<?xml version="1.0" encoding="UTF-8" ?>
<rss version="2.0" xmlns:s="http://www.techrepublic.com/search" xmlns:dc="http://purl.org/dc/elements/1.1/"  xmlns:atom="http://www.w3.org/2005/Atom">
<channel>
    <title><![CDATA[Discussion on Like Passwords for Chocolate, coming soon to a security theater near you ]]></title>
    <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412]]></link>
    <atom:link rel="hub" type="application/rss+xml" href="http://pubsubhubbub.appspot.com/" />
    <atom:link rel="self" type="application/rss+xml" href="http://www.techrepublic.com/forum/discussions/102-344412/rss" />

    <description><![CDATA[]]></description>
    <language>en-us</language>
    <lastBuildDate>2013-06-19T22:01:05-07:00</lastBuildDate>
             

    <item>
        <title><![CDATA[depends on the sysadmin]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3452237]]></link>
        <description><![CDATA[I, for one, wouldn't give up others' passwords just for filthy lucre.  I'm weird, though.On the other hand, don't trust me to hold up to torture.  Instead, trust technology -- and you can trust me to prefer technology that keeps your password save so I don't have to.  If I use a system that doesn't give me access to users' passwords, it doesn't matter whether I'm tortured or not; I still don't know anyone else's password.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3452237]]></guid>
        <dc:creator><![CDATA[apotheon]]></dc:creator>
        <pubDate>Wed, 18 May 2011 13:39:39 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[cracking passwords, cracking applications, and walking through a doorway]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3452253]]></link>
        <description><![CDATA[When cracking something, you overcome technical hurdles -- measures meant to deny access.By way of analogy, one does not crack the combination for one's own bicycle lock; one just knows it to begin with.  Someone cracking the combination might sit there with his or her ear pressed to the lock listening for the movements of tumblers.  If someone puts a sticker on the lock with the combination written on it, though, the act of cracking the combination is not necessary.Cracking the lock, rather than its combination, is a way to get around the need for a combination by exploiting some weakness in the design of the lock itself.  Having an administrative interface by which one can read passwords is like knowing the password in the first place; having to download a password file and run an offline brute force attack is cracking the password; exploiting a vulnerability in the application so you don't need the password at all to do whatever you like is cracking the application.Hmm.  In some respects, I suppose this means that using MS Windows means nobody ever cracks your security.  People just walk right in, because there aren't any prohibitive technical measures to speak of, just like someone leaving the bicycle lock unlocked all the time.  (I kid -- sorta.)]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3452253]]></guid>
        <dc:creator><![CDATA[apotheon]]></dc:creator>
        <pubDate>Wed, 18 May 2011 13:34:38 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[the difference: one sysadmin]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3451942]]></link>
        <description><![CDATA[Only a rogue sysadmin would compromise your password without having to crack it. (they &quot;just have access to it&quot;) Anyone else would be cracking in the blind, starting with trying to find the hash in the first place.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3451942]]></guid>
        <dc:creator><![CDATA[pgit]]></dc:creator>
        <pubDate>Wed, 18 May 2011 06:34:03 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[hadn't though of that weak link]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3451941]]></link>
        <description><![CDATA[What would it take to bribe a sysadmin into coughing up passwords? They'd have to cover tracks extremely well, but ultimately a car, tropical vacation or equivalent would probably do.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3451941]]></guid>
        <dc:creator><![CDATA[pgit]]></dc:creator>
        <pubDate>Wed, 18 May 2011 06:31:06 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[You probably know what you are talking about]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3451860]]></link>
        <description><![CDATA[So, enlighten me.Please explain in more detail the difference between &quot;cracking&quot; a password and &quot;just have access to it&quot;.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3451860]]></guid>
        <dc:creator><![CDATA[santeewelding]]></dc:creator>
        <pubDate>Tue, 17 May 2011 21:23:38 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[hmm]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3451819]]></link>
        <description><![CDATA[If admins can see your passphrase because it's stored in plain text or they have decryption keys, they haven't cracked your password; they just have access to it, which is a completely different type of vulnerability than something easily cracked.  Also . . . if those admins are trustworthy, and their servers are well secured, the complexity of your password still matters for  others who might want to try to crack it.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3451819]]></guid>
        <dc:creator><![CDATA[apotheon]]></dc:creator>
        <pubDate>Tue, 17 May 2011 20:50:35 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[That can help.]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3451843]]></link>
        <description><![CDATA[Scare tactics like that can certainly help get the point across.  Of course, it would be better to somehow get them on  your side -- but failing that, appealing to their desire to look out for their own side can be a passable fall-back.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3451843]]></guid>
        <dc:creator><![CDATA[apotheon]]></dc:creator>
        <pubDate>Tue, 17 May 2011 19:07:51 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[That's a different problem.]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3451808]]></link>
        <description><![CDATA[The chocolate example shows that people don't value the security of their passwords above the cost of getting a bar of chocolate.  The Milgram experiments show that assuming a mantle of authority can also get you passwords -- but if people care about the security of their passwords, they can be  trained to resist false claims of authority, even if only by setting a more verifiable claim of authority up as a shield against such claims.In short, defending against false claims of authority for passwords is more likely to succeed if approached intelligently than defending against someone not caring enough about you to resist an immediate impulse for chocolate.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3451808]]></guid>
        <dc:creator><![CDATA[apotheon]]></dc:creator>
        <pubDate>Tue, 17 May 2011 17:49:41 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[I use an approach that seems to work for most users.]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3451631]]></link>
        <description><![CDATA[I got tired of fighting the ones that always write their password down by simply doing this.I ask them if they enjoy their job or would they rather get fired when the following happens.Someone finds your password, and they remember you did something, or at least they think you did something that they want to teach you a leason. So they login to your email account, send the CEO a very descriptive letter of what he can do to himself. It is your mail, you can't point the finger at anyone else, so you can bet your job is in deep doodoo.That has opened the eys of those that could not grasp the importance of protecting their password.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3451631]]></guid>
        <dc:creator><![CDATA[jdriggers@...]]></dc:creator>
        <pubDate>Tue, 17 May 2011 08:53:41 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[no such thing]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3451604]]></link>
        <description><![CDATA[as an uncrackable pass phrase. Ever made a 'forum' account on the internet? The administrators for the forum can click on your name and see your log in password, and your email address. If you use the same password for your email as you do for you forum........ you're compromised. It doesn't matter if your password is 'cat' or 'ChcaHaoHcaUio93408934789023849023x1000']]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3451604]]></guid>
        <dc:creator><![CDATA[Rayezilla]]></dc:creator>
        <pubDate>Tue, 17 May 2011 08:29:19 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[You don't need chocolate.]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3451546]]></link>
        <description><![CDATA[Look up the famous Milgram experiments on authority and conformity.  You can bet money that roughly 65% of the time, someone will divulge a password just because a perceived authority figure told them to do it - no chocolate necessary.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3451546]]></guid>
        <dc:creator><![CDATA[lshanahan]]></dc:creator>
        <pubDate>Tue, 17 May 2011 05:24:37 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[sunburns]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3451312]]></link>
        <description><![CDATA[I got one in 1971 or so, but went to work, to avoid getting in trouble.  I was stationed at McConnel AFB in Wichita and had gone to Fall River Reservoir for a day or so and was in the water too long.  The military is a little different than just a civilian employee of the Governement or a civilian company.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3451312]]></guid>
        <dc:creator><![CDATA[dhays]]></dc:creator>
        <pubDate>Mon, 16 May 2011 09:34:55 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[passwords]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3451322]]></link>
        <description><![CDATA[Too many different formats, and we will be going to using our Smart Card ID, so id someone gets ahold of my ID, who needs a password, except for the 8 characters assigned to it by me?  I just changed my password to a DOD library last week, no repeats for 24 times, at least 15 characters in length!  Some systems require an 8 character password, no repeated, upper and lower, numbers in the middle, but the other one requires 8 characters, don't have to have upper and lower case.  Our network requires U/L, special, numbers, some sites cannot have spaces, some can,  Some can be any length up to 256 characters, others 8, 8-15, 15 or more... Some ar egood 90 days, some 180 days, some no time limits.  How does one figure out passwords for these types of systems?  Sites such as Tech Republic, TV stations, newspapers...do not have time limits on their access passwords.  My password manager is an Ms Excel Spreadsheet, protected by a password.  6 pages of them, and that is after some sites have been removed.  I have never used any other.  Don't know how either.  Really don't want to mess with one.  It would be nice if all places requiring passwords, work and public, would have the same rules for fromats of passwords, whether one password is used for everything or not.  We are required to take security training every year to remind us about not leaving things unsecured as I have done a couple of times today already.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3451322]]></guid>
        <dc:creator><![CDATA[dhays]]></dc:creator>
        <pubDate>Mon, 16 May 2011 09:26:48 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[exactly]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3450890]]></link>
        <description><![CDATA[The sunburn example is a good demonstration of the principle I meant to describe.The trick is to give employees a sense of ownership over the value the data provides without encouraging employees to act in a manner inconsistent with the company's aims because of a jealously possessive attachment to the data.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3450890]]></guid>
        <dc:creator><![CDATA[apotheon]]></dc:creator>
        <pubDate>Fri, 13 May 2011 14:13:58 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Destruction of government property for soldiers who get sunburns off duty.]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3450864]]></link>
        <description><![CDATA[You can also worry about data ownership going too far the other way.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3450864]]></guid>
        <dc:creator><![CDATA[bboyd@...]]></dc:creator>
        <pubDate>Fri, 13 May 2011 12:17:29 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[the multiple password problem]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3450858]]></link>
        <description><![CDATA[&gt;  I do not know what kind of security TechRepublic has in place (no offence, this would just be an example).   Lets face it, if you must provide and eMail address before getting onto some sites they just put you on their spam list. To be fair, that's not  always   Now others want you toYour complaints about differing password policies are exactly the sorts of problems that password managers are meant to address.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3450858]]></guid>
        <dc:creator><![CDATA[apotheon]]></dc:creator>
        <pubDate>Fri, 13 May 2011 12:07:35 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Can you imagine the spam...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3450849]]></link>
        <description><![CDATA[that anonymity in posting here would allow.Still won't trust my low grade password here to match any other PW elswhere.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3450849]]></guid>
        <dc:creator><![CDATA[bboyd@...]]></dc:creator>
        <pubDate>Fri, 13 May 2011 12:04:33 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Depends on the user]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3450772]]></link>
        <description><![CDATA[I consider myself very security aware and it is extremely difficult to practice best policies. I must have 40 to 50 ids and passwords between work and personal. I do not set up accounts the same way for every web site. For example, I do not know what kind of security TechRepublic has in place (no offence, this would just be an example). My bank should have better controls and safeguards in place if for no other reason than there are mandated regulations and controls... so I will not use the same id and password for both of these. This is based on the assumption that if TechRepublic does not have appropriate safeguards the user id and password will not work for my bank. So I have different levels of security and some of the multiple ids is self-imposed. But every time you need to create an account there is also a different set of rules for both Id and password. There is the eMail account id... again I have a work eMail and a couple personal. One personal for my use and a second that it kind of a garbage account. Let???s face it, if you ???must??? provide and eMail address before getting onto some sites they just put you on their spam list. Now others want you to use account number, or you create a name or they give you a user id and then there are the passwords or pin or even both! Must start with letter, must be numeric, must have special characters, cannot support special characters, limited to 8 characters, must be more than eight. How about select a picture so that you are sure it is the authentic site? Or better yet I have 4 accounts that you must get back to and change your password every 60 days or it expires. One of these must be more than 10 characters, include at least one numeric, special and uppercase without more than 2 repeating characters! And of course the passwords cannot be reused. And one of the other 4 that change all the time is limited to 8 characters so I can???t even use the same password for all four every 60 days. The industry is a mess.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3450772]]></guid>
        <dc:creator><![CDATA[VirtualPro]]></dc:creator>
        <pubDate>Fri, 13 May 2011 09:12:39 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[another one]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3450762]]></link>
        <description><![CDATA[I take it you're another one of those who did not bother reading the article very closely and following a couple of links that the article specifically describes as addressing that sort of problem.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3450762]]></guid>
        <dc:creator><![CDATA[apotheon]]></dc:creator>
        <pubDate>Fri, 13 May 2011 08:49:15 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[disagreement noted, but not convincing]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3450748]]></link>
        <description><![CDATA[&gt;  Password managers help (and I use one) but even the best ones are not that easy to use and do not necessarily work everywhere.My password manager setup works great for everything except a couple of specific cases, such as remembering the password used to access the password manager.  Of course, the situation is somewhat less conducive to easy use on MS Windows, and if that's the OS you have to use, I guess you're likely to think password managers are not as nice as I do -- but that's a separate problem.  With a good password manager on a good OS, they're eminently usable.. . . and yes, much of the problem is that people don't care.  If they did, they'd find a way to make it work, given all the tools that are available to them.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-344412-3450748]]></guid>
        <dc:creator><![CDATA[apotheon]]></dc:creator>
        <pubDate>Fri, 13 May 2011 08:47:42 -0700</pubDate>
    </item>
    </channel>
</rss>

