New password security rules may surprise users

[Kevin Lancaster]

New password security rules may surprise users

Making all password policies complex doesn’t stop attacks, said the United Kingdom’s government.

 

[Bryn]

Or just use something like LastPass and never worry about passwords again.

 

[Sonic2k]

It might not stop attacks, but it makes it harder.
Using simple passwords makes the time required to launch a successful intrusion orders of magnitude shorter.

 

[psyc]

Or just use something like LastPass and never worry about passwords again.

Until they get hacked again

 

[gregmcc]

Until they get hacked again

They might have been hacked but none of the passwords were exposed.

https://blog.lastpass.com/2015/06/lastpass-security-notice.html/

If you have F2A its even more secure, and now with HSM's the chances of your master password being decrypted is virtually zero.

 

[icyrus]

https://agilebits.com/onepassword

Nothing more to say.

 

[ActivateD]

Or just use something like LastPass and never worry about passwords again.

https://www.blackhat.com/eu-15/briefings.html#even-the-lastpass-will-be-stolen-deal-with-it .

 

[ScottulusMaximus]

Hackers no longer sit there trying to guess single users passwords, they go after the site directly. After that it makes no difference if your password is 1234 or 5up3r-l0ng.,/c0mplicat3dAsFcK

 

[Thor]

Or just use something like LastPass and never worry about passwords again.

This looks pretty nice, how is the free version?

 

[Bryn]

This looks pretty nice, how is the free version?

I don't think there is one. Probably just a trial. It's pretty damn cheap though at $12 a year.

 

[dualmeister]

Dashlane let you store them on your PC.

 

[krycor]

I use 1Password - AgileBites.. no subs, just once off cost for software which i got on special. Pretty much uses iCloud or/& dropbox to sync encrypted store between devices. Supports finger print id etc too and if u want, generated OTP though i prefer having this separate.

PS. if u lose ur pwd for it u kinda ****ed haha. Cool think i like about 1Password is the integration into apps on ios atleast and websites

 

[backstreetboy]

I switched to http://keepass.info/ very capable and does what it needs to. Most of all it's free...

 

[Turgon]

*knock* *knock*

"Who goes there?"

"A brother."

"What's the password?"

"Uh...hold on...let me check with my registered third party password manager"...

-------

Sigh.

 

[Bryn]

https://www.blackhat.com/eu-15/briefings.html#even-the-lastpass-will-be-stolen-deal-with-it .

Those exploits almost certainly rely on users who opt to not have to login to LastPass with every new session. It's not recommended by LastPass and not something I do.

Hackers no longer sit there trying to guess single users passwords, they go after the site directly. After that it makes no difference if your password is 1234 or 5up3r-l0ng.,/c0mplicat3dAsFcK

That's probably true. But at least with a password manager like LastPass, all your passwords are unique. So if one is compromised the others aren't affected. It's the main reason I signed up with LastPass.

*knock* *knock*

"Who goes there?"

"A brother."

"What's the password?"

"Uh...hold on...let me check with my registered third party password manager"...

-------

Sigh.

You'd have to type in a password anyway. At least with a password manager, you have the benefit of one password being able to manage unique passwords for all your sites.

I switched to http://keepass.info/ very capable and does what it needs to. Most of all it's free...

I'm suspicious of free password managers. The amount of technical expertise required on their end is extreme, so how do they manage without charging users?

 

[krycor]

*knock* *knock*

"Who goes there?"

"A brother."

"What's the password?"

"Uh...hold on...let me check with my registered third party password manager"...

-------

Sigh.

It's become basically like encryption keys.. Either you have one on your keychain/Pwc manager or you don't..

 

[kianm]

Can't ask all your users to sign up to lastpass /keypass etc etc. Imagine the look on their faces

 

[Electric]

Or just use something like LastPass and never worry about passwords again.

One of the users here also suggested this until LastPass was breached and all the info was available.

 

[backstreetboy]

One of the users here also suggested this until LastPass was breached and all the info was available.

Show me where user passwords were made available?

 

[Bryn]

One of the users here also suggested this until LastPass was breached and all the info was available.

LastPass has never had encrypted user info become publicly available.