.

Why do website fail with login detials

<<

Jamie.R

User avatar

Sr. Member
Sr. Member

Posts: 435

Joined: Mon Aug 06, 2012 9:57 am

Location: UK

Post Tue Aug 14, 2012 5:09 am

Why do website fail with login detials

Hi All,

Why are so many companies finding it hard to have a good way for end user to login to their account?

Recently in the news there have been a few passwords leaked where companies cant even do the basic of encrypting passwords and adding some salt to them. A lot of sites still wont let you add symbols and dont allow over 40 char passwords. Many comapnies still force you into using number and letter and that is it. In this day and age why is every site not using two way authentication?

For me I dont see why everyone is not using two way authentication it seem like more seucre way to go. Dont get me wrong within time this maybe broken but at the moment its the best thing we have.

There are lots way to set it up you can using a mobile like Paypal, online banks and other companies are using. There are also even yubico that are not expensive that can be used for two way authentication.

Do you think its time we moved to a two method authentication system for every website nd every system  we use ?

something I have, and somthing I know is the way to go !!
| OSWP | eCPPT Silver and Gold | eWPT |

I'm an InterN0T'er
<<

RoleReversal

User avatar

Hero Member
Hero Member

Posts: 928

Joined: Fri Jan 04, 2008 8:54 am

Location: UK

Post Tue Aug 14, 2012 7:08 am

Re: Why do website fail with login detials

I think the biggest problem is user acceptance.

You and I may understand the need for two-factor authentication, but Joe Bloggs just wants to access his free email account to share pictures of cute cats. And whilst the cost of 2FA may be relatively cheap (and getting cheaper), if it's still an additional cost to access a 'free' service, most users will complain and look for alternatives.

In the UK, most banks now utilise personal chip and pin readers to provide access based on account cards. But despite banks providing these free to account holders I still know people that complain about the extra 'inconvenience', unable to understand why a simple user/password isn't enough.

Thankfully things may be changing, and I think as more services move to a system where users can choose to implement improved security to access their accounts (whilst I've not used it, Google's mobile phone authentication is a good example) acceptance of more stringent authentication requirements should improve in general users over time; whilst allowing the truly (and rightfully?) paranoid increased security precautions sooner.
<<

m0wgli

User avatar

Sr. Member
Sr. Member

Posts: 308

Joined: Fri Jul 20, 2012 3:34 pm

Post Tue Aug 14, 2012 7:14 am

Re: Why do website fail with login detials

I'd imagine many companies wouldn't consider the additional cost and time of implementing two factor authentication to be worthwhile. The trade off between usability and security also being a major consideration.

Depending upon it's implementation two factor authentication can also have it's own issues:

http://www.infosecisland.com/blogview/1 ... tions.html

http://it.slashdot.org/story/11/12/06/0 ... ngineering

Where additional security measures are available I'll use them but I know plenty of people who don't even when I've told them about them.
Security + | OSWP | eCPPT (Silver & Gold) | CSTA
<<

Jamie.R

User avatar

Sr. Member
Sr. Member

Posts: 435

Joined: Mon Aug 06, 2012 9:57 am

Location: UK

Post Tue Aug 14, 2012 7:30 am

Re: Why do website fail with login detials

Yah some good points made but the problem is always going to be the end user and I think its our jobs as security people and websites to educate their user by explaing why they need to do somthing rather than forcing them or telling them.

Big companies have the money to educated their user but who is training home user  and until we break this where home user are gettign educated security is alway going to be a hugh issue. As home user are taking their bad habbits to work with them and its just a circle.

Many of the banks in the Uk do use devices for authentication but how of the banks really explained why they are using them. I think if you said to anyone this device will help reduce the change people can get access to your money most people would want the device. Instead banks just send the device and say you must use this so people see it as a pain and dont really understand why.
| OSWP | eCPPT Silver and Gold | eWPT |

I'm an InterN0T'er
<<

DataDwarf

User avatar

Newbie
Newbie

Posts: 30

Joined: Wed Jul 25, 2012 4:43 pm

Post Tue Aug 14, 2012 5:30 pm

Re: Why do website fail with login detials

It's a cost/risk analysis.

How much will it cost to implement better security? Remember that some of these systems are running on legacy code. Much of the banking systems in the world are FORTRAN/COBAL. These legacy systems would have to be rewritten from the ground up. A HUGE undertaking as at a HUGE cost.

vs.

How likely is a breach and how much will it cost if/when it happens?


The simple fact is that the cost of a security breach is much less then the cost of upgrading the vast majority of these systems to a higher level of security.
<<

Jamie.R

User avatar

Sr. Member
Sr. Member

Posts: 435

Joined: Mon Aug 06, 2012 9:57 am

Location: UK

Post Wed Aug 15, 2012 3:23 am

Re: Why do website fail with login detials

Some good points but on the other what price do they put on their reputation. Being hacked and having all your customer passwords leacked i think would cost more in the long run.
| OSWP | eCPPT Silver and Gold | eWPT |

I'm an InterN0T'er
<<

m0wgli

User avatar

Sr. Member
Sr. Member

Posts: 308

Joined: Fri Jul 20, 2012 3:34 pm

Post Wed Aug 15, 2012 3:35 am

Re: Why do website fail with login detials

You would think that their reputation would be damaged, but in reality it seems that little actually changes. The vast majority of people still continue to use their services.

Take LinkedIn for example, how many people stopped using it? Their share price even actually rose after the breach.
Security + | OSWP | eCPPT (Silver & Gold) | CSTA
<<

Jamie.R

User avatar

Sr. Member
Sr. Member

Posts: 435

Joined: Mon Aug 06, 2012 9:57 am

Location: UK

Post Wed Aug 15, 2012 7:06 am

Re: Why do website fail with login detials

That is shocking just goes show how many people dont have a clue about things
| OSWP | eCPPT Silver and Gold | eWPT |

I'm an InterN0T'er

Return to Opinions

Who is online

Users browsing this forum: No registered users and 1 guest

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software