Tag Archives: passwords

Posted on

Easily Manage Website Passwords

Managing multiple website passwords is one of the more difficult tasks for agency personnel. While tools like Transformation Station and TransactNOW help with this process, there continues to be many sites that your staff goes to daily where each time they have to manually enter User ID and password information.

RoboForm is a tool that can help. I’ve been using it for a while and don’t know how I got along without it!

The program installs as part of your Web browser and manages login and passwords for you. When you log into a website, RoboForm offers to save the online login information into a Passcard after you click the Login/Submit button. The Passcard is saved into a fully encrypted file that requires a master password to access it.

Once the login information page is saved, true one-click login is available by clicking on the website name in the Passcard list. The program automatically navigates to the website’s login page, fills the stored login information into the form, and clicks the submit button. You are logged in with one click.

RoboForm can also complete a form with saved information, such as a contact information form. Your predefined contact information can be populated into a form with just one click.

The free version of RoboForm allows you to have 10 Passcards or less. Upgrading to the Desktop version ($29.95) allows you to save an unlimited number of Passcards and Identities, and comes with unlimited toll-free customer support. Or you could try out the RoboForm Everywhere license for $9.95 for the first year ($19.95 afterwards). The RoboForm Everywhere license allows you to use RoboForm software on all your Windows computers, Macs, and other mobile devices.

Posted on

Microsoft: Frequent Password Resets are a Waste of Time

In a recent research paper, Microsoft principal researcher Cormac Herley asserted that security measures that are being recommended are a waste of time. He argues that security protocols that attempt to protect an individual or organization from the consequences of a security breach often exact a much steeper price—in the form of user effort and time expended.

While everyone knows that “123456” is not a good choice for a password, is it worth the effort to force users to change their passwords? “Most security advice simply offers a poor cost benefit tradeoff to users and is rejected,” said Herley. Following certain password rules “shields [users] from the direct costs of attacks, but burdens them with far greater indirect costs in the form of effort.” Herley contends that users who ignore security advice aren’t lazy or stupid; rather they’re acting rationally. Required security activities are complex, and the benefits are “largely speculative or moot.”

He particularly slams the common requirement that users change passwords at specified intervals. A hacker who steals your password is going to use it right away; he won’t wait two months. “Insisting that users choose a unique strong password for each [[account]] which they change often and never write down is clearly a large burden.

The study also says that teaching users to recognize phishing URLs is a losing proposition, not worth the time spent. Herley calculates that a task requiring one minute per day from every working adult in the United States costs about $15.9 billion per year. Unnecessary security advice “treats as free a resource that is actually worth $2.6 billion an hour.”

While he might have a point, don’t go changing all your passwords to “123456” just yet. Using different passwords for different accounts and Web sites really is beneficial, as is using complex, non-guessable passwords. You can cut down on the time and effort required by using a password manager and letting it generate strong passwords for you.

Posted on

The Problem with Passwords

Last December, someone hacked into the Web site RockYou.com, and exposed a list of usernames and passwords on the Web, in plain text. A month later, security analysis firm Imperva analyzed the most common passwords. The results are eye-opening and should serve as a reminder to you and your staff about the importance of creating and using good passwords.

By far, the most popular password on RockYou.com was “123456,” which satisfies the minimum character limit for the site’s password restrictions, but does little for security. A full 290,731 users had this password, far more than the runner-up, 12345, which had 79,078 users.

Of the list of compromised passwords, other usual suspects surfaced: Password; the site’s name, or rockyou; abc123; and first names, such as Ashley and Daniel. Imperva published a list of the most popular passwords, all of which are extremely weak from a security standpoint.

For years, security experts have argued that users need to use more complex passwords, especially as the computing power and algorithms behind brute-force password crackers become ever more sophisticated. But 30% of the RockYou users picked a password less than six characters in length, and 40% used only lowercase letters.

Posted on

Consortium Works on Password Solution

Google, PayPal, Equifax, VeriSign, Verizon, CA, and Booz Allen Hamilton have formed a nonprofit company to oversee the development and exchange of online identity credentials on Web sites as a way to help with the user ID and password problems we all face.

The goal of the Open Identity Exchange (OIX) is to create a “trust framework” and certification program that lets organizations and individuals exchange digital credentials and know what identity, security, and privacy assertions are behind them. In addition to the single sign-on convenience, the credentials could be compelling because they let people be authenticated without being identified.

Separately, Microsoft is also working on creating a better way to implement online IDs. These initiatives are helpful and timely, because the current method of identifying individuals through IDs and passwords needs to change. It is too complex to manage—and when complexity increases, security decreases.

Posted on

How Secure is Your Password?

People tend to choose passwords that are easy to remember. That can be very dangerous because it makes it easier for a hacker to break the password. The following passwords are most common. If you use one of these, change it immediately:

Password, 123456, qwerty, abc123, letmein, monkey, myspace1, password1, link182, (your first name)