Close
  • Latest News
  • Artificial Intelligence
  • Video
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Subscribe
Logo
  • Latest News
  • Artificial Intelligence
  • Video
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Subscribe
    Home Applications
    • Applications
    • Cloud
    • Cybersecurity
    • IT Management
    • Mobile

    Password Security, How Does It Work?

    Written by

    P. J. Connolly
    Published February 25, 2011
    Share
    Facebook
    Twitter
    Linkedin

      eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

      I thought it was silly of Gawker Media to taunt world-plus-dog to test its IT security, only to be caught napping last year when its systems were compromised. But when your whole business is IT security, it’s even more embarrassing to be caught reenacting the tale of the cobbler’s children.

      In that story, the cobbler was so busy making shoes for the village that his own children had to run around barefoot. This is-after being updated for the 21st century-pretty much what happened to security consultancy HBGary and its subsidiary HBGary Federal. From what I understand, one or more of the company’s executives thought that it was a good idea to use the same password for Twitter, LinkedIn and the firm’s content-management system. That became a problem after HBGary Federal’s CEO Aaron Barr decided that he was going to try to infiltrate the hacktivists collectively known as “Anonymous.” He was successful in doing so, but after revealing himself, apparently thought that his company was immune to retaliation.

      But Barr’s sloppiness with passwords gave his enemies enough of a toehold to allow them to break into the consultancy’s e-mail server in early February and capture about 50,000 documents and messages. For the last few weeks, the two firms have been the butt of jokes, especially after HBGary posted a “pity me” sign in place of its booth at the RSA Conference in San Francisco.

      Here’s the thing that makes this situation even more amusing than the Gawker debacle: HBGary was soliciting clients by letting them believe that its team knew better than to reuse passwords among key systems. (I’m sure that wasn’t actually in the pitch, but it was one of those things that you assume is there in much the same way that one assumes that a LAN uses Ethernet.) On top of that, HBGary had offered its services to Bank of America as experts in fighting back against WikiLeaks and in turn, Anonymous. This is the Internet’s equivalent of waving a red cape in front of a bull; do it enough, and you’re likely to be gored.

      More likely than not, from some of the e-mail that I’ve seen that passed between Barr and one of his top coders, arrogance played a part in the debacle. The problem with the “can’t touch this” attitude is that it’s only valid while the people who want to take you down have better things to do.

      I’m sure that the HBGary executives were thinking the same thing most of us do: “I’m kind of busy right now, and I’ll change it to something stronger when I have a little more time.” I’ve done that more times than I care to think about, as I noted in December when the Gawker story broke. Since then, I’ve become a little bit better at resisting the temptation to slap a quick and dirty password on an account. But I’m still doing it from time to time, as I realized the last time I ordered a cable from my new favorite vendor for such things.

      I’m convinced that practicing password security in the fashion that many security experts say we should is just too much bother for all but a handful of people. “Easy to remember, hard to forget” only gets one so far if the password has to be rotated every month or two. Maybe we really are better off carrying around a piece of paper full of random characters with a few real passwords embedded in the randomness. This “poor man’s steganography” has to be a better approach to password security than what we have today.

      P. J. Connolly
      P. J. Connolly
      P. J. Connolly began writing for IT publications in 1997 and has a lengthy track record in both news and reviews. Since then, he's built two test labs from scratch and earned a reputation as the nicest skeptic you'll ever meet. Before taking up journalism, P. J. was an IT manager and consultant in San Francisco with a knack for networking the Apple Macintosh, and his love for technology is exceeded only by his contempt for the flavor of the month.

      Get the Free Newsletter!

      Subscribe to Daily Tech Insider for top news, trends & analysis

      Get the Free Newsletter!

      Subscribe to Daily Tech Insider for top news, trends & analysis

      MOST POPULAR ARTICLES

      Artificial Intelligence

      9 Best AI 3D Generators You Need...

      Sam Rinko - June 25, 2024 0
      AI 3D Generators are powerful tools for many different industries. Discover the best AI 3D Generators, and learn which is best for your specific use case.
      Read more
      Cloud

      RingCentral Expands Its Collaboration Platform

      Zeus Kerravala - November 22, 2023 0
      RingCentral adds AI-enabled contact center and hybrid event products to its suite of collaboration services.
      Read more
      Artificial Intelligence

      8 Best AI Data Analytics Software &...

      Aminu Abdullahi - January 18, 2024 0
      Learn the top AI data analytics software to use. Compare AI data analytics solutions & features to make the best choice for your business.
      Read more
      Latest News

      Zeus Kerravala on Networking: Multicloud, 5G, and...

      James Maguire - December 16, 2022 0
      I spoke with Zeus Kerravala, industry analyst at ZK Research, about the rapid changes in enterprise networking, as tech advances and digital transformation prompt...
      Read more
      Video

      Datadog President Amit Agarwal on Trends in...

      James Maguire - November 11, 2022 0
      I spoke with Amit Agarwal, President of Datadog, about infrastructure observability, from current trends to key challenges to the future of this rapidly growing...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2024 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.