Cybersecurity

10644 readers

1 users here now

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

Be respectful. Everyone should feel welcome here.
No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
No Ads / Spamming.
No pornography.

Community Rules

Idk, keep it semi-professional?
Nothing illegal. We're all ethical here.
Rules will be added/redefined as necessary.

If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !securitynews@infosec.pub !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub

Notable mention to !cybersecuritymemes@lemmy.world

founded 3 years ago

MODERATORS

kid@sh.itjust.works

Lanky_Pomegranate530@midwest.social

The Password Paradox: Why Security Theater is Making Us Less Safe (jakubjirak.medium.com)

submitted 1 month ago by schipelblorp@sh.itjust.works to c/cybersecurity@sh.itjust.works

57 comments fedilink hide all child comments

Microsoft’s research team studied this extensively. They looked at what actually happens when you enforce complexity requirements. Users don’t create randomly generated passwords. They follow predictable patterns. Capital letter at the start. Numbers at the end. Exclamation point at the very end. The word “Password” appears in about eight percent of “complex” passwords. When you force rotation, users increment numbers. Summer2024 becomes Fall2024. Or they add exclamation points. Or they change a single character and call it done. The false sense of security is dangerous. IT departments see compliance numbers go up. Everyone is following the password policy. The auditors are happy. Meanwhile, actual security hasn’t improved at all.

you are viewing a single comment's thread
view the rest of the comments

[–] Cricket@lemmy.zip 0 points 1 month ago (1 children)

Also, there’s no lockdown after X attempts. I can try infinitely, as far as I’m aware.

Eh, AFAIK that's not a best practice anyway, at least not any low number. From what I recall, the recommendation is to either have a high number of attempts that causes a lockout (50+?) or high-priority alerts when a large number of invalid attempts is detected. One of the problems with lockouts based on X attempts, especially low numbers like you often see, at least in my mind, is that it opens people up to a denial of service attack. Let's say that all account names are predictable, like first initial and last name. A rogue user could lock out anyone they wanted to with that knowledge. What if they know or can easily predict the usernames for all admins or IT people in the organization and they lock them all out?

[–] ricecake@sh.itjust.works 0 points 1 month ago

Typically you want to do the lockout for a location, not the user, or you step up the auth level. 3 bad logins -> please mfa before trying again.

But yeah, letting an attacker do that at will is bad. I'm a fan of token bucket rate limiting with exponential back off. You get 10 attempts. A new attempt is added every second. An attempt while the bucket is empty makes that become two, then four and so on.

Most people never notice because a buffer of ten and a new attempt every second just never runs out. If you accidentally hold down enter you're only blocked for a few moments. A dumb attacker quickly locks themselves out forever.