NIST Guy Who Came Up With Hair-Tearing Password Requirements Says He’s Sorry.

The “NIST midlevel manager” who came up with the crazy password requirements – well, technically, recommendations. You know, must include special characters, uppercase and lower case letters, alphanumeric – says that he’s sorry and that “much of what [he] did [he] now regret[s].” As the Wall Street Journal explains, Bill Burr was a manager at […] read more

Longer Passwords Is The Way To Security.

In a continuation to the post from last week, it looks like it’s not only the FTC’s Chief Technologist that is waging war against the periodic renewal of passwords. The National Institute of Science and Technology (NIST) is apparently onboard as well, and they will also be recommending that something be done about password complexity […] read more

Frequent Password Changes Not A Secure Data Security Practice.

According to the Federal Trade Commission’s Chief Technologist, forcing users to frequently change their password can be counterproductive when it comes to fighting data breaches. Mind you, it’s not the frequency itself that leads to security weaknesses. Rather, it’s what happens at the weakest link in most security systems — individual behavior — that leads […] read more

Sharing Passwords is Hacking, Which is a Federal Crime.

The controversies regarding cyberspace just keep burning brightly. In the past couple of weeks, the Ninth Circuit Court of Appeals ruled that the unauthorized sharing and use of passwords can be deemed as hacking, and thus can be a violation of the Computer Fraud and Abuse Act (CFAA). As noted by motherboard.vice.com and others, this […] read more

Apple Security Could Be About Marketing But It’s Also About Security.

I’ve been contemplating on the FBI’s accusations that Apple is using encryption and security as a marketing ploy to sell more phones. So what if it is? It doesn’t mean that Apple’s arguments regarding security are any less true just because they’re using it to push phones. Remember when Blackberry was the device to have […] read more

IRS Hacked, 101K PINs For Electronic Tax Filing Stolen (aka, What’s New?).

According to csoonline.com, the IRS had to block unknown persons or person who was downloading a massive trove of PINs used for electronic tax filing: The attack occurred in January and targeted an IRS Web application that taxpayers use to obtain their so-called Electronic Filing (E-file) PINs. The app requires taxpayer information such as name, […] read more

Ashley Madison Passwords Easy To Crack After All.

Ah, Ashley Madison.  Even as one tries to move away from it to other issues, new problems surface like toxic malaise at a swamp: fraudulent $19 data scrubbings, men being conned by bots, some of the weakest passwords known to mankind securing their servers, an ex-CTO who supposedly hacked the competition…  Michael Corleone, I get […] read more

Password Security: Ashley Madison Patrons Had Terrible Passwords.

Last week, motherboard.com reported that 4000 cracked passwords belonging to Ashley Madison customers were “awful,” security-wise.  The site went on to conclude that: It’s understandable for users to be frustrated with Ashley Madison for failing to protect their data. But when customers are choosing passwords that could probably just be guessed, they need to take […] read more

Data Encryption: Creating Passphrases That You Can Memorize While Thwarting Would-Be Monitors.

Over at firstlook.org, The Intercept has an article on creating passphrases (not passwords) that are strong and memorizable.  The trick lies in the number of elements (that is, how many words are used in the passphrase) and randomness.  Indeed, the principle is not different from how encryption works to secure data.  For example, AlertBoot’s managed […] read more