What is the origin of passwords submitted to honeypots?
isc.sans.edu
isc.sans.edu
The most common passwords are problematic. They will frequently work, but they will work for the other guy, too. So then the question is "how do you pull up the ladder?"
Changing the password is simple, but likely to get the machine reimaged.
Looking at the login history would give an allowlist of subnets, which can be used to deny other attackers access, but hopefully without inconveniencing the owner into reimaging.
I've never heard that metaphor before, but it's a good one. Thanks.
[1] https://isc.sans.edu/diary/Potential+Weaponizing+of+Honeypot...
Which article is better? They both seem pretty good and I'm unclear on the difference.
[1] https://isc.sans.edu/diary/What+is+the+origin+of+passwords+s...
PSA: For most basic and routine websites/apps of low-value, please, please use the FaceID/TouchID protected platform authenticators for passwordless authentication.
And for those archaic sites that still insist on passwords (why? tell them about passwordless by writing feedback/app reviews), use the platform built-in password managers. Don't do passwords by memory.
For higher value things like banks, please use a different user-id/e-mail-id and passwords stored in password-manager (or write down the password in a book kept safely at your home – this is so much safer than weak passwords you try to scheme up and remember). And, always use 2FA – preferably a hardware FIDO key that you can enroll at least 2 of them and keep them safe. In India, regulator insists banks use mobile SMS OTP. In such case, keeping your phone secure from SMS sniffing malicious apps is critical. If you are really paranoid, get the simplest modern feature phone with a phone number dedicated for receiving such critical SMS! The day when all financial institutions use passwordless auth with FIDO2 MFA cannot come soon enough!
While they are not brilliant at anything, they are good enough on many dimensions. Some disadvantages of the things you mention are:
* They don't require specialised hardware * They don't require complicated recovery mechanisms if that hardware is lost, stolen or broken. * Arguably, biometrics should not be used for authentication. Once a biometric system is compromised, you have no way to recover. You can't change your biometrics.
Now all that protects my account is a 5 digit PIN and SMS, and you can reset the pin via SMS.
I'm glad financial companies hire security minded folks.
No, thank you, I don't wear my passwords on my face or my fingers because they need to be secret to serve their purpose. I don't really feel like wearing a balaclava and gloves all the time.
Also sometimes I need to change them (if they get compromised, if computing progress made them easier to bruteforce, etc.), and I don't really want to have to use cosmetic surgery when that happens.
Biometrics are closer to a username than a password in this regard.
> Don't do passwords by memory.
We can agree on this (and the disaster that SMS OTP is due to lousy carrier security mostly), you will still need a password for that password manager usually though. You can have a key based setup but you still need a way to store/remeber that key. So passwords will not die just based on this, they might become less ubiquitous.
It sounds like you want to trivialize a problem that has existed for way longer than computer science and systematically relies at some point on human memory if you want a certain level of security and secrecy.
Obviously if you decrease these requirements, you can get away with weaker authentication mechanisms... but you will not secure whatever that password was securing as well then.
Point is it wasn’t long ago that nobody could fake your voice either.
The biometrics authenticate you with the Secure Enclave in your phone. The enrolled biometric data is stored within the Secure Enclave and practically unrecoverable. Authentication is done directly within the Secure Enclave. The connection between the sensor (fingerprint, camera) and Secure Enclave is direct and encrypted.
Conceptually, this is identical to using a passcode or password to unlock your device.
Once the Secure Enclave is unlocked, your phone can use it to sign requests, decrypt data (e.g., stored passwords), etc. The signed request or decrypted password is what’s transmitted to the app, website, or whatever else you’re authenticating against.
Your biometric data never leaves a secure encrypted channel between the sensor and Secure Enclave, and within the Secure Enclave’s own storage.
It’s some seriously cool hardware and the lengths it goes to to mitigate a lot of common and uncommon attacks is impressive. (It has a separate built in voltage and clock monitor with a wider operating envelope so if you try and voltage glitch it, it can lock and disable itself and require a reset. Bet Nintendo wishes they had thought of that.)
There are a _lot_ of details published about this.
Secure Enclave: https://support.apple.com/en-ca/guide/security/sec59b0b31ff/...
Overall platform security: https://support.apple.com/en-ca/guide/security/welcome/web
Also, you should be able to use a platform authenticator with a PIN.
Assuming the "problem" you are referring to is authentication, this is not necessarily true. "Something you know" is just one auth factor of several. Using a thumbprint (something you are) to grant access to a private key stored on a device to sign a challenge does not rely on human memory, and is probably more secure than using a password in most cases.
An argument can also be made that using a password manager implies that you are specifically doing the opposite of relying on human memory for authentication.
That said, I also disagree with the premise of the original comment that "Passwords should be dead soon and this article should be irrelevant soon after." They will be around for a while, although I hope passwordless mfa can soon replace them as the default choice.
> Also sometimes I need to change them (if they get compromised, if computing progress made them easier to bruteforce, etc.), and I don't really want to have to use cosmetic surgery when that happens.
That's not how it works. Each hardware device that acquires your FaceID or TouchID (or Iris ID etc) do it in a way that's unique to them. Even mission impossible style face mask can't fool these modern FaceIDs. Like all things in security, it is a game of making it really expensive to break it and not really about it being impossible.
YOU, a relatively wealthy programmer/middle manager living in a first-world country, have access to such a device.
Ever think about who you're disenfranchising with tech like this? Or to whom you're ceding socioeconomic power and political influence?
Btw, your assumptions about me are wrong. You don't know anything about me. So don't make it personal.
But for the average website, passwordless is confusing for the end user.
I've researched WebAuthn for a web game to see if I could make the login natively and seamless. And it sucked. In Windows, it would prompt a confusing window asking for either an USB key, Windows Hello (So, a PIN or face, and most of people don't have this feature enabled), or to use a QR code. The average user won't know what they should do, so they won't be able to register.
Also, it's really hard to use your account on other devices. Like, if you log in first with a Google phone, then yeah, you'll be able to use your key by scanning a QR when prompted on your computer. But if you log in with a computer first, you won't be able to use your key anywhere else because exporting keys isn't implemented anywhere yet.
I've ended up just implementing Google and Apple OAuth, since WebAuthn requires accounts anyways to store your keys (Microsoft on Windows, Google on Android, Apple on Mac/ios), so why not just log in with them directly?
And there's work being done in that direction. Apple supports passkeys from third-party password managers, 1Password has a Passkey beta and KeePassXC has a pull request working on passkey support. [0]
That independence is a design goal of passkeys, because they want to replace passwords and passwords are independent by their nature.
nope
I am working on basing less critical stuff on Google, not interested in doing exact opposite (or doing the same mistake with Apple)
FWIW I use a password manager of sorts, but only to remember "hints". Once I see the hint I can reliably recall what the full password is, but there's no way reasonable way for someone else to do so. It's only passwords I use very rarely I even really need such hints for.
No, I prefer to keep my fingers intact on both of my hands. Better to use the mind for something secured; the brain is essentially hack-proof.