Comments on: You give out your passwords every day http://blog.forret.com/2007/02/you-give-out-your-passwords-every-day/ and I mean it Wed, 18 Nov 2009 21:45:03 +0100 http://wordpress.org/?v=2.8.4 hourly 1 By: Erlend http://blog.forret.com/2007/02/you-give-out-your-passwords-every-day/comment-page-1/#comment-53604 Erlend Thu, 15 Feb 2007 08:57:21 +0000 http://blog.forret.com/2007/02/you-give-out-your-passwords-every-day/#comment-53604 I always use sFTP when possible, and all my websites use client-side encrypting when logging into a secure area(Javascript). SSL would be beter, but that is not always an option! I always use sFTP when possible, and all my websites use client-side encrypting when logging into a secure area(Javascript). SSL would be beter, but that is not always an option!

]]> By: Maxim http://blog.forret.com/2007/02/you-give-out-your-passwords-every-day/comment-page-1/#comment-53407 Maxim Thu, 15 Feb 2007 00:44:07 +0000 http://blog.forret.com/2007/02/you-give-out-your-passwords-every-day/#comment-53407 Oh, by the way, I just found http://www.sxipper.com/, an extension to firefox which provides multisite authentication and is made by... sxip (pronounce "skip"), the company of Dick Hardt, who made the presentation I linked in my last comment Just as example, websites like technorati or the blog platform wordpress have integrated openid as a authentification method, allowing you to share your your identity across websites (and I apologize because in fact I wanted to post this more recent presentation : http://www.identity20.com/media/ETECH_2006/) Oh, by the way, I just found http://www.sxipper.com/, an extension to firefox which provides multisite authentication and is made by… sxip (pronounce “skip”), the company of Dick Hardt, who made the presentation I linked in my last comment

Just as example, websites like technorati or the blog platform wordpress have integrated openid as a authentification method, allowing you to share your your identity across websites

(and I apologize because in fact I wanted to post this more recent presentation : http://www.identity20.com/media/ETECH_2006/)

]]> By: Maxim http://blog.forret.com/2007/02/you-give-out-your-passwords-every-day/comment-page-1/#comment-53380 Maxim Wed, 14 Feb 2007 23:42:18 +0000 http://blog.forret.com/2007/02/you-give-out-your-passwords-every-day/#comment-53380 @Robin : there is http://keepass.info/ , an opensource software hosted on sourceforge which provides password storage in a highly secured way (read AES). And, coincidence, a plugin for firefox was just released! Maybe this is the beginning of a solution... The problem with secured protocols (whether it is FTPS, IMAPS, POPS or even SSL or SFTP) is that it has a heavy load on servers and, as said Peter, it is expensive to deal with it because you'll have to invest in more powerful servers or to buy many for load balancing... I was jocking earlier, talking about IPv6 (because it is not used today by individuals), though the idea of authentication could be a first way to deal with clear passwords without using a secure (read "encrypted") layer. Ok, the password is sent in a clear way but if you are not who you claims to be, you are rejected. You can think about solutions like http://openid.net/ (and if you don't know what it is, you should check this (famous) presentation : http://www.identity20.com/media/OSCON2005/) Any thoughts? @Robin : there is http://keepass.info/ , an opensource software hosted on sourceforge which provides password storage in a highly secured way (read AES). And, coincidence, a plugin for firefox was just released!

Maybe this is the beginning of a solution…

The problem with secured protocols (whether it is FTPS, IMAPS, POPS or even SSL or SFTP) is that it has a heavy load on servers and, as said Peter, it is expensive to deal with it because you’ll have to invest in more powerful servers or to buy many for load balancing…

I was jocking earlier, talking about IPv6 (because it is not used today by individuals), though the idea of authentication could be a first way to deal with clear passwords without using a secure (read “encrypted”) layer.
Ok, the password is sent in a clear way but if you are not who you claims to be, you are rejected.

You can think about solutions like http://openid.net/ (and if you don’t know what it is, you should check this (famous) presentation : http://www.identity20.com/media/OSCON2005/)

Any thoughts?

]]> By: Robin Wauters http://blog.forret.com/2007/02/you-give-out-your-passwords-every-day/comment-page-1/#comment-53360 Robin Wauters Wed, 14 Feb 2007 23:10:03 +0000 http://blog.forret.com/2007/02/you-give-out-your-passwords-every-day/#comment-53360 Related but not really on-topic: I have a nasty tendency to use the same user name and password for every service I subscribe or register for. I'm always concerned about the fact that anyone who has access to the 'back-ends' (admins, helpdesk people, etc.) of those services might try logging on to other well-known services with that data. For example: a Wordpress support employee could try and log on to Gmail with the same user name and password I provided in your Wordpress account, and he'd get in just like that. The only way to avoid this is to use different user names and password for each service(or only the 'critical' ones), but how could you keep track, if you're used to registering for all kinds of beta stuff out of interest? Related but not really on-topic:

I have a nasty tendency to use the same user name and password for every service I subscribe or register for. I’m always concerned about the fact that anyone who has access to the ‘back-ends’ (admins, helpdesk people, etc.) of those services might try logging on to other well-known services with that data.

For example: a Wordpress support employee could try and log on to Gmail with the same user name and password I provided in your Wordpress account, and he’d get in just like that. The only way to avoid this is to use different user names and password for each service(or only the ‘critical’ ones), but how could you keep track, if you’re used to registering for all kinds of beta stuff out of interest?

]]> By: Peter http://blog.forret.com/2007/02/you-give-out-your-passwords-every-day/comment-page-1/#comment-53348 Peter Wed, 14 Feb 2007 22:37:55 +0000 http://blog.forret.com/2007/02/you-give-out-your-passwords-every-day/#comment-53348 Gmail, Hotmail and Yahoo web-based mail do the authentication over https, so those are secure. For the others: POP3S, IMAPS and SMTPS would be better, but I don't think providers will start offering them, it would be too expensive. FTP: SFTP (file transfer over SSH) works great if your host allows SSH. CMS (e.g. Wordpress/Drupal) login: one could consider Javascript hashing? Gmail, Hotmail and Yahoo web-based mail do the authentication over https, so those are secure.
For the others: POP3S, IMAPS and SMTPS would be better, but I don’t think providers will start offering them, it would be too expensive.

FTP: SFTP (file transfer over SSH) works great if your host allows SSH.

CMS (e.g. Wordpress/Drupal) login: one could consider Javascript hashing?

]]> By: Maxim http://blog.forret.com/2007/02/you-give-out-your-passwords-every-day/comment-page-1/#comment-53344 Maxim Wed, 14 Feb 2007 22:33:06 +0000 http://blog.forret.com/2007/02/you-give-out-your-passwords-every-day/#comment-53344 We should wait for IPv6 and full IPsec support for authentification (at least) and encryption? :p We should wait for IPv6 and full IPsec support for authentification (at least) and encryption?

:p

]]>