Date: Fri, 24 Apr 2015 11:38:56 -1000
From: Jim Manico <jim@...ico.net>
To: discussions@...sword-hashing.net
Subject: Forgot Password Conjectures....

 > There are people out there researching & doing some really 
interesting work into improving password resets now. The https link via 
unencrypted email is easily accessible by many more than your favorite 
.gov agency, and doing it over SMS instead doesn't really raise the bar 
much for falling victim to a targeted attack. All that, in combination 
with 2FA too often being a usability bolt-on disguising as better 
security imho deserves a FSCK.


Per,

I would love to hear more on this. The OWASP foundation has a living 
document on this topic and I would be grateful for any help to give 
better advice.

https://www.owasp.org/index.php/Forgot_Password_Cheat_Sheet

While we are on the topic, I'd also love any review and edit suggestions 
to...

https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet

These are all open source documents meant to help inform developers to 
do the right thing. I appreciate any help from you.

Aloha,
Jim Manico


On 4/24/15 11:26 AM, Per Thorsheim wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Den 24.04.2015 18:53, skrev Krisztián Pintér:
>> Sascha Schmidt (at Friday, April 24, 2015, 6:34:04 PM):
>>> 2015-04-24 18:12 GMT+02:00 Krisztián Pintér
>>> <pinterkr@...il.com>:
>>>> expiration yes, but it is not reckless. it is merely an
>>>> inconvenience.
>>>> and we are not talking about months here. we are talking about
>>>> years.
>>> I'm pretty sure that this is a common time span for at least some
>>> scenarios.
>> moore's law says 3% increase per month, 20% in half year. if our
>> security margin is so low we can't afford that, we are screwed
>> anyway, and it is time to ditch password based identification.
>>
>>> I just personally have a great aversion of forgotten password
>>> routines when it comes to usability and security. Maybe I just
>>> haven't seen a good one yet.
>> i agree that security is effectively nonexistent. but improving it
>> is another story. launch the PRPC. as far as usability goes, i see
>> no problem resetting a password after a year. i do it for some
>> sites 3-4 times a year, minor annoyance. maybe i just got used to
>> it.
> Password policies are usually written by paranoid computer security
> engineers, and they are almost never implemented as in writing, due to
> constraints and sysadmins.
>
> The same applies to most of the ecosystem around account registration
> & password resets.
>
> There are people out there researching & doing some really interesting
> work into improving password resets now. The https link via
> unencrypted email is easily accessible by many more than your favorite
> .gov agency, and doing it over SMS instead doesn't really raise the
> bar much for falling victim to a targeted attack.
>
> All that, in combination with 2FA too often being a usability bolt-on
> disguising as better security imho deserves a FSCK.
>
> I have hopes for #passwords15 in Las Vegas (August) to perhaps shed
> some additional light on these topics, and next iteration after that
> will probably December 7-9 at the university in Cambridge, UK.
>
> CFP submissions most welcome.
>
> Best regards,
> Per Thorsheim
>
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2
>
> iQEcBAEBAgAGBQJVOrUSAAoJEHJew+oCXWmfLMkH/A9Q6bPPp+YsxXph5ZlGPGPb
> QQGHrOb/Wn0mQUNUmQ913IiJwo661OjXQ8fz9gixN35XILsB6ArLQv34eKX0gxhR
> BLVECEhWCw9W71r2kPpwr5+3x013osBgml15PLQIGRnb/AL+Ns7RMPrU0YT+gsoF
> rQXJrHpo2XOzjqMgfXR5hM4hOAfH3/RrLq+MdCM4stutc4pky2Q6yfeee9wEeZO2
> JrTQET71iv0Yl1imGzEMmQx71NX1tRU7LaxKL498QDwb/IZOA6wR68SJhIiVvwwm
> UkSDLa3qrMvfFwbB0BBgurp96iQEviDaP+1u1/6oNIFBl6tb33bYkOI4H1Lzeck=
> =JsNj
> -----END PGP SIGNATURE-----

Powered by blists - more mailing lists