Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #275826
| From | Jeffrey Walton <noloader@gmail.com> |
|---|---|
| Newsgroups | linux.debian.user |
| Subject | Re: Writing passwords down [was: a passwordless operating system] |
| Date | 2024-12-17 15:30 +0100 |
| Message-ID | <JUGKe-eHG-11@gated-at.bofh.it> (permalink) |
| References | <JTRHH-h9O8-5@gated-at.bofh.it> <JTXap-hd9b-1@gated-at.bofh.it> <JUwUx-8vi-5@gated-at.bofh.it> <JUxnz-8U5-9@gated-at.bofh.it> <JUyCZ-9Eu-1@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Tue, Dec 17, 2024 at 12:45 AM <tomas@tuxteam.de> wrote:
>
> On Mon, Dec 16, 2024 at 10:22:43PM -0600, John Hasler wrote:
> > songbird writes:
> > > perhaps because the accounts are jointly owned and it is much easier
> > > to just continue using the credentials as they exist instead of having
> > > to set everything up all over again for no real gain.
> >
> > Then follow Bruce Schneier's advice and*write them down*.
>
> Do you have a reference?
You might also try Peter Gutmann's Engineering Security,
<https://www.cs.auckland.ac.nz/~pgut001/pubs/book.pdf>. From Chapter
7, Passwords, Section "Passwords on the Client" (p. 614):
The most effective client-side password management technique that the
typical computer user can employ is to write them down.
No, you didn’t read that wrong. From what we’ve found out from the
endless surveys and studies that have been done on this topic over the
years (see the start of this chapter) and the analysis of how users
currently deal with passwords (see the remainder of the chapter) this
really is the most effective client-side password management technique
for the typical user.
And from the Intro to the chapter (p. 564):
This 1960s perspective of computing is the type of threat model that
some of the password-security guidelines that are in use today were
designed to counter! What’s worse is that even today, decades after
these archaic threat models were employed as the basis for
password-usage guidelines, we’re still fairly consistently giving
users the wrong advice about password security such as “Passwords are
like underwear, change them often” (solving no identifiable problem
but creating several new ones, see “Password Lifetimes” on page
574) and “Firewalls are useless if passwords are stuck to the monitor
with a Post-it” [9] (phishers are pretty creative but the one thing
they haven’t managed to do yet is reach out of the monitor to read
your Post-it notes, see “Passwords on the Client” on page 614). As
Bob Blakley puts it, “despite the fact that both attacks and losses
have approximately doubled every year since 1992, we continue to rely
on old models that are demonstrably ill-suited to the current reality
and don’t inhibit the ongoing march of failure” [10].
Gutmann earned his PhD in security usability (SUX). And his book is
well cited with conference papers and security usability results.
> I ask because I'm in the middle of a discussion (and that was my advice,
> too). Seeing what Schneier has to say on that would be very interesting.
Jeff
Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
a passwordless operating system 🦓 <czyborra@gmail.com> - 2024-12-15 09:00 +0100
Re: a passwordless operating system debian-user@howorth.org.uk - 2024-12-15 14:50 +0100
Re: a passwordless operating system 🦓 <czyborra@gmail.com> - 2024-12-15 15:30 +0100
Re: a passwordless operating system songbird <songbird@anthive.com> - 2024-12-17 05:00 +0100
Re: a passwordless operating system John Hasler <john@sugarbit.com> - 2024-12-17 05:30 +0100
Writing passwords down [was: a passwordless operating system] <tomas@tuxteam.de> - 2024-12-17 06:50 +0100
Re: Writing passwords down [was: a passwordless operating system] "Loris Bennett" <loris.bennett@fu-berlin.de> - 2024-12-17 08:30 +0100
Re: Writing passwords down [was: a passwordless operating system] <tomas@tuxteam.de> - 2024-12-17 08:50 +0100
Re: Writing passwords down [was: a passwordless operating system] Mike Castle <dalgoda+debian@gmail.com> - 2024-12-17 18:00 +0100
Re: Writing passwords down [was: a passwordless operating system] Jeffrey Walton <noloader@gmail.com> - 2024-12-17 15:30 +0100
Re: Writing passwords down [was: a passwordless operating system] Lee <ler762@gmail.com> - 2024-12-17 15:40 +0100
Re: libreoffice/openoffice system theme <tomas@tuxteam.de> - 2024-12-17 16:00 +0100
Re: Writing passwords down [was: a passwordless operating system] Michael Stone <mstone@debian.org> - 2024-12-17 17:10 +0100
Re: Writing passwords down [was: a passwordless operating system] Jeffrey Walton <noloader@gmail.com> - 2024-12-17 18:30 +0100
Re: Writing passwords down [was: a passwordless operating system] "James H. H. Lampert" <jamesl@touchtonecorp.com> - 2024-12-17 18:40 +0100
Re: Writing passwords down [was: a passwordless operating system] <tomas@tuxteam.de> - 2024-12-17 18:30 +0100
Re: Writing passwords down [was: a passwordless operating system] Jeffrey Walton <noloader@gmail.com> - 2024-12-17 18:40 +0100
Re: Writing passwords down [was: a passwordless operating system] tomas@tuxteam.de - 2024-12-17 19:30 +0100
Re: Writing passwords down [was: a passwordless operating system] Nicholas Geovanis <nickgeovanis@gmail.com> - 2024-12-17 21:10 +0100
Re: Writing passwords down Michael Kjörling <c9bc136c6063@ewoof.net> - 2024-12-17 18:50 +0100
Re: Writing passwords down Peter Hillier-Brook <phb@hbsys.plus.com> - 2024-12-17 20:20 +0100
Re: Writing passwords down John Hasler <john@sugarbit.com> - 2024-12-17 20:50 +0100
Re: Writing passwords down Karen Lewellen <klewellen@shellworld.net> - 2024-12-18 06:00 +0100
Re: Writing passwords down Michael Kjörling <c9bc136c6063@ewoof.net> - 2024-12-18 11:00 +0100
Re: Writing passwords down Chris Green <cl@isbd.net> - 2024-12-18 18:20 +0100
Re: Writing passwords down John Hasler <john@sugarbit.com> - 2024-12-18 19:00 +0100
Re: Writing passwords down "James H. H. Lampert" <jamesl@touchtonecorp.com> - 2024-12-18 19:10 +0100
Re: Writing passwords down John Hasler <john@sugarbit.com> - 2024-12-18 20:10 +0100
Re: Writing passwords down pocket@homemail.com - 2024-12-18 21:20 +0100
Re: Writing passwords down Michael Kjörling <c9bc136c6063@ewoof.net> - 2024-12-18 19:30 +0100
Re: Writing passwords down Chris Green <cl@isbd.net> - 2024-12-18 20:30 +0100
Re: Writing passwords down <tomas@tuxteam.de> - 2024-12-19 06:00 +0100
Re: Writing passwords down Chris Green <cl@isbd.net> - 2024-12-18 20:30 +0100
Re: Writing passwords down John Hasler <john@sugarbit.com> - 2024-12-18 23:10 +0100
Re: Writing passwords down Karen Lewellen <klewellen@shellworld.net> - 2024-12-19 02:20 +0100
Re: Writing passwords down Karen Lewellen <klewellen@shellworld.net> - 2024-12-19 02:20 +0100
Re: Writing passwords down John Hasler <john@sugarbit.com> - 2024-12-19 02:30 +0100
Re: Writing passwords down Karen Lewellen <klewellen@shellworld.net> - 2024-12-19 02:40 +0100
Re: Writing passwords down Chris Green <cl@isbd.net> - 2024-12-19 10:20 +0100
Re: Writing passwords down Joe <joe@jretrading.com> - 2024-12-19 12:20 +0100
Re: Writing passwords down Max Nikulin <manikulin@gmail.com> - 2024-12-20 04:30 +0100
Re: Writing passwords down George at Clug <Clug@goproject.info> - 2024-12-20 05:40 +0100
Re: Writing passwords down <tomas@tuxteam.de> - 2024-12-20 05:40 +0100
Re: Writing passwords down Jeffrey Walton <noloader@gmail.com> - 2024-12-20 06:10 +0100
Re: Writing passwords down Chris Green <cl@isbd.net> - 2024-12-20 10:50 +0100
Re: Writing passwords down George at Clug <Clug@goproject.info> - 2024-12-21 01:40 +0100
Re: Writing passwords down Max Nikulin <manikulin@gmail.com> - 2024-12-21 04:30 +0100
Re: Writing passwords down Chris Green <cl@isbd.net> - 2024-12-20 10:30 +0100
Re: Writing passwords down Michael Kjörling <c9bc136c6063@ewoof.net> - 2024-12-18 10:20 +0100
Re: Writing passwords down <tomas@tuxteam.de> - 2024-12-18 10:20 +0100
Re: Writing passwords down Michael Kjörling <c9bc136c6063@ewoof.net> - 2024-12-18 10:30 +0100
Re: Writing passwords down Chris Green <cl@isbd.net> - 2024-12-18 18:20 +0100
Re: Writing passwords down <tomas@tuxteam.de> - 2024-12-18 19:00 +0100
Re: Writing passwords down Jeffrey Walton <noloader@gmail.com> - 2024-12-18 19:20 +0100
Re: Writing passwords down Frank Jezzer <etphonehomefrance@gmail.com> - 2024-12-22 17:30 +0100
Re: Writing passwords down Jeffrey Walton <noloader@gmail.com> - 2024-12-17 23:30 +0100
Re: Writing passwords down John Hasler <john@sugarbit.com> - 2024-12-17 20:30 +0100
Re: Writing passwords down debian-user@howorth.org.uk - 2024-12-17 21:50 +0100
Re: Writing passwords down Michael Kjörling <c9bc136c6063@ewoof.net> - 2024-12-18 10:30 +0100
Re: a passwordless operating system debian-user@howorth.org.uk - 2024-12-17 12:10 +0100
Re: a passwordless operating system Jeffrey Walton <noloader@gmail.com> - 2024-12-15 15:40 +0100
Re: a passwordless operating system 🦓 <czyborra@gmail.com> - 2024-12-16 08:50 +0100
Re: a passwordless operating system Jeffrey Walton <noloader@gmail.com> - 2024-12-16 08:50 +0100
Re: a passwordless operating system Andy Smith <andy@strugglers.net> - 2024-12-16 09:00 +0100
Re: a passwordless operating system 🦓 <czyborra@gmail.com> - 2024-12-16 09:10 +0100
Re: a passwordless operating system 🦓 <czyborra@gmail.com> - 2024-12-16 09:10 +0100
Re: a passwordless operating system Jeffrey Walton <noloader@gmail.com> - 2024-12-16 09:10 +0100
Re: a passwordless operating system 🦓 <czyborra@gmail.com> - 2024-12-16 09:20 +0100
csiph-web