Interesting article on the problems with passwords

[aramis]

http://www.wired.com/gadgetlab/2012/11/ff-mat-honan-password-hacker/all/

The implications for this are scary... even more so in Traveller... Ramifications of higher TL security?

 

[Greylond]

The idiot's first mistake was using Apple products and Apple's website...

Also, most of that article is about methods developed 15/20 years ago. They work, and always work because people are generally lazy and willing to trust others...

 

[aramis]

Around page 3 he discusses some newer approaches. That's were the interest really lies for me as a GM - that, and what's reasonable for PC's to be able to get their hands onto with Computer-3 skill...

 

[Greylond]

Not really. The key to the easiest way of breaking into a system is, IMO, always going to be social engineering. People, and therefore Companies, are lazy. They willingly put all of their personal information out on public networks and then company services that they use they demand have an easy way to get into their private info by way of "password recovery." A truly secure system is one that is not connected to anything else at all. If it is connected, then there is a way in and that way is going to be compromised by users and the admins who run it, who are lazy.

 

[CosmicGamer]

The key to the easiest way of breaking into a system is, IMO, always going to be social engineering.

And when the author of the article started talking about a multiple check system based on multiple levels of personal data I just rolled my eyes and stopped reading.

What he says the problem is: Passwords are not a viable security measure
Yet most of the detailed hacks he mentions were via someone gathering personal data and using "social engineering" to obtain the password.

Personal data questions are silly. Questions that any family or friend would know the answers to. Hackers would know what sites ask what questions. So now someone just needs to gather the info and facebook is nice enough to give a head start by providing a list of family and friends to query.

And after all, how does this personal data unlock your online account?
1) By typing it in - susceptible to all the same hacking as passwords, such as key loggers or mirror websites
2) Storing the answers on servers - susceptible to all the same hacking as passwords
The use of personal data is susceptible to all the same things a password is, but then it's also susceptible to "social engineering".

I can't see how personal data is more secure than a password.

I do agree that the more you must provide, the more secure the system will be. However I'd opt for secure ID and other additional access verification methods over "hard coded" questions and answers that are easily gathered and repeated.

A truly secure system is one that is not connected to anything else at all. If it is connected, then there is a way in and that way is going to be compromised by users and the admins who run it, who are lazy.

Like how I secure my....

Sorry, I'm not going to tell people on a public website how I secure things other than one suggestion: When asked personal questions such as mothers maiden name or favorite ice cream flavor give a suitable random password or an unrelated phrase. If you have a poor memory, write this down and lock it in a safe where someone has to physically go to your home and get into your safe to get it.

Brute force hacking is an archaic method only viable on simplistic systems. It would be hard to gain access even with just a list of the 100 most common passwords. Most sites will lock the account after a certain number of failed attempts to gain access. Make sure financial and other accounts you think are important do such then get familiar with the method they use for unlocking the account and make sure someone can't easily gain access this way.

Don't log in from any system that you have any doubts about being safe from key logging or other bad software. Don't log in at locations that my not be secure. Do you know how many public places provide internet video feeds? Perhaps that train station your at or the restaurant your in is providing a video feed of you logging in.

======================
Regarding higher TL and Traveller.

Practically every web site needs a log in nowadays. Want to add a comment after a news article, forums like this or about your car or sports or other interests and you need to log in. I don't worry too much about someone hacking these. These types are extremely prevalent, and also designed to be extremely convenient and easy to access. To me, the same goes for social sites like facebook and even email systems. The security for these sites should not reflect the ability or lack thereof to secure things at our TL but instead may be more related to our social level and desire to interact with everything from anywhere.

Overall, as TL goes up there is no reason the level of security will go up if people are more concerned with ease of access. Even with old tech methods you could implement security for a ships locker with both a traditional keyed lock and also a second lock with a combination. Heck, add a second set of locks and the requirement that two crew be present. High tech materials should make it hard to physically break in. Next, the keys are locked in a small high tech case only opened by proper thumbprint, eye scan and voice command.

The point is that, like the article did say, there is a compromise between ease of access and security.

For me, I believe that with an increase in TL, the security level of devices does increase. I could postulate a brain wave scanning device that verifies a user. How about something that is swallowed and provides an encrypted transmission based on the bio signature of the host and a complicated secure ID like algorithm. Who knows what futuristic security measures are possible. I would leave such to individual GMs to decide on their own.

Nothing is completely secure. Off the top of my head a game mechanism might be something like

TL / AAC = UA

TL = Tech level
AAC = Authorized Access Convenience. A low number being something made very easy for users to access and a high number representing a something that is more complicated.
UA = Unauthorized Access. A high number being harder.

A higher UA could be represented by time, expertise, cost, availability (access to popper tools), risk and perhaps other things I'm not currently thinking of.

 

[Greylond]

Excellent post about it!

To me, the systems that are even more scary about being compromised are the various controller systems. Stuxnet and its implications about the security issues with controller systems are where our real security concerns should be pointing toward.

Read this;
http://www.wired.com/threatlevel/2011/07/how-digital-detectives-deciphered-stuxnet/all/


This is an area that I think most RPGs dealing with Technology are weak in.

 

[DaveChase]

Windows 8 allows imagery 'password' protection.

You select an image and then you pick out part of that image that you must touch to open the system for use.

Assuming part about this is I easily opened up a friends image protected machine for them.

I just tilted the screen so that I could see where it had been touched the most and after 2 tries opened it.



For every way to protect something there is a way to break it open. Some are harder than others, but nothing is truly protected from someone who really wants it.

Dave Chase

 

[mbrinkhues]

And if you have access to the user there is always the "anti-sozial engineering" option - wielding a blunt implement near his kneecaps should work nicely most of the time.

 

[Fritz_Brown]

What he says the problem is: Passwords are not a viable security measure
Yet most of the detailed hacks he mentions were via someone gathering personal data and using "social engineering" to obtain the password.

Exactly.

and facebook is nice enough to give a head start by providing a list of family and friends to query.

I can't remember what they called it (some variant on phishing), but it is the biggest thing for getting into stuff, now: you corrupt the target's friends, and hack them, then use the friends' accounts to send to the target, or you corrupt the target's friends and have the friends "introduce" you. It evidently works wonders since most people tend to think the people on their "friends" list really are friends and not merely acquaintances.

However I'd opt for secure ID and other additional access verification methods over "hard coded" questions and answers that are easily gathered and repeated.

The key is to use different methods in combination. The most common in use among the US government is something-you-have and something-you-know. You have to use your issued card (something you have) along with the password for it (something you know). This is the same method used in Sneakers - they can steal the geek's passcard, but they also have to get him to say the passphrase. (It's actually three-layer, since it requires the card [something-you-have], knowledge of the passphrase [something-you-know], *and* your voice saying the passphrase [something-else-you-have].)

When asked personal questions such as mothers maiden name or favorite ice cream flavor give a suitable random password or an unrelated phrase. If you have a poor memory, write this down and lock it in a safe where someone has to physically go to your home and get into your safe to get it.

Hehe. We weren't allowed to write down the combos to our safes in the military. Unless it was stored in a same-or-higher-level classified safe. So, if you had two Secret safes, you could put the password to one in the other and vice-versa. You just hoped that somebody remembered the combo to at least one of them!

Most sites will lock the account after a certain number of failed attempts to gain access.

Oh, there's an amazing number of them that do no such thing.

Overall, as TL goes up there is no reason the level of security will go up if people are more concerned with ease of access.

Yep.

I just tilted the screen so that I could see where it had been touched the most and after 2 tries opened it.

Oh, that's rich!

 

[Dragoner]

My laptop has a finger print reader, don't use it much, but I set it up though.

 

[DaveChase]

My laptop has a finger print reader, don't use it much, but I set it up though.

I know a couple of resturants that use such for their orders. It lets the managment keep track of who is actually doing the work. Each waiter/waitress uses on each order and the cashier (or waiter) uses it again when taking payment.

Also, a couple of open office enviroments use it on some of their computers to keep track who was on when and who can be on that particular system. Most of those systems had data not on the local hub in protyping and development.

Dave Chase

 

[Dragoner]

Good for personal stuff, but I'll wager what we'll see is more AI management of predictable behavior; someone will still be able to spoof the system by acting "normal", but if they start doing things outside the predictors it will raise flags.

 

[mbrinkhues]

Windows 8 allows imagery 'password' protection.

You select an image and then you pick out part of that image that you must touch to open the system for use.

Assuming part about this is I easily opened up a friends image protected machine for them.

I just tilted the screen so that I could see where it had been touched the most and after 2 tries opened it.



Dave Chase

Would not work on my Win8 unit - WACOM styli do not leave "Steve Jobs Remembrance smears" on the display

=========

As for the "x retries and we lock the account" setups - they mostly fell out of use since they open the way to "Denial of Service" attacks. Just type in random phrases x times for root/admin and lock out the guy(s) who could re-set the passwords(1)

Voice has the problem that voice recognition and flue/cold do not mix well. Dragon Natural 12 and a nasty cold do not work and DN is better that most "passwort" systems. Again you could make it more fault tolerant but that raises the chance of a similar sounding intruder (or a recording) getting past that security

Iris scans work quite well. Contrary to "Demolition Man" they require blood running through the eye (goood units can even detect the pulsing) but many intruders might not know. So unless cyber eyes are common this might have it's own problems. And IF cyber eyes are common - it likely will no longer work. And you need to re-scan the eye occasionally since there are small changes over time (years)

Fingerprint has a high rate of failure AND again the "cut of the finger" idea is around. Actually would work with lower grade units (like those in the Lenovo Tablets) that do not have heartbeat/heat detection. But even mid-grade units can be fooled resonably easy if you get a fingerprint

Thinks like an RSA token where you enter a passphrase/pin in a small unit NOT attached to the network and it generates a one-time key valid a short time work nicely. As described you need a lot of elements yet none is irreplacably attached to your body and none can be recorded (The pin never leaves the token, all transfered data is invalid after one use and linked to stuff like IPs etc)

=========

Oh and do not forget to remove/disable users who are no longer with you. I used to send the admin of one of my former employers emails through the OWA web interface of that company - years after I left the company (on good terms but still they should have killed the account)



(1) Yes, there are ways around that like "Physical console does not require password" but they open new problems

 

[Icosahedron]

IMO the whole thing is a house of cards held up by its own bootstraps.

The more personal info you give 'them' to 'verify' who you are, and that 'they' store on their computers, the more info is available 'out there' to hackers.

The one thing that was obvious to me in that article was that the fault isn't in the passwords, it's in the fact that other people are insecurely storing your data, be it a password, a fingerprint or a life-history - and the more personal and important the information you give them to store insecurely, the more complete your devastation when they inevitably lose it to the bad guys. He (along with most corporations and governments) is asking us to put out the fire with gasoline!

If your fingerprint is on your hand, there is only one place a criminal can get it from. If it's on your hand and on your computer, there are two places - and the second one is much easier to 'hack' if you'll excuse the pun. If it's on your hand, your computer and ten thousand government, banking and social computers, it's ten thousand times easier to hack...

And as the guy said, you can't change your fingerprint. What happens when your digitized fingerprint 'proves' you've been somewhere you shouldn't (and haven't)?

Give me a list of fifteen digit alphanumeric passwords that I can scratch onto a dog-tag any day!

And if you want some money, walk to the £*&%* bank!

Not that walking solves all the problems. Twenty years ago, if I wanted a few quid from the bank, I'd go and sign a withdrawal slip. The only thing a criminal could get was the few quid I'd taken out. Now I have to go armed with umpteen forms of ID that are much more valuable to the mugger than the few quid I collected from the bank - and this is supposed to improve my security!
Yeah, right.

Less info = more security IMO.

 

[HG_B]

"My Apple, Twitter, and Gmail passwords were all robust—seven, 10, and 19 characters, respectively, all alphanumeric, some with symbols thrown in as well—but the three accounts were linked, so once the hackers had conned their way into one, they had them all."

Stupid mistake he should have never made.

"First thing I do? Search for the word “bank” to figure out where you do your online banking. I go there and click on the Forgot Password? link. I get the password reset and log in to your account, which I control. Now I own your checking account as well as your email."

Only if you've made mistake #1 and stupid mistake #2 (using a known email address for you bank account AND it was hacked by the same person AND made mistake #3 of not setting up a good secret question with your bank.

 

[BillDowns]

Seeing this reminded me that it's time to change all my passwords!

Like changing batteries!

 

[HG_B]

Excellent post about it!

To me, the systems that are even more scary about being compromised are the various controller systems. Stuxnet and its implications about the security issues with controller systems are where our real security concerns should be pointing toward.

Stuxnet was handcrafted with the help of the Controller software manufacturer in return for the companies products to not be blacklisted by the largest IT purchaser on the planet...

 

[atpollard]

I know a couple of resturants that use such for their orders. It lets the managment keep track of who is actually doing the work. Each waiter/waitress uses on each order and the cashier (or waiter) uses it again when taking payment.

Also, a couple of open office enviroments use it on some of their computers to keep track who was on when and who can be on that particular system. Most of those systems had data not on the local hub in protyping and development.

Dave Chase

We had a security expert do a 'lunch and learn' at our office on access control for buildings. I was surprised to learn that bio-metric scanners (like palm readers) were popular at schools where students could scan for a lunch without remembering a student ID number or fumbling for a student ID card.

 

[BillDowns]

Preventing stupid human mistakes is still the biggest obstacle.

I remember being in a Casino in Colorado, eating breakfast and watching the manager review security policies with his consultant. I could have had anything out of that place!

 

[Greylond]

Stuxnet was handcrafted with the help of the Controller software manufacturer in return for the companies products to not be blacklisted by the largest IT purchaser on the planet...

And in the process now it has been shown how weak the security of most controllers are. Like I said, to me that's more scary than regular computers being insecure only because a lot of companies don't even think about securing them even though they have tough IT Security Policies.