Hacker News Reader

Comment by k4ch0w | Hacker News Reader

Depends on what the sleep time is. If it’s after 1 minute, yes. After 10, I think that’s fair.

As someone currently fighting with IT because of their 64 character password and a Global Policy for a 5 minute timeout, I would be so happy to have 10 minutes.

https://ericdraken.com/usb-mouse-jiggler/

That's a great solution, which all of our developers are exploiting.

I feel like since I'm on the security team, I should find a non-exploit method to actually resolve the policy failure.

Perhaps the mouse jiggler IS the answer. Not to solve your own plight as a result of the policy by using one, but to illustrate what lengths people are going to in order to mitigate the undesirable effects of the policy.

Agreed man. If developers are resorting to this the policy is wrong, not the developers.

Note most SIEM's (your SOC team) can detect this (not by default as far as I know).

Depending on the desk, a downward facing bass speaker and a raspberry pi+webcam that detects your presence could do the job while maintaining an airgap (assuming you're using a mouse, not a trackpad).

...and now I have a project for this weekend.

Genuinely curious: how would they do this?

The naive approach is to look at device ID, but article already talks about copying identification data, and the rest of USB descriptor is trivially copyable as well.

Is the system going to have a rule like "mouse moves same amount of pixels with equally spaced pauses"? But what if they randomize motion commands and intervals between them?

Probably they are lot more advanced then they used to be, but yeah, checking for device ID / Process ID in combination with binary (.exe) and location. Typically these Programs are portable (no installation required, just run the .exe.) and on a corporate machine there are not many places to store it (typically within your user profile). Programs like "Process Explorer" and "Process Monitor" will give a great amount of detail on processes which can be used for detection.

https://docs.microsoft.com/en-us/sysinternals/downloads/proc...

The linked device is a hardware mouse jiggler, not software. USB devices are easy to imitate, so such a jiggler could be programmed to look like, for example, last year's most popular wireless mouse.

But this a physical USB device which presents exactly the same interface as a real mouse, likely up to the device descriptor.

There is no device ID, process ID or binary to match.

Well, my siem probably wonders why I randomly and repeatedly mash the F15 key through the day sometimes (keeps teams status as "Alive and Present")

64 character password... no. I get it for password cracking purposes but they should make it hard to ever move to that stage in the first place.

If they are stuck on that policy, they should give you a smart card/yubikey heck even a fingerprint reader (You can't rotate these :-p ) to unlock your device.

You will just end up copying and pasting it around. I'd rather avoid that as there's many ways to copy out your clipboard with Javascript or a malware payload that somehow got onto your host.

You can have a static password on a yubikey - tap and go to log in - https://www.yubico.com/resources/glossary/static-password/

I hope they also have a 30 day password expiry policy as well. Dont want users to get too comfortable with their password.

I don't understand these insanely long password requirements. How are they more secure than say a strong 8-char password?

Even with a 12 password policy I see most people just using 'MyP@ssword2021', so I guess with 64 characters most people will just use 'MyPassword(012..9){6}'

IIUC, 8 characters is too short now. You should use at least, IIRC, 12 random characters. Or a multi-word passphrase of equivalent entropy.

Yesterday I was playing with this:

https://www.my1login.com/resources/password-strength-test/

Along with this:

https://www.random.org/strings/

and I discovered that apparently, a 7 character password of random chars that includes a 0 (zero) is really hard to crack!

I wont be doing that though for my own passwords but it was interesting none-the-less.

64 characters? Why would they do that?

I assume there was a bet involved.

Reply on news.ycombinator.com