Notice Account Security Advice

Evidently so @ShinySideUp ! Yes, although we Admins & Mods discussed getting rid of it many times, it was felt necessary to keep it to avoid infecting the rest of the site with the content that is posted there. That some people never venture outside it is a matter that they might ponder on themselves...
 
I’ve set up the two step security (with email verification) and even though I’m logged in I randomly got yesterday and today verification passes sent to me. I wonder if it’s a glitch or somebody attempting to login here :eek:
 
Personally I just use the passwords generated with Safari, they are saved in my key chain so available on all my Apple devices. And FWIW they are pretty long with numerous letters numbers and other keys thrown in.
 
Marino said:
I’ve set up the two step security (with email verification) and even though I’m logged in I randomly got yesterday and today verification passes sent to me. I wonder if it’s a glitch or somebody attempting to login here :eek:
Click to expand...
No idea about that I'm afraid. If it becomes an issue then it may be worth switching it off again, but I've not seen or been made aware of any hacking attempts the last few days.
 
for password just google with its super hard password and the password manager :)
 
Contax said:
While the advice about using 2FA and (especially) not using the same password on different sites is excellent, the suggestion to regularly change passwords goes against National Cyber Security Centre guidance.

https://www.ncsc.gov.uk/collection/passwords/updating-your-approach
Click to expand...
That's useful guidance, but we need to work with what we have available - passwords and 2FA. Whilst the complexity argument is indeed flawed by human behaviour, it doesn't alter the fact that there are 26 upper case characters, 26 lower case, 10 numeric characters, and (depending on character set) a number of special characters. Consequently as in any cryptographic algorithm, by and large simple character replacement can only take you so far. The longer and more complex the password, the easier it is for the hacker to fall foul of the limited number of failed logins the target system allows. However with complexity comes the desire to write down or store the password, which undermines its effectiveness with a new vulnerability.. For this reason, I like the use of a number of discrete words separated by numbers and characters., to achieve semantic complexity rather than character-set complexity. At least that's my choice. I also like 2FA and always use Face or Fingerprint authentication where possible.
 
lindsay said:
That's useful guidance, but we need to work with what we have available - passwords and 2FA. Whilst the complexity argument is indeed flawed by human behaviour, it doesn't alter the fact that there are 26 upper case characters, 26 lower case, 10 numeric characters, and (depending on character set) a number of special characters. Consequently as in any cryptographic algorithm, by and large simple character replacement can only take you so far. The longer and more complex the password, the easier it is for the hacker to fall foul of the limited number of failed logins the target system allows. However with complexity comes the desire to write down or store the password, which undermines its effectiveness with a new vulnerability.. For this reason, I like the use of a number of discrete words separated by numbers and characters., to achieve semantic complexity rather than character-set complexity. At least that's my choice. I also like 2FA and always use Face or Fingerprint authentication where possible.
Click to expand...
There are multiple vectors of attack against passwords (including shoulder surfing, network sniffing, brute force, re-use, etc.). Using very long/complex passwords - allied to a limited number of permitted failed logins - will go some way to redressing brute force attacks, although most hackers will be using Rainbow Tables these days, which considerably reduces the effectiveness of long/complex passwords or passphrases

What I was referring to above was the suggestion to change passwords on a regular basis. The main benefit of changing passwords is to limit the window of opportunity during which a compromised password can be used. However, the reality is that most attackers will utilise compromised authentication credentials within a very short period of time of their compromise, and the downsides of forcing regular password changes (people choosing less secure passwords, guessable passwords (e.g. going from "password1" to " password2" to "password3") and/or writing them down) more than offsets the increased security from regular changes
 
When setting up any new security please remember that not everyone uses a mobile phone or mobile device, either through choice or down to a disability. This often makes two step authentication very awkward to say the least. Biometric security also does not work reliably for people with certain disabilities/illnesses.
 
Adrian Jones said:
When setting up any new security please remember that not everyone uses a mobile phone or mobile device, either through choice or down to a disability. This often makes two step authentication very awkward to say the least. Biometric security also does not work reliably for people with certain disabilities/illnesses.
Click to expand...
Noted @Adrian Jones which is why we would prefer people to do whatever they can to protect their accounts themselves, which can also include requesting us to set their account to exclude access to the classifieds/marketplace if they wish
 
Contax said:
While the advice about using 2FA and (especially) not using the same password on different sites is excellent, the suggestion to regularly change passwords goes against National Cyber Security Centre guidance.

https://www.ncsc.gov.uk/collection/passwords/updating-your-approach
Click to expand...
Not quite true. It states that requesting customers to frequently change Password can be bad; "Many systems will force users to change their password at regular intervals, typically every 30, 60 or 90 days. This imposes burdens on the user." This can result in users just using slight variations each change or other short cuts.

Dave
 
Dave Canon said:
Not quite true. It states that requesting customers to frequently change Password can be bad; "Many systems will force users to change their password at regular intervals, typically every 30, 60 or 90 days. This imposes burdens on the user." This can result in users just using slight variations each change or other short cuts.

Dave
Click to expand...

My brother was head of IT at a large city council, when a new system was being installed frequently changing passwords ever couple of months was kicked into touch. It was said to be more trouble than it was worth, with people constantly asking IT to reset a forgotten password, writing them down on the desk and people just using the same one and adding a number on the end incrementally.

I know from experience at my last place of work you could tell how long people had worked there by the number on the end of a password, most started a 1 then when forced to change went to 2 and so on.
 
Dave Canon said:
Not quite true. It states that requesting customers to frequently change Password can be bad; "Many systems will force users to change their password at regular intervals, typically every 30, 60 or 90 days. This imposes burdens on the user." This can result in users just using slight variations each change or other short cuts.

Dave
Click to expand...
Doesn't matter whether you say "frequently" or "regularly" - the point is that forcing users to change passwords (other than immediately after a known compromise) is counterproductive and is more likely to weaken security than to strengthen it.
 
Adrian Jones said:
When setting up any new security please remember that not everyone uses a mobile phone or mobile device, either through choice or down to a disability. This often makes two step authentication very awkward to say the least. Biometric security also does not work reliably for people with certain disabilities/illnesses.
Click to expand...
I guess something like a Yubikey would be the way around that, but it would depend on the forum software supporting it.
 
Contax said:
Doesn't matter whether you say "frequently" or "regularly" - the point is that forcing users to change passwords (other than immediately after a known compromise) is counterproductive and is more likely to weaken security than to strengthen it.
Click to expand...
Which is why I included the quote with the numbers. The link you provided to the NCSC might be useful for TP management if they have not already studied it.

Dave
 
We have studied it, thanks, and I acknowledged it's usefulness. We are at present trying to avoid making life harder for members whilst there are easy solutions to improver account security. If we feel the need for tighter protection, we will dig deeper.
 
lindsay said:
We are at present trying to avoid making life harder for members whilst there are easy solutions to improver account security.
Click to expand...
Indeed - there are three factors at play in any security scenario - "Cost", "Security" and "Ease of Use". You can never optimise all three, and for any given context it's a case of finding the right balance between these conflicting requirements.
 
i got sick of trying to remember passwords so i have a system for passwords on different websites, say my amazon account i use every other letter of the name of the website so in this case its aao, then i add my first car registration that i can remember( this is obviously a mixture of letters and numbers), add a character at the end and bobs your uncle, every website i visit has a unique password but something i can remember
 
Hi, i’ve recently reactivated my acount from years ago and change my password. Can I get access to the classifieds again? Thanks
 
For those above who are wanting access to Classifieds and find they don't have it, just use the Contact Us feature (bottom right of screen in the footer) to request Mods action.
 
I would add my reinforcement to this post. Also ensure your protect your domain names. I lost my main domain thinking it was (as it did every year) going to auto renew.
 
Doubly important if you use the domain for the email account that you use to sign up for everything else...
 
Dave Canon said:
Not quite true. It states that requesting customers to frequently change Password can be bad; "Many systems will force users to change their password at regular intervals, typically every 30, 60 or 90 days. This imposes burdens on the user." This can result in users just using slight variations each change or other short cuts.

Dave
Click to expand...

Er, no. the NCSC advice says regular.

NCSC said:

Don't enforce regular password expiry​

Regular password changing harms rather than improves security. Many systems will force users to change their password at regular intervals, typically every 30, 60 or 90 days. This imposes burdens on the user and there are costs associated with recovering accounts.

Forcing password expiry carries no real benefits because:

  • the user is likely to choose new passwords that are only minor variations of the old
  • stolen passwords are generally exploited immediately
  • resetting the password gives you no information about whether a compromise has occurred
  • an attacker with access to the account will probably also receive the request to reset the password
  • if compromised via insecure storage, the attacker will be able to find the new password in the same place
Instead of forcing expiry, you should counter the illicit use of compromised passwords by:

  • ensuring an effective movers/leavers process is in place
  • automatically locking out inactive accounts
  • monitoring logins for suspicious behaviour (such as unusual login times, logins using new devices)
  • encouraging users to report when something is suspicious
Click to expand...

The words frequently and frequent do not appear anywhere in the linked article.

I suppose there is a minor debate over whether the example of changing passwords every 90 days is frequent or not (for myself I would consider that to be infrequent) but the rest of the section talks only about the poor value in any forcing of password expiry at any interval whatsoever.
 
Hadn't realised that 2fa was available - I didn'tsee the option on the security page at first. Activated now
 
lindsay said:
@Plain Nev The concern primarily is that if someone hijacks your account they might put up a sale notice, and using your long standing on the site, someone might feel it safe to send you money for said sale item. Except it won't be going to you, it'll be going to Russia, India, China, or wherever.
Our life would be much much easier without HT and Classifieds, but we know a lot of people like and use those sections, so we keep them.
Click to expand...
Is there a way to forbid or opt out accounts like mine from participating on the Classified or Buy & Sell sections?

I live in the Philippines and it would be too much of a hassle and headache to ship items from here to the US, UK, EU, AU, NZ, etc.
 
dolina said:
Is there a way to forbid or opt out accounts like mine from participating on the Classified or Buy & Sell sections?

I live in the Philippines and it would be too much of a hassle and headache to ship items from here to the US, UK, EU, AU, NZ, etc.
Click to expand...
There is and I have removed classifieds access for your account.
 
As someone quite techy I am ashamed to say my password here is far too easy. Will secure up.
 
Not been on for a while but my account is still active and would like it to continue.
My prferences are people and portraiture, with a little techy stuff on the side.
 
You must log in or register to reply here.
Back
Top