Difference between revisions of "Talking Passwords"

From MicroFocusInternationalWiki
Jump to: navigation, search
(Undo revision 21789 by 137.65.227.74 (talk))
 
(27 intermediate revisions by 7 users not shown)
Line 1: Line 1:
Hi,  
+
[[Category:Open Enterprise Server]]
I wanted to gauge people's opinion and current setups for password policies.
+
[[Category:Security and Identity]]
At some-Cola UK we are about to roll out universal passwords but to plagiarise other people’s ideas on passwords.
+
 
 +
<h1>Talking Passwords</h1>
 +
===what is this page for?===
 +
 
 +
The idea of the page is to address password issues around universal passwords.  Specifically;
 +
<h4>A: What considerations are there for password policies? What are your policies? ''(Please don't use your company name)''</h4>
 +
<h4>B: Ideas for challenge/response questions and the potential downfall of these solutions?</h4>
 +
<h4>C: Implementation considerations</h4>
 +
 
 +
I hope it will be of use for people thinking of implementing universal passwords, like me!
 +
===what is not for===
 +
This is not a support site. Please use either Cool Solutions or the Novell Support Connection forums for that purpose.
 +
===who started it===
 +
Me --[[User:Pfallon|Pfallon]] 04:19, 25 May 2005 (MDT), I've never made a Wiki before, or a webpage for that matter.  I started it as i wanted to contribute to Novell's Wiki, learn how they are used and answer the questions that this page poses.
 +
 
 +
Feel free to reformat, add to and remove content as you see fit as long as we keep to what the page is for it doesn't matter.
 +
===how to use the page===
 +
Not sure yet... Please use and edit the discussion page as well as the article page, there is good content on both!''
 +
===Question===
 +
 
 +
At some-Cola UK company we are about to roll out universal password and wish to plagiarise other people's ideas on passwords, and contribute the collective knowledge
  
 
Our current policy is 6 characters, 42 days reset, no duplicates and 6 grace logins
 
Our current policy is 6 characters, 42 days reset, no duplicates and 6 grace logins
Line 7: Line 27:
 
Now we can be clever with advanced universal password rules we want to provide a better level of password security without creating more helpdesk calls due to over complex policies.
 
Now we can be clever with advanced universal password rules we want to provide a better level of password security without creating more helpdesk calls due to over complex policies.
  
So we don’t want a 26 character, dictionary proof password with at least 7 forms of punctuation 3 capital letters and 5 digits that needs to change daily and never repeat, ever.
+
So we don't want a 26 character, dictionary proof password with at least 7 forms of punctuation 3 capital letters and 5 digits that needs to change daily and never repeat, ever.
  
 
Nor do we want people to use cola as their password.
 
Nor do we want people to use cola as their password.
  
<b>what is the best mix of security and complexity, what is your policy?</b>
+
====='''Q:  What is the best mix of security and complexity, what is your policy?'''=====
  
We want to use self service password resets, by getting users to answer a set of questions that can be used to reset all passwords within the meta-directory. However, most suggestions I’ve had are either;  
+
We want to use self service password resets, by getting users to answer a set of questions that can be used to reset all passwords within the meta-directory. However, most suggestions I've had are either;  
 
Obscure i.e. what did you have for lunch on January 12 1982  or
 
Obscure i.e. what did you have for lunch on January 12 1982  or
 
Obvious  i.e. what colour is your hair?  
 
Obvious  i.e. what colour is your hair?  
  
<b>what are good questions to ask users, what you do you ask them?</b>
+
====='''Q:  What are good questions to ask users, what you do you ask them?'''=====
  
 
Thanks in-advance
 
Thanks in-advance
  
08:28, 13 May 2005 (MDT)
 
  
'''Suggestions'''
 
  
First of all, remember the old trade-off between user convenience and security. Typically the stronger the password, the less convenience to the user. So the user will modify their habits to make things convenient. For example, writing down their password and stick in under the keyboard.
+
===Links===
 +
<br>
 +
Pass Phrases vs. Passwords
 +
http://www.microsoft.com/technet/community/columns/secmgmt/sm1004.mspx
  
Next, if you are trying to come up with a solid password management policy, get buy-in from senior managers first and then let the politics of the password pilyc flow down from the top. The 8th layer of the OSI model. If management doesn't support you, it's not going to do any good trying to enforce policy without a hammer behind the fist.
+
Discussion on writing down your password..
 +
http://it.slashdot.org/it/05/05/24/2047228.shtml?tid=172
  
As far as challenge questions go, the question set should be simple but yet not something that other users know about the person - when the questions are presented as a set. For example, I would consider using this set:
+
sites which allow you to find out information that could be used to answer challenge question, Beware!
 +
http://friendsreunited.co.uk
  
What is your favorite color? (People's hair color changes - don't use)
+
===Forgotten Password question ideas (Challenge Response)===
  
What is your mother's maiden name?
+
Questions shouldn't be dependant on time, i.e. talk about current things (cars pets etc) or last times (last holiday, last car) as these change with time and the challenges don't. Questions should also be answerable by all where possible to avoid answers of "N/A".
  
What are the last 4 digits of your social security number?
+
In an office situation it is likely you share things about yourself with your colleagues and they generally can see what you look like from a staff directory, and what is on your desk if they so wish, so questions should be tailored to protect against this in some way.
  
This would be a solid challenge set for regular users who do not have sweeping access to directory/file systems. I would use a different set of challenge questions for network administrators and keep that under wraps just to deter social engineering.
 
  
Lastly, if you are creating a security/password policy from scratch, start with tight security and loosen later (rather than loose security and tighten later). Users scream when you take away something, but when you give them something they don't have they are your best friend.
+
====''Good questions''====
 +
These are questions i cant find fault with, if you disagree feel free to edit the wiki!
  
Here's a good article:
 
  
http://www.microsoft.com/technet/community/columns/secmgmt/sm1004.mspx
+
'''What is your favourite colour?'''
 +
''I disagree with this, becouse there five or six possible answer and is ease to guess.''
  
--[[User:Mgoddard|Mgoddard]] 11:51, 17 May 2005 (MDT)
+
'''If you could meet someone from history, who would it be?'''
  
===forgotten password question ideas===
+
'''Where did you go on your first holiday?'''
<b>What is your shoe size?</b> (too easy to guess?)
+
 
<br>
+
'''What is your least favourite film of all time?'''
<b>What is your inside leg measurement?</b> (do most people know this?)
+
 
<br>
+
'''Name a memorable place'''
<b>What is your payroll id?</b>(fairly easy to guess)
+
''Too vague - people don't easily remember 'memorable' places''
<br>
+
 
<b>What is your favourite colour?</b>
+
'''Name a memorable date'''
<br>
+
''Also too vague''
<b>What is your mortgage/rent payment per month?</b>(too personal?)
+
 
<br>
+
'''Where were you born?'''
<b>What colour are your partner's eyes?</b>(not everyone has a partner)
+
''Whether this is good or not may depend on the country/region where you are. For example in Luxembourg, there are only 3 or 4 cities were typically people get born and for most it is Luxembourg (city) anyway. The case of Luxembourg is of course extreme, but there may be other places which may present similar patterns, e.g. most people being born in one of the same few cities.''
<br>
+
 
<b>What is your mother's maiden name?</b>
+
'''What is the name of the primary school you attended?'''
<br>
+
''Quite easy to research - try a website like friendsreunited.com''
<b>What is your favorite beverage?</b>
+
 
<br>
+
'''What is your father's first name?'''
<b>What was your high school mascot?</b>
+
''Too easy to research''
<br>
+
 
<b>What was the name of your first pet?</b>
+
'''What is your mother's first name?'''
<br>
+
''Too easy to research''
 +
 
 +
'''Where were you at midnight on the 2000 Millenium?'''
 +
 
 +
'''Airline Loyalty Card Number?'''
 +
''(on the downside, not everyone has one)''
 +
 
 +
'''Cell phone IMEI number - key *#06# on any phone to get this'''
 +
''(on the downside, not everyone has one)''
 +
 
 +
'''Think of things that people carry around with them that have codes on them - have you anything unique on the back of your company ID badge?  I know we do!'''
 +
 
 +
'''First name of your first kiss!'''
 +
 
 +
====''Questionable questions''====
 +
These type of questions may be fine for some environments but could cause problems in others.  On the other hand they could just be plain dumb.
 +
 
 +
 
 +
{| border="1" cellpadding="5" width="100%" cellspacing="0" align="center"
 +
|-
 +
! style="background:#efefef;" width="35%" | Question
 +
! colspan="2" style="background:#efefef;" width="65%" | potential issue
 +
 
 +
|-
 +
|'''What is your shoe size?'''
 +
|Too easy to guess as male shoe size range is small that many options? / shoes left in the gym
 +
 
 +
|-
 +
|'''What is your inside leg measurement?'''
 +
|Do most people know this?
 +
 
 +
 
 +
|-
 +
|'''What is your payroll id?'''
 +
|Written on your staff ID card?
 +
 
 +
|-
 +
|'''What is your mortgage/rent payment per month?'''
 +
|Too personal?
 +
 
 +
|-
 +
|'''What colour are your partner's eyes?'''
 +
|Not everyone has a partner!
 +
 
 +
|-
 +
|'''What is your mother's maiden name?'''
 +
|Various Geneology databases hold lists of marriages and maiden names ''(perhaps being a little paranoid here?)''
 +
 
 +
|-
 +
|'''What is your favourite beverage?'''
 +
|'''there is only one answer in my company, may be OK in yours? :)'''
 +
 
 +
|-
 +
|'''What was your high school mascot?'''
 +
|Is this an American thing? If so could be fine for a US workforce
 +
 
 +
|-
 +
|'''What was the name of your first pet?'''
 +
|not everyone has or has had a pet ''(believe it or not)''
 +
 
 +
|-
 +
|'''What are the last 4 digits of your social security number?'''
 +
|Another American thing? if so could be fine for a US workforce, or worked to include another company's equivalent
 +
 
 +
|-
 +
|'''What is your Fathers middle name?'''
 +
| Not all have a middle name and middle names often becomes sons first  name
 +
 
 +
 
 +
|-
 +
|'''What was your first car/bike?'''
 +
| Not all had a car or bike
 +
 
 +
|-
 +
|'''What is the third letter of your home address (street name)?'''
 +
|This can change in time
 +
 
 +
|-
 +
|'''How long have you lived at your current address?'''
 +
|This changes in line with the time!
 +
 
 +
|-
 +
|'''Where was youe last holiday destination?'''
 +
|Changes with time and is talked about in the office
 +
 
 +
|-
 +
|'''what is your favourite sports team?'''
 +
|Talked about, everywhere
 +
 
 +
|-
 +
|'''Favourite Food?'''
 +
|'''there is only one answer in my company, may be ok in yours? :)'''
 +
 
 +
|-
 +
|'''How many children do you have?'''
 +
|Not all of us have children and most poeple have 2.2 anyway

Latest revision as of 13:49, 16 March 2015


Talking Passwords

what is this page for?

The idea of the page is to address password issues around universal passwords. Specifically;

A: What considerations are there for password policies? What are your policies? (Please don't use your company name)

B: Ideas for challenge/response questions and the potential downfall of these solutions?

C: Implementation considerations

I hope it will be of use for people thinking of implementing universal passwords, like me!

what is not for

This is not a support site. Please use either Cool Solutions or the Novell Support Connection forums for that purpose.

who started it

Me --Pfallon 04:19, 25 May 2005 (MDT), I've never made a Wiki before, or a webpage for that matter. I started it as i wanted to contribute to Novell's Wiki, learn how they are used and answer the questions that this page poses.

Feel free to reformat, add to and remove content as you see fit as long as we keep to what the page is for it doesn't matter.

how to use the page

Not sure yet... Please use and edit the discussion page as well as the article page, there is good content on both!

Question

At some-Cola UK company we are about to roll out universal password and wish to plagiarise other people's ideas on passwords, and contribute the collective knowledge

Our current policy is 6 characters, 42 days reset, no duplicates and 6 grace logins

Now we can be clever with advanced universal password rules we want to provide a better level of password security without creating more helpdesk calls due to over complex policies.

So we don't want a 26 character, dictionary proof password with at least 7 forms of punctuation 3 capital letters and 5 digits that needs to change daily and never repeat, ever.

Nor do we want people to use cola as their password.

Q: What is the best mix of security and complexity, what is your policy?

We want to use self service password resets, by getting users to answer a set of questions that can be used to reset all passwords within the meta-directory. However, most suggestions I've had are either; Obscure i.e. what did you have for lunch on January 12 1982 or Obvious i.e. what colour is your hair?

Q: What are good questions to ask users, what you do you ask them?

Thanks in-advance


Links


Pass Phrases vs. Passwords http://www.microsoft.com/technet/community/columns/secmgmt/sm1004.mspx

Discussion on writing down your password.. http://it.slashdot.org/it/05/05/24/2047228.shtml?tid=172

sites which allow you to find out information that could be used to answer challenge question, Beware! http://friendsreunited.co.uk

Forgotten Password question ideas (Challenge Response)

Questions shouldn't be dependant on time, i.e. talk about current things (cars pets etc) or last times (last holiday, last car) as these change with time and the challenges don't. Questions should also be answerable by all where possible to avoid answers of "N/A".

In an office situation it is likely you share things about yourself with your colleagues and they generally can see what you look like from a staff directory, and what is on your desk if they so wish, so questions should be tailored to protect against this in some way.


Good questions

These are questions i cant find fault with, if you disagree feel free to edit the wiki!


What is your favourite colour? I disagree with this, becouse there five or six possible answer and is ease to guess.

If you could meet someone from history, who would it be?

Where did you go on your first holiday?

What is your least favourite film of all time?

Name a memorable place Too vague - people don't easily remember 'memorable' places

Name a memorable date Also too vague

Where were you born? Whether this is good or not may depend on the country/region where you are. For example in Luxembourg, there are only 3 or 4 cities were typically people get born and for most it is Luxembourg (city) anyway. The case of Luxembourg is of course extreme, but there may be other places which may present similar patterns, e.g. most people being born in one of the same few cities.

What is the name of the primary school you attended? Quite easy to research - try a website like friendsreunited.com

What is your father's first name? Too easy to research

What is your mother's first name? Too easy to research

Where were you at midnight on the 2000 Millenium?

Airline Loyalty Card Number? (on the downside, not everyone has one)

Cell phone IMEI number - key *#06# on any phone to get this (on the downside, not everyone has one)

Think of things that people carry around with them that have codes on them - have you anything unique on the back of your company ID badge? I know we do!

First name of your first kiss!

Questionable questions

These type of questions may be fine for some environments but could cause problems in others. On the other hand they could just be plain dumb.


Question potential issue
What is your shoe size? Too easy to guess as male shoe size range is small that many options? / shoes left in the gym
What is your inside leg measurement? Do most people know this?


What is your payroll id? Written on your staff ID card?
What is your mortgage/rent payment per month? Too personal?
What colour are your partner's eyes? Not everyone has a partner!
What is your mother's maiden name? Various Geneology databases hold lists of marriages and maiden names (perhaps being a little paranoid here?)
What is your favourite beverage? there is only one answer in my company, may be OK in yours? :)
What was your high school mascot? Is this an American thing? If so could be fine for a US workforce
What was the name of your first pet? not everyone has or has had a pet (believe it or not)
What are the last 4 digits of your social security number? Another American thing? if so could be fine for a US workforce, or worked to include another company's equivalent
What is your Fathers middle name? Not all have a middle name and middle names often becomes sons first name


What was your first car/bike? Not all had a car or bike
What is the third letter of your home address (street name)? This can change in time
How long have you lived at your current address? This changes in line with the time!
Where was youe last holiday destination? Changes with time and is talked about in the office
what is your favourite sports team? Talked about, everywhere
Favourite Food? there is only one answer in my company, may be ok in yours? :)
How many children do you have? Not all of us have children and most poeple have 2.2 anyway