Online Security Overkill and other Idiocy

[RJM62]

I'm wondering if anyone else is getting a bit tired of some of the security hoops users have to jump through on some online sites. One of my credit unions has a site that's a real chore to access.

First, I have to enter my user ID, which is my account number. Because it's not coded as such on the site, however, the browser won't save it.

It's also not the same number as the one on my checks. The checks have some digits added at the beginning and end of the account number, but I can never remember which ones are the extra ones.

Next, I have to answer a random question that they select from the questions they have on file for me. More about that later...

On the next screen, I have to identify a picture as my own.

Then I have to identify a security word as my own.

Finally, after doing all of the above, I can enter my username (which is distinct from my user ID) and my password, and do whatever I went on the site to do -- assuming that I still remember what that was.

Except not always.

If after providing all of the above information, the system detects that I am logging in from a given IP address for the first time, I have to provide yet another security code, which they send as a text message. I found this out after I moved, and I was trying to log in to update my records -- including my new cell phone number.

Luckily, a quick phone call to the credit union (along with answering a couple more security questions) got everything sorted out.

Now, about the online security challenge questions themselves:

When I first established the online account, I had to select about half a dozen questions from a batch of maybe fifteen or twenty that they offered. No two (or more) questions were allowed to have the same answer. Here's a sampling of some of the questions:

• In what city were you born?
• In what city was your spouse born?
• In what city did you attend elementary school?
• In what city did you attend high school?
• In what city did you meet your first boyfriend / girlfriend?
• In what city was your first job?
• In what city did you meet your spouse?
• In what city were you married?
• What is your spouse's middle name?
• What is your spouse's mother's first name?
• What is your spouse's father's first name?
• What is your spouse's birthday (MM/DD/YYYY)?

And some others.


My first criticism: Is is all that unusual for someone to be born, attend elementary and high school, meet their first crush, meet their spouse (more about that later, too), work their first job, and get married -- all in the same city? And is it unusual that someone's spouse would have been born in the same city as the someone in question?

But because no answer can be used more than once, that someone would only be able to select one of the city-related questions.

Now about spouses, isn't it rather stupid to have so many spouse-related security questions?

First of all, information about someone's spouse would seem fairly easy for an identity thief to obtain.

Secondly, what if the person has never been married? Then all the spouse questions are useless.

Thirdly, what if the person has been married more than once? Then all the spouse-related questions require the person to pick a spouse, as it were, and remember which spouse they picked.

I understand that identity theft is a big problem, and that certain steps need to be taken to protect against it. But isn't it getting a little ridiculous when it takes almost as long to log into my account as it would to just drive to the blasted credit union?

-Rich

 

[Mafoo]

The Russian mob, who is incredibly smart and well funded, used to export women for the sex trade. Problem was if they got caught, they went to jail for life. The Russian government doesn't take kindly to people who hurt there own.

So, the mob wised up, and moved to primarily making a living stealing credit cards and bank information. One of the top guys a few years ago go caught, and he spent one month in jail. Seems Russia is less concerned about criminals who steal from the US, and then spend there profits in Russia.

So now they poor hundreds of millions of dollars a year into trying to get your information, and banks spend about the same trying to protecting it.

So, it sucks, but trust me when I say not doing it will suck a lot more.

I spent a few days at a security conference, and when I was done, I wanted to just pull all my money out and put it in my mattress. Some scary effective things going on out there.

 

[poadeleted21]

The security questions are a good way to get your account compromised, ask Sara Palin. Never answer them truthfully. I have an algorithm for answering them if I'm forced to answer them, no, I won't share it. You can thank your elected officials for mandating the security measures. I had to implement the federally mandated security measures for a LARGE credit union. Almost instantly our "unauthorized access" count skyrocketed. The security measures they insisted on were blatantly idiotic and insecure and nobody understood what was going on anyway.

For instance, one of them was the picture, nobody understood that "you're supposed to see the picture you pick every time you come here" so nothing really changed with people succumbing phishing attacks. Then we had this key pad where you entered your "secret key" the problem with this was the keypad was the size of a small island, you could watch what people click on from a mile away. The next facinating thing about the key pad was that the all the characters on it were randomized. Random sounds great in security right? wrong? The problem is that all though they're random, you still have to display all the characters in the "special key" just refreshing the page a sufficient amount of times would pretty much tell you all the characters in the special key, if it was a dictionary based word, name or something like that "wha-la". The bad part about it was, we couldn't change it, we were bound by federal regulations we agreed to, to keep it.

 

[denverpilot]

Online security, is just quite broken, in general. A few organizations have started to offer keyfobs for dual-factor authentication, but those cost them money, and who wants a keying full of the stupid things?

Most corporations already use them. And RSA admitted theirs were compromised last year... By... You guessed it... A cracker break in.

$100 to the cleaning people and you can take down most company networks with a USB key booted on any desktop. Some organizations make an effort to turn off USB ports, but not many.

And the biggest threat to any large datacenter is someone with an access badge who sneaks a super-soaker in under a trenchcoat. Hell, they could just **** on the server being targeted if they're male.

Most of the stories of how bank internal networks really run that I've heard, would curl your toes. There is no accountability or audit meant for them, you see. PCI is for vendors, many of the credit card companies who require it of vendors, can't even pass the PCI audit themselves. Ask 'em sometime. Especially if you're a vendor who has to follow the rules. The answer will be enlightening and embarrassing.

 

[\__[Ô]__/]

I'm wondering if anyone else is getting a bit tired of some of the security hoops users have to jump through on some online sites.

YES!!!
For some of the reasons you mention and many more.

For instance, one of them was the picture, nobody understood that "you're supposed to see the picture you pick every time you come here" so nothing really changed with people succumbing phishing attacks.

Did you tell the user why they were picking a picture?
I had to do that for an old account and the page said nothing about the purpose of the picture. It was the first time i had seen a site do that and there was no explanation of what it was for (at least not that i could find - and i did look). Unfortunately the security of that method depends on the user understanding it. Until i figured out the purpose on my own, it was completely useless.

Assuming people understand the purpose, is there a general flaw in that method?

 

[RJM62]

Online security, is just quite broken, in general. A few organizations have started to offer keyfobs for dual-factor authentication, but those cost them money, and who wants a keying full of the stupid things?

Most corporations already use them. And RSA admitted theirs were compromised last year... By... You guessed it... A cracker break in.

$100 to the cleaning people and you can take down most company networks with a USB key booted on any desktop. Some organizations make an effort to turn off USB ports, but not many.

And the biggest threat to any large datacenter is someone with an access badge who sneaks a super-soaker in under a trenchcoat. Hell, they could just **** on the server being targeted if they're male.

Most of the stories of how bank internal networks really run that I've heard, would curl your toes. There is no accountability or audit meant for them, you see. PCI is for vendors, many of the credit card companies who require it of vendors, can't even pass the PCI audit themselves. Ask 'em sometime. Especially if you're a vendor who has to follow the rules. The answer will be enlightening and embarrassing.

That's why I stopped hosting e-commerce sites. I can get a server into PCI compliance (or host the checkout on a bank site or PayPal), but that doesn't really relieve me of liability. Because of the scattergun approach taken by litigators, I could easily find myself in court defending myself against a client's bad or stupid acts, over which I had absolutely zero control, such as their saving their gateway passwords in a file named "passwords.txt" on their desktops.

You can build as much security into a server / site as you like. It's more tedious than difficult. Building dumbness out of humans isn't as easy.

Here's another example. The place where I live doesn't have route carrier mail service. Everyone has a P.O. box, and mail sent to our 911 (street) addresses will be returned to sender as undeliverable. The proper way to address mail to me here is to put the physical address as the first line, and the P.O. box as the second line.

Because of a problem at USPS, both the first and second lines are being "corrected" to the P.O. box when a bank or other company does a USPS verification. This causes the verification to fail, of course, for companies like banks and credit unions that are required to obtain a physical address.

In almost every case, I have been able to call the companies involved and explain the situation over the phone, and they've been able to override the USPS verification process and change my address. Sounds like good customer service, except that none of the companies involved went to any great lengths to verify my identity before making the changes.

The one exception among financial companies was PayPal. When I explained the situation to PayPal, they told me that I would have to do two things. The first was that they would send me a code by mail to my P.O. box that I would then have to enter on their site, just to prove that I could receive mail there so they could send me my debit card, 1099s, etc.

The second step would be to verify my physical address for Homeland Security purposes, which I could do by several methods, the easiest of which was to link a credit card from a bank or credit union that already had the address information on file.

Another exception was a pharmacy that I use which usually will not ship to P.O. boxes. They also required verification that I couldn't receive mail at my street address, and provided several options. The easiest was to obtain a letter from the postmaster of my local Post Office, who apparently is accustomed to this sort of thing and has a letter template that he uses.

Other than PayPal and the pharmacy, no one else bothered to require that I verify the information I gave them over the phone. They all cheerfully overrode the USPS verification process for me. Now on the one hand, that was a good thing because the USPS database was wrong, in my particular case. But in another way, not so much, because some guy in Brighton Beach named Igor or Boris could just as easily have done the same thing.

So again, it's easier (if tedious) to build security into a site than it is to build it into humans.

-Rich

 

[Dr. O]

Numb nuts coding geeks are the worst... The more complicated and obtuse it is, they get off on it..
My one S&L has it very simple, just the acct # and a password - any password, even a single letter...
You can wire transfer all the money in the world into the account...
Not enough security, you say?
Well, the kicker is there only two ways to withdraw money -
1. present yourself to the counter with photo ID
2. call on the voice phone and have a check mailed to your registered address...

Manager says they have not had even a single act of hacking...
works for me...

 

[Mafoo]

Numb nuts coding geeks are the worst... The more complicated and obtuse it is, they get off on it.

Not sure what developers you have been around, but as one, I can speak for myself, and everyone I know with respect to this:

The two things we hate the most in development, is writing documentation, and dealing with security.

In that order

 

[Sac Arrow]

Online security, is just quite broken, in general. A few organizations have started to offer keyfobs for dual-factor authentication, but those cost them money, and who wants a keying full of the stupid things?

Most corporations already use them. And RSA admitted theirs were compromised last year... By... You guessed it... A cracker break in.

$100 to the cleaning people and you can take down most company networks with a USB key booted on any desktop. Some organizations make an effort to turn off USB ports, but not many.

And the biggest threat to any large datacenter is someone with an access badge who sneaks a super-soaker in under a trenchcoat. Hell, they could just **** on the server being targeted if they're male.

Most of the stories of how bank internal networks really run that I've heard, would curl your toes. There is no accountability or audit meant for them, you see. PCI is for vendors, many of the credit card companies who require it of vendors, can't even pass the PCI audit themselves. Ask 'em sometime. Especially if you're a vendor who has to follow the rules. The answer will be enlightening and embarrassing.

So what are your recommendations?

 

[poadeleted21]

Not sure what developers you have been around, but as one, I can speak for myself, and everyone I know with respect to this:

The two things we hate the most in development, is writing documentation, and dealing with security.

In that order

100% agree but you forgot #3 : designing web pages/GUIs

 

[poadeleted21]

So what are your recommendations?

Without going into details, I've done some legit and some umm.. borderline security audits. By far the easiest way to get into a system is to trick/pay off an idiot, it's not that hard to do, especially when there's a sufficiently large pool of idiots. The weakest link is always going to be a human. I had one company offer to pay me to break in with a bonus if I was successful, I said "get ready to fire someone", they wouldn't let me proceed since they were thinking "exploits to our apache server". I replied "why would I try to discover a zero day exploit on your patched apache server, when I can just call your empoyees and ask?" As my Human Computer Interaction teacher used to say: "Never design software to be idiot proof, society will produce a better idiot" Online security hasn't heeded that warning. P.S. I can't wait till CAPTCHA along with "Security Questions" die a horrible death. There are good way to implement security, but thanks to AOL your average computer user would be too dumb and lazy to figure it out and it only takes one idiot to say "here you go" with his credentials, whatever they might be to screw it all up. Even finger prints and retina scans are't secure.

 

[denverpilot]

So what are your recommendations?

Cash still works, but it's inconvenient. Ha.

 

[denverpilot]

I took a network security course taught by an ex-NSA guy (if there is such a thing). Once he demonstrated that anyone will answer anything over the phone with the right words given, I realized most of this stuff doesn't matter. Patch machines to generally keep up with vendor patches and know without a shadow of a doubt that the lowest paid person in the company will sell you out for a car payment.

 

[poadeleted21]

I took a network security course taught by an ex-NSA guy (if there is such a thing). Once he demonstrated that anyone will answer anything over the phone with the right words given, I realized most of this stuff doesn't matter. Patch machines to generally keep up with vendor patches and know without a shadow of a doubt that the lowest paid person in the company will sell you out for a car payment.

Google's methods for security seem rather "well duhh" but nobody seems to be implementing them. They have more of a heuristic reactionary based approach to minimize damage AFTER it happens. Where most security infrastructures I see are "Build a brick wall and assume no one can penetrated it". Then it takes weeks, months or even years to detect a breach, patch it up, then go back to the same mentality. OTOH The current "self auditing" system I'm currently dealing with, just alerts 80000000 people everytime some China based bot tries to malform a URL and I get 79999999 people emailing me wanting to know "What was compromised". My response is usually "My Inbox".

 

[Mafoo]

100% agree but you forgot #3 : designing web pages/GUIs

Yea.. that's a close third. I think I blocked that one out, due to tramma.

 

[Mafoo]

I took a network security course taught by an ex-NSA guy (if there is such a thing)...

These guys are not human.

Quick story....

I used to be the System Administrator for a department at the Air Force Research Laboratory at Kirkland AFB. I got a call telling me that in a few weeks, a NSA guy is going to come review the security on the Unix boxes with me. So I made sure everything was up to snuff, so when we sat there and logged in, he would at least realize I knew what I was talking about.

Well a few weeks later he comes in from Washington, shakes my hand, and asks if there is an office we can sit and talk in. I asked if we needed to get on the computer, and he said nope, just an office.

So we go sit in one of the nice conference roomes, and he reaches into his briefcase, and pulls out a 3 ring binder with about 50 pages in it. He said here are all your security holes. He had everything about my system already, and he had done it from Washington the day before. In order to get to these files, he needed to go through a base firewall, AFRL's firewall, my firewall, and then bypass the security on my boxes. He has a list of all the weak passwords, and how to fix it so they were not so weak. All the patches I needed to get, and where to get them. All the file permissions I needed to fix, and what I needed to set them too, and so on.

At the end, I asked him "If I did all this stuff, would it had prevented you from obtaining this report from Washington?" He chuckled and said no.

He shook my hand, we said our goodbyes, and I immediately went to my Unix boxes looking for any evidence in the log files that he had been on my system. There was nothing. I called both Base security, and AFRL security, and asked them if they saw anything abnormal in the last 48 hours. They both said no.

All I can say, is I am glad they are on our side

 

[Sac Arrow]

These guys are not human.

Quick story....

I used to be the System Administrator for a department at the Air Force Research Laboratory at Kirkland AFB. I got a call telling me that in a few weeks, a NSA guy is going to come review the security on the Unix boxes with me. So I made sure everything was up to snuff, so when we sat there and logged in, he would at least realize I knew what I was talking about.

Well a few weeks later he comes in from Washington, shakes my hand, and asks if there is an office we can sit and talk in. I asked if we needed to get on the computer, and he said nope, just an office.

So we go sit in one of the nice conference roomes, and he reaches into his briefcase, and pulls out a 3 ring binder with about 50 pages in it. He said here are all your security holes. He had everything about my system already, and he had done it from Washington the day before. In order to get to these files, he needed to go through a base firewall, AFRL's firewall, my firewall, and then bypass the security on my boxes. He has a list of all the weak passwords, and how to fix it so they were not so weak. All the patches I needed to get, and where to get them. All the file permissions I needed to fix, and what I needed to set them too, and so on.

At the end, I asked him "If I did all this stuff, would it had prevented you from obtaining this report from Washington?" He chuckled and said no.

He shook my hand, we said our goodbyes, and I immediately went to my Unix boxes looking for any evidence in the log files that he had been on my system. There was nothing. I called both Base security, and AFRL security, and asked them if they saw anything abnormal in the last 48 hours. They both said no.

All I can say, is I am glad they are on our side

Do you think there is a possibility he may have been bull****ting you?

 

[Mafoo]

Do you think there is a possibility he may have been bull****ting you?

About what? He had all the info about my systems in his hand. It was too new to be from weeks ago.

I guess he could have broken into my office the night before, but he is a computer geek. Not someone who deals with physical security.

Also he would have still needed to logon, and then I still should have seen some traces.

I still to this day, have no idea how he did it.

 

[Sac Arrow]

About what? He had all the info about my systems in his hand. It was too new to be from weeks ago.

I guess he could have broken into my office the night before, but he is a computer geek. Not someone who deals with physical security.

Also he would have still needed to logon, and then I still should have seen some traces.

I still to this day, have no idea how he did it.

I'm just saying, governmental cookie cutter UNIX box, 50 pages of generic bull****, not saying he didn't hack through your three firewalls but have you actually read through the 50 pages of info to see if it actually was you?

 

[Anymouse]

It's been a bunch of years since I've been in the IT world, however I did notice a trend developing before I left the industry. As users were required to have more complicated passwords, and change them more often, they became harder to remember. Of course, it was a hassle to call the help desk to reset the password, so the users would simply scribble down the new password and have it easily accessible. Sometimes, you'd actually see it on a post-it stuck to their monitor.

Gotta love the increased security.

 

[Mafoo]

I'm just saying, governmental cookie cutter UNIX box, 50 pages of generic bull****, not saying he didn't hack through your three firewalls but have you actually read through the 50 pages of info to see if it actually was you?

Yea. That's why he was there. We went over every line in the document. There was nothing cookie cutter about it.

And the Unix box was mine. I set it up, and maintained it how I saw fit. That was not cookie cutter either.

 

[denverpilot]

I believe the story. It took the guy who taught the class 10 minutes and a phone book, to "break" into a webserver. This was years before Schnier's "Secrets and Lies" which opened a lot of people's eyes.

Two of the smartest people I have known besides him were contractors to them. Still "outsiders" and from what I know of their work, the "insiders" must be freaks of intelligence. (Pun possibly intended? )

I too, am glad they're on our side, but I'd love to know how we prove that they really are. Decide to go up against the US Government and Citizen or not, they're not on "your" side anymore, that's for sure.

I'm both concerned and pleased that they're behind the largest effort in illegal spying on Citizens. That kind of power can so easily be abused.

 

[EppyGA]

It's been a bunch of years since I've been in the IT world, however I did notice a trend developing before I left the industry. As users were required to have more complicated passwords, and change them more often, they became harder to remember. Of course, it was a hassle to call the help desk to reset the password, so the users would simply scribble down the new password and have it easily accessible. Sometimes, you'd actually see it on a post-it stuck to their monitor.

Gotta love the increased security.

Bingo!

 

[John Baker]

I have several bank accounts one with a small bank, Pacific Western Bank, and the other with San Diego County Credit Union. I don't like the credit union because calling them on the phone is a major hassle working through their automated answering system, it takes a good five minutes or so to talk to a human, assuming you make no mistakes on your key pad. I like them because it is a breeze to access my account on line.

I like the bank the best because they answer their phone, no automation whatsoever other than music on hold, a place they very rarely put me. I don't like them because it is a major ***** getting into my account on line. It requires going through several pages, answering the phone, and being ready to write down a six digit access code, entering it, then going through another few questions before getting into my account. This is another five or so minute ordeal assuming no mistakes are made.

I still use the bank as my primary account though simply because they answer their phone. If I'm out shopping and need money transfered, it only takes a couple of minutes with the bank. It's about ten or more minutes with the credit union.

-John

 

[comanchepilot]

Security questions are silly. If they let me put anything in I have my own personal nonsense word that I use. Has no relationship to anything and only my old RIO would get it. And he passed about 10 years ago. I called for a password reset in an account opened years ago with an old email address and needed to use my nonsense world to the question what was your first pets name.

NEVER NEVER USE REAL WORLD ANSWERS to these questions for anything that contains any personal information.

 

[genetk44]

When the security nonsense gets too onerous I close my account and move to another bank. I don't appreciate companies that are making money out of me making me work too hard for the privilege .....

 

[weilke]

I still to this day, have no idea how he did it.

Using the various back-doors the manufacturers provide to NSA in order to be left alone.

 

[denverpilot]

The Oatmeal (web cartoon) pointed out a while back that just asking someone to type a random sentence would be a better password than all of the random letter/number/character schemes. People could remember it, and a long sentence has more entropy and can easily be typed by a touch-typist.

Limiting password fields to a small number of characters and all the combinations of characters and numbers actually makes them more easily brute-force "guessed" by algorithms and machines.

If my password was "I had a totally kick-ass time at Gastons this year!" even though it's an obvious thought to many friends and acquaintances, they'd never be able to type it the exact way I would nor really guess it. Make it a random thought like, "Those Unicorn commercials for that casino are retarded." and it'd never be broken, but I'd never have to write it down or have trouble remembering it.

Random character/number/symbol passwords and personal questions LOWER security. Passphrases made up of sentences and thoughts would be far far better. Not that hard to code, either.

 

[weilke]

I have accounts for a number of goverment websites, each with their own set of oddball requirements and on a different rotation schedule. The biggest vulnerabiity is the masster password list I have to maintain as a result.

 

[masloki]

I have accounts for a number of goverment websites, each with their own set of oddball requirements and on a different rotation schedule. The biggest vulnerabiity is the masster password list I have to maintain as a result.

That is my biggest peeve with website passwords right now. Whether it requires caps, numbers or special characters, and length limits. Drive me bonkers when it is limited to 8 chars, but no specials, and must have a a number and a cap. Nope, still insecure!

Nate is right, as passwords can't be brute forced in a practical amount of time once they start getting over 12 characters. Where "practical" is defined in the financial sense; all bets are off when it is personal or otherwise.

 

[weilke]

Nate is right, as passwords can't be brute forced in a practical amount of time once they start getting over 12 characters. Where "practical" is defined in the financial sense; all bets are off when it is personal or otherwise.

'Brute force hacking' of passwords is a mathematical game, not a real security threat for anything beyond a 4 digit PIN. Ever since someone figured out to lock out an account after 5 incorrect tries, this has ceased to be a threat. Passwords are compromised, usually through theft by insiders or intercepted communications, once someone has your password for 'cheapflowersbymail.com' it doesn't matter whether it contains '1 cap, 2 numbers and a special but not more than 8 characters' or whether it is the name of your pet.

 

[flyingcheesehead]

The Oatmeal (web cartoon) pointed out a while back that just asking someone to type a random sentence would be a better password than all of the random letter/number/character schemes. People could remember it, and a long sentence has more entropy and can easily be typed by a touch-typist.

They're not the only ones... XKCD did one too:



Alt text: "To anyone who understands information theory and security and is in an infuriating argument with someone who does not (possibly involving mixed case), I sincerely apologize."

 

[denverpilot]

I was remembering the XKCD one. Thanks Kent. Wasn't The Oatmeal.

 

[flyingcheesehead]

It's been a bunch of years since I've been in the IT world, however I did notice a trend developing before I left the industry. As users were required to have more complicated passwords, and change them more often, they became harder to remember. Of course, it was a hassle to call the help desk to reset the password, so the users would simply scribble down the new password and have it easily accessible. Sometimes, you'd actually see it on a post-it stuck to their monitor.

Gotta love the increased security.

Ugh. No kidding. I have a relative who shall remain unnamed who works for a government agency where they are required to log in to several different systems. Along with the standard password complication rules, they're not allowed to have the same password on more than one system, they must change their passwords every 90 days, and they're not allowed to ever use a password they've used before. And yes, these policies are enforced by their security software.

EVERY SINGLE COMPUTER that I saw there has all the passwords on post-it notes on their monitors. Only the TSA would think that's secure.

 

[flyingcheesehead]

Oh, and my latest security beef: LinkedIn's captcha system. I recently tried to log in and after a dozen tries I couldn't make it past the captcha. Sheesh.

 

[Capt. Geoffrey Thorpe]

Oh, and my latest security beef: LinkedIn's captcha system. I recently tried to log in and after a dozen tries I couldn't make it past the captcha. Sheesh.

Captcha - No kidding.

I tried to create a microsoft account to comment on how to remove some browser hijack / popup malware (ilivid and/or yieldmanager (all the other things people had suggested didn't work - what did work was a system restore from a date before it showed up )) but I gave up.

And, of course, how much real security is there when one wrong click can install purd near any malware that is out there? I have no idea how / what I did. (Microsoft Security Essentials, Ad-aware, Malware Bytes, and Spyware Terminator all let it slide)

 

[Skylane81E]

I hated when I had to "lock" my school issued laptop to prevent the IT nazi from deleting my files after he broke into my locked locker and stole it during lunch (happened to a lot of classmates unfortunately)

My pass code became common words encrypted via a code I came up with using the keyboard as a key. This was important because we were INSTRUCTED to keep a sheet of paper with all our passwords on it in the bag with the computer!

A friends solution was even better however. Realizing the IT guy typed by hunt and peck he simply jumbled the keys on the computer

 

[Ghery]

EVERY SINGLE COMPUTER that I saw there has all the passwords on post-it notes on their monitors. Only the TSA would think that's secure.

Reminds me of walking out of a secure Navy facility one day and seeing the post-it note by the door with the new cypher lock combination that was to go into effect the next day. I was a visitor and had no need to know that combination. I had a great conversation with the security officer the next day.

 

[Mafoo]

My favorite security technique I have used in the past works as follows:

You walk into the data center you need to login to, sit at a terminal, and type in a password. For this example, let's say the password was "Apple"

You then install some software on your computer from the It shop.

When you want to login, it asks for your user name, you enter it, and then it displays a word. That word might be "House".

So you enter into the software program you got from the data center the word House and Apple, and you will get something back. Let's say what you get back is "Bike".

This is your one time use password. You enter Bike, and your in. Next time you login, it will give you a new word, and you need to respond with a new word.

What I really like about this, is your password "Apple" never goes across the wire, and even if someone found the key pair combos that have been going back and forth, there is no way to predict the next one.