Passwords

9 years ago

last modified: 9 years ago

Most of you who recognize me here know that I am a fan of SANS [isc] and usually check their website on a daily basis to stay current with whatever may be floating around the internet of a nasty nature. Usually...about once a year....they post something about passwords...the good...the bad...the ugly...kind of info. Here's their latest contribution. I thought you might enjoy it. Plus...you can check your own against their list. :-)

https://isc.sans.edu/

Sort by:Oldest

Comments (5)

Elmer J Fudd
9 years ago
last modified: 9 years ago
Being unfamiliar with your recommendation, I went to the the Sans website. I found it to be vague about the true nature of the company (I hate businesses that do that). Wikipedia to the rescue, it's really a for-profit business with a completely different name.

That doesn't make its information better or worse but for me it does put it into context as a source. I always have a basic dislike (and maybe distrust) for companies or organizations that want to mask their true identities and broader activities.
User
Original Author
9 years ago
Try looking up Johannes B. Ullrich, Ph.D. I think you'll find enough info to sate your curiosity. He owns the site...or did...when I bookmarked it over 15 years ago.

Yes...it's a source but a very valuable one as far as I [and many professionals] are concerned. I've found answers or work arounds to avoid attacks/hacks on his website long before MS or others have posted corrections. Saved me more than a time or two in the old days. Nothing shady about Johannes. Of that, I'm sure.
Related Discussions
Making new passwords
Q
Comments (17)
I keep mine in a database, plus I let Firefox remember them. I like the convenience, nobody else uses my computers, and I'm willing to accept the risk. In Linux I wrote a script that generates a password and stores it along with username and site. Adding a password looks something like this:If I don't like the looks of the password I can refresh the page to get a new one. I can change the length, etc. in the script. When I hit "Submit", login info is stored in a database. I'm not a Windows user and am not fluent in Windows Powershell but a bit of Googling gives me something that could be built upon, or even used as is. Just two lines: Add-type -AssemblyName System.Web [System.Web.Security.Membership]::GeneratePassword(32, 5) Save with an extension of ps1 (or just paste in the two lines to test) and run in/with Windows Powershell ISE. The modify to suit your needs parameters 32 and 5 means 32 characters long, including a minimum of 5 symbols. In use: Of course, that just generates passwords, you'd still need to copy/paste them into a text file or whatever. But if you're not a do-it-yourself-er like I am, that probably doesn't help at all. Being a Firefoxer, I'd probably use it's password generator/manager if I hadn't already taken time to do my own. The modified phrase passwords are a good idea. I do that sometimes on sites my phone might forget when I'm away from home. Cat owners could just let their cat generate a more random password. Although uppercase might be difficult. :-)
...See More
Passwords manager working on iPhone and Windows?
Q
Comments (9)
Thank you all. Kudzu, that's exactly why I asked. It happened to me with two sites and I stopped doing it. Frankly, when I go to log into a site, such as my bank, gmail, etc. I keep having an Apple notice to let me know my password is weak and I should let them put in a strong password. Made the mistake of doing so and realized I had no idea what the password was. Frankly, it was a long string of characters and numbers which I didn't write down because I was outside and not at home. I had to then find a way (wasn't easy) to delete the phone password to be able to access my accounts on my computer. I really didn't give it alot of thought at the time and realized I couldn't use one password on my phone and my old password on my computer. I suppose if I had a Apple computer it would carry over from the phone to the Apple machine. I do not intend to buy a Mac . So, thank you all for confirming what I thought...when I thought about it! Elmer, I do the same. I keep an index file (Rolodex type) in a drawer near my computer. However, I realize I've been using the same passwords (slightly changed when websites require more characters or #'s) on most of the places I visit. I would like stronger passwords but would never memorize the Apple type passwords to memory. I wish passwords would go the way of the dinosaur and use retina or something similar that doesn't require us older folks to remember all these passwords.
...See More
Recovering password?
Q
Comments (13)
Go to your settings and check your email address to make sure you're using the correct one. You can also log in with FB (if you have an account). click on your icon on the top right next to "your Houzz". Then go down to "profile and settings". You'll find the link for your password there. OR.................. if your browser on your computer saves your password, you can find your password in your browsers password settings. I'll have to search again to find that, but it depends on the browser you use as well.
...See More
Choosing passwords
Q
Comments (31)
Some sites, especially financial, have security questions. These can be a bear, so keep track of them as well. After my dad had his stroke, he and I were working with his financial institutions on some things. We were on the phone with a representative asked the security questions so that they could talk to me. The question was, where did you first meet your spouse? Now remember, you usually get to choose from a selection of security questions, and provide your own answer. Well, Dad launches into the story of how he and Mom met. The rep is quiet. At one point I asked the rep if he needs the verbatim answer Dad had provided when he set the questions up? Yes. Had Dad done so in his answer here on the phone? Well, no. Was he close? ”It has to be exactly what he entered online.” So we had to find a workaround, which took at least a week. In another day, I had to do something online when he was not available. I could answer most of the security questions, but then came this: What was the name of your grandmother’s dog? His grandmother had a dog? Which grandmother? When? Here, or in the old counter? I asked Dad later, he had no idea. (in case you were wondering, we had just signed the paperwork allowing me to manage the trust, this work was while we were still getting it changed over with the institutions themselves. Some things needed doing in the meantime.)
...See More
Elmer J Fudd
9 years ago
last modified: 9 years ago
I'm not suggesting anything shady. I'm also not suggesting that they're anything other than leading experts. Why the charade about their identity?

I don't suspect that what they do is something ordinary users need concern themselves with. I get it, it's an interest for you, fair enough.

Cyber attacks and other activities I presume this group monitors don't affect me nor do they affect most other individual users. I've always assumed what might be of concern to me is taken care of by the security software I pay for.

I did look the guy up. Ulrich's PhD is in optics, unrelated to the Computer Science, Computer Engineering or the soft (non-infrastructure) part of the internet.
User
Original Author
9 years ago
Why the charade about their identity?

I have no idea. I've never considered their identity to be anything other than what I knew it to be. The site has been very informative and I've gleaned a lot of helpful and educational information from it over the years.

I posted today's bit about passwords because I thought others might get a kick out them/it. Not to start a long, involved analytical discussion with you, Fudd. Can't you just enjoy it for what it is? A list of passwords that obviously aren't working. It's a common posting subject at least once a year both on the internet and through the news media. But now that you've made such an issue of it.....I'll refrain from sharing it on here in the future. No personal loss on my end.
Elmer J Fudd
9 years ago
last modified: 9 years ago
Maybe I took umbrage at the article because it listed several passwords I'm rather fond of and use frequently, in various forms.

In describing itself, it uses language as if it were a university, non-profit or something of that ilk. It's misleading. The company name is

The Escal Institute Of Advanced Technologies, Inc

Passwords

Comments (5)

Elmer J Fudd

User
Original Author

Related Discussions

Elmer J Fudd

User
Original Author

Elmer J Fudd

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

Passwords

Comments (5)

Elmer J Fudd

UserOriginal Author

Related Discussions

Elmer J Fudd

UserOriginal Author

Elmer J Fudd

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

User
Original Author

User
Original Author