When Passwords Attack!

[qubit]

You can see why the clueless stick a Post-It note on the monitor, can't you?

It may be Halloween, but for thousands of corporate IT users there’s another reason today inspires fear: it’s time once again for the mandatory end-of-month password change. Few common IT policies drive users to distraction as regularly and reliably as the aggressiveness of enterprise password policies.

But with more potential threats to enterprise security coming from external sources that take advantage of the users’ accounts once they’re already logged in, do byzantine password policies really do anything to protect corporate data? In some cases, the password policy may create a bigger security threat than the risk of a password being guessed.

The password problem

Passwords are still important, but the value of aggressive password policies as security against unauthorized access is questionable, said Andrew Marshall, CIO of Philadelphia-based Campus Apartments in an interview with Ars Technica. “Statistical attacks—repeated attempts at guessing a password using hints or a dictionary—are unlikely to yield results, provided that the enterprise system implements a ‘lockout after X incorrect attempts” policy,” he said. “Enforcing tricky complexity and length rules increases the likelihood that the password will be written down somewhere.”

Ars Technica

[Kreij]

I never write down passwords, I just remember them.
I know my drivers lic. #, my CC #, my SSN, my med hist #, and I know all of the passwords of every user on my network at work.

My wife and I were watching TV one night and there was an advertisement for something (don't remember what it was) and she said she liked it so I memorized the 800 number.
Three weeks later she said she wished she would have bought it.
I told her to call them and she said the advert wa no longer running.
I spewed out the 800 number. She didn't believe me until she called it and it was the place to get the item.

Maybe it's a geek thing?

[cheesy999]

Everytime they make me change my password i just press Ctrl-Alt-Delete buttons once i've logged in and then click the change password button to set it back to the old one

[N-Gen]

Originally Posted by Kreij

I never write down passwords, I just remember them.
I know my drivers lic. #, my CC #, my SSN, my med hist #, and I know all of the passwords of every user on my network at work.

My wife and I were watching TV one night and there was an advertisement for something (don't remember what it was) and she said she liked it so I memorized the 800 number.
Three weeks later she said she wished she would have bought it.
I told her to call them and she said the advert wa no longer running.
I spewed out the 800 number. She didn't believe me until she called it and it was the place to get the item.

Maybe it's a geek thing?

I'm like that as well, I never need to look up my numbers, which includes family phone numbers. Then there's people who have to write their own phone number down.

[qubit]

Originally Posted by Kreij

I never write down passwords, I just remember them.
I know my drivers lic. #, my CC #, my SSN, my med hist #, and I know all of the passwords of every user on my network at work.

My wife and I were watching TV one night and there was an advertisement for something (don't remember what it was) and she said she liked it so I memorized the 800 number.
Three weeks later she said she wished she would have bought it.
I told her to call them and she said the advert wa no longer running.
I spewed out the 800 number. She didn't believe me until she called it and it was the place to get the item.

Maybe it's a geek thing?

Yeah, you da memory man. I can't do that. The look on your wife's face must have been priceless.

I want the same shit your takin'.

[micropage7]

Originally Posted by Kreij

I never write down passwords, I just remember them.
I know my drivers lic. #, my CC #, my SSN, my med hist #, and I know all of the passwords of every user on my network at work.

My wife and I were watching TV one night and there was an advertisement for something (don't remember what it was) and she said she liked it so I memorized the 800 number.
Three weeks later she said she wished she would have bought it.
I told her to call them and she said the advert wa no longer running.
I spewed out the 800 number. She didn't believe me until she called it and it was the place to get the item.

Maybe it's a geek thing?

wow, some people can remember much and better than other
maybe thats the way its. you handle many apps and your wife has pretty good memory.
btw for sometimes i writedown my pass coz i register on many webs and some of them i visit maybe once in a month. but for webs that i usually visit i dont write the pass

[Kreij]

It just seems to be numbers and passwords. I am forever losing stuff around the house because I don't remember where I put it.

[exodusprime1337]

I memorize mine, i also work in IT. In the last year i've memorized every password to every one of th 90 or so clients we support, and their rdp url's so i can get to them. I also tend to memorize any password for any user i set up on said servers. This is probably due to a similar password scheme, but who knows.

[N-Gen]

Originally Posted by Kreij

It just seems to be numbers and passwords. I am forever losing stuff around the house because I don't remember where I put it.

I only seem to lose stuff if I tidy up, if I don't tidy up I can find it. If I tidy up to find it easier, I don't find it. On the other hand when I hide something, I can't find it again...so I'd say that's a mission accomplished.

[Black Panther]

I remember them all too. I guess it works the same way that I can remember all my company cars' number plates... Whereas if a person talks to me I won't be remembering his face or name the next day.

[m4gicfour]

For whatever reason I can remember username/password combos very easily. Even easier if they're not mine. On the other hand, straight numeric strings (IE CC#, SIN/SSN#, etc) are more difficult for me, but after a few uses I can usually remember them too.

There must be a certain correlation between those drawn to IT or technical fields and a brain which is geared for this kind of data retention.

[N-Gen]

Yes, it's only a matter of time before I start spitting out code I've learnt by heart every now and then...and now it's even useless to me.

[Kreij]

Originally Posted by m4gicfour

There must be a certain correlation between those drawn to IT or technical fields and a brain which is geared for this kind of data retention.

I think you are correct. We are basically data spounges when it comes to tech stuff (which is usually numeric or password oriented), but the mundain things that don't interest us very much we tend not to recall.

I too, am really poor at remembering names, but I bet if we had numbers instead of names I would be good to go.

[N-Gen]

Originally Posted by Kreij

I think you are correct. We are basically data spounges when it comes to tech stuff (which is usually numeric or password oriented), but the mundain things that don't interest us very much we tend not to recall.

I too, am really poor at remembering names, but I bet if we had numbers instead of names I would be good to go.

I bet you love James Bond because he has a number...and Hitman for that matter.

[95Viper]

I voted no, I never write them down, as I can remem... Uh, what was question?

[Neuromancer]

Originally Posted by Kreij

I never write down passwords, I just remember them.
I know my drivers lic. #, my CC #, my SSN, my med hist #, and I know all of the passwords of every user on my network at work.

My wife and I were watching TV one night and there was an advertisement for something (don't remember what it was) and she said she liked it so I memorized the 800 number.
Three weeks later she said she wished she would have bought it.
I told her to call them and she said the advert wa no longer running.
I spewed out the 800 number. She didn't believe me until she called it and it was the place to get the item.

Maybe it's a geek thing?

I am not that good, but am similar. Phone numbers are easy.

I still remember both randomly generated passwords a boss gave me uh 7 years ago. Dunno why. Only used them for the year I was working there.

[scaminatrix]

Originally Posted by Kreij

Maybe it's a geek thing?

I reckon so, my old party trick is to remember a mobile number only being told it once. The most I've done in a night was 5, so I quit while I was ahead in case I couldn't manage a 6th. I was about 16 then. In UK, mobile numbers are written like 07989 446364 and there's certain patterns for the first 5 numbers so it's easy once you start repeating it in your head and getting the pattern.

Aah the good old days. Now, if I get up to go the bedroom to get something, it's pretty much guaranteed I forget what I'm supposed to be doing

At least I can still remember all mine and the other half's passwords for the net etc. though. We've got altogether >10 different passwords between us (E-mail acc. each, eBay each, Paypal each, TPU, Tesco for shopping, Verified by Visa, other sites etc. probably lots more than 10!!)

Originally Posted by Kreij

I too, am really poor at remembering names, but I bet if we had numbers instead of names I would be good to go.

Yup same here. Also, I used to care for someone who would tell you which day of the week you were born on if you tell him your date of birth; a real maths head; and he was terrible at remembering names too.