The Secret Life of Passwords
nytimes.com
nytimes.com
Password reuse is much worse that having a weak password. Hackers only brute force high value targets, everyone else should just aim to have unique passwords for every service they use.
However, the average person can only remember 5-10 unique passwords and they have many many accounts...password reuse. For the average person password managers aren't an option for normal people, so we have a big problem.
Why not?
Every major browser in its default configuration offers to remember your passwords, and some will even offer to sync them across all your devices.
The only thing that's missing is an offer to generate random passwords automatically, for which you currently need an add-on/extension. But even without that ability, the browser is already a pretty decent password manager.
On plenty of sites, Chrome/FF/IE/etc. will fail to recognize a user or password field. They'll often fail to recognize them at account creation. Sometimes you'll need multiple accounts on a single domain, which Chrome can't handle (for example). I could go on and on...
Browsers remember passwords as a mere convenience, when it happens to work. They are in no way "proper" password managers, which are encrypted with a master password, can be exported and backed up, handle multiple accounts, etc...
But since some of the best password managers are already open source, I wonder what's preventing browser vendors from integrating at least some of the functionality. A good password manager not only helps contain the damage of leaked passwords, but also does a very good job at protecting users from phishing attacks at similar-looking domains.
All the browsers have been pretty stagnant on this front for the last few years. I suspect they've been hoping that everyone will move to an SSO platform in which the browser vendors themselves have a vested interest (Mozilla Persona, Google account, Microsoft account).
This baffles my mind. Is this common practice in finance? What would stop a malicious actor from impersonating someone whose password they knew? Even if these passwords aren't tied to someone's identity in any way, they presumably exist to secure sensitive data and/or systems, but then they're shared with officemates like Dilbert comics?
I wrote a basic command line only one[1] a few years ago, but command line UI doesn't really make for "usable by everyone". It would be nice if there were something like this that had a good UI.
[1]: example: https://code.google.com/p/cryptsetup/. I believe that the way it works is it encrypts the actual decryption key for data with keys derived from passphrases multiple times, so any one of the those passphrases can decrypt the key, which then can access the data.
Aren't there regulations for security of financial information? It's hard to believe this passes muster. If it's a 'reasonable precautions' regulation, this fails badly.
I dearly hope that those people who actually told passwords to the author were either no longer using them or immediately changed them to something better on reflection of just how terrible they were. My mother kept a door from her parents' first house (which they built after emigrating after WW2) for sentimental reasons, that doesn't mean she relied on the old antique lock to secure her current house.
And if you see how Cantor Fitzgerald treated its employees and their families in the wake of that crisis, you'd see that helping them was the right thing.
The banking industry may have metastasized from a service industry to a giant vampire squid, but that doesn't mean every company turned into slimy blood-sucking leeches.
(And maybe C-F were heartless leeches before the attack and reformed due to their literal near-death experience -- I really paid little attention to them until that day. But they are famous for how they responded and rebuilt the business).
Money, finance, jobs, passwords, it all seems so pointless when I think of it against that loss.
They also provided health care to the families for 10 years. Again, if they went out of business, none of that would have been there.
Losing someone who is earning a salary often drives families into a downward spiral. Having to sell your house and move because you suddenly are choosing between mortgage payments and food for your kids is not easy. The survival of the company prevented this from being a sudden financial adjustment for many of these families.
What made the story famous was the fact that the company went out of its way to support the families of its dead staff even when the company itself was in the middle of an existential crisis. And it has continued to be somewhat of a "good guy" (as much as you can say that about someone in that business). I am sure there's a lot of PR spin, of course, but I watched this happen in the news when they appeared to be struggling pretty hard and were not managing their PR at all. They tried cutting off the survivors but got hammered (and probably needed that password help!). Most companies just let their insurance deal with the dead employees' families.
(Hmm, by doing a quick search of "cantor fitzgerald 9/11" I see that they were indeed utter assholes before the event.)
Of course they've had a chance to burnish their image since then.
It may have turned out well here, but you really don't want to tie together things like "the company survives" and "grieving widows continue to eat". And not just because it may involve things like calling up relatives of the deceased to ply them for passwords while the bodies are still warm.
Something they couldn't access then. Are they talking about passwords for 3rd party services? Or perhaps passwords for encrypted hard drives?
Passwords to business-critical systems should be stored in a safe, in an off-site location (preferably multiple offsite locations).
Taking this to another extreme, does a DR plan need to account for the earth no longer being viable? Do you need system/data backups in space?
[Cough]. Even in America? More like especially nowadays, no?
Beautifully written piece, otherwise.
Massive declines.
Does anyone feel like sharing?
Ahh, the memories.