PUBLIC DEFENDER By Brian Livingston A new feature of Microsoft’s Edge browser is causing our readers to ask, “Is this MS initiative going to place our
[See the full post at: Should you give Microsoft all of your passwords?]
|
There are isolated problems with current patches, but they are well-known and documented on this site. |
-
Should you give Microsoft all of your passwords?
- This topic has 37 replies, 16 voices, and was last updated 2 years, 3 months ago.
AuthorViewing 23 reply threadsAuthor-
-
-
There are many web sites where I wouldn’t care if the name and/or password is hacked, including more than a few that apparently require a username and password only because it makes their owners feel important. The Firefox feature that offers to save and automatically fill in a username and password is useful in these situations.
1 user thanked author for this post.
-
There are many web sites where I wouldn’t care if the name and/or password is hacked
Of course, I do the same, I store passwords for printers in chrome – its basically the same password for approx. 100 IP addresses. Its faster than typing it all the time.
Also, I store my password for AskWoody, created wesbsites and ohter blogs. I dont consider that to be so risky nor painfull to lose some login to the website.
Those logins that I value the most, I dont store anywhere. I always type ’em.Dell Latitude 3420, Intel Core i7 @ 2.8 GHz, 16GB RAM, W10 22H2 Enterprise
HAL3000, AMD Athlon 200GE @ 3,4 GHz, 8GB RAM, Fedora 29
PRUSA i3 MK3S+
1 user thanked author for this post.
-
The Firefox feature that offers to save and automatically fill in a username and password is useful in these situations.
Yes! I’ve been using Fx and its forks since Netscape died. I’ve never been much of a IE or Edge user and would never touch Google junk. I trust Mozilla and its main fork I use as my default browser (Basilisk) to treat my saved logins in an honorable way. I also write all logins down on paper. I have about 50 pages of written down logins …front and back of each page so actually about 100 pages of saved logins since I got my first computer in 1999.
I had third party software years ago to manage and save the logins and then disaster struck the software so I began writing each down on paper and also letting Fx, and later Basilisk, save and manage them. I couldn’t possibly memorize all of them and I don’t believe in ever using the same login for more than one site.
2 users thanked author for this post.
-
I did some Goggling on the alternates, Authenticator App, and FOB key. I was surprised on one comment in where a reader used Authenticator App and then had to reset or buy a new phone. He was completely locked out of all his accounts because the Authenticator was on his phone!
That’s easily mitigated: just keep a copy of the QR code.
When setting up an Authenticator token, the website will generate a unique QR code on screen, at which you point your camera. In addition to snapping the QR code with the Authenticator app, also take a regular photo or screenshot of it. If you ever have to reset or change your phone, just reinstall the Authenticator app and point it at your saved copy of the QR code. Job done.
And for those who don’t know, the Google Authenticator app can be used for more than just Google. All TOTP (“Time-based One Time Passcode”) apps work the same, so the authenticator apps from Google, Microsoft, Facebook, Authy, et al, are interchangeable. You only need one, and it can be configured with TOTP tokens for multiple sites.
Beyond TOTP, and if it’s a Google account you’re talking about, note Google can also generate a series of “Backup Verification Codes” that you can print and store offline, to be used when your normal 2FA method isn’t available. That’s always a good safety measure.
1 user thanked author for this post.
Re: Authenicator App and being locked out…
To avoid lockouts, you need to backup your encrypted Authenticator file just like you need to backup your encrypted password file. And when you do backup these sensitive files, encrypt them again. For example, mine are backed up within an encrypted disk. And keep multiple backed up copies in different locations. Make sure you pick Password Managers and Authenticator Apps that give you a means to back them up, such as storing the user data in an encrypted file.
Windows 10 22H2 desktops & laptops on Dell, HP, ASUS; No servers, no domain.
1 user thanked author for this post.
Was or will [known flaws in the global cellular network] be fixed?
If you’re in the US, don’t hold your breath. The telcos hold too much power and resist any attempt to force them to spend money fixing their product.
Like the banking and credit card industries (witness how they dragged their feet implementing chip-and-pin), the US telco industry lags behind the rest of the world.
Since text 2FA is so much simpler to set up and use than the Authenticator App …
I would disagree. Setting up a TOTP authenticator is nearly as easy as setting up text-based 2FA.
Install and launch the authenticator app, then tell the service provider (e.g., Google, Facebook, or Microsoft) that you want to set up 2FA, and they’ll display a QR code with an embedded secret key. Point your smartphone’s camera at the QR code, and voila! The only thing left to do is tell the provider what 6-digit code your authenticator is showing, just so the provider can confirm both of you are using the same secret key — a desirable safety measure before they go ahead and enable 2FA on your account.
As for using an authenticator, I find it much easier than texts — just pop open the authenticator and the code is right there, waiting for you to copy it. You don’t have to wait for a text to arrive, which at times may take several minutes or never arrive at all. I’ve also been in places where I have a wired ethernet connection on a computer to get into my email, but no cell connection. In that scenario, waiting for a texted code would be futile. In contrast, the authenticator app doesn’t need a cell connection to work.
The only problem to that is that the 3 choices seem to be offered together after entering a password so a hacker could still use the cell text option, unless the cell text option could be blocked.
That depends on what service you’re talking about, but with Google accounts the answer is yes, the text option can be disabled.
On my account I have three 2FA methods enabled but not the voice/text option. When logging in from an unknown device, the 2FA prompt appears after the username and password are entered, but the prompt has a “Try another way” link that lets me select the second or third method if my primary method is not available. The voice or text option is not offered under “Try another way” because I don’t have that option set up.
-
However, since the thief still has a locally working phone he can still access your account with the authenticator codes on the phone.
In this case, you should immediatelly block your phone from the second device. Usually from PC. You can lock iOS phone remotly, phone with Android and Google account too. I suppose you can lock phone with MS Account too somehow, but I have no experience with that.
Dell Latitude 3420, Intel Core i7 @ 2.8 GHz, 16GB RAM, W10 22H2 Enterprise
HAL3000, AMD Athlon 200GE @ 3,4 GHz, 8GB RAM, Fedora 29
PRUSA i3 MK3S+
1 user thanked author for this post.
So the conclusion is this?
The 2FA via SMS is not safe, because attacker could see your SMS code on the lock screen. But still needs to know your “Whatever account” password to gain access.
+ Attacker must have your phone and break the password, lets say 10 alphanumeric characters or worse.MS Authenticator seems good, but if someone stoles you phone and unlocks it, they can gain access everywhere. Without any password.
+ Attacker must break 4-6 numbers, or gesture/picture/fingerprint.If FOB is lost and no password needed, you are doomed.
+ Attacker must have the FOB, then has access instantly, or needs to crack passowrd, again, lets say 10 alphanumeric characters or worse.Neither way is totally safe. I would say its adequatelly safe. And thats all. The less you put into online world, the more secure you are.
Dell Latitude 3420, Intel Core i7 @ 2.8 GHz, 16GB RAM, W10 22H2 Enterprise
HAL3000, AMD Athlon 200GE @ 3,4 GHz, 8GB RAM, Fedora 29
PRUSA i3 MK3S+
3 users thanked author for this post.
I have a question related to this thread. General audience media stories always say to use a complex password so dictionary (or brute force) attacks that try hundreds or thousands of passwords will not figure your password out. In my experience with banking, etc. if my password is entered incorrectly 3 or 4 times, the account is locked and requires a visit or live phone call to reset using security questions. I asked an officer at my bank branch and they said this type of attack would not succeed at their bank.
My question is, do these attacks succeed and if so how? I can understand that knitting-tips.com might not have great security rules, but major banks, etc. do.
Can someone at AskWoody or in the audience explain this disconnect? Thanks!
1 user thanked author for this post.
-
Most brute force attacks occur offline, against a leaked or stolen password database.
In case of an offline attack where the attacker has access to the encrypted material, one can try key combinations without the risk of discovery or interference. However database and directory administrators can take countermeasures against online attacks, for example by limiting the number of attempts that a password can be tried, by introducing time delays between successive attempts, increasing the answer’s complexity (e.g. requiring a CAPTCHA answer or verification code sent via cellphone), and/or locking accounts out after unsuccessful login attempts.
Brute-force attack — Countermeasures [Wikipedia]
Windows 11 Pro version 22H2 build 22621.2361 + Microsoft 365 + Edge
3 users thanked author for this post.
Livingston’s newsletter article makes the argument for using a password manager (instead of letting the browser store them), and using 2FA when available:
The best security, which you should always use when it’s available, is two-factor authentication (2FA). After you enter a username and password, a website sends a code to a different device — the second factor. Done right, this is almost totally unhackable.
That’s somewhat misleading, though.
First, 2FA doesn’t have to involve a website sending a code. That may be true for text-based 2FA, but authenticators, security fobs, and biometrics (face ID, fingerprint/palm readers, iris scan) don’t require a website to send a code anywhere. That’s part of their strength because texts can be intercepted en route to your phone.
Second, it’s a little cavalier to say something is “almost totally unhackable”. As doriel points out, you can be vulnerable if your second factor is compromised — which isn’t a rare or unthinkable possibility.
But the whole point of 2FA is to make it more difficult for the bad guys, even if you can’t make it impossible for them.
The “factors” in 2FA fall into three categories:
- something you know (e.g., password, mother’s maiden name, combination lock code)
- something you have (e.g., house key, phone, security fob, safe deposit box key)
- something you are (e.g., fingerprint, iris scan, face ID)
Two-Factor Authentication requires items from two different categories, with the theory being that it is much more difficult for a bad guy to steal items from two categories than two items from one category. So even if you lose your phone or fob, a bad guy would still need to know your account name and password (and the stronger, the better) to make use of your stolen Authenticator token.
But getting past that, my signing in is mostly non Microsoft stuff such as bank, insurance, retail sites and it seems like I would have to have app for all of those if they even allow it
Remember, TOTP apps are the same. You don’t need a separate app for each site. One TOTP app can serve different tokens for different sites.
(Aside: some TOTP apps have an extra security option of requiring a PIN to open the app. Google Authenticator does not, so it’s not my preferred choice. But my main point is under the hood they all generate the ever-changing 6-digit code the same way.)
As for sites that support TOTP authentication … IME, few banks do. It boggles the mind.
if my password is entered incorrectly 3 or 4 times, the account is locked and requires a visit or live phone call to reset using security questions.
Note that’s about how your bank handles password attacks. That won’t help stop a hacker if he already has your valid password. But 2FA will.
Note that asking for “security questions” isn’t 2FA. If your bank asks for your password and then follows it up with a security question, both items fall into the same category of “something you know”. That’s often called Two-Step Authentication, which is better than one step but not as strong as Two-Factor. It’s not as strong because if somebody knows you well enough to know your password, they may also know your favorite pet’s name, etc.
1 user thanked author for this post.
That’s often called Two-Step Authentication, which is better than one step but not as strong as Two-Factor. It’s not as strong because if somebody knows you well enough to know your password, they may also know your favorite pet’s name, etc.
Which is why you use a password manager and make up answers to those questions, saving said answers in the password manager. Even you can’t guess the correct answer.
Strong random passwords and any sort of 2FA is much better than a password you can remember.
cheers, Paul
1 user thanked author for this post.
if my password is entered incorrectly 3 or 4 times, the account is locked
Don’t forget your laptop that you accidently leave in your unlocked car with your saved passwords while the thief is watching. Your laptop does not lock out after 3 tries. I found a website (don’t remember which one but you can Google search) that does a test brute force attack on any password you want to test. It tells you how long it would take to break it. Basically it said a password with random numbers, letters, etc of 12 characters would take over a 100 years to break with today’s super computers. A simple 4 character common name would be instant. However, that time gets less as computers get faster.
Even with 3 try lockout it is better to have a long password so if your bank’s data base gets hacked a password of “keic8ue3e9fc8ueuod87fi4eui” is much less likely to be used than “rover”. Of course you cannot type “kdji4eoi9de9ud9” every time so either use a password manager or write the password in a text file that you can copy/paste at log in.
2 users thanked author for this post.
-
When talking about passwords, its a fact, that the longer the passowrd is, the longer it takes to “guess” it. The function depending on number of characters is exponetial, not linear. It means, that with every character added to your password you make it much harder to crack it.
One guess takes milisecon (for example).
One alphanumerical character password:
36 possibilities; 36 x 1ms = 36 msTwo alphanumerical character password:
36 ^ 2 possibilities; 1296msTen alphanumerical character password:
36 ^ 10 possibilities; 3656158440062976ms = 115 936 years
For curiosity, that is.. (Wolframalpha link here)
So even “Strongpassword123” (length 17) is better, than “kdji4eoi9de9ud9” (length 15). Its not nesscessary to have difficult password, but its important to have a long password.
Dell Latitude 3420, Intel Core i7 @ 2.8 GHz, 16GB RAM, W10 22H2 Enterprise
HAL3000, AMD Athlon 200GE @ 3,4 GHz, 8GB RAM, Fedora 29
PRUSA i3 MK3S+
The GRC.com website has a Password Haystacks section for checking length and complexity.
“Strongpassword123” (length 17) is better, than “kdji4eoi9de9ud9”
Except that an attacker would try a dictionary attack as well as random and the longer password will be found relatively quickly. If you are going to use common words you need to add more length and / or extra characters, e.g. “Strong.;password#123” or “Strongverylongpassword123”
cheers, Paul
-
Or at least some unexpected uppercase: StrongpaSSworD123 should be enough. There is too many combinations even for the dictionary attack.
Dell Latitude 3420, Intel Core i7 @ 2.8 GHz, 16GB RAM, W10 22H2 Enterprise
HAL3000, AMD Athlon 200GE @ 3,4 GHz, 8GB RAM, Fedora 29
PRUSA i3 MK3S+
1 user thanked author for this post.
-
Shouldn’t the discussion take into consideration that the attacker will (very likely) not know the length of the password, and so will have to start at some minimum length and work his way up? Most websites that I’ve seen require at least 6 characters, so if your password is 12 characters, wouldn’t the attacker have to try all 6-character passwords, then all 7-character passwords, and so on? The cumulative time for that seems to be beyond the reach of anyone and anything available, even if dictionary words are used.
-
-
The issue is less about guessing passwords as using the same password on multiple sites, so ones from a breach are automatically valid.
Using a password manager to generate long passwords is just a good way to manage your online accounts.
cheers, Paul
-
-
-
No.
Really? Why even discuss this?
Google’s about to begin changing user passwords if they show up on some compromised pwd’s lists. Read that again. “We changed your password to protect you from yourself!” Stay dumb, your phone is your brain, we do your thinking, you don’t know how.
Passwords written on sticky notes are more secure than those trusted to any online so called manager.
The idea that companies can trash the small remaining trust they may have by compromising security and privacy is a snake eating its tail. Lawsuits don’t matter, they have more money than many small countries combined. Unfortunately, it’s a very, very long snake.
Additionally, if they can raid your accounts based on some initiative a half asleep team conjured up, what else are they doing that’s hidden from users? Unless a third party is managing pwds or they’re somehow hidden, there’s no privacy at all.
1 user thanked author for this post.
-
Google’s about to begin changing user passwords if they show up on some compromised pwd’s lists. Read that again. “We changed your password to protect you from yourself!”
Despite the ghacks.net headline, it’s not automatic:
Google announced today that it is bringing a new security feature to the company’s Chrome web browser that informs users about compromised passwords and lets them change these passwords to a secure new password instantly.
…
Chrome users who prefer to stay in control can do so, for instance by ignoring the feature.Windows 11 Pro version 22H2 build 22621.2361 + Microsoft 365 + Edge
1 user thanked author for this post.
wouldn’t the attacker have to try all 6-character passwords, then all 7-character passwords,
I tried a gobbledygook 7 char password on the password tester on security.org and it quoted 19 minutes to break. So I think the hacker would have plenty of time to go through all combinations up to 10 which shows a month to crack and then 11 chars 4 years. I don’t think the hacker sits their waiting, but probably more like a chat situation where your stolen laptop is started while working on your offline bank account. 12 chars looks like the minimum at 400 years.
1 user thanked author for this post.
12 chars looks like the minimum at 400 years
12 is not long enough. 18 to 20 is the place to start, then it will take several centuries – assuming it is guessed in 10% of the time it takes to perform an exhaustive search.
cheers, Paul
Viewing 23 reply threads
Plus Membership
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
Get Plus!
Recent Topics
-
What Windows Really Needs [Pure OPINION]
by 2 hours, 19 minutes ago
-
“Winmail.dat” attachments when email is sent from Outlook to Thunderbird
by 2 hours, 42 minutes ago
-
win 11 22H2 Memory itegrity error
by 4 hours, 43 minutes ago
-
McLaren Health Care 6TB data breach
by 5 hours, 26 minutes ago
-
Long Live the Red Envelope Era | Farewell to DVDs | Netflix
by 7 hours, 33 minutes ago
-
Faststone Image Viewer updates
by 1 day, 9 hours ago
-
Malicious ad served inside Bing’s AI chatbot
by 1 day, 9 hours ago
-
win10 pro 22H2 current minus 1 mo,to, win11. suggestions…
by 22 hours, 23 minutes ago
-
Microsoft entered negotiations to sell Bing to Apple in 2020
by 1 day, 19 hours ago
-
X CEO shows her iPhone’s Home Screen – and X isn’t there
by 1 day, 20 hours ago
-
Keeping an older Mac secure
by 1 day, 20 hours ago
-
Thunderbird – problem ”setting up existing email address”
by 1 day, 20 hours ago
-
Windows 11 Insider Preview build 23555 released to DEV
by 2 days, 7 hours ago
-
Something didn’t go as planned KB5030310, KB 5030219
by 20 hours, 48 minutes ago
-
“Enhanced” search box
by 2 days, 8 hours ago
-
Windows Ends Installation Path for Free Windows 7/8 Upgrade
by 2 days, 9 hours ago
-
Icon text drop shadows latest Win 11 update
by 2 days, 3 hours ago
-
Group Policy to change context menu to Win10 version?
by 2 days, 10 hours ago
-
You can no longer activate newer Windows 11 builds with Windows 7/8/8.1 keys
by 1 day, 9 hours ago
-
Reddit is removing the option to prevent Reddit from tracking ..
by 2 days, 18 hours ago
-
Vivaldi for iOS and iPadOS released
by 2 days, 18 hours ago
-
Windows 11 attempted update to 22H2 results in Error Code 0x8024001e
by 2 days, 7 hours ago
-
lock screen goes black after ~ 25-30 secs.
by 2 days, 3 hours ago
-
Need File Location Which Lists Default Apps Used
by 1 day, 3 hours ago
-
Canadian’s identify alternative tape that prolongs life of laptop batteries
by 3 days, 4 hours ago
-
Browswers and Windows 11
by 3 days, 5 hours ago
-
Advice on whether to upgrade to Windows 11
by 3 days, 5 hours ago
-
Linuxmint LMDE 6 Officially Released
by 2 days, 8 hours ago
-
Edge browser – ad quality concern
by 1 day, 4 hours ago
-
Strange problem after upgrade from Win10Pro 22H2 to Win11Pro 22H2
by 2 days, 19 hours ago
