Passwords

[johnwhelan]

Creating secure Passwords is a problem and a fairly sensible 1and1 suggested method is below:

Create and remember secure passwords. The best way to create and remember many different passwords is to create a master password that you can slightly alter for every website or system.

1. Think of an easy-to-remember sentence and take the first letters of each word (lower and uppercase), numbers and special characters (!, &, $, -,#…). For example: In ’97, we were on vacation in Spain! This results in “I’97wwoviS!,” which is now your master password.
2. In order to easily remember what you use this password for, add an abbreviation for each website or system. For example: “I’97wwoviS!_WiLo” for your Windows login, or “On_ I’97wwoviS!_Ba” for your online banking account.

The full blog is at:



blog.1and1.com/2014/09/05/dos-and-donts-of-password-security

Cheerio John

 

[JCitron]

Thank you for posting this. Hopefully most people here will find it helpful. Maybe they'll get away from using their birthdays, kid's names, and other easily searched words for passwords. As you've pointed out, the best thing to do is come up with an easy-to-remember, but still secure password. The more important thing though is to change it fairly often, and this can present a problem for all of us.

At one point I had an Excel spreadsheet, which generated random passwords using a macro. These were quite complex and contained not-so-easy to remember passwords. Sadly I lost the spreadsheet during my many years in computer administrator roles, and the file is no longer available from TechRepublic's free service.

John

 

[SuperSpeedMaglev]

Or for a unbeatable password...

Copy and paste something from the webbar you type in(your password).


NOTEut it on a memory Stick once saved into your Documents or wherever you wanna put it.(The password you copy into the password box should also be copied onto the word document)

 

[johnwhelan]

Thank you for posting this. Hopefully most people here will find it helpful. Maybe they'll get away from using their birthdays, kid's names, and other easily searched words for passwords. As you've pointed out, the best thing to do is come up with an easy-to-remember, but still secure password. The more important thing though is to change it fairly often, and this can present a problem for all of us.

At one point I had an Excel spreadsheet, which generated random passwords using a macro. These were quite complex and contained not-so-easy to remember passwords. Sadly I lost the spreadsheet during my many years in computer administrator roles, and the file is no longer available from TechRepublic's free service.

John

One day I was feeling bored so I grabbed one of the computer security guys and without logging onto the network I managed to get into the admin accounts of about 50 database servers using the default password which was about half of them. He hadn't realised how easy it was to get into them. I had one of my lads write a script once, default passwords and user accounts set up by database addons, we had about 100 of them. We got into practically all the Oracle databases.

Then we had the top 100 password list, I had another trainee at a different department write a small script to test user accounts. We were successful in logging onto about 2,000+ or half the end user accounts.

Cut and paste, Microsoft SQL server takes practically anything so typically we would use a sentence from a book. Very difficult to crack.

Cheerio John

 

[JCitron]

One day I was feeling bored so I grabbed one of the computer security guys and without logging onto the network I managed to get into the admin accounts of about 50 database servers using the default password which was about half of them. He hadn't realised how easy it was to get into them. I had one of my lads write a script once, default passwords and user accounts set up by database addons, we had about 100 of them. We got into practically all the Oracle databases.

Then we had the top 100 password list, I had another trainee at a different department write a small script to test user accounts. We were successful in logging onto about 2,000+ or half the end user accounts.

Cut and paste, Microsoft SQL server takes practically anything so typically we would use a sentence from a book. Very difficult to crack.

Cheerio John

I like the passphrase security. I should try that the next time I need a secure login. I wouldn't doubt that regarding the servers. Most system and network admins appear to be lazy and assume that the users in-house would never hack into their servers. Guess again! Many hacking cases occur in-house and due to social engineering. All there needs to be is a so-called consultant visiting who talks to the local office admin. She then blabs out the passwords, which of course is the same password used on all servers, and now he has the whole store in his hands. He can then do anything he wants including loading up locally installed malware, modify scripts, and grab other information. He probably could have walked by any desk and picked up the information off of a sticky plastered on the front bezel of a monitor. This is the scary part as many users keep their user names and passwords on a sticky stuck on their laptops and workstations. This is particularly dangerous for remote users who usually put their VPN credentials on there as well. This is like giving the whole world a key to the safe containing their data back at the office!

Back in my IT days, my biggest peeve was local security and the lack of concern for it amongst the user population. Instead of a username and password being a lock and key, to them it was an annoyance and a way of preventing them from getting to Facebook all day in the office, I mean their work. With that in mind, I then setup departmentalized user education where I would take about an hour out of my day, once a month, to cover computer security and maintenance where I discussed passwords, malware infections, and then went on to user accountability and prevention. Once the whole office was covered, I could then plan around new hires, and this training was then included in the new hire training that all the new hires attended.

We have to keep in mind that people using computers today in the office usually have machines at home where they don't think of network security. For them having to use secure login credentials in the office is both foreign and an inconvenience. If people used secure passwords at home, then the use of the same in the office would be a natural thing and they'd think nothing about it.

Or for a unbeatable password...

Copy and paste something from the webbar you type in(your password).


NOTEut it on a memory Stick once saved into your Documents or wherever you wanna put it.(The password you copy into the password box should also be copied onto the word document)

You don't ever, ever want to store passwords and usernames on your local machine. If you are ever hacked, the hacker will scan your documents and get your username and password information. Keeping the passwords offline, an old-fashioned notebook will suffice, is actually the most secure method for tracking usernames and passwords.

John

 

[Falcus]

Best Password method I've ever encountered:
Pick 4 Words that have some association to each other to you, or mean something to you. Should be more then 4 letters
AuntSallyMakesCookies
Add 1 # Anywhere
AuntSallyMakes2Cookies

You have no created a Password that would take a modern supercomputer close to a month to Brute Force. Only way it can be defeated easily is with a trojan, in which case you're screwed no matter what you do (By the by, Trojans and P/W Sharing, direct or not, is the primary way Passwords are "hacked", all this nonsense about password strength is fluff. Any hacker with a life outside their computer just hacks Database's, not accounts).

@Jcitron
If a computer 3rd party/machine hacks your computer, they're not going to check your obscure document files, they'll read your cookies and saved passwords first and go from there..... Again, this type of hacking is MUCH rarer then just company Database Hacking. At this point in time, your Auran.com Account is safer then your Target Card Account.....

Falcus

 

[nicky9499]

Take a simple word or phrase. For example, Mr. John Citron wants to use his name as an easy-to-remember password:

JohnCitron

Throw in some numbers, looks better already:

J0hnC1tron

Maybe a punctuation or two:

J0hn_C1tron!

And a bit of bling just in case:

$J0hn_C1tron!

There, perfect password. And if the "different passwords for different sites" is going to be an issue...https://lastpass.com/

Cheerio,
Nicholas

 

[BuilderBob]

Creating secure Passwords is a problem and a fairly sensible 1and1 suggested method is below:

Use a password manager application. Reviews are available on the www, so you can easily choose one that is secure and functional. There is a small amount of administration if you need to replicate the password database amongst different devices, and you must implement a backup strategy. It will generate the passwords for you and make them as complex as you choose. Then use copy and paste to enter the password - no more typing mistakes and lockouts after repeated failures.

A big advantage is that you also store other information there, such as your trainz registration key - no more hunting for the original manual when you need to do a re-install.

It is not recommended that you allow the operating system or the browser to remember passwords for you, as their storage is not secure. Use copy and paste from the password manager, or a fingerprint reader, so that the password is entered at each login.

 

[johnwhelan]

Use a password manager application. Reviews are available on the www, so you can easily choose one that is secure and functional. There is a small amount of administration if you need to replicate the password database amongst different devices, and you must implement a backup strategy. It will generate the passwords for you and make them as complex as you choose. Then use copy and paste to enter the password - no more typing mistakes and lockouts after repeated failures.

A big advantage is that you also store other information there, such as your trainz registration key - no more hunting for the original manual when you need to do a re-install.

It is not recommended that you allow the operating system or the browser to remember passwords for you, as their storage is not secure. Use copy and paste from the password manager, or a fingerprint reader, so that the password is entered at each login.

One of the first problems we hit in security at a university was the fake login screen. I've also seen fake password managers, and for security products don't trust reviews, who wrote them? A sticky on the computer actually isn't bad just add a few extra characters front and back, also the hacker needs to get physical access to the machine.

>AuntSallyMakes2Cookies

Brute force not a problem, the technique is to generate passwords and apply them to many accounts at the same time or you trickle in one attempt per day over a period of time, most of the time the password attempts won't even get noticed. There are only 22 characters here and 26+26+9 permutations per character so 61*61*61*61 etc..

Add in a wider character set 120*120*120 and you see the permutations mount much faster so upper and lower case plus numeric isn't as secure as adding in those extra characters.

Cheerio John

 

[JCitron]

Speaking of network hacks...

Quite a number of years ago a hacker attempted to steal the password to our FTP server. I guess he/she thought it was a huge thing to store their files, but if they got in they'd be quite disappointed as it was only 2GB and kept that size anyway for that reason. The machine was also separate and FTP ran in a virtual Cygwin session and not as part of the operating system. Anyway, getting back to the password and username. First we never used a default administrator login. The login, on the now defunct machine and at the long gone company, was FTPAdmin, and the password was quite simple, but effective. I added in the most useful character in passwords, the ~ (tilde). Add that somewhere in between and it will throw off the brute force attacks. I'm sure any non-alpha character would work, but that's an easy one to reach for when making up a password!

This hacker attempted to login using admin with 1234, administrator with password1234, and so it went for about 30mb of logs. I let him run long enough and then I forwarded this information to his ISP. He was located in the UK and the authorities were more than interested in his activities.

@Falcus regarding the cookies and network stuff. Sure that's grabbed from the web, but for internal users and internal attacks, that's usually how it goes. A bit of social engineering is all that's needed to gain access to a computer room. Someone could come in with an "official-looking" badge and uniform, or have some kind of fake ID and company name, and the naïve user will let the person into their facility. This is usually the case even with security guards in place. They can be dumb enough most of the time to be boondoggled around the usual standard protocol. With Marshalls and TJX, this was an inside job with people putting the infrastructure in place to be hacked from the outside. This is very much what I'm talking about and it does happen more often than we're lead to believe. This like the Target issue was an inside job with some employee setting up the hacking mechanism for his cohorts.

With the more recent POS terminal attacks in the news, I blame both the VAR (the value added reseller) that has setup the system as well as the end-users and management. The VAR most likely has setup a quick password to get the systems up and running. It's probably the same password on all the systems they sell. This all very well and good, and where they fail. They should change the password immediately for the customer and setup the system to force password changes on a frequent basis. It's also an end-user issue again where they probably share their usernames and passwords with their coworkers, and probably don't bother to lock the systems when they walk away. I blame the management for trying make things easy and for not enforcing the security implications behind enforcing strict and frequently changing passwords. This issue can be truly a problem in a public place as the hacker can then go in and install malware very quickly using any vector they have available including a USB drive, which unfortunately are usually mounted immediately when inserted. With this the script could be configured to download the data immediately via an autorun applet or batch file.

The passwords we've been discussing above, with letter and number replacement are all well and good as along as they are changed frequently and kept distinct for various uses. Having a different secure password for email that is distinct from the Planet Auran server, is smart. Having another different password as part of the local login is better, and having yet another password for the local administrator account is smarter. The more different keys used to enter systems the more complex and difficult it is for people to hack in just as it would be to break into a house with multiple locks.


John

 

[johnwhelan]

The Target and Home Depot were thought to be attacks through the climate control systems. Apparently its quite common to use the same network and the air conditioner people used the default passwords.

Cheerio John

 

[JCitron]

The Target and Home Depot were thought to be attacks through the climate control systems. Apparently its quite common to use the same network and the air conditioner people used the default passwords.

Cheerio John

I wouldn't doubt it. This again boils down to people thinking that these networked devices are a separate entity and they can't be a vector for infection or attack so they create an insecure login or no login at all. A former manager of mine had a similar system he'd login into from home to control the A/C and heat in a building he owned. I helped him configure a new IP address for his equipment when he upgraded the software, and he did have a username and password.

The scary thing is these devices are making their way into homes with the Internet of Things. GE and other appliance manufacturers now have refrigerators, stoves, microwaves, and other appliances that can communicate via Bluetooth and wired networks to notify the household of various things. Given what we've been discussing, this is now a whole new way to hack waiting to happen.

John

 

[narrowgauge]

A thing to remember is that T:ANE will not accept any characters other than A-Z, a-z and 0-9. It will accept them in Settings but ignores them internally.

Peter

 

[JohnnyC1]

I use a program that generates, any length you choose, password and automatically inserts the proper PW when you open a web address that calls for a PW. It's called RoboForm.

John