# Need a Strong Password? **URL:** \ **Category:** NYSpeed Off Topic\ **Created:** [August 31, 2011, 9:21am UTC](https://forums.speedlife.net/t/need-a-strong-password/216058 "2011-08-31T09:21:02Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![boardjnky4](https://avatars.discourse-cdn.com/v4/letter/b/96bed5/32.png) [@boardjnky4](https://forums.speedlife.net/u/boardjnky4)\ **Post date:** [August 31, 2011, 11:11am UTC](https://forums.speedlife.net/t/need-a-strong-password/216058/21 "2011-08-31T11:11:50Z")
Yep, the whole idea of a password should be thrown out the window. It should be called a passphrase. Cracking as well as brute forcing are terribly difficulty if you just make the password longer. ---
**Author:** ![boxxa](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/boxxa/32/5045_2.png) [@boxxa](https://forums.speedlife.net/u/boxxa)\ **Post date:** [August 31, 2011, 11:13am UTC](https://forums.speedlife.net/t/need-a-strong-password/216058/22 "2011-08-31T11:13:50Z")
The most secure networks I have dealt with involved multilayer password protection setup. It was a lab that some super secret stuff was going on and only a few people had access to it. The entire building was sectioned off by keyfab scanners. A user would swipe into certain areas to physical access to certain rooms and labs. When they logged into the PC, their credentials were authenticated not only to the domain controller, but also to the keyfab database which linked swipes, location, and usernames together. This way, someone from the outside trying to access a PC as a lab tech that never swiped into the building would get denied. The theory was if someone was never physically swiping into the lab, why would they be logging in with the username. Just a small part of what went on but THAT is password security. ---
**Author:** ![boardjnky4](https://avatars.discourse-cdn.com/v4/letter/b/96bed5/32.png) [@boardjnky4](https://forums.speedlife.net/u/boardjnky4)\ **Post date:** [August 31, 2011, 11:15am UTC](https://forums.speedlife.net/t/need-a-strong-password/216058/23 "2011-08-31T11:15:48Z")
> [@boxxa](#): > > The most secure networks I have dealt with involved multilayer password protection setup. It was a lab that some super secret stuff was going on and only a few people had access to it. The entire building was sectioned off by keyfab scanners. A user would swipe into certain areas to physical access to certain rooms and labs. When they logged into the PC, their credentials were authenticated not only to the domain controller, but also to the keyfab database which linked swipes, location, and usernames together. This way, someone from the outside trying to access a PC as a lab tech that never swiped into the building would get denied. The theory was if someone was never physically swiping into the lab, why would they be logging in with the username. > > Just a small part of what went on but THAT is password security. That’s a hell of a setup One of the reasons why I really like it (aside from that it’s very secure) is that it’s easy on the user. Swiping to get in is easy, and most times expected. ---
**Author:** ![LZ1](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@LZ1](https://forums.speedlife.net/u/LZ1)\ **Post date:** [August 31, 2011, 11:18am UTC](https://forums.speedlife.net/t/need-a-strong-password/216058/24 "2011-08-31T11:18:24Z")
There is a datacenter with similar security you use RFID fobs to unlock racks they also hang sensors from the ceiling to detect location of RFID fobs on the people in the datacenter lol It’s always about layers of security Normally places that don’t want remote access just air gap the two networks ---
**Author:** ![boxxa](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/boxxa/32/5045_2.png) [@boxxa](https://forums.speedlife.net/u/boxxa)\ **Post date:** [August 31, 2011, 11:39am UTC](https://forums.speedlife.net/t/need-a-strong-password/216058/25 "2011-08-31T11:39:54Z")
> [@boardjnky4](#): > > That’s a hell of a setup > > One of the reasons why I really like it (aside from that it’s very secure) is that it’s easy on the user. Swiping to get in is easy, and most times expected. Ya it was pretty awesome. Users were already required to each swipe in and out of doors. You enter a room/lab/section, you were already swiping yourself in and out even if you walked in with a group. As soon as you swiped,database was updated that was tied to the network and user access control. Swipe out and the system knew you were gone. Also protected against people leaving their account logged in. > [@LZ](#): > > There is a datacenter with similar security you use RFID fobs to unlock racks they also hang sensors from the ceiling to detect location of RFID fobs on the people in the datacenter lol > > It’s always about layers of security > > Normally places that don’t want remote access just air gap the two networks I am always cracked up about people who have servers or network equipment and ask “Well what if the user plugs cable into it, what info can they get?” or “Can i access the device from its serial port and only have to use one password?”. LOCK YOUR DAMN DOORS IDIOT! ---
**Author:** ![boardjnky4](https://avatars.discourse-cdn.com/v4/letter/b/96bed5/32.png) [@boardjnky4](https://forums.speedlife.net/u/boardjnky4)\ **Post date:** [August 31, 2011, 11:46am UTC](https://forums.speedlife.net/t/need-a-strong-password/216058/26 "2011-08-31T11:46:38Z")
sadly, at some large institutions COUGHUNIVERSITIESCOUGH it’s WAY too easy to get physical access to a device on the network. Hell, sometimes it’s as easy as walking in and plugging a device into a jack with DHCP or just hijacking a workstation. Workstations with USB booting enabled can be a quick in. Super easy to either boot an OS from it, or just use a boot disc to hack the Admin password. Linux boxes are stupid easy if their isn’t a GRUB password. ---
**Author:** ![boxxa](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/boxxa/32/5045_2.png) [@boxxa](https://forums.speedlife.net/u/boxxa)\ **Post date:** [August 31, 2011, 11:55am UTC](https://forums.speedlife.net/t/need-a-strong-password/216058/27 "2011-08-31T11:55:03Z")
> [@boardjnky4](#): > > sadly, at some large institutions COUGHUNIVERSITIESCOUGH it’s WAY too easy to get physical access to a device on the network. Hell, sometimes it’s as easy as walking in and plugging a device into a jack with DHCP or just hijacking a workstation. Workstations with USB booting enabled can be a quick in. Super easy to either boot an OS from it, or just use a boot disc to hack the Admin password. Linux boxes are stupid easy if their isn’t a GRUB password. Haha ya. I have done consulting for companies and just talked to users and within 30 seconds, they give me their work station, go to get coffee, and even will give me a postit note with their password on it with out even asking. Gotta educate your users, limit the general population, and secure the equipment you deem critical. A router or server in a remote building that just is a proxy for something simple doesn’t need its own locking rack but your schools student databases may not want to be in a room the part time maintenance guy has access to. ---
**Author:** ![boardjnky4](https://avatars.discourse-cdn.com/v4/letter/b/96bed5/32.png) [@boardjnky4](https://forums.speedlife.net/u/boardjnky4)\ **Post date:** [August 31, 2011, 12:12pm UTC](https://forums.speedlife.net/t/need-a-strong-password/216058/28 "2011-08-31T12:12:55Z")
> [@boxxa](#): > > Haha ya. I have done consulting for companies and just talked to users and within 30 seconds, they give me their work station, go to get coffee, and even will give me a postit note with their password on it with out even asking. Gotta educate your users, limit the general population, and secure the equipment you deem critical. A router or server in a remote building that just is a proxy for something simple doesn’t need its own locking rack but your schools student databases may not want to be in a room the part time maintenance guy has access to. Sadly, there are places where sensitive devices are in switch closets where it’s questionable who has the keys to it. It’s just the nature of the beast. People who don’t know what they are doing just stand these servers up wherever they feel like it and nobody even knows it’s there, let alone physically and remotely vulnerable. ---
**Author:** ![ProgRocker](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/progrocker/32/5434_2.png) [@ProgRocker](https://forums.speedlife.net/u/ProgRocker)\ **Post date:** [August 31, 2011, 12:35pm UTC](https://forums.speedlife.net/t/need-a-strong-password/216058/29 "2011-08-31T12:35:25Z")
> [@boardjnky4](#): > > sadly, at some large institutions COUGHUNIVERSITIESCOUGH it’s WAY too easy to get physical access to a device on the network. Hell, sometimes it’s as easy as walking in and plugging a device into a jack with DHCP or just hijacking a workstation. Workstations with USB booting enabled can be a quick in. Super easy to either boot an OS from it, or just use a boot disc to hack the Admin password. Linux boxes are stupid easy if their isn’t a GRUB password. Unfortuantely it’s not always the decision of the IT department to layout things that way. Budgets, CIOs, VPs all come into play when architecting (\<-not a word? huh…) a network. ESPECIALLY if you are understaffed…ask me how I know :). ---
**Author:** ![boardjnky4](https://avatars.discourse-cdn.com/v4/letter/b/96bed5/32.png) [@boardjnky4](https://forums.speedlife.net/u/boardjnky4)\ **Post date:** [August 31, 2011, 12:37pm UTC](https://forums.speedlife.net/t/need-a-strong-password/216058/30 "2011-08-31T12:37:34Z")
> [@ProgRocker](#): > > Unfortuantely it’s not always the decision of the IT department to layout things that way. Budgets, CIOs, VPs all come into play when architecting (\<-not a word? huh…) a network. ESPECIALLY if you are understaffed…ask me how I know :). Oh trust me, I know all about it ---
**Author:** ![walter](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/walter/32/7202_2.png) [@walter](https://forums.speedlife.net/u/walter)\ **Post date:** [August 31, 2011, 8:41pm UTC](https://forums.speedlife.net/t/need-a-strong-password/216058/31 "2011-08-31T20:41:27Z")
> [@boardjnky4](#): > > oh yeah, you’re right. I work at a top-10 in the national hospital with access to PHI of every patient. That’s not important to protect. actually? it isn’t. anyway, you’re more likely for some careless 'tard barge to let someone in like in the RSA scenario than to have someone crack your MEGA PASSWORD, so why bother remembering something retarded when anything better than “password1234” is going to make you account more secure than 90% of them out there? ---------- Post added at 11:38 PM ---------- Previous post was at 11:36 PM ---------- > [@LZ](#): > > DoD says differently? I can count the people with DoD clearances on this site on one hand. The number of people however that have ridiculously complex passwords far exceeds that, which was my point. Most people have retardedly long passwords for their gmail account so their girlfriend doesn’t figure out they are in to a CP ring, which, while a good secret to protect, is moderately worthless. The likelyhood that any single account is going to be the victim of a brute force attack I’d also say is relatively low (but thats just a guess) ---------- Post added at 11:39 PM ---------- Previous post was at 11:38 PM ---------- > [@08GT500](#): > > Protip: You’re a noob. Protip: Nope. ---------- Post added at 11:41 PM ---------- Previous post was at 11:39 PM ---------- The other thing is, last I checked, we didn’t live in the movie hackers. Gaining access to my email address is hardly going to allow you to take over my company. ---
**Author:** ![boardjnky4](https://avatars.discourse-cdn.com/v4/letter/b/96bed5/32.png) [@boardjnky4](https://forums.speedlife.net/u/boardjnky4)\ **Post date:** [August 31, 2011, 8:53pm UTC](https://forums.speedlife.net/t/need-a-strong-password/216058/32 "2011-08-31T20:53:35Z")
Sorry, not quoting that mess. Remembering a 3 word phrase that you type 20-30 times per day isn’t difficult. As a system administrator working now in the realm of security, my opinions are understandably different. However, I think if you’ve seen things from my perspective, your opinions might be more aligned with mine. ---
**Author:** ![LZ1](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@LZ1](https://forums.speedlife.net/u/LZ1)\ **Post date:** [September 1, 2011, 4:03am UTC](https://forums.speedlife.net/t/need-a-strong-password/216058/33 "2011-09-01T04:03:20Z")
> [@walter](#): > > The number of people however that have ridiculously complex passwords far exceeds that, which was my point. Most people have retardedly long passwords for their gmail account so their girlfriend doesn’t figure out they are in to a CP ring, which, while a good secret to protect, is moderately worthless. The likelyhood that any single account is going to be the victim of a brute force attack I’d also say is relatively low (but thats just a guess) Well im one of them and regardless my gmail password is decently long and I use googles 2 factory authentication :lol: Nothing worse then bitching about security and getting pwned ---
**Author:** ![ProgRocker](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/progrocker/32/5434_2.png) [@ProgRocker](https://forums.speedlife.net/u/ProgRocker)\ **Post date:** [September 1, 2011, 4:06am UTC](https://forums.speedlife.net/t/need-a-strong-password/216058/34 "2011-09-01T04:06:47Z")
> [@walter](#): > > STUFF WAS HERE Well that’s kinda like saying, why bother with a WEP/WPA key on my router…the chances of someone hacking YOUR WiFi and stealing all your travel information, blah blah blah is slim. Why bother locking your car, if someone can just smash the window. ---
**Author:** ![LZ1](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@LZ1](https://forums.speedlife.net/u/LZ1)\ **Post date:** [September 1, 2011, 4:26am UTC](https://forums.speedlife.net/t/need-a-strong-password/216058/35 "2011-09-01T04:26:24Z")
> [@walter](#): > > Gaining access to my email address is hardly going to allow you to take over my company. A number of very real possibilities. You may use the same password structure You may email funny things to people at work could be exploited to send attacks Banking info? Facebook info? possible links to coworker info Send and email back to you based on similar emails in your inbox and gain access to your PC where you might VPN into work or login to corp email etc ---
**Author:** ![1QIKZ](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/1qikz/32/6112_2.png) [@1QIKZ](https://forums.speedlife.net/u/1QIKZ)\ **Post date:** [September 1, 2011, 4:43am UTC](https://forums.speedlife.net/t/need-a-strong-password/216058/36 "2011-09-01T04:43:21Z")
> [@boxxa](#): > > dasd$3rfd@ is not a secure password. > R3@llyC00l is not a secure password. > > redhorsepilotcanyon is more secure mathematically. also, based on general public, companies that require 8-10 letter “complex” passwords leave their users to write them down on a pad of paper next to their desk. companies that do not allow long passwords are less secure than the admin making password rules like the following list I have seen: > > no repeating letters > must contain letter, number, and symbol > must not be one used the last 10 times > must start with a capital letter (this itself makes the first character only 26 guesses) > > Also, certs are only as trust worthy as the providers of them. The best security that is used at high level banks is client certs that are all based on machines and issued on an internal CA. Hell, the Iranian government was issued certificates to man in the middle all the Google sites recently. > > ![http://imgs.xkcd.com/comics/password_strength.png](https://canada1.discourse-cdn.com/flex034/uploads/speedlife/original/3X/f/4/f4ac89b0bb201d6dc51e2bf969f41b7972550375.png) > > Also, if you have no account locking on failed login attempts, you deserve to be hacked. And you guys think I have too much time on my hands. ---
**Author:** ![boxxa](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/boxxa/32/5045_2.png) [@boxxa](https://forums.speedlife.net/u/boxxa)\ **Post date:** [September 1, 2011, 7:02am UTC](https://forums.speedlife.net/t/need-a-strong-password/216058/37 "2011-09-01T07:02:17Z")
> [@LZ](#): > > A number of very real possibilities. > > You may use the same password structure > You may email funny things to people at work could be exploited to send attacks > Banking info? > Facebook info? possible links to coworker info > Send and email back to you based on similar emails in your inbox and gain access to your PC where you might VPN into work or login to corp email etc Ya people now have the same passwords for things. Single email account can get a users general password. Typically, the non dod clearance user has the same password for a lot of accounts and you can work from there to really cause problems for the user. Lots of places, their email/ad/vpn password are all the same so you can gain access to the network and start attacking internal things pretty easily from the outside. ---
**Author:** ![drvnkd](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/drvnkd/32/109615_2.png) [@drvnkd](https://forums.speedlife.net/u/drvnkd)\ **Post date:** [September 1, 2011, 9:18am UTC](https://forums.speedlife.net/t/need-a-strong-password/216058/38 "2011-09-01T09:18:39Z")
I hope no one hacks my NYSpeed account… I’m working on getting access to a poorly secured traffic signal control system… Then I will have full access to all other databases used for national security and I can blow stuff up with my PC. (Maybe I’ll disguise myself as a state trooper from Alabama) You security noobs clearly do not understand how the worlds databases are interconnected. ---
**Author:** ![boardjnky4](https://avatars.discourse-cdn.com/v4/letter/b/96bed5/32.png) [@boardjnky4](https://forums.speedlife.net/u/boardjnky4)\ **Post date:** [September 1, 2011, 11:01am UTC](https://forums.speedlife.net/t/need-a-strong-password/216058/39 "2011-09-01T11:01:22Z")
[quote=“drvnkd,post:38,topic:216058"”] I hope no one hacks my NYSpeed account… I’m working on getting access to a poorly secured traffic signal control system… Then I will have full access to all other databases used for national security and I can blow stuff up with my PC. (Maybe I’ll disguise myself as a state trooper from Alabama) You security noobs clearly do not understand how the worlds databases are interconnected. [/quote] Are you serious? Clearly I know more than you. They are connected by tubes!!! ---
**Author:** ![Blue\_Eyed\_Devil](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/blue_eyed_devil/32/7292_2.png) [@Blue\_Eyed\_Devil](https://forums.speedlife.net/u/Blue_Eyed_Devil)\ **Post date:** [September 1, 2011, 11:11am UTC](https://forums.speedlife.net/t/need-a-strong-password/216058/40 "2011-09-01T11:11:46Z")
Biometrics FTW! Err, wait… :tinfoilhat: [Previous page](https://forums.speedlife.net/t/need-a-strong-password/216058.md?page=1) [Next page](https://forums.speedlife.net/t/need-a-strong-password/216058.md?page=3)