Hacker News Reader

Hacker News

Comment by lupire | Hacker News Reader

Parent Full thread

lupire

My company requires a password every time laptop wakes from sleep.

Is that an unreasonable burden on people?

View on HN

I lock my laptop every time I stand up from my chair.

I currently work from home.

Habits are important. I also put on my parking break every time I turn off my car!

So, IMHO, not an unreasonable burden!

Depends on what the sleep time is. If it’s after 1 minute, yes. After 10, I think that’s fair.

As someone currently fighting with IT because of their 64 character password and a Global Policy for a 5 minute timeout, I would be so happy to have 10 minutes.

https://ericdraken.com/usb-mouse-jiggler/

That's a great solution, which all of our developers are exploiting.

I feel like since I'm on the security team, I should find a non-exploit method to actually resolve the policy failure.

Perhaps the mouse jiggler IS the answer. Not to solve your own plight as a result of the policy by using one, but to illustrate what lengths people are going to in order to mitigate the undesirable effects of the policy.

Agreed man. If developers are resorting to this the policy is wrong, not the developers.

Note most SIEM's (your SOC team) can detect this (not by default as far as I know).

Depending on the desk, a downward facing bass speaker and a raspberry pi+webcam that detects your presence could do the job while maintaining an airgap (assuming you're using a mouse, not a trackpad).

...and now I have a project for this weekend.

Genuinely curious: how would they do this?

The naive approach is to look at device ID, but article already talks about copying identification data, and the rest of USB descriptor is trivially copyable as well.

Is the system going to have a rule like "mouse moves same amount of pixels with equally spaced pauses"? But what if they randomize motion commands and intervals between them?

Probably they are lot more advanced then they used to be, but yeah, checking for device ID / Process ID in combination with binary (.exe) and location. Typically these Programs are portable (no installation required, just run the .exe.) and on a corporate machine there are not many places to store it (typically within your user profile). Programs like "Process Explorer" and "Process Monitor" will give a great amount of detail on processes which can be used for detection.

https://docs.microsoft.com/en-us/sysinternals/downloads/proc...

The linked device is a hardware mouse jiggler, not software. USB devices are easy to imitate, so such a jiggler could be programmed to look like, for example, last year's most popular wireless mouse.

But this a physical USB device which presents exactly the same interface as a real mouse, likely up to the device descriptor.

There is no device ID, process ID or binary to match.

Well, my siem probably wonders why I randomly and repeatedly mash the F15 key through the day sometimes (keeps teams status as "Alive and Present")

64 characters? Why would they do that?

I assume there was a bet involved.

64 character password... no. I get it for password cracking purposes but they should make it hard to ever move to that stage in the first place.

If they are stuck on that policy, they should give you a smart card/yubikey heck even a fingerprint reader (You can't rotate these :-p ) to unlock your device.

You will just end up copying and pasting it around. I'd rather avoid that as there's many ways to copy out your clipboard with Javascript or a malware payload that somehow got onto your host.

I don't understand these insanely long password requirements. How are they more secure than say a strong 8-char password?

Even with a 12 password policy I see most people just using 'MyP@ssword2021', so I guess with 64 characters most people will just use 'MyPassword(012..9){6}'

IIUC, 8 characters is too short now. You should use at least, IIRC, 12 random characters. Or a multi-word passphrase of equivalent entropy.

Yesterday I was playing with this:

https://www.my1login.com/resources/password-strength-test/

Along with this:

https://www.random.org/strings/

and I discovered that apparently, a 7 character password of random chars that includes a 0 (zero) is really hard to crack!

I wont be doing that though for my own passwords but it was interesting none-the-less.

You can have a static password on a yubikey - tap and go to log in - https://www.yubico.com/resources/glossary/static-password/

I hope they also have a 30 day password expiry policy as well. Dont want users to get too comfortable with their password.

No Windows Hello I assume? Either Fingerprint or Face?

Lid-closed or inactivity-sleep? Yes, absolutely.

It depends. Can you turn off auto-sleep?

My corp laptop auto-locks the screen (if that's what you mean), but can also be unlocked by biometrics, but only if it's already on. (And only for a limited time; I think after a week, the password is required again.) If the laptop is booting fresh, the password is required.

I wouldn't call it a burden.

> but can also be unlocked by biometrics

I always switch off the biometric access of any machine, so you can save yourself the hassle of cutting off my thumb or trying to unlock a device when I am asleep.

I guess anyone able to do either of these things could just torture you into surrendering your password, though.

I guess you could hope for their decency to cut off bits only after they've killed you. Combine that with their possible (probable?) stupidity to assume you have biometrics enabled, and they might kill you without even asking for any password, so you'd die secure in the knowledge that they'll never crack your data.

Though Idunno how happy that'll make you.

Don't turn it off, get something like the little Caffeine application. It simulates an F15 keypress every 59 seconds to keep it awake.

The idea is that basically very few keyboards have an F15, let alone applications that rely on the F15 key.

Note that if you're caught doing this by IT, you may get fired for willfully breaking policy. It is quite easy to detect.

There is plausible deniability. Just say my touchpad is malfuncioning and sometimes moves the cursor.

In other words, you didn't report a touchpad malfunction that was interfering with obvious and clearly stated security policies, and allowed the malfunction to interfere with your work for days/weeks/months without seeking assistance from IT?

This is not a good look, but if that's how you want to play the game of lying to your employer, fine with me!

No, because the touchpad malfunctioning has no impact on a security policy whatsoever. Not even work possibly.

If you want to lock your PC you need to lock it.

As I mentioned above, the SOC team can detect the exact process ID for these app really easily. No plausible deniability.

What do you mean by process ID? A PID seems like a useless bit of information. Now an app bundle or process executable checksum... Seems more useful. But couldn't you build the app from source and add a but of random data into the executable?

Yes it's better to have a hardware fix, like a USB stick that moves the cursor regularly or sends a key press, or even just put your mouse on top of a watch that has hands.

I mean.. There's also OS APIs to prevent sleep that are probably even better suited.

Oh boy, I see the potential for very weird bug reports that will be fun to debug when you forget that that thing is active (or another user is using the computer).

I just 3D printed a little clip that holds the scroll lock key down. Or, there’s always the mechanical or electronic mouse jigglers you can buy off of Amazon.

Windows Powertoys has an Awake applet that does the same thing nowadays. Same thing as in, has the same effect of keeping the machine awake, that is; dunno how it does it, if it's simulating a keypress or something else.

Reply on news.ycombinator.com