Password Complexity, Good or bad?
-
@Dashrender said:
@JaredBusch said:
@scottalanmiller said:
The thing that you have can be a file. SSH Keys + Passphareses are two factor and are completely free (in the same way knowing your password is free, without getting into the "nothing is free" theories.) There is no money spent in that way.
How do you use SSH Keys to log into your windows desktop?
Scott did mention that his 2FA was all after desktop logon.
@scottalanmiller said:
Google Authenticator is free, based on the assumption that the devices like phones and such already exist. If you assume that users have no computers, have no phones, etc. then yes, you would need to provide something.
You are pushing the requirement of a smartphone onto all office users. Are you going to pay for the required use of their personal smart phone?
Personally, I don't have an issue with this. You want to work here, you must have a device that's able to run this 2FA software. At the time of hire we can negotiate if needed around any compensation - but frankly I think those days are past. When I have employees demanding that I provide free WiFi for them so they can watch their home video camera system to watch their dog or kids get home from school - I think I can put some demands back on them...
Of course you can, but it is a cost you have to accept as a business. It is not free, ever. Period.
-
@Dashrender said:
if you know the password, the whole discussion is moot. But if you know the user's password is only lower case letters, you know the set size is 26. It's only worth talking about in situations where you don't know the password.
But how do you find that out? That's the thing. Once you are getting an arbitrary set of the possible chars why do you assume it is "all lower case" and not just the actual set? Why one ASCII set and not another?
It's not how these things work. If you are getting a limited set, you already know a lot about the password.
-
@JaredBusch said:
You are pushing the requirement of a smartphone onto all office users. Are you going to pay for the required use of their personal smart phone?
Lots of companies do this. NTG provides phones, so yes, that's how they deal with it. But lots just require it. Should they, that's a different discussion. But do they, absolutely.
-
@travisdh1 said:
@Dashrender said:
if you know the password, the whole discussion is moot. But if you know the user's password is only lower case letters, you know the set size is 26. It's only worth talking about in situations where you don't know the password.
Right. Which is why I know that most password policies that require a certain amount of special characters, upper case, lower case and numbers, actually reduce the number of possible passwords in use.
While it might socially reduce it, how does it actually reduce the number? By socially I mean that users will do $ocial instead of $social because they (the user) wants it to be easier to remember. But that is on the user, not the system.
But you're right, like this whole thread.. that add the requirement of complexity itself moves people to make bad choices for their own simplicity... which is bad for security.
-
@scottalanmiller said:
@JaredBusch said:
You are pushing the requirement of a smartphone onto all office users. Are you going to pay for the required use of their personal smart phone?
Lots of companies do this. NTG provides phones, so yes, that's how they deal with it. But lots just require it. Should they, that's a different discussion. But do they, absolutely.
The company is providing a phone, then that is an expnse the company has taken on to handle it. Again that makes it not free, which is the entire point, you stated 2FA is free and it is not.
-
@Dashrender said:
@travisdh1 said:
@Dashrender said:
if you know the password, the whole discussion is moot. But if you know the user's password is only lower case letters, you know the set size is 26. It's only worth talking about in situations where you don't know the password.
Right. Which is why I know that most password policies that require a certain amount of special characters, upper case, lower case and numbers, actually reduce the number of possible passwords in use.
While it might socially reduce it, how does it actually reduce the number? By socially I mean that users will do $ocial instead of $social because they (the user) wants it to be easier to remember. But that is on the user, not the system.
Forcing "complexity" itself is a social thing.
I think this actually made me realize what the problem is... no complexity is added. No complexity is checked. Using the term complexity itself is marketing and extremely misleading.
If the system was complexity checking, it would be looking at the size of the set, not that random pieces of different human visible sets are selected. It's not checking complexity, calling it that is a means of socially engineering end users to "feel better" about something that isn't true. It sounds nice, it helps them sleep at night, but it's not more complex at all.
-
@JaredBusch said:
@scottalanmiller said:
@JaredBusch said:
You are pushing the requirement of a smartphone onto all office users. Are you going to pay for the required use of their personal smart phone?
Lots of companies do this. NTG provides phones, so yes, that's how they deal with it. But lots just require it. Should they, that's a different discussion. But do they, absolutely.
The company is providing a phone, then that is an expnse the company has taken on to handle it. Again that makes it not free, which is the entire point, you stated 2FA is free and it is not.
Sure, and that's what I said, if we are assuming that things like phones, desktops, etc. are not already paid for then the 2FA is not free. We provide phones without 2FA, though. So if we did 2FA on them, 2FA is free.
This gets into the "the word free is useless" category. Like my friends who say that food can't be free unless someone else eats and poops it for you (real conversation where they disputed free software because you were still required to operate it.) It's free to the way that humans mean to use the term free... it itself incurs no cost outside of the use of it.
-
@scottalanmiller said:
This gets into the "the word free is useless" category. Like my friends who say that food can't be free unless someone else eats and poops it for you (real conversation where they disputed free software because you were still required to operate it.) It's free to the way that humans mean to use the term free... it itself incurs no cost outside of the use of it.
LOL I remember that conversation!
-
@scottalanmiller said:
@JaredBusch said:
@scottalanmiller said:
@JaredBusch said:
You are pushing the requirement of a smartphone onto all office users. Are you going to pay for the required use of their personal smart phone?
Lots of companies do this. NTG provides phones, so yes, that's how they deal with it. But lots just require it. Should they, that's a different discussion. But do they, absolutely.
The company is providing a phone, then that is an expnse the company has taken on to handle it. Again that makes it not free, which is the entire point, you stated 2FA is free and it is not.
Sure, and that's what I said, if we are assuming that things like phones, desktops, etc. are not already paid for then the 2FA is not free. We provide phones without 2FA, though. So if we did 2FA on them, 2FA is free.
This gets into the "the word free is useless" category. Like my friends who say that food can't be free unless someone else eats and poops it for you (real conversation where they disputed free software because you were still required to operate it.) It's free to the way that humans mean to use the term free... it itself incurs no cost outside of the use of it.
The use of the term free here is constrained by the context of the conversation.
Said context is that I stated 2FA is not going to see a huge roll out in the office scenario. Implied in that, because of our past knowledge of each other, is the fact that I mean the SMB space.@Dashrender stated that cost is the factor, and I agreed while you stated it could be free.
Most SMB do not provide equipment to all of their office staff capable of doing anything with 2FA. So to add that piece is a cost to the business.
The context of all IT decisions have to be based on the business.
-
@JaredBusch said:
The use of the term free here is constrained by the context of the conversation.
Said context is that I stated 2FA is not going to see a huge roll out in the office scenario. Implied in that, because of our past knowledge of each other, is the fact that I mean the SMB space.Most SMB do not provide equipment to all of their office staff capable of doing anything with 2FA. So to add that piece is a cost to the business.
Agreed, but I've seen several SMBs in a number of spaces that either require the use of your existing phones or provide them. Sure many don't or won't, but many don't care about 2FA either.
-
@scottalanmiller said:
@JaredBusch said:
The use of the term free here is constrained by the context of the conversation.
Said context is that I stated 2FA is not going to see a huge roll out in the office scenario. Implied in that, because of our past knowledge of each other, is the fact that I mean the SMB space.Most SMB do not provide equipment to all of their office staff capable of doing anything with 2FA. So to add that piece is a cost to the business.
Agreed, but I've seen several SMBs in a number of spaces that either require the use of your existing phones or provide them. Sure many don't or won't, but many don't care about 2FA either.
Absolutely. I know of several myself. But that is far from even a large minority of the SMB I am personally familiar with. I am quite comfortable with my statement above that Most SMB do not.
-
@JaredBusch said:
@scottalanmiller said:
@JaredBusch said:
The use of the term free here is constrained by the context of the conversation.
Said context is that I stated 2FA is not going to see a huge roll out in the office scenario. Implied in that, because of our past knowledge of each other, is the fact that I mean the SMB space.Most SMB do not provide equipment to all of their office staff capable of doing anything with 2FA. So to add that piece is a cost to the business.
Agreed, but I've seen several SMBs in a number of spaces that either require the use of your existing phones or provide them. Sure many don't or won't, but many don't care about 2FA either.
Absolutely. I know of several myself. But that is far from even a large minority of the SMB I am personally familiar with. I am quite comfortable with my statement above that Most SMB do not.
I agree, most do not. But I think that those mostly overlap with those that aren't looking for 2FA, too.
-
I have a scenario going on right now.
A local hospital is deploying 2FA to all offsite personal who access their systems. They offer two choices for 2FA
- when you log in, your default phone number will be called, you press 1 to indicate that you did log in, and the system allows you in.
- you are provided a key fob and type the number when prompted.
Option 1 assumes that there is a direct phone number to you - be that a DID to a phone in your office, or a cell phone.
Management in my office denied this option because they are of the opinion that personal phones can't be demanded to be used for work without paying the employee for phone use (even though it amounts to $5 or less per month, employees would undoubtly try to get something ridiculous like 50% of the phone bill paid for - so management just said no)
This unexpected refusal by my office to use phones as 2FA means the hospital has to purchase and support 80+ key fobs for my office alone. They have a near countless number of offices that have remote access to their systems. I'm sure the cost of key fobs is what has stalled this project.
-
@Dashrender I would agree with management on this as well. If they aren't already paying for employees phones, it's much easier to manage a keyfob and access that way.
But it makes the employee have to keep track of 1 more item. But the headache of managing cell phones for as many people as you're describing seems to be way more painful.
-
@Dashrender said:
I have a scenario going on right now.
A local hospital is deploying 2FA to all offsite personal who access their systems. They offer two choices for 2FA
- when you log in, your default phone number will be called, you press 1 to indicate that you did log in, and the system allows you in.
- you are provided a key fob and type the number when prompted.
Option 1 assumes that there is a direct phone number to you - be that a DID to a phone in your office, or a cell phone.
Management in my office denied this option because they are of the opinion that personal phones can't be demanded to be used for work without paying the employee for phone use (even though it amounts to $5 or less per month, employees would undoubtly try to get something ridiculous like 50% of the phone bill paid for - so management just said no)
This unexpected refusal by my office to use phones as 2FA means the hospital has to purchase and support 80+ key fobs for my office alone. They have a near countless number of offices that have remote access to their systems. I'm sure the cost of key fobs is what has stalled this project.
Part of the issue here is that this is for non-employee access. We assume, to some degree, that employees have some amount of company provided equipment already. But non-employees, that's no longer a reasonable assumption.
-
@DustinB3403 said:
@Dashrender I would agree with management on this as well. If they aren't already paying for employees phones, it's much easier to manage a keyfob and access that way.
But it makes the employee have to keep track of 1 more item. But the headache of managing cell phones for as many people as you're describing seems to be way more painful.
Managing cell phones? LOL - I'm of the opinion... guess what folks, you're job has changed - if you already have a cell phone, you will be required to use it for work - to take a call for 2FA. Period. but that's just me - the a$$hole.
those who don't have a cell phone, we'll provide a fob.But even if we did go so far as to pay employees for cell phone use, we should just pay them a pure stipend of $5-10 a month. If someone wants to contest how much we are costing them.. I would encourage them to bring in their phone bill and we could sit down and figure the cost the employee was incurring because of these phone calls. Often it would be zero because the employees have huge number min plans and the added use of 20 or less mins a month wouldn't even be noticed... but even if you skip the flat rate large mins setup.. and simply say bill divided by mins (which is unfair to the employer because most of them have data and it wouldn't take data usage into account) and figured a per min value, I suppose it's possible, even likely that the above stated 20 mins would be more expensive than $10 a month... but all other caveats still apply and really don't make that a business tenable setup.
-
@scottalanmiller said:
Part of the issue here is that this is for non-employee access. We assume, to some degree, that employees have some amount of company provided equipment already. But non-employees, that's no longer a reasonable assumption.
From a hospital perspective, sure. But those staff do work somewhere, otherwise they wouldn't have access at all. And that other employer is providing some equipment, in this case the PCs.. not the phones or any phone stipend.
-
@Dashrender said:
@DustinB3403 said:
@Dashrender I would agree with management on this as well. If they aren't already paying for employees phones, it's much easier to manage a keyfob and access that way.
But it makes the employee have to keep track of 1 more item. But the headache of managing cell phones for as many people as you're describing seems to be way more painful.
Managing cell phones? LOL - I'm of the opinion... guess what folks, you're job has changed - if you already have a cell phone, you will be required to use it for work - to take a call for 2FA. Period. but that's just me - the a$$hole.
those who don't have a cell phone, we'll provide a fob.But even if we did go so far as to pay employees for cell phone use, we should just pay them a pure stipend of $5-10 a month. If someone wants to contest how much we are costing them.. I would encourage them to bring in their phone bill and we could sit down and figure the cost the employee was incurring because of these phone calls. Often it would be zero because the employees have huge number min plans and the added use of 20 or less mins a month wouldn't even be noticed... but even if you skip the flat rate large mins setup.. and simply say bill divided by mins (which is unfair to the employer because most of them have data and it wouldn't take data usage into account) and figured a per min value, I suppose it's possible, even likely that the above stated 20 mins would be more expensive than $10 a month... but all other caveats still apply and really don't make that a business tenable setup.
Ha this reminds me of the weirdos in FL that if their service went down for 30 minutes they would want a full month's refund. When in reality it cost them about $0.07 (if they had a$100 a month bill).
-
@Dashrender said:
Managing cell phones? LOL - I'm of the opinion... guess what folks, you're job has changed - if you already have a cell phone, you will be required to use it for work - to take a call for 2FA. Period. but that's just me - the a$$hole.
How far does that go? They have to provide a car, computer, etc.? It's a tough one, and it crosses legal lines if you have to protect data. For purely 2FA if the call is fully free, it's not bad. But do you really limit it to those times, and make sure you never interrupt them while sleeping, travelling, vacation, etc.? It introduces a lot of issues.
While I know that nearly everyone does it, I don't like it. Or as an option, never as a requirement.
-
@johnhooks said:
Ha this reminds me of the weirdos in FL that if their service went down for 30 minutes they would want a full month's refund. When in reality it cost them about $0.07 (if they had a$100 a month bill).
That's not how it works, though. They didn't pay for "all but 30 minutes". What if it was during that 30 minutes that they needed to use the phone? One person's "that doesn't affect them" could be "that was down for the whole month for me."
You can't assume that the service has equal value for the whole month. What if you had a financial trading system and it was down for five minutes. You say... what, five minutes out of a month, that's nothing. They say... but we lost five million in traders (more than the service fee) and thousands of customers.
If you are paying for something to be there and it isn't, you didn't get what you paid for. What if you bought a Big Mac and they "only" left out the burger (actually, that's how I get it.) Would you be okay paying 75% because only one little ingredient was missing?
