Passwords are for AES-holes
Security is an illusion
Something for the Weekend, Sir? When did you reach burnout? For me, it was spring 2009. Looking back, I did well to last as long as I did but the constant pressure of coming up with something new, again and again, became too much.
I'm not confessing to an emotional crisis, by the way. I'm talking about my ability to create new system logins that I can remember for longer than an afternoon. Today, about a third of my incoming emails have 'password reset' in the subject line.
'Oh god, not another bloody password to remember. One more and I'll fake my own death just to avoid the buggers'
Source: BBC/2 Entertain
My password fatigue came to a crunch while I was freelancing at a company that bullied its users into entering a unique login every time you wanted to do anything whatsoever on one of their computers. First up was a straightforward Active Directory login, which is fair enough, but this barely carried you beyond the company's intranet page.
Want to visit an external website? Another login. Check email? Another login - yes, even with AD. Run the core apps? Another login. Open the image library? Another login. Access the database? Another login. Browse the archive? Another login. Launch the production tool? By now, you know the answer.
If I was working remotely, I had to use yet another login to seek permission to enter any of the above logins, and it was particularly irritating because it insisted on asking me to enter this one twice. Those of you who know me: it's not the company you think it is, so keep guessing.
'I didn't get where I am today by not forcing my staff to log in 13 times to to start work'
Source: BBC/2 Entertain
Most of the company employees got around the problem by creating identical ID names and passwords for everything. The IT department responded to this challenge by forcing users to change their passwords every month. The ever-resourceful users quickly discovered that the automatic prompt was fixed to a 12-month cycle, so all they had to do when prompted to change their passwords was to spend a minute changing it 12 times and then choose their original password again.
Now I understand why computer security is important. I also understand why I should not use the same ID and password for all my bank accounts and credit cards. What I don't understand is why I would need 13 different logins at the same company simply to identify who I am.
COMMENTS
Pot... meet Kettle
Seriously Reg, how you can have the gall to publish an article criticising anyone else's login/password failings, is beyond me. Especially when your own website has about eleventy-billion completely pointless separate subdomains, all requiring individual logins –and there are Alzheimer's inflicted goldfish with better recall than your login cookie's "remember me.." option.
Title says it all.
[Had to login for about the fourth time today, to post this]
Re: In fact it is not
Okay, so how do they enter their strong password made up of numbers and letters and a limit set of non-alphanumeric characters in a field with masked input without typos?
Re: In fact it is not
"The point, for those thickos who've missed it (which is all of you so far!), is not that I don't know how to type accurately without being able to see what I'm doing -- I'm a sysadmin, of course I can do that. Users mostly can't."
And there's the elitism that our industry is famous for: IT pros are perfect; users are useless. Well, Aaron, fuck you. You're wrong, and you probably know it.
Show me a study. Show me numbers that prove sysadmins are better typists than average users, and I still won't believe you.
I deal with "users" on a daily basis, and the ones I know are better at typing than I am, and I'd have no problem with Correct Horse Battery Staple.
Re: If that's so, then why
So we reach the crux of it, which is that you just don't like anything that refers to XKCD and your'e so determined to hate everything related to Randall Munroe's "opus" that you reject, out of hand, eminently sensible and workable solutions to the whole password problem with the same elitist bullshitting attitude you always seem to have on these forums.
Now here's the affix: I don't work in anything directly related to IT these days. I got out of it, in part, because of people like you throwing your not inconsiderable weight around every chance you got, insulting everyone who wasn't uyou as "luser" waste of space morons who obviously have to be nannied through everything - even when it wasn't true. In fact especially when it wasn't true. You are an arrogant little blowhard who has a little bit of power over his domain (oh ho ho) and refuses to accept that maybe, just maybe you might be wrong sometimes.
What's the biggest single security hole passwords have these days? People writing them down. Why do they write them down? Because they can't remember them. What do we want people to do with their passwords? Remember them and not write them down. On that score alone the regular language phrase is superior to the cryptic nonsense string of characters. People are able to remember phrases because they are semantic. They contain meaning, and meaning is the glue that makes memory stick.
And in terms of entropy it's a winner again. An 8 character password is easier to brute-force than a 32 character one no matter what characters it's made up from. There is no difference between the strings abababab and nGl04$sh when you are brute-forcing and if you have access to hash tables there's no amount of security that can keep you out over even a short period.
So it comes back to blocking that one major hole: the user. Your solution ensures that there will always be a human-readable copy of some large portion of your userbase's passwords available on handy little pieces of paper. The regular language solution provides a way to close that hole.
So as far as I can tell the only reason you have for rejecting it is that you didn't come up with the idea and Monroe did. Which says plenty about you and little about the idea itself.
