Password Complexity, Good or bad?

scottalanmiller

And yes, I realise that sadly the bar for what people consider IT is insanely low. And that's why I only said that we should consider motivations, not take legal action. If this was from a firm advertising its security expertise, I would definitely recommend legal action, at the very least to get all audit costs, mitigation costs and payments returned.

If it turns out that they were just hiring some high school kid to run their IT and provided no training and required no training and were not paying for any expertise, then it is, to some degree, excusable. Not a "ah this happens to everyone" level of excuse, but enough that they should just be required to take some basic computer and security training.

As we don't know who implemented this, we don't know the scope of the issue. But there is every chance that this was an MSP claiming that they knew what they were doing rather than someone's nephew trying to "help out" without proper basic security training.

travisdh1

@JaredBusch said:

@scottalanmiller said:

The bottom line is that this is very basic knowledge. You can say that people are taught wrong, and I agree. But the levels of responsibility here are big.

It is most certainly not very basic knowledge. Most IT people do not even know how basic encryption works and have no chance ti understand why a complex password is not better than a simple one.

Let alone getting into anyone outside of IT.

Very sad that it's true.

Everyone repeat after me. The number one rule of doing encryption is, do no write your own! Most security researchers I know say to trust the math and just use encryption libraries someone else has already written. That's how hard it is to get right.

crustachio

@travisdh1 said:

@JaredBusch said:

@scottalanmiller said:

The bottom line is that this is very basic knowledge. You can say that people are taught wrong, and I agree. But the levels of responsibility here are big.

It is most certainly not very basic knowledge. Most IT people do not even know how basic encryption works and have no chance ti understand why a complex password is not better than a simple one.

Let alone getting into anyone outside of IT.

Very sad that it's true.

Everyone repeat after me. The number one rule of doing encryption is, do no write your own! Most security researchers I know say to trust the math and just use encryption libraries someone else has already written. That's how hard it is to get right.

But I got this thing free in a cereal box!

Dashrender

@scottalanmiller said:

@JaredBusch said:

It is most certainly not very basic knowledge. Most IT people do not even know how basic encryption works and have no chance ti understand why a complex password is not better than a simple one.

Let alone getting into anyone outside of IT.

Perhaps that is true. But it is setting an insanely low bar for IT. What's the first thing you learn about security? Well, that's never run as the admin. And the second is to never share accounts. But this still very basic stuff. Maybe you can excuse a first time help desker with never thinking about or learning how computers work (maybe, I'd have to consider that) but for a security decision maker?

Well, are we talking about paid security decision maker or are we talking about typical IT? Granted there should be some basic knowledge - but you speak of first thing you learn? Don't run as admin - LOL I certainly didn't learn that first, or second or even top 100. This wasn't a concept to me until well after Windows 2000 came out.

I suppose if you grew up on the Linux or any Nix side of the house that might have been different - but hell, it's pretty easy to run as root if you just want to in a lot of cases.

I started in DOS, upgrade to Win3.x - Win9x, jumped over to Win NT 3.5, 3.51 and 4.0 (learned about admin and general security) but still - running as non admin wasn't done by me or anyone around me. When the company I worked for at the time deployed Windows 2000, that was the first real time it was a thing - not running as an admin.

So to that end - the idea that a smaller complex password is not as secure as a longer though visually more simple password is easy to see why many (including IT people) wouldn't innately pick this up. Toss in the fact that how you show that a longer though visually more simple password offers better protection involves math - Most people hate dealing with math, again IT people are no exception. Tons of IT people can't figure out Subnets, don't understand the use of Binary to find same networks, etc... so when you're talking about complexity and you bring math to explain why longer is better - their eyes just glaze over.

Dashrender

@travisdh1 said:

@JaredBusch said:

@scottalanmiller said:

The bottom line is that this is very basic knowledge. You can say that people are taught wrong, and I agree. But the levels of responsibility here are big.

It is most certainly not very basic knowledge. Most IT people do not even know how basic encryption works and have no chance ti understand why a complex password is not better than a simple one.

Let alone getting into anyone outside of IT.

Very sad that it's true.

Everyone repeat after me. The number one rule of doing encryption is, do no write your own! Most security researchers I know say to trust the math and just use encryption libraries someone else has already written. That's how hard it is to get right.

This is proven every day with all the exploits that are discovered.

Hell Apple's iMessage has a flaw in it - one that can't be fixed without whole sale replacing the current system, so yet another gaping whole that will just be left to rot.

scottalanmiller

@Dashrender said:

Well, are we talking about paid security decision maker or are we talking about typical IT?

Well, while we can't guarantee it, this is a company and we should assume that someone was getting paid to make security decisions. So to some degree these two are one and the same.

BRRABill

@scottalanmiller said:

Remember that password complexity is a myth. It's complex to a human but the computer cannot tell. p@55w0rd and password are exactly the same to a computer - they are both easily guessable eight character passwords.

Is that true? Doesn't adding character sets make it harder to guess? Human interaction aside? I am just saying aaaaaaaa versus something random with punctuation would take longer to crack. Are you saying that is not the case?

travisdh1

@BRRABill said:

@scottalanmiller said:

Remember that password complexity is a myth. It's complex to a human but the computer cannot tell. p@55w0rd and password are exactly the same to a computer - they are both easily guessable eight character passwords.

Is that true? Doesn't adding character sets make it harder to guess? Human interaction aside? I am just saying aaaaaaaa versus something random with punctuation would take longer to crack. Are you saying that is not the case?

Length matters, everything else is a flying spaghetti monster. If you really want to know why, you've got a LOT of reading to do, and probably more math than you've ever wanted to understand, let alone do.

brianlittlejohn

No matter what they say... length matters

travisdh1

@brianlittlejohn said:

No matter what they say... length matters

Yes, I purposely went there. I'm heading home now, latter

BRRABill

@travisdh1 said:

Length matters, everything else is a flying spaghetti monster. If you really want to know why, you've got a LOT of reading to do, and probably more math than you've ever wanted to understand, let alone do.

I also agree with that.

I am just saying isn't

thisisalongpassword

weaker than

thisisa@longpassword

Dashrender

@BRRABill said:

@travisdh1 said:

Length matters, everything else is a flying spaghetti monster. If you really want to know why, you've got a LOT of reading to do, and probably more math than you've ever wanted to understand, let alone do.

I also agree with that.

I am just saying isn't

thisisalongpassword

weaker than

thisisa@longpassword

Yes, of course it is. but thisisalongpassword is way better than P@ssw0rd

BRRABill

@Dashrender said:

Yes, of course it is. but thisisalongpassword is way better than P@ssw0rd

I originally was questioning @scottalanmiller that

password
and
P@ssw0rd

are the same to a computer.

Not arguing anything here. Agree with it all.

Dashrender

@Dashrender said:

thisisalongpassword

according to howsecureismypassword.com

thisisalongpassword

and P@ssw0rd

Dashrender

@BRRABill said:

@Dashrender said:

Yes, of course it is. but thisisalongpassword is way better than P@ssw0rd

I originally was questioning @scottalanmiller that

password
and
P@ssw0rd

are the same to a computer.

Not arguing anything here. Agree with it all.

He was over simplifying it, sure. But both would be in a pre defined dictionary which would take seconds to crack so he does have that on his side.