incident Handling
  121. Hacking Tools Windows 10
  122. New Hack Tools
  123. What Is Hacking Tools
  124. Nsa Hack Tools
  125. Pentest Tools Bluekeep
  126. Hacking Tools Mac
  127. Hack Tools For Pc
  128. Black Hat Hacker Tools
  129. Hacking App
  130. Best Hacking Tools 2019
  131. What Is Hacking Tools
  132. Hack Tools For Mac
  133. Hacking Tools Mac
  134. Hacker Techniques Tools And Incident Handling
  135. New Hack Tools
  136. Hack Tools
  137. Hacking Tools Software
  138. Hacker Tools For Pc
  139. Hack App
  140. Pentest Tools Port Scanner
  141. Hack Apps
  142. Hacker Tools Windows
  143. Hacker Tools For Pc
  144. Top Pentest Tools
  145. Pentest Reporting Tools
  146. Hacker Tools For Windows
  147. Hacker Tools 2020
  148. Hacker Tools Github
  149. Pentest Tools Website Vulnerability
  150. Pentest Tools For Windows
  151. Hacker Tools Free Download

沒有留言:

發佈留言