• FIA (unregistered) in reply to ASDF
    ASDF:
    Face goes to palm.

    The soldier of fortune work must've dried up then. :(

  • FIA (unregistered) in reply to KattMan
    KattMan:
    david:

    That is a wtf right there. By adding password expirations, you've virtually guaranteed that everyone will write their password down instead of memorizing it. The only purpose of making passwords expire is if you think people will have their passwords compromised. You should really rethink that policy.

    I agree, and yet every company feels this is the proper policy, not realizing that by following it, they are lowering their security rather than raising it.

    Amen to that, this seems to be one of the biggest problems in companies today. (Someone with 'security' in their title says it's a good idea, so it must be, even if you calmly outline /why/ it's a bad idea.)

    I personally think it's largely down to training, users should be told that their password should be secure, and it should be treated like their door key. This should be then augmented with sysadmin attempting to crack peoples passwords at regular intervals (mmmm rainbow tables), and having users with weak passwords change theirs. Also, social cracking is probably a good idea as well. (Ring people up and ask them for their password, if they give it, and it's correct, then you've identified a potential security risk and you can provide training and guidance.)

    KattMan:
    Yes make sure that passwords and user names don't match. Yes allow some complexity, but auto expirations are not necessary.
    I think complexity should be encouraged, but not enforced, I mean if I know my password must be 8 chars, and contain a number, that's immediatly removed AAAAAAAA-ZZZZZZZZ (and all the variations thereof) from my attack space.
    KattMan:
    Honestly, when was the last time you had to change the PIN on your ATM card? Now when was the last time that PIN was compromised? This will tell you how important expiring passwords are.

    Thank you, I'll be using that analogy in future.... :)

  • Dax5 (unregistered) in reply to Morty
    Morty:
    KattMan:
    Honestly, give me one reason why you would force a random password change?

    Once upon a time, this made a lot of sense. Passwords on some systems (i.e. old Unix systems) used to be stored using a relatively weak hashing algorithm in a world-readable file. So when you changed your password, you had a window of a few months during which your password could be presumed "safe", after which, you really should change it. Unix systems eventually went to shadowed password files, but Windows reintroduced the same issue with the Windows password hashing system in the LAN manager days.

    Today, this is less justifiable. But there is still some logic to it. If you have a means of login that does NOT lockout accounts with N failed logins, then it's possible for an ehaustive search attack to find your passwords, unless you periodically change your passwords. There is also always the chance that your passwords have been compromised via a one-time attack, which wasn't detected; periodically changing passwords limits the damage that the attacker can do.

    Someone already solved that pesky "password compromise" situation. It's called two-factor authentication ;)

    Use your password and a gizmo that spits out ever-changing numbers.

    The ones that are time-based, change every 60 seconds; the other ones are made so that all previous valid numbers are invalidated when the next one is introduced.

  • M L (unregistered) in reply to Bob
    Bob:
    Some people live in small villages where the crime rate is near zero. These people do, indeed, leave their doors unlocked, if not open.

    Security is about risk management -- there is a convenience cost with every security measure so obviously one weighs up the pros and cons and surely any entity should be entitled to make these decisions with their own possessions.

    Exactly. The company I work for has a COTS defect tracking system that is installed at the data center. Our project team (about 25 people total) uses it and we have own sandbox with our own accounts, database, repository, etc. However, because its COTS, every user must have a login AND password.

    The login makes sense. We need to know what defects are assigned to us, and who wrote the defects, and who wrote the notes on them, etc. Many of the queries we use are based on the login name.

    However, to us, the passwords aren't really necessary. There's 25 of us. We've worked together for years. It's highly unlikely anyone do anything malicious to the defect database, and even if someone did, the damage would be incredibly minimal. There's nothing confidential in there at all. It's just not a system that requires a lot of security. However, because the software requires us to have a password, we all do. We all have the password "password".

    Now, if for some reason we timed out every hour, I could easily see us calling up the data center and say "hey, could you increase the timeout here? We all use the same password anyway and there's just no reason for this thing to be secured." Is that a WTF? Not really.

  • Random832 (unregistered) in reply to ForcedSterilizationsForAll

    Your ability to comprehend sarcasm astounds me.

  • Random832 (unregistered) in reply to Random832
    Your ability to comprehend sarcasm astounds me
    was in response to
    What you saw was the parody of the actual episode. In the Twilight Zone episode his glasses break and that's the end. Your version was most likely from either the Simpsons or Futurama.
  • Random832 (unregistered) in reply to Random832
    Your ability to comprehend sarcasm astounds me
    was in response to
    What you saw was the parody of the actual episode. In the Twilight Zone episode his glasses break and that's the end. Your version was most likely from either the Simpsons or Futurama.
  • Random832 (unregistered) in reply to Random832

    [quote user="Random832"]Your ability to comprehend sarcasm astounds me.[/quote] was in reply to [quote]What you saw was the parody of the actual episode. In the Twilight Zone episode his glasses break and that's the end. Your version was most likely from either the Simpsons or Futurama.[/quote

  • (cs) in reply to Jeff
    Jeff:
    Funny topic, as just a few weeks ago I wrote a blog post on how the lyrics to the song "Ironic" really isn't about irony. Yes, I know, it's shameless self-promotion, but here's the link:

    http://www.alphabetsoupfamily.com/blogs/archive/2007/05/22/24.aspx

    It's a coincidence that this post and my blog post are related in such a timely manner, but it's not ironic.

    Jeff

    Well, Jeff, you and a score of others on this thread are demonstrating the hallmarks of WTF-producing programmers: Re-interpreting specs Getting very arrogant about the results of the misdirected conclusions you arrive at.

    The word used here was not "irony", but "ironic". The distinction is greater than you may think. Please look up the adjective rather than the noun.

    The situations described in the song are indeed ironic. I'm old enough to remember the year that song came out. Chardonnay was the vogue wine of the season, chosen and consumed not just for its taste, but to convey an air of sophistication. The big black fly that came and plopped itself into your glass sort of blew that inpression. Likewise, the weddings of that time tended to be held outside and scheduled for time when the weather was likely to be fair, so as to convey the "sunny future" ahead for the union. When the thunderclouds roll in and douse the guests, the effect is again spoiled.

    Even the lines that may seem to hold a bit less irony, such as the traffic jam and the no smoking sign, come into more ironic light if one has sufficient imagination to paint the context: the stressed out morning cooped up in the office, with the smoke break as a brief opportunity to get away from external pressures for five minutes. The great shortcut you took to beat the clock, only to find that everyone else had chosen the same shortcut, yada, yada.

    So maybe we can all stop nitpicking for a moment and ETFS.

  • (cs) in reply to rjnewton
    rjnewton:
    Jeff:
    Funny topic, as just a few weeks ago I wrote a blog post on how the lyrics to the song "Ironic" really isn't about irony. Yes, I know, it's shameless self-promotion, but here's the link:

    http://www.alphabetsoupfamily.com/blogs/archive/2007/05/22/24.aspx

    It's a coincidence that this post and my blog post are related in such a timely manner, but it's not ironic.

    Jeff

    Well, Jeff, you and a score of others on this thread are demonstrating the hallmarks of WTF-producing programmers: Re-interpreting specs Getting very arrogant about the results of the misdirected conclusions you arrive at.

    The word used here was not "irony", but "ironic". The distinction is greater than you may think. Please look up the adjective rather than the noun.

    The situations described in the song are indeed ironic. I'm old enough to remember the year that song came out. Chardonnay was the vogue wine of the season, chosen and consumed not just for its taste, but to convey an air of sophistication. The big black fly that came and plopped itself into your glass sort of blew that inpression. Likewise, the weddings of that time tended to be held outside and scheduled for time when the weather was likely to be fair, so as to convey the "sunny future" ahead for the union. When the thunderclouds roll in and douse the guests, the effect is again spoiled.

    Even the lines that may seem to hold a bit less irony, such as the traffic jam and the no smoking sign, come into more ironic light if one has sufficient imagination to paint the context: the stressed out morning cooped up in the office, with the smoke break as a brief opportunity to get away from external pressures for five minutes. The great shortcut you took to beat the clock, only to find that everyone else had chosen the same shortcut, yada, yada.

    So maybe we can all stop nitpicking for a moment and ETFS.

    Nit-picking is spelt with a hyphen.

  • Jules (unregistered)

    Everybody on this thread seems to have gone off on a side-track about password security. I scanned the three pages of comments, and didn't see anyone make a comment on the timeout issue.

    So... were the "timeouts" really timeouts from people going away from their browsers for awhile? Or were they occurring because a single user account was being shared as well as the passwork or because there was some session info tied to the password somehow, and only one such user allowed at a time? So that the next person logging on with a given password would cause the other person's session to become invalid?

  • (cs) in reply to Dax5
    Morty:
    KattMan:
    Honestly, give me one reason why you would force a random password change?

    Once upon a time, this made a lot of sense. Passwords on some systems (i.e. old Unix systems) used to be stored using a relatively weak hashing algorithm in a world-readable file. So when you changed your password, you had a window of a few months during which your password could be presumed "safe", after which, you really should change it. Unix systems eventually went to shadowed password files, but Windows reintroduced the same issue with the Windows password hashing system in the LAN manager days.

    Today, this is less justifiable. But there is still some logic to it. If you have a means of login that does NOT lockout accounts with N failed logins, then it's possible for an ehaustive search attack to find your passwords, unless you periodically change your passwords. There is also always the chance that your passwords have been compromised via a one-time attack, which wasn't detected; periodically changing passwords limits the damage that the attacker can do.

    The problem here isn't the password, it is the idea of not locking accounts after N failures. And the periodic change does not really limit the damage an attack does. Remember it takes very little time once a hacker gets in for him to do something. They are not going to wait around and see if you find them first, they are going to do something soon. If you can't detect that, then nothing short of daily password changes are really going to protect you.

    Teach your users the true importance of strong passwords, hire proper network admins and at least one with real security credentials to detect potential intrusions. Manage your risk appropriately, but do not hide behind the illusion of safety given by constantly changing password rotations.

  • mover (unregistered) in reply to dkf
    dkf:
    EvanED:
    We have physical locks on our building. Everyone has a copy of the same key.
    There's a keycode-d security door in our building that has the code written on the wall next to the door. On the side that the general public has access to, yes.
    I know such a building, and the keycode lock + paper with the code did exactly what was intended: not keeping the general public OUT, but keeping people with dementia IN...
  • Top Cod3r (unregistered) in reply to mover

    last post.

  • GrammarDeficient (unregistered) in reply to rjnewton
    rjnewton:
    The word used here was not "irony", but "ironic". The distinction is greater than you may think. Please look up the adjective rather than the noun.

    The distinction is that of the noun form versus the adjective form; the meaning of the word isn't any different. In fact, the definition of the adjective ironic uses the noun irony in it:

    Merriam Webster:
    Main Entry: iron·ic Function: adjective 1 : relating to, containing, or constituting irony <an ironic remark> <an ironic coincidence> 2 : given to irony <an ironic sense of humor>

    So tell me, what do you see as the differences in the noun irony and the adjective ironic? What would make you think that the adjective would convey a meaning that is totally unrelated to the noun?

  • [ais]linn . (unregistered) in reply to Sgt. Preston

    who cares, the song is cool. (:

  • (cs) in reply to [ais]linn .

    Dayum, this thread is still going? I had to do a search on "irony" to find it.

    Anywaze... I gotcher irony right here. Copied from a forum in a galaxy far, far away...

    "Paris is a reatard."

  • Joel (unregistered) in reply to Sgt. Preston
    Sgt. Preston:
    I'm not convinced that Ms Morissette had this superstition in mind anyway, since everything else that she calls ironic in her song is simply a bummer.
    And therein lies the true irony of the song!

    (Not that I think she intended it that way.)

Leave a comment on “It's Like Raiiiiiin”

Log In or post as a guest

Replying to comment #:

Log Out

« Return to Article