Difference between revisions of "Talking Passwords"

From MicroFocusInternationalWiki
Jump to: navigation, search
(added links section)
(usage information etc.)
Line 1: Line 1:
Hi,  
+
<h1>Talking Passwords</h1>
I wanted to gauge people's opinion and current setups for password policies.
+
===what is this page for?===
 +
<br>
 +
The idea of the page is to address password issues around universal passwords.  Specifically;
 +
<h4>A: What should be considered for a password policy and how to implement it</h4>
 +
<h4>B: Ideas for challenge/response questions and the potential downfall of these solutions</h4>
 +
<h4>C: Implementation considerations</h4>
 +
 
 +
I hope it will be of use for people thinking of implementing universal passwords, like me!
 +
===what is not for===
 +
This is not a support site either cool solutions or the forums should be used for that purpose
 +
===who started it===
 +
Me --[[User:Pfallon|Pfallon]] 04:19, 25 May 2005 (MDT), I've never made a Wiki before, or a webpage for that matter.  I started it as i wanted to contribute to Novell’s Wiki, learn how they are used and answer the questions that this page poses.
 +
feel free to reformat add to and remove content as you see fit as long as we keep to what the page is for it doesn’t matter.
 +
===how to use the page===
 +
n''ot sure yet...    please use the discussion page as well as the article page, their is good content there too!''
 +
===Question===
 +
 
 
At some-Cola UK we are about to roll out universal passwords but to plagiarise other people’s ideas on passwords.
 
At some-Cola UK we are about to roll out universal passwords but to plagiarise other people’s ideas on passwords.
  
Line 31: Line 47:
 
As far as challenge questions go, the question set should be simple but yet not something that other users know about the person - when the questions are presented as a set. For example, I would consider using this set:
 
As far as challenge questions go, the question set should be simple but yet not something that other users know about the person - when the questions are presented as a set. For example, I would consider using this set:
  
What is your favorite color? (People's hair color changes - don't use)
+
What is your favourite colour? (People's hair colour changes - don't use)
  
 
What is your mother's maiden name?
 
What is your mother's maiden name?
Line 47: Line 63:
 
http://www.microsoft.com/technet/community/columns/secmgmt/sm1004.mspx
 
http://www.microsoft.com/technet/community/columns/secmgmt/sm1004.mspx
 
<br>
 
<br>
Discusion on writng down your password..
+
Discussion on writing down your password..
 
http://it.slashdot.org/it/05/05/24/2047228.shtml?tid=172
 
http://it.slashdot.org/it/05/05/24/2047228.shtml?tid=172
  
Line 65: Line 81:
 
<b>What is your mother's maiden name?</b>
 
<b>What is your mother's maiden name?</b>
 
<br>
 
<br>
<b>What is your favorite beverage?</b>
+
<b>What is your favourite beverage?</b>
 
<br>
 
<br>
 
<b>What was your high school mascot?</b>
 
<b>What was your high school mascot?</b>

Revision as of 10:19, 25 May 2005

Talking Passwords

what is this page for?


The idea of the page is to address password issues around universal passwords. Specifically;

A: What should be considered for a password policy and how to implement it

B: Ideas for challenge/response questions and the potential downfall of these solutions

C: Implementation considerations

I hope it will be of use for people thinking of implementing universal passwords, like me!

what is not for

This is not a support site either cool solutions or the forums should be used for that purpose

who started it

Me --Pfallon 04:19, 25 May 2005 (MDT), I've never made a Wiki before, or a webpage for that matter. I started it as i wanted to contribute to Novell’s Wiki, learn how they are used and answer the questions that this page poses. feel free to reformat add to and remove content as you see fit as long as we keep to what the page is for it doesn’t matter.

how to use the page

not sure yet... please use the discussion page as well as the article page, their is good content there too!

Question

At some-Cola UK we are about to roll out universal passwords but to plagiarise other people’s ideas on passwords.

Our current policy is 6 characters, 42 days reset, no duplicates and 6 grace logins

Now we can be clever with advanced universal password rules we want to provide a better level of password security without creating more helpdesk calls due to over complex policies.

So we don’t want a 26 character, dictionary proof password with at least 7 forms of punctuation 3 capital letters and 5 digits that needs to change daily and never repeat, ever.

Nor do we want people to use cola as their password.

what is the best mix of security and complexity, what is your policy?

We want to use self service password resets, by getting users to answer a set of questions that can be used to reset all passwords within the meta-directory. However, most suggestions I’ve had are either; Obscure i.e. what did you have for lunch on January 12 1982 or Obvious i.e. what colour is your hair?

what are good questions to ask users, what you do you ask them?

Thanks in-advance

08:28, 13 May 2005 (MDT)

Suggestions

First of all, remember the old trade-off between user convenience and security. Typically the stronger the password, the less convenience to the user. So the user will modify their habits to make things convenient. For example, writing down their password and stick in under the keyboard.

Next, if you are trying to come up with a solid password management policy, get buy-in from senior managers first and then let the politics of the password pilyc flow down from the top. The 8th layer of the OSI model. If management doesn't support you, it's not going to do any good trying to enforce policy without a hammer behind the fist.

As far as challenge questions go, the question set should be simple but yet not something that other users know about the person - when the questions are presented as a set. For example, I would consider using this set:

What is your favourite colour? (People's hair colour changes - don't use)

What is your mother's maiden name?

What are the last 4 digits of your social security number?

This would be a solid challenge set for regular users who do not have sweeping access to directory/file systems. I would use a different set of challenge questions for network administrators and keep that under wraps just to deter social engineering.

Lastly, if you are creating a security/password policy from scratch, start with tight security and loosen later (rather than loose security and tighten later). Users scream when you take away something, but when you give them something they don't have they are your best friend.

--Mgoddard 11:51, 17 May 2005 (MDT)

Links


Pass Phrases vs. Passwords http://www.microsoft.com/technet/community/columns/secmgmt/sm1004.mspx
Discussion on writing down your password.. http://it.slashdot.org/it/05/05/24/2047228.shtml?tid=172

forgotten password question ideas

What is your shoe size? (too easy to guess?)
What is your inside leg measurement? (do most people know this?)
What is your payroll id?(fairly easy to guess)
What is your favourite colour?
What is your mortgage/rent payment per month?(too personal?)
What colour are your partner's eyes?(not everyone has a partner)
What is your mother's maiden name?
What is your favourite beverage?
What was your high school mascot?
What was the name of your first pet?