Comments on: Neilsen on password security vs usability

By: Clive Robinson

Clive Robinson — Mon, 26 Oct 2009 06:29:02 +0000

There are a couple of problems with client/container certificates.

The first is “tracability”, the second is “context and roles”.

Both arise from the “geek think” technical solution to human problem issue (which is where passwords originated from).

The saying “on the Internet nobody knows your a dog” makes the average person think they have the ability to be anonymous however in reality the Internet does not care if you are a dog or not only if you are a “good dog” or a “bad dog”.

But humans like cut jems have many sides to them and all give a different perspective.

Humans have many different aspects to them

1, proffesional
2, work
3, social
4, family
5, spouse

And many of us actualy keep these areas of our lives seperate out of self protection. Further we break these down into sub groups.

In Face to Face (F2F) off-line communications most of us automatical assume a “context” within which we have a “role” at the time. We give them names such as “proffesional manner”, “loving parent”, “devoted spouse”, etc.

If you use the wrong “role” in a given “context” you commit an error or “gaff”.

As humans we have a myriad of informal protocols to let others know they are commiting a gaff in a F2F context. Usually gaffs are mildly embarising fairly quickly resolved and forgoton, unless they are repeat offenders in which case they tend to be rejected by others in that context (it should be noted that “geeks” tend to have ASD and cannot see the contexts or respond to the subtal protocols).

One joy of the Internet is it “never forgets” and has a habit of “remembering” “inconveniant statments” and “embarising behaviour”.

Another is it is relativly easy to search so such “inconveniant statments” or “embarising behaviour” that are on-line are easy to find if they can be linked to an individual (traceability).

There are other issues with the Internet in that it has no notion of context or roles, and importantly it is not only “broadcast public” but permanently so. And as such there is no place to hide, not just currently but from your past as well.

We have all seen or heard people being interviewed on TV get asked about their past views. Often the snipet used is taken out of context and used as a “political tool”

A client certificate is a sure fire way to link even suposadly “anonymous” comment back to a persona.

Therefore we need not client or container certificates but role certificates, and the tools to handle them correctly.

Otherwise in just a few years certificates will be just as discredited as passwords are.

By: AbiusX

AbiusX — Tue, 13 Oct 2009 15:29:29 +0000

@Wireghoul
But there’s a trade-off among simplicity and security there, And I bet users would rather cut their own head’s off than to have passwords like these remembered and actually used in different scenarios, including the point that both the meta and data are not directly related to themselves!

I think using a password manager here with a complex 20 char or 12 char mixture works best, and thats what me and my guys are using and suggesting to other people,

BTW tnx for the follow up.

By: Wireghoul

Wireghoul — Sun, 16 Aug 2009 02:30:40 +0000

@AbiusX
Sorry for the late follow up…
Well I explicitly said from a brute force perspective. In the other end my long passwords usually consist of a sentence that containa 8+ character complex password. A silly example would be setting my password to:
“to access my email I enter #eXgp6)Q”
quotes included, and if I advice others I usually recommend combining their normal password with a street address or email address not directly related to them and add some meta, ending up with something like;
abc123!6 Johnson Place,55123,Wisconsin

Neither ones are particularly weak to dictionary attacks.

By: AbiusX

AbiusX — Wed, 01 Jul 2009 21:29:16 +0000

and to Wireghoul, try http://www.passcracking.com to see how long-easy-to-remember-password s do! Its not about brute-force at all. Your 5 letter pass would take a zillion years on brute-force, since only stupid systems allow you to brute-force them!

Take a peek at Hellman’s Time Memory Trade-off for more info.

By: AbiusX

AbiusX — Wed, 01 Jul 2009 21:27:09 +0000

Hi there, I strongly agree. Had a presentation about 2 years ago about passwords and people loved it. I think less than 1% of people use Password Managers (i do) and i think those aint good as well, since you’ve got to have them on your PDA or always carry them around on your notebook.

My solution is, every entity should have a digital certificate assigned with himself, somewhere around, and have its counter-part in a token or on a secure space accessible everywhere, and access that storage with a password:D

By: Wireghoul

Wireghoul — Mon, 29 Jun 2009 11:20:58 +0000

I commented on the appsec street fighter blog as well.
Password complexity is meant to make the passwords harder to brute force, yet password length far outlast complexity and there is no reason you cannot have a simple yet long easy to remember password.