Hacking as Usual

="what's worse than a password system which forces you to create a password you can't possibly remember?

=" how does LinkedIn/eHarmony/whoever allow thousands of password guesses without noticing?

~~

it has long been know that enforcing "3 strikes \ out" rule on password access solves the problem-- although creating a new problem: too many help desk calls for locked passwords

the answer is known: you generate a new, 1-time password and e\mail it to the customer.  the customer logs on by clicking the link from the 1-time password message to the create new password page. Remember: you really should be using Secure Mail of some type,-- I prefer Outlook\PGP or Thunderbird\ENIGMAIL because these use public key encryption directly under your control.

if you are using 3 strikes and out you don't need essoteric passwords as much,-- just stay clear of the top 100 or so...

however,-- that ain't all there is to it,--

• if you have malware in your computer you have to get rid of that first
• if you have not run a software audit you don't know if you have malware or not
• if the host has been hacked, oh well

RAINBOW TABLES

if the host has been hacked the hacker may have taken the passwords from the host database.  these should be encrypted, using SHA-1 or MD5\salted

the attacker may have a "rainbow table".  a rainbow table is a reverse look-up: the attacker presents the hash of the password and the table returns a character string value for that hash.  this has been used with good effect against MD5; not so much against MD5\salted or SHA-1. yet

Hacker tools such as rainbow tables can be had for cash on the Dark Net where Hackers live

Today's Suggested Reading is pretty heavy going.  Although the essay is a little dated the content is still very insightful: we suffer more from hacking that what we should.

ACCESS AUDIT

In all cases where password protection is used when the customer logs on the system should show: PRIOR LOGON INFO: Date,Time,System_ID

not everyone will watch this infor like they should but enough people will so that a compromised system can be identified more quickly

Mashka,

Your password may not be stored in your email, but it's where you can reset your passwords for other sites, it tells a hacker which sites to attack, it gives them much of the data to guess your questions, etc.

Agreed. I hate it when online banking sites force me to choose a new password every month or pick passwords that are annoyingly long with mandatory inclusion of punctation and numbers.

But I suppose I don't understand how dictionary attacks work nowadays -- how does LinkedIn/eHarmony/whoever allow thousands of password guesses without noticing? 

Can't win.  That seems very lax, but what's worse than a password system which forces you to create a password you can't possibly remember?

It's surprising that password systems still allow dictionary words and common passwords like 12345... but I think that just shows that users don't care about security.

http://mashable.com/2012/06/08/linkedin-stolen-passwords-list/

This all reminds me of this classic XKCD:

http://xkcd.com/936/

and this one, too:

http://xkcd.com/538/

Recall that the same thing happened with Sarah Palin.

On the other hand, this blizzard of questions I'm getting subjected to ("What's your favorite song? Who was your kindergarten teacher?" Christ, I don't know!) isn't useful either.

davidmanheim,

all of your other passwords are typically stored in your email.

Really? Do people store their passwords  in their emails?? I saved some pin codes for my cards  there, but then deleted them as well. 

the Internet\Computer Community could of course make provision for each of us to generate an x.509 certificate

and you could then install your x.509 certificate in your various devices giving you single logon  --- but --- exact identification to any service you logged onto using your certificate...

we cannot tolerate malware

let's suppose for a moment that we have established Commercial Computers separate from experimental\development computers

the difference being that the software on a commercial computer is controlled and not modified without authorization. risky practices such as RPC have been abolished

the implication would be that when you log on using an x.509 certificate you are positively identified ...

think about this

Now Susan, I know it's Sunday, but here is our Suggested Reading for today

Freedom of the Press is essential to our well-being. Unfortunately we do have thugs who will use improper methods to silence viewpoints they don't like.

The Internet has give us all unprecendented Freedom of Expression

Let's Keep it that way

Remember when you review public key cryptography (x.509 certificates use public key cryptography )it is incumbent on you to verify signatures: either directly of via a Certificate Authority. existing procedures have taken shortcuts in this, assuming the individual's responsibility for him\her -- and -- allowing way too many certicates to acquire automatic approvals. Public key cryptography is not broken: it just isn't properly used.

Seems the LinkedIn hacker struck twice and dumped 1.5 million eHarmony passwords, many cracked, in the same forum as the LinkedIn list.

Yes, I changed my LinkedIn password.