Security

Ask something
Discussion Locked

How do you manage passwords?

0 helpful
17 replies

by choppit 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

There's always plenty of emphasis on creating strong passwords, but how do you actually manage your passwords?

Do you assign a unique password to each device (router, switch, server, local user account etc), give every device the same password, or perhaps assign passwords by groups of devices?

How do you store passwords so that they're available to those that need to know, but secure from those who don't?

17 replies

by tbragsda

.
Personaly, all routers etc have one password. It is changed when people leave that know it.

Admin passwords, one for NDS, NT etc, when people leave blah blah.

So, yes its by device type, or app type, but I do use a home grown passgen app. I use it most for initial password, and temp accounts and VPN. You put in the username, and it spits out 983A21F etc. Reproducable, and insures good passwords.

by dafe2

Passwords are unique for every device, application, server or service.

We keep the passwords in an encrypted database & synchronise to pocket PC's carried by those that need them. They only need to know the one password that opens the database.

Crazy.............but it works.

by dafe2

About a year ago we secured an Adobe generated union contract.....HR asked us to secure it against edits (and) no printing, then publish it on an intranet.

None of us could remember the password (of course) about 8 months later when they changed thir minds.........so this system came in handy real quick. LOL

by dafe2

This is the better (IMO) of the two.

http://www.dataviz.com/products/passwordsplus/pwp_apps.html

We used The Password Vault (Freeware) in a pilot and it worked VERY well...... Password plus offered a lot more flexibility.

Either of them will do a great job.

As you know you end up with a lot of passwords to remember. Some are only used every once in awhile............I just check & we're up to 183 :-(............................but I can find em :-)

by oz_media

Apparently new members get a free passweord manager download. I haven't checked it out or seen what level of security/management it offers but perhaps it's worth making a new acount for.

by chinqin

Why donot transfer the task of password calculation to server and the hardware Tokens? To be a user of Feitian Technologies' ePass OTP USB Token, you just need to press a botton and get a random password. According to the security level you need, you can evaluate the two-factor authentication based ePass USB Token and or smart card based FTSmart Authentication cooperating with Feitian Technologies. Contact them and get the free SDK to try.

by andre.j.hawkins

I've heard that there might be opportunities to avoid purpose-specific tokens altogether. For example, shouldn't there be a solution that utilizes an existing piece of hardware in the hands of consumers--say,a phone or a pager--that can fulfill the same functions without the IT manager having to distribute and manage one?

by kumar.jeff

Consider that most people have a phone in hand. Also consider that the input mechanism doesn't have to be the browser. Input could be the phone itself. Solutions like PhoneFactor are a nice possiblity.

by brian.samuela

Well, with the phonefactor scenario, if your phone were stolen, you'd still need the right username and password to manage the first factor, i.e., login to terminal services. I suppose the main problem might be a situation where you are under duress (i.e., gunpoint), but I can't think of situation (other than physical security in your building) where you can defend against that...

by andre.j.hawkins

LOL, I doubt any security mechanism could overcome the duress scenario. I'd love to be able to find a solid 2factor solution that's a little easier to deal with than certificates or tokens

by kumar.jeff

There's actually a nice PhoneFactor agent for Outlook Web Access, making it very easy to set up strong Authentication. We run it through our VPN. Took us about a half hour to set up, easy to manage too.

by bwilliams

Since Anakam is a true second-factor out-of-band solution, it is able to distribute passcodes to the end-user to confirm they still have what they registered. Consequently, no longer need high entropy passwords. Also, get an immediate alert of password compromise. Finally, with Anakam, you can skip password altogether and just do UN and passcode (second factor).

by brian.samuela

Well, keep in mind that if you use a phone for 2 factor authentication (for solutions like PhoneFactor), you don't have to manage any physical device in the hands of your customer. Good that there is no software downloaded to the phone.

by andre.j.hawkins

Checked in on the phonefactor solution and it seems to work pretty well for terminal services. Users manage their own token (phone). If they lose it, they get their own new phone.

This discussion is closed to new replies.