Blog Feed Post

8 Thoughts on Passwords and Password Management

In light of the recent disclosures (within 24 hours of each other) of the stealing of passwords (or password hashes) from LinkedIn, last.fm, and eHarmony, I thought I’d share a few thoughts and tips on passwords and password management.

For users:

  1. As Ed Amoroso said in this video use different passwords for different accounts.  If the bad guys manage to compromise one account, they don’t have access to everything you have everywhere.
  2. Use a password manager or encrypted notepad app to keep track of them.  If you are going to use different passwords, you probably won’t be able to remember them, so use one of the applications out there that help you manage them.  The advice for years has been not to write them down, but to some extent we no longer have any choice.  At the very least, there are “notepad” apps for mobile devices that use strong encryption and allow you to encrypt individual notes.  Use a VERY STRONG password to encrypt these other passwords.
  3. A longer (moderately) less complex password is better than a short complex one. On the AT&T ThreatTraq webcast, immediately after the disclosure of these breaches we were discussing a little about how modern password attacks work.  If the hashes are stolen, they can be cracked offline using lots and lots of computing power for both brute force and dictionary attacks. For this reason,  longer passwords (using the standard complexity rules of requiring upper and lower case, digits, and special characters) help when the bad guys can generate billions of guesses per second with modern GPUs

  4. Don’t help the bad guys by typing them into sites to “see if they were on the list.”  This one may seem a little odd, but in the aftermath of these breaches, some websites sprung up offering to tell you if your password was on the list.  While some of them may have been legitimate, if the bad guys set something up like this, you just helped them crack passwords they may not have already cracked. Just assume yours was cracked and change it.
  5. As soon as you are aware of the breach, change your passwords, but be ready to change them again, because you can’t be sure they aren’t still in there stealing the new one. Be ready to change passwords in the initial aftermath and again relatively soon afterward.

For those managing passwords in their applications/databases:

  1. Salt them.  If the bad guys get the hashes, make them crack every one instead of getting off easy by potentially getting the passwords for multiple users by cracking just one hash.
  2. Consider using something slower than MD5/SHA for the hashing. This one is related to #3 for users and was explained well in a post on the security company F-Secure’s blog and one by security researcher Thierry Zoller.  While most operating systems (and many applications) have a built-in limit on the number of login attempts in a given amount of time (and then lock out future attempts for some period of time), if the hashes are stolen and the bad guys are attempting to crack offline, make them use a more complex algorithm. The algorithm should only allow them to guess on the order of 10,000-100,000 per second rather than a billion per second. Speed is good for many hashing algorithms, but here it is not.
  3. Allow longer passwords and special characters.  Nothing frustrates me more than setting up an account on a banking site only to discover that your password cannot be longer than 8 characters and can only consist of letters and digits.  This is 2012. Let your users create long passphrases that include [email protected]#$%^&&*()_-+=/?.>,<;:’”
So, what do you think?  Have I forgotten any useful tips or tricks for handling passwords?

Read the original blog entry...

More Stories By Steve Caniano

Steve Caniano is VP, Hosting, Application & Cloud Services at AT&T Business Solutions. As leader of AT&T's global Hosting, Application and Cloud infrastructure business, he is instrumental in forging key partner alliances and scaling AT&T's cloud services globally. He regularly collaborates with customers and represents AT&T at key industry events like Cloud Expo.

Latest Stories
"ZeroStack is a startup in Silicon Valley. We're solving a very interesting problem around bringing public cloud convenience with private cloud control for enterprises and mid-size companies," explained Kamesh Pemmaraju, VP of Product Management at ZeroStack, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
"Codigm is based on the cloud and we are here to explore marketing opportunities in America. Our mission is to make an ecosystem of the SW environment that anyone can understand, learn, teach, and develop the SW on the cloud," explained Sung Tae Ryu, CEO of Codigm, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
In his session at 21st Cloud Expo, Carl J. Levine, Senior Technical Evangelist for NS1, will objectively discuss how DNS is used to solve Digital Transformation challenges in large SaaS applications, CDNs, AdTech platforms, and other demanding use cases. Carl J. Levine is the Senior Technical Evangelist for NS1. A veteran of the Internet Infrastructure space, he has over a decade of experience with startups, networking protocols and Internet infrastructure, combined with the unique ability to it...
High-velocity engineering teams are applying not only continuous delivery processes, but also lessons in experimentation from established leaders like Amazon, Netflix, and Facebook. These companies have made experimentation a foundation for their release processes, allowing them to try out major feature releases and redesigns within smaller groups before making them broadly available. In his session at 21st Cloud Expo, Brian Lucas, Senior Staff Engineer at Optimizely, discussed how by using ne...
"CA has been doing a lot of things in the area of DevOps. Now we have a complete set of tool sets in order to enable customers to go all the way from planning to development to testing down to release into the operations," explained Aruna Ravichandran, Vice President of Global Marketing and Strategy at CA Technologies, in this SYS-CON.tv interview at DevOps Summit at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
"There's plenty of bandwidth out there but it's never in the right place. So what Cedexis does is uses data to work out the best pathways to get data from the origin to the person who wants to get it," explained Simon Jones, Evangelist and Head of Marketing at Cedexis, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
"Cloud Academy is an enterprise training platform for the cloud, specifically public clouds. We offer guided learning experiences on AWS, Azure, Google Cloud and all the surrounding methodologies and technologies that you need to know and your teams need to know in order to leverage the full benefits of the cloud," explained Alex Brower, VP of Marketing at Cloud Academy, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clar...
Large industrial manufacturing organizations are adopting the agile principles of cloud software companies. The industrial manufacturing development process has not scaled over time. Now that design CAD teams are geographically distributed, centralizing their work is key. With large multi-gigabyte projects, outdated tools have stifled industrial team agility, time-to-market milestones, and impacted P&L stakeholders.
Gemini is Yahoo’s native and search advertising platform. To ensure the quality of a complex distributed system that spans multiple products and components and across various desktop websites and mobile app and web experiences – both Yahoo owned and operated and third-party syndication (supply), with complex interaction with more than a billion users and numerous advertisers globally (demand) – it becomes imperative to automate a set of end-to-end tests 24x7 to detect bugs and regression. In th...
Enterprises are moving to the cloud faster than most of us in security expected. CIOs are going from 0 to 100 in cloud adoption and leaving security teams in the dust. Once cloud is part of an enterprise stack, it’s unclear who has responsibility for the protection of applications, services, and data. When cloud breaches occur, whether active compromise or a publicly accessible database, the blame must fall on both service providers and users. In his session at 21st Cloud Expo, Ben Johnson, C...
"Infoblox does DNS, DHCP and IP address management for not only enterprise networks but cloud networks as well. Customers are looking for a single platform that can extend not only in their private enterprise environment but private cloud, public cloud, tracking all the IP space and everything that is going on in that environment," explained Steve Salo, Principal Systems Engineer at Infoblox, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Conventio...
Data scientists must access high-performance computing resources across a wide-area network. To achieve cloud-based HPC visualization, researchers must transfer datasets and visualization results efficiently. HPC clusters now compute GPU-accelerated visualization in the cloud cluster. To efficiently display results remotely, a high-performance, low-latency protocol transfers the display from the cluster to a remote desktop. Further, tools to easily mount remote datasets and efficiently transfer...
"Akvelon is a software development company and we also provide consultancy services to folks who are looking to scale or accelerate their engineering roadmaps," explained Jeremiah Mothersell, Marketing Manager at Akvelon, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
"MobiDev is a software development company and we do complex, custom software development for everybody from entrepreneurs to large enterprises," explained Alan Winters, U.S. Head of Business Development at MobiDev, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
Agile has finally jumped the technology shark, expanding outside the software world. Enterprises are now increasingly adopting Agile practices across their organizations in order to successfully navigate the disruptive waters that threaten to drown them. In our quest for establishing change as a core competency in our organizations, this business-centric notion of Agile is an essential component of Agile Digital Transformation. In the years since the publication of the Agile Manifesto, the conn...