main

Password imperfect

malebolgia   on 09 December 2004 - 23:28 · 20 comments & 1673 views

Advertisement (Why?)
For years, Microsoft has hammered away at the security flaws in its desktop operating system. Now the company is looking to plug another security hole: weak passwords.

People tend to choose easy-to-remember passwords--which means they're easy to crack. Even complex passwords can be stolen. They've moved from a security measure to a security risk, says Microsoft Chair Bill Gates, who for the past year has been publicly urging customers to stop relying on passwords. Last month, the software giant set an example for those customers when it kicked off a big push to adopt a second security measure for its internal networks: smart cards for every employee.

By the end of 2005, tens of thousands of telecommuting Microsoft employees will be issued the cards, which will be required to log on to the company's networks. "Moving to biometric and smart cards is a wave that is coming, and we see our leading customers doing this," Gates told attendees at the IT Forum in Denmark last month. "In time, we will completely replace passwords." This isn't the first time Microsoft has got behind smart cards as a second line of protection for businesses.

News source: C|Net News.com


B]Features:[/B]

· The best PC performance: Choose between a silent running mode or the best graphics performance settings and the wizard automatically adjusts all performance metrics (clocks, voltages, fan speeds, bus speeds, etc.) to get the best options for the hardware in the system.
· Improved dynamic overclocking: Provides on-the-fly overclocking and BIOS configuration within an easy-to-use Windows interface that is streamlined and simplified for better user understanding.
· Benchmarking wizard: See how your PC configuration stacks up against synthetic benchmarks before and after adjusting system parameters.
· Saved system profiles: Save, import, and export custom overclocking or BIOS profiles. Assign profiles to favorite programs for automatic application. A safety "watchdog" checks temperature and steps system down if failure could occur.
· GPU overclocking: Overclocking of GeForce FX and GeForce 6 Series GPUs is supported in concert with system overclocking, temperature monitoring, and system profiles.
· System troubleshooting: An automated reporting tool captures all needed information to help you determine when problems may be happening to the system, and helps you troubleshoot.
· Improved system monitoring: Temperatures, voltages, and bus speeds are now available as an “always-on-top” window with a transparency option so that it is visible at all times.
· Voltage and bus speed monitoring: Track actual motherboard voltages, GPU clocks, bus speeds, and CPU core speed to ensure safe and correct settings.
· Temperature and fan speed monitoring: Real-time monitoring of CPU, GPU and system temperatures helps prevent hardware damage. nTune supports dual-CPU and SLI multi-GPU systems.
· Dynamically adjustable voltages and fan speeds: Adjust motherboard voltage levels without a reboot, as well as dynamically control fan speeds.
· Dynamically adjustable memory timings: Change critical memory timings without rebooting and without entering the BIOS.

Post a comment · Send to friend Comments · There are 20 additional comments
#1 WinMacLin on 09 Dec 2004 - 23:38
I have seen some stuff done with USB Flash keys. holds a special identy which is plugged into the front USB (well any USB really just front for easy access) to allow people access to there user account on the windows computer and also have all cookies and other stuff kept on the USB key for security.

Its neat. But no one uses this computer but me.
(3 replies) #2 NetRyder on 10 Dec 2004 - 00:24
Would be nice to have a biometric reader built into my laptop.
#2.1 pat_593 on 10 Dec 2004 - 00:55
I wonder if someone could design a trackpad that also functioned as a fingerprint reader.
#2.2 nic on 10 Dec 2004 - 04:22
or why not just the "home row" on your keyboard. It could read all of your digits when you place your hand on the keyboard, and power on accordingly.
#2.3 shao on 10 Dec 2004 - 09:00
some of ibm's thinkpads have thumbprint readers built right into the case.
http://www.theregister.co.uk/2004/10/05/biometric_thinkpad_t42/
(2 replies) #3 moeburn on 10 Dec 2004 - 01:12
I've had someone steal my keys. I've never had someone read my mind.
#3.1 noll3095 on 10 Dec 2004 - 01:16
Anyone ever look over your shoulder?
#3.2 Jon on 10 Dec 2004 - 13:28
moeburn, you've completely lost the point:

QUOTE
People tend to choose easy-to-remember passwords--which means they're easy to crack


The key word there is crack. They don't need to read your mind, just a nice ntlm hash or similar and a bit of time.
(1 reply) #4 Kushan on 10 Dec 2004 - 01:23
You know I think pass phrases are much better to go by in the short term, it may be easy to guess a single word, but an 18 + character passphrase? To me that would be alot safter than just handing out keys to everyone, which could be far more easily stolan than a password of decent size cracked.
Biometric stuff, however, is probably the best rout in the end. Fingerprint scanners, iris scanners, stuff like that would be almost impossible to crack unless you plan on lopping off some poor bugger's hand or something.
#4.1 dotRoot on 10 Dec 2004 - 07:11
Smart Cards aren't just swiped and *bam* you are in. You have a PIN that goes with it. And at least for the air force its 8 digits at least.
(1 reply) #5 epheterson on 10 Dec 2004 - 01:33
Passwords will NEVER fade away. It's simply impractical to imagine a world where every person has with them, at all times, a card that is used to identify them. I could imagine coming out of my shower, going to unlock my computer and slowly glancing back at my dirty pile of clothes.. which burries my smart card in some unknown pocket. Not just that, imagine I want to give access to my computer to a friend, simply telling him 'blahblah879', I'd have to be around him every time he wants to log on. Using smart cards for internet passwords simply don't make sense, it defy's the laws of the internet - what you want where you want it. If you're traveling with a friend and have forgotten your smart card, you're screwed, your email can wait for a rainy day.

It might hit small, but it won't hit big. If anything is going to happen it'd be fingerprints, but even that isn't a perfect method. Whoops, paper cut!
#5.1 NetRyder on 10 Dec 2004 - 02:19
You could have a fingerprint reader that holds multiple profiles from more than one of your fingers so that you could use any one of them. The chances of getting a paper cut on all of them wouldn't be very high anyway.

I agree with your point about smart cards though...not very convenient. Biometric readers are the way to go.
#6 SquareSoft0 on 10 Dec 2004 - 03:44
User input errors, you get what you deserve.
#7 nemo on 10 Dec 2004 - 04:19
Motorola does that with their Upper Tier phone programming software. You need a dongle (a physical key device) which plugs into the computer and then a hardware fingerprint to load the software. It's been cracked - but it's very hard to do, and not many people have it.
(1 reply) #8 quick on 10 Dec 2004 - 04:48
QUOTE
Microsoft Chair Bill Gates, who for the past year has been publicly urging customers to stop relying on passwords.


Heh... if Microsoft haven't yet completely rolled this out on themselves.. how can they expect the avg small business to change to this system anytime soon....
#8.1 lare2 on 10 Dec 2004 - 07:58
Looks like they are always jumping late
#9 kev^ on 10 Dec 2004 - 05:29
passwords: the more characters, the longer it takes to crack down. The more variety of different characters, again the longer to crack down.

Why aren't I seeing unix-variants such as Linux or BSD Distributors say things even similar to what the Chairman of M$ has just said of "don't rely on passwords".

Make a better operating system, then tell to companies n individuals what to do. Until then, improve security as you always seem to need it.
#10 Caboose447 on 10 Dec 2004 - 07:28
QUOTE
You know I think pass phrases are much better to go by in the short term, it may be easy to guess a single word, but an 18 + character passphrase? To me that would be alot safter than just handing out keys to everyone, which could be far more easily stolan than a password of decent size cracked.
How many people do you think could remember an 18+ character passphrase? Most people can't remember a 4 character password for that patter! Biometric scanners are a lot better! Iris, or fingerprint scanning. Even palm scanning would be best! Plus its a lot cooler than a smartcard or a password or passphrase!
#11 schwit on 10 Dec 2004 - 07:46
This is a smoke screen to take the focus off of the weekly list of new security problems in Windows and Internet Explorer.
#12 Surr3al on 10 Dec 2004 - 16:21
Passwords are definately unsafe when I can just put a bootable linux cd in an XP machine and delete the passwords database thus giving me local admin control to a machine.

Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.

Advertisement (Why?)