I understand your desire to hear or receive your password from someone when you lose it. It sounds simple: I lose my password, ask for it and then receive it.
Unfotunately it is the question that is wrong. You should never be able to read a password, let alone send it from a system. If you type in a nw pasword it should only be stored in an ncrypted form (you can easily look up how Windows servers do this). If you are asked to confirm a password, only the encrypted version of it should be compared to the encrypted version of it that is stored somewhere safe.
If you ask someone (helpdesk, manager or whoever) "can you give me my password" their answer should be "no, I cannot. You can reset your password in the following way.....".
The policy is very simple and is deployed and used in many systems. If you work on a LAN it is highly likely that nobody will be able to tell you your passord from a system (if you have told or emailed them your password yourself this is a different matter of course).
If you are storing emails with the history of your passwords of various systems than that is a security risk. Life is full of risks, and this one is well intended. If you search for "password" in your emails and delete all emails that have a readable password in them you would be a lot safer. The systems that you forget passwords for should have alternatives for peole who forget them.
O2 should drop the bad practice of emailing passwords because it exposes their customers to more risk than should be acceptable. O2 should adhere to known industry good practice in the interest of their customers. It should not have to be very expensive and it would reflect positively on O2.
A lot of shoulds in there, I know.
cheers.
Unfotunately it is the question that is wrong. You should never be able to read a password, let alone send it from a system. If you type in a nw pasword it should only be stored in an ncrypted form (you can easily look up how Windows servers do this). If you are asked to confirm a password, only the encrypted version of it should be compared to the encrypted version of it that is stored somewhere safe.
If you ask someone (helpdesk, manager or whoever) "can you give me my password" their answer should be "no, I cannot. You can reset your password in the following way.....".
The policy is very simple and is deployed and used in many systems. If you work on a LAN it is highly likely that nobody will be able to tell you your passord from a system (if you have told or emailed them your password yourself this is a different matter of course).
If you are storing emails with the history of your passwords of various systems than that is a security risk. Life is full of risks, and this one is well intended. If you search for "password" in your emails and delete all emails that have a readable password in them you would be a lot safer. The systems that you forget passwords for should have alternatives for peole who forget them.
O2 should drop the bad practice of emailing passwords because it exposes their customers to more risk than should be acceptable. O2 should adhere to known industry good practice in the interest of their customers. It should not have to be very expensive and it would reflect positively on O2.
A lot of shoulds in there, I know.
cheers.
Last time I forgot my password and it was 18 months ago, it was sent in clear text in an email.
The article says it's not good yet doesn't mention any decent alternatives. The most common I've come across is the web link to change. Problem being if you are on a browser that doesn't support the website it's a pain and I'm talking mobile devices here. Amusingly, the easiest way I remember is by keeping hold of emails as I forget the password to the password locker program I have!
Not an easy subject really to come up with any decent answer to the best policy. Believe me, in my job, I have to use strong passwords across multiple applications and I hate trying to come up with a new one every so often. Also comes down to what we want to tolerate.
"Working on" as in creating/developing/programing or as in using?
- 27019 Posts
- 247 Topics
- 1614 Solutions
