Re: Please do not change your password

["SCHALIP, MICHAEL" <mschalip () CNM EDU>]

Have there been any studies recently that have identified the net effects of "long passwords" or passphrases?....or 
complex passwords?  Before coming to higher ed, I came from the "sensitive" Fed sector - and they used 8-char passwords 
that were generated for you - upper/lower case, and one number, (and they used a cool little routine in the password 
generator that made the passwords "pseudo-pronounceable" so that they were easier to remember.) 

I also remember asking why they weren't required to use passwords that were longer, more complex, etc - and the answer 
was: "Passwords keep honest people honest - the vast majority (if not all) of compromised accounts have not come about 
by the way of 'cracked passwords' - they have come about by the capturing or surrendering of legitimate passwords.  
Captured through malware or bogus websites - Surrendered through phishing or social engineering means."  I was 
skeptical until I started doing some research on my own - and I couldn't find more than 1-2 obscure instances where a 
password was actually 'cracked' - most were cases where passwords were immaterial, and the system was compromised by 
"going around the password" altogether.

So - this does beg the question - even though longer passwords are theoretically harder to "crack", who cares....the 
bad guys are just going to go around them anyway....?

Thoughts?  And thanks for the discussion....

Michael

-----Original Message-----
From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of John 
Ladwig
Sent: Wednesday, April 14, 2010 7:27 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] Please do not change your password

Unlikely that it'll change the audit book.

Nor should it, necessarily.  The study is really predicated on consumer accounts, and doesn't address duty of care 
issues for data custodians, among other things.  I've rarely seen that mentioned over the last five months' discussion, 
since the paper was published.

One particularly acute point on this topic is the paper's assertion that financial fraud loses the use nothing.  While 
true for some financial accounts situations for personal accounts, that is demonstrably not true for US commercial 
online bank accounts (see Krebsonsecurity.com for many examples), and as I recall isn't true for all personal banking 
accounts in other countries.

All that said, it's a goodish paper, and we've all known that passwords are horrid for well over a decade, but 
substantial progress on password replacement is pretty poor, overall.

    -jml


-----Original Message-----
From: Justin Sherenco
Sent: 2010-04-14 08:04:59
To: Justin Sherenco;The EDUCAUSE Security Constituent Group Listserv
Cc: 
Subject: [SECURITY] Please do not change your password


Hello,

I came across an interesting article on password changes.  Author Cormac
Herley of Microsoft makes a good case albeit just a cost-benefit analysis.
I had to go back and think of why these types of policies were created in
the first place.  I came to my own conclusion that they were created
before the days of complex password (passphrase) enforcement and the
ability to automatically lock out accounts after X amount of failed log-in
attempts. 

 

Do you think he can convince the auditors?  

 

 

 
<http://www.boston.com/bostonglobe/ideas/articles/2010/04/11/please_do_not
_change_your_password/?page=full>
http://www.boston.com/bostonglobe/ideas/articles/2010/04/11/please_do_not_
change_your_password/?page=full

 

Regards,

Justin

 

 

-------------------------------------

Justin Sherenco

Security Analyst

734-487-8574

Easten Michigan University

http://it.emich.edu/security

 

 

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.