Comments on: Passwords – a secret you have no right to share

By: Rob Farley

Rob Farley — Sat, 21 Oct 2017 03:08:17 +0000

My point is that when you re-use a password across multiple sites, you’re effectively telling them your password. If they lose it, someone else might gain access to your stuff. You need to consider if you re-use or share a password, you’re trusting your password to organisations that aren’t necessarily trustworthy.

By: dd

dd — Sat, 15 Oct 2016 22:36:41 +0000

Pot calling the kettle black.
When companies and governments are losing our passwords by the hundreds of millions you have the effrontery to blame the user for sharing his password.
It is more likely as a store that you will lose my and all your customers details at one go than it is for my friends to abuse my password.

By: Dell Anderson

Dell Anderson — Sat, 15 Oct 2016 19:45:58 +0000

Passwords are an antiquated authentication and security mechanism which simply has not yet been replaced by anything better. I can’t wait until an open source solution that works similarly to something like Steve Gibson’s SQRL relegates the antiquated and cumbersome password system to the Dustbin of History

By: John Winterbottom

John Winterbottom — Sat, 15 Oct 2016 14:53:23 +0000

A better approach might be to ask why users are sharing passwords and try to address the root cause, (hint it’s probably because they just want to get their damn work done). As IT folk we sometimes lose sight of the big picture – information systems are there to achieve an end and not as an end in themselves. This end could be increased efficiency, higher productivity etc. Chances are that our password-sharing users are simply working around obstacles rather than plotting something nefarious. Let’s talk to them and try and understand why before we simply add more rules to their lives.

By: jchang

jchang — Wed, 12 Oct 2016 18:31:20 +0000

there are 3 levels of password security
1) low – easily guessed
2) medium – somewhat difficult to remember, write it down on a yellow sticky, stick on back of monitor
3) high – difficult to remember, write it on a yellow sticky, stick on front of monitor

By: DuncanGreaves

DuncanGreaves — Wed, 12 Oct 2016 14:59:15 +0000

And don’t use the passwords you use for eternal providers internally.
The LinkedIn passwords that were leaked have been used to compromise systems
where the same password was used with the company account.

By: AdaTheDev

AdaTheDev — Wed, 12 Oct 2016 12:45:27 +0000

One of the best ways to prevent sharing of passwords, is to have passwords that you don’t even know/remember yourself.
Obviously there are some passwords you HAVE to remember, such as for your password-store-of-choice (LastPass, 1Password….), but in majority of cases let a password generator create a unique one for you for that particular site/service. I know it’s going to do a far better job than my memory can for remembering secure/random passwords! .

By: RichB

RichB — Wed, 12 Oct 2016 04:20:25 +0000

Sure… but also remember the opposite goes as well.
Don’t ask me for a complicated password to merely protect some inane ramblings on a website.
Don’t ask me for the same old hackneyed ‘secret’ questions and answers that somehow need to end up all over the internet to ‘protect’ my identity.
Don’t make me change it so often I need to write it down. Don’t make me have so many different ones _for the same organisation_ that I need to write them down.
Don’t make it hard for me to remember it.
Don’t make it hard for me to reset it.
Don’t, whatever you do, email it to me with instructions to change it immediately, but set the AD property that prevents me changing the password until after the weekend…

By: Peter

Peter — Wed, 12 Oct 2016 02:13:42 +0000

I use dirty words in all of my passwords to discourage sharing.