+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Social Engineering (https://sinister.li/Forum-Social-Engineering)
+--- Thread: Cyber Murder (/Thread-Cyber-Murder)
Pages:
1
2
RE: Cyber Murder - mothered - 12-18-2015
(12-18-2015, 01:50 PM)Megan Claus Wrote: and in any system security the people are always the weakest point.
You've hit the nail on the head.
A business can have the best Firewall, Intrusion prevention software, follow best practices with password policies (password complexity requirements, expiration period etc), HDD encryption and so forth. However, all the "technological" side of things means nothing If the person operating the PC, can be SE'd via human manipulation Into simply giving away critical credentials.
RE: Cyber Murder - zombiefied - 12-19-2015
(12-18-2015, 01:58 PM)mothered Wrote: You've hit the nail on the head.
A business can have the best Firewall, Intrusion prevention software, follow best practices with password policies (password complexity requirements, expiration period etc), HDD encryption and so forth. However, all the "technological" side of things means nothing If the person operating the PC, can be SE'd via human manipulation Into simply giving away critical credentials.
Having complicated password policies are not always beneficial, if a user has to have special characters, more than one number and both capital and lower-case characters, they'll write it on a sticky note under the keyboard. If you allow having "dragon1" as a password, the risk that they'll write it down is lower.
RE: Cyber Murder - mothered - 12-19-2015
(12-19-2015, 11:25 AM)zombiefied Wrote: Having complicated password policies are not always beneficial, if a user has to have special characters, more than one number and both capital and lower-case characters, they'll write it on a sticky note under the keyboard. If you allow having "dragon1" as a password, the risk that they'll write it down is lower.
Yes I certainly agree.
A lot of users base passwords on familiarity and personal Interests. As a result, when having multiple account logins, not only Is It easy to remember (and easily compromised by password predictability), but they tend to use the very same password for all accounts. Best practices such as complex passwords, 2FA (two-factor authentication where supported), OTP (One-time passwords), setting up alerts/notifications (to their alternate email address and/or cell phone) when security challenges are performed on their account as well as training & awareness against social engineering attacks, are simply overlooked by most users.
Also, when creating complex passwords, the complexity Isn't that difficult to remember when formatted In a way that denotes the password, but In a different manner. For example, I'll use the password you mentioned of "dragon1". This Is a VERY easy password to crack, but If It's formatted as "Dr4g0N1", due to lower & uppercase letters and 3 numbers, It's complexity significantly Increases, yet Is still familiar to the user.
RE: Cyber Murder - Megan - 12-19-2015
(12-19-2015, 01:45 PM)mothered Wrote: Yes I certainly agree.
A lot of users base passwords on familiarity and personal Interests. As a result, when having multiple account logins, not only Is It easy to remember (and easily compromised by password predictability), but they tend to use the very same password for all accounts. Best practices such as complex passwords, 2FA (two-factor authentication where supported), OTP (One-time passwords), setting up alerts/notifications (to their alternate email address and/or cell phone) when security challenges are performed on their account as well as training & awareness against social engineering attacks, are simply overlooked by most users.
Also, when creating complex passwords, the complexity Isn't that difficult to remember when formatted In a way that denotes the password, but In a different manner. For example, I'll use the password you mentioned of "dragon1". This Is a VERY easy password to crack, but If It's formatted as "Dr4g0N1", due to lower & uppercase letters and 3 numbers, It's complexity significantly Increases, yet Is still familiar to the user.
This, I don't like actually using characters in my passwords, they can be hard to remember and some sites don't like them (their loss) where as most will always accept letters lower and higher and numerals.
I believe more sites should use 2 factor authentication, I have to use a special code to login to my FB from any device that's not my phone.
RE: Cyber Murder - mothered - 12-20-2015
(12-19-2015, 03:56 PM)Megan Claus Wrote: This, I don't like actually using characters in my passwords, they can be hard to remember and some sites don't like them (their loss) where as most will always accept letters lower and higher and numerals.
I believe more sites should use 2 factor authentication, I have to use a special code to login to my FB from any device that's not my phone.
I agree that more sites should support 2FA.
And then there's sites that "claim" to have 2FA Implemented, whereby both forms of authentication are via alternate email addresses. This Is more so two-step verification. Two-factor authentication MUST fall Into separate categories, meaning any two of the following:
* Something you "know" (example a password, answer to a security question).
* Something you "own" (example a cell phone to receive a security code),.
* Something you "are" (example biometrics, such as fingerprint scanning, voice recognition, Iris (retinal) scanning).