Honestly I never thought the fingerprint of a Microsoft was gonna keep me secure. I tend to trust my cell phone and my server. I rarely access personal data on my pc. N while not necessarily the...
Honestly I never thought the fingerprint of a Microsoft was gonna keep me secure. I tend to trust my cell phone and my server. I rarely access personal data on my pc. N while not necessarily the intent of the article it would be interesting to know where others primarily access their personal data.
Can you expand on what you mean when you say that you don't access personal data on your computer? What about banking for example? Do you do that via your phone only? Why would that be more secure...
Can you expand on what you mean when you say that you don't access personal data on your computer? What about banking for example? Do you do that via your phone only? Why would that be more secure than using a desktop PC laptop?
The question for me is less where I access my data, but where I store it. The important stuff is on a usb-key that I pull out the drawer if necessary.
I access my banking data only on my iPhone. I just feel is more secure than a website and trusting windows to protect me as the authentication requires my biometrics vs a password or 2 factor auth.
I access my banking data only on my iPhone. I just feel is more secure than a website and trusting windows to protect me as the authentication requires my biometrics vs a password or 2 factor auth.
What does that mean with regards to the security of biometrics vs. good old passwords? I take it that the best way to secure access to my computer is still a long and complicated password, and not...
What does that mean with regards to the security of biometrics vs. good old passwords?
I take it that the best way to secure access to my computer is still a long and complicated password, and not my fingerprint?
I think this depends on what metrics you use for "the best" but to add something you may not have considered -- at least in my understanding of US law, cops can force you to unlock things using...
I take it that the best way to secure access to my computer is still a long and complicated password, and not my fingerprint?
I think this depends on what metrics you use for "the best" but to add something you may not have considered -- at least in my understanding of US law, cops can force you to unlock things using biometric data but they can't force you to give them your password.
You remember accurately. If your threat profile includes the police (it should), you definitely need to have a password on the device. It is this reason that I don't fully trust the "passkey"...
You remember accurately. If your threat profile includes the police (it should), you definitely need to have a password on the device.
It is this reason that I don't fully trust the "passkey" approach, if I can't also mandate a proper 20+ character password to secure it. If it's all biometrics you've basically handed the government free reign to log into all your shit.
A 4-digit PIN is not good enough unless the device has a long lockout period after a few failed attempts.
8 character passwords are no longer considered sufficient against bute force. 12 is the new minimum.
I'm a big fan of "sentence passwords" for the few I need to remember myself (I use a password manager overall). But ofc one needs to be wise to possible dictionary attacks with those.
I'm a big fan of "sentence passwords" for the few I need to remember myself (I use a password manager overall). But ofc one needs to be wise to possible dictionary attacks with those.
Yes, I routinely use 30+ character passwords, in the form of full sentences with punctuation and such. The phrases would be nonsense phrases to anyone else, but much easier to remember than...
Yes, I routinely use 30+ character passwords, in the form of full sentences with punctuation and such. The phrases would be nonsense phrases to anyone else, but much easier to remember than DS@#$fds@#asf@#$sjslklkj type passwords.
I see the push to 12 characters password and the IT help desk filled with forgot password requests, then I wonder what's the end game here. They can't keep increasing it. I suppose they're pushing...
I see the push to 12 characters password and the IT help desk filled with forgot password requests, then I wonder what's the end game here. They can't keep increasing it.
I suppose they're pushing passkeys because 16 character passwords are not really possible for people without password manager or 60wpm typing speed
"MySUPERSecretPassword!ForTheNewServiceI’mSigningUpForRightNowNovember2023“ is already infinitely better than any 8-character password. But realistically, you (should) need only remember two...
I see the push to 12 characters password and the IT help desk filled with forgot password requests, then I wonder what's the end game here. They can't keep increasing it.
"MySUPERSecretPassword!ForTheNewServiceI’mSigningUpForRightNowNovember2023“ is already infinitely better than any 8-character password.
But realistically, you (should) need only remember two categories of passwords (+ login credentials, e.g. email address, if needed): Those for unlocking hardware (1 per device), and those for unlocking software (password managers, typically one, maybe a second one that’s used on the job).
That’d be, for most people, four to five of these passwords probably.
Not to mention phone and probably password manager could be done via biometrics and most people would still feel comfortable/"safe enough" (despite the security implications of biometric unlocks, they're probably faster in day-to-day use for slow or prone-to-typo typers).
You caught me. Well I don't really think of myself as prone to typo, I guess when I type out long comments or such in the event I typo I don't even realize it because it's easy enough to correct...
prone-to-typo typers
You caught me. Well I don't really think of myself as prone to typo, I guess when I type out long comments or such in the event I typo I don't even realize it because it's easy enough to correct without having to think about. I can hit about 100wpm typing but at that speed I do get occasional inaccuracies that probably bring it down to more of an effective 90wpm or something like that.
However with my few passwords I need to remember, where I've employed the longer passphrase type similar to the example you gave, it's especially annoying when I typo on that considering password fields are generally hidden by default. I recently changed password managers and changed my master password in the process, and I was typoing my master password frequently. It's also way unlike typical communication where a typo can get recognized and highlighted by software and functionally your communication still works even with a typo, so it was aggravating me a bit initially. I've gotten used to typing it now so it happens less often, there's times where I type it out and I get to the end and I'm legitimately surprised it worked (because I thought I may have made a typo).
As @tauon mentioned, part of it is outdated security advice. The passphrase is much more secure, on average, than any traditional password, provided the phrase is chosen randomly from a...
As @tauon mentioned, part of it is outdated security advice. The passphrase is much more secure, on average, than any traditional password, provided the phrase is chosen randomly from a sufficiently large dictionary. Ideally not any popular phrase. Especially if there is a user-chosen separator and random 2-digit number somewhere in it.
Luckily anti-brute-force measures like lockouts mitigate this substantially.
But still, before the cellphone, it was not uncommon for the average person to have 5-10 10-digit phone numbers fully memorized. Now with more ubiquitous password managers, people only really need to memorize two passwords: A device password, and a password manager password. If that is done (and biometric data stored in password manager), insanely long, complex passwords (including proper passkeys) is trivial.
I guess what I'm saying is that passkeys should be nested in a password manager or device, with a mandatory long password. The reliance on biometrics eliminates a key component (something you know), and much of the legal backing for digital privacy.
And yet my work has implemented their new standard of a minimum of 17 characters recently. I jumped beyond that because the jargon I was stringing together just came out that way, but it's still...
And yet my work has implemented their new standard of a minimum of 17 characters recently. I jumped beyond that because the jargon I was stringing together just came out that way, but it's still significantly more difficult for me to log in first thing in the morning, before I've had my coffee and before my lazy hands are warmed up. Honestly, I'm shocked that I haven't managed to lock myself out with failed attempts yet.
Yep, coercion to give up a password is currently considered a potential violation of the 5th Amendment where you can't be compelled to testify against yourself. There are situations where there...
Yep, coercion to give up a password is currently considered a potential violation of the 5th Amendment where you can't be compelled to testify against yourself. There are situations where there have been attempts to coerce revealing passwords - there's the case of Terry Childs, who changed a bunch of San Francisco computer system passwords and was held in jail in contempt until he revealed them - but generally has been applied.
Honestly I never thought the fingerprint of a Microsoft was gonna keep me secure. I tend to trust my cell phone and my server. I rarely access personal data on my pc. N while not necessarily the intent of the article it would be interesting to know where others primarily access their personal data.
Can you expand on what you mean when you say that you don't access personal data on your computer? What about banking for example? Do you do that via your phone only? Why would that be more secure than using a desktop PC laptop?
The question for me is less where I access my data, but where I store it. The important stuff is on a usb-key that I pull out the drawer if necessary.
I access my banking data only on my iPhone. I just feel is more secure than a website and trusting windows to protect me as the authentication requires my biometrics vs a password or 2 factor auth.
What does that mean with regards to the security of biometrics vs. good old passwords?
I take it that the best way to secure access to my computer is still a long and complicated password, and not my fingerprint?
I think this depends on what metrics you use for "the best" but to add something you may not have considered -- at least in my understanding of US law, cops can force you to unlock things using biometric data but they can't force you to give them your password.
You remember accurately. If your threat profile includes the police (it should), you definitely need to have a password on the device.
It is this reason that I don't fully trust the "passkey" approach, if I can't also mandate a proper 20+ character password to secure it. If it's all biometrics you've basically handed the government free reign to log into all your shit.
A 4-digit PIN is not good enough unless the device has a long lockout period after a few failed attempts.
8 character passwords are no longer considered sufficient against bute force. 12 is the new minimum.
I'm a big fan of "sentence passwords" for the few I need to remember myself (I use a password manager overall). But ofc one needs to be wise to possible dictionary attacks with those.
Yes, I routinely use 30+ character passwords, in the form of full sentences with punctuation and such. The phrases would be nonsense phrases to anyone else, but much easier to remember than DS@#$fds@#asf@#$sjslklkj type passwords.
The 'correct horse battery staple' approach is what I use too.
I see the push to 12 characters password and the IT help desk filled with forgot password requests, then I wonder what's the end game here. They can't keep increasing it.
I suppose they're pushing passkeys because 16 character passwords are not really possible for people without password manager or 60wpm typing speed
"MySUPERSecretPassword!ForTheNewServiceI’mSigningUpForRightNowNovember2023“ is already infinitely better than any 8-character password.
But realistically, you (should) need only remember two categories of passwords (+ login credentials, e.g. email address, if needed): Those for unlocking hardware (1 per device), and those for unlocking software (password managers, typically one, maybe a second one that’s used on the job).
That’d be, for most people, four to five of these passwords probably.
Not to mention phone and probably password manager could be done via biometrics and most people would still feel comfortable/"safe enough" (despite the security implications of biometric unlocks, they're probably faster in day-to-day use for slow or prone-to-typo typers).
You caught me. Well I don't really think of myself as prone to typo, I guess when I type out long comments or such in the event I typo I don't even realize it because it's easy enough to correct without having to think about. I can hit about 100wpm typing but at that speed I do get occasional inaccuracies that probably bring it down to more of an effective 90wpm or something like that.
However with my few passwords I need to remember, where I've employed the longer passphrase type similar to the example you gave, it's especially annoying when I typo on that considering password fields are generally hidden by default. I recently changed password managers and changed my master password in the process, and I was typoing my master password frequently. It's also way unlike typical communication where a typo can get recognized and highlighted by software and functionally your communication still works even with a typo, so it was aggravating me a bit initially. I've gotten used to typing it now so it happens less often, there's times where I type it out and I get to the end and I'm legitimately surprised it worked (because I thought I may have made a typo).
As @tauon mentioned, part of it is outdated security advice. The passphrase is much more secure, on average, than any traditional password, provided the phrase is chosen randomly from a sufficiently large dictionary. Ideally not any popular phrase. Especially if there is a user-chosen separator and random 2-digit number somewhere in it.
Luckily anti-brute-force measures like lockouts mitigate this substantially.
But still, before the cellphone, it was not uncommon for the average person to have 5-10 10-digit phone numbers fully memorized. Now with more ubiquitous password managers, people only really need to memorize two passwords: A device password, and a password manager password. If that is done (and biometric data stored in password manager), insanely long, complex passwords (including proper passkeys) is trivial.
I guess what I'm saying is that passkeys should be nested in a password manager or device, with a mandatory long password. The reliance on biometrics eliminates a key component (something you know), and much of the legal backing for digital privacy.
And yet my work has implemented their new standard of a minimum of 17 characters recently. I jumped beyond that because the jargon I was stringing together just came out that way, but it's still significantly more difficult for me to log in first thing in the morning, before I've had my coffee and before my lazy hands are warmed up. Honestly, I'm shocked that I haven't managed to lock myself out with failed attempts yet.
yeah this is definitely something that'll vary heavily by jurisdiction. I've just heard about it as an issue in the US specifically.
Yep, coercion to give up a password is currently considered a potential violation of the 5th Amendment where you can't be compelled to testify against yourself. There are situations where there have been attempts to coerce revealing passwords - there's the case of Terry Childs, who changed a bunch of San Francisco computer system passwords and was held in jail in contempt until he revealed them - but generally has been applied.