FTC Chief Technologist Lorrie Cranor wrote in March it is time to reconsider mandatory password changes. Unless there is reason to believe a password has been compromised or shared, requiring regular password changes may actually do more harm than good in some cases. (And even if a password has been compromised, changing the password may …
Even with Little Caesars expanding back into the DC area, there isn’t one that close to my house. But we still get to enjoy their commercials. In this commercial a husband asks the wife for the login password so he can order pizza. She explains that Little Caesars has hot and ready pizza so you …
A couple of good updates if you’re a LastPass Enterprise customer. The LDAP sync utility version has been updated and will now run as a service. Before it ran as an application, and that didn’t work well for me. The LDAP sync talks to your directory and updates new users and disabled/deleted users according to …
A hacking crew D33D posted the results file of a Yahoo hack containing 450 thousand email addresses and passwords. The hack is believed to be a SQL injection attack performed on a Yahoo Voices server. The hackers claim this is but one of many security flaws in Yahoo’s services. Yahoo reports that this is an …
After a recent update to LastPass 2.0, I noticed that Preferences had a setting for PBKDF2 and it was set to 1. What is PBKDF2? The short version is it is a way to make it harder for an attacker to brute-force your password. If you have a password hash, you can attempt to guess …
“Are you tired of losing track of those login/usernames and passwords you create every time you visit a new Web site? Do you have sticky notes and scraps of paper scattered about your office and home computer space covered with these vital pieces of information, but never seem to be able to put your hands …
I don’t plan to mention every security related thing I see in TV, but this one made me chuckle. On The Finder, a new show on Fox, Michael Clarke Duncan’s character, finds a character logged into the computer as him. He asks in his booming voice, “How do you know my password?” The answer, “you say …
Last year at about this time, Qualys and Cyber-Ark announced a new integration. I implemented this last week. Most companies have password policies requiring the expiration of passwords. Yet these policies hardly ever get applied to service and application accounts only users. Many times these service passwords even predate the implementation of strong password requirements. This is …
I was sidetracked by work this morning. As a result everyone and their brother has beaten me to the LastPass blog post. So let me be the millionth person to post “It is the last pass you’ll ever need, until we force you to change it.” LastPass monitors their network, saw an anomaly and in an abundance of caution …