Login Fatigue Is Plaguing Organizations, 1Password Study Finds - Page 1
Forum section: electronics / general

author: Black Phoenix
author_rank: Super Contributor
timestamp: September 21, 2022, 10:00:17 am
content: https://vpnoverview.com/news/login-fatigue-is-plaguing-organizations-1password-study-finds/QuoteQuoteRegarding myself, I don't use 1Password, since having my credentials in the cloud is not my dream. I've been using since 2008 an opensource app called Keypass that creates a database file and have support officially or via the community in most systems as Linux, iOS, Windows Mobile and even Symbian.The only think I need to remember is when I make changes to the database as adding a new entry, to sync with all the others (if different entries were made in 2 different systems and I didn't replace the main file before it) or plainly replace the copy (if it was only one system and all copies are the same old version).Yubikey would be an alternative no?

author: Someone
author_rank: Super Contributor
timestamp: September 21, 2022, 10:16:07 am
content: Quote from: Black Phoenix on September 21, 2022, 10:00:17 amNo, it can be a part of a replacement but alone its a pretty opaque blob that you dont know what its doing and requires handing over control/trust to the service you connecting it with (some services won't let you have multiple/backup hardware keys registered!)

author: dferyance
author_rank: Regular Contributor
timestamp: September 21, 2022, 01:53:47 pm
content: Most of the multiple logins and password issues in organizations are self-inflicted. If I already logged into my work computer, why would I need to log into anything else? I'm authenticated, my session has a ticket, everything should accept that ticket. No need to login again. Either the software used isn't properly configured to trust the organization's Kerberos authentication or the software isn't well-designed and shouldn't be used.I have to jump through hoops every time I access office-online from my computer. It requires a username, password and 2FA. However, if I run the office programs, which access exactly the same documents and data, it doesn't prompt me. That's a sign something isn't setup right. If I can get in without 2FA, it is optional, than is 2fa really doing anything for security?Much of it too is these online services. They all have their own user accounts and passwords. But it is a solved problem. ADFS works. But either people sign up for online services without consulting IT or security or IT doesn't know or care about having single authentication. Makes user management a nightmare too. Think of all the accounts IT has to shut down when someone leaves, many IT doesn't even know about.

author: Marco
author_rank: Super Contributor
timestamp: September 21, 2022, 02:47:46 pm
content: I fear Apple will run away with secure login.Passkeys are still a complete PITA if they can't be painlessly synced across trusted devices, U2F has been intentionally designed to make that impossible ... it's a mess (I suspect having dongle manufacturers be part of the standard process was not a good idea). Apple will not follow them down that rabbit hole. Better to have Apple's proprietary sanity than open standard insanity.

author: eti
author_rank: Super Contributor
timestamp: September 21, 2022, 02:53:58 pm
content: The man you need to speak to is Steve Gibson of GRC. He’s the de facto authority on this stuff. Listen to his “Security Now” podcast.

author: hans
author_rank: Super Contributor
timestamp: September 21, 2022, 03:21:40 pm
content: Quote from: dferyance on September 21, 2022, 01:53:47 pmExactly. My employer uses Microsoft 2FA for everything. It's annoying to say the least to login into e-mail, teams, etc. a couple timesper daywhen using multiple machines (I use 3 on an almost daily basis).I've now resorted to installing Thunderbird and Office in a VM on my NAS. If I want to access e-mail/documents, I remote into that machine. Far more usable.For some reason, using the Office365 plugin with Thunderbird only requires 2FA once

author: Ed.Kloonk
author_rank: Super Contributor
timestamp: September 21, 2022, 03:59:01 pm
content: Somebody told me this yesterday:What's Forrest Gump's password?1forrest1Sorry.

author: madires
author_rank: Super Contributor
timestamp: September 21, 2022, 07:00:10 pm
content: If you need strong authentication to limit access to important things then it's, of course, more cumbersome than a simple password. However, there are solutions to deal with this for a long time. One problem I see is that the large platforms/vendors are re-inventing their own version of the wheel. And since most users use services from all major platforms/vendors they can't simply use one authentication method to access all services. Instead, some services share one authentication method, other servcies another one, and so on The IT department rarely can make all services SSO.. There are also environments which require different autentication methods for each realm for security reasons (network segmentation). Another problem is laziness and lack of training, i.e. many users don't understand the purpose of all those cumbersome logins. Yes, people are that smart. And if you still think that all this is a nuisance try entering secured areas/environments which require much more than a password.

author: thm_w
author_rank: Super Contributor
timestamp: September 21, 2022, 08:39:53 pm
content: Quote from: hans on September 21, 2022, 03:21:40 pmKinda confusing statement here, as you agree with them but then what you write sounds like something isn't setup correctly.Can you not just leave the machines logged in to your account and lock them?

author: hans
author_rank: Super Contributor
timestamp: September 21, 2022, 10:30:34 pm
content: I was commenting on the difference between native and browser apps. I never press any logout button.. it seems to have a mind of it's own and does that by itself. I cannot configure 'anything'. It does this in any browser I use. I always VPN to home so IP stays the same. Meanwhile, the integration via Thunderbird does not have this issue.I hear the same compliant from colleagues that run their stuff on company managed installs in Windows. My 3 machines include 2 Linux laptops and a Linux desktop that's dual booting. It's inevitable these get shutdown as I'm not a fan of standby mode with sudden wake-ups (Linux power management is kind of iffy).

author: thm_w
author_rank: Super Contributor
timestamp: September 22, 2022, 01:14:09 am
content: Ah browser access and linux would make sense. Presumably closing the browser clears whatever auth cookie was there, or it expires after a certain amount of time it doesn't see you online.

author: amyk
author_rank: Super Contributor
timestamp: September 22, 2022, 02:47:36 am
content: "Password manager company says using password managers will help."

author: vk6zgo
author_rank: Super Contributor
timestamp: September 22, 2022, 03:23:03 am
content: Quote from: amyk on September 22, 2022, 02:47:36 amWell-duhhh....It's bad enough that I need a PIN number to get into my own personal computer to talk crap on EEVBlog, but I'm being pushed to change to any of a dozen competing complex ID systems.Meanwhile, the "bogeyman" can use my debit card to make multiple purchases without needing my PIN number.It seems craptalk is more precious than my life's savings!

author: eti
author_rank: Super Contributor
timestamp: September 22, 2022, 04:03:51 pm
content: Old, simpler ways are best:Have a notebook, and inside the notebook you write all your passwords. You label the notebook “Recipes” or “Germination records for dandelion seeds” or something equally as boring sounding.You keep the notebook in the same place all the time.Solved.

author: RJSV
author_rank: Super Contributor
timestamp: September 22, 2022, 08:30:36 pm
content: Just happening now:Dermatologist is a specialist utilized by my main doctor, and that Dermatology office is a 'sub-structure' in the network I've been encountering...So they use a 'Healthcare Portal, supplementing the main doctor's Web Portal.But NOW, that Dermatology specialist needs a skin tag removal done, and so now there is a SECOND sub-level, having the similar LOG-ON Password creation / account creation (needing documents submitted by camera).So, that's THREE log-in style 'Portals', each needing an entry, into my 'BLUE' personal note book/ journal...Often, I've had to spend seemingly endless time, calling doctor's customer representatives, trying to unsnag snafues like:Screen flips to other menu stuff, just as I lift my finger to 'Enter Password'. Android phones not so good, the office staff has said, "Please come into office and bring your phone,...so we can help figure out YOUR GLITCH in phone entry, there." YEAH, MY Fault...I've sometimes contemplated doing a STRIKE ! Not allowing ANY questions, from anyone, (except traffic cops),... NOT cooperating with anyone...until they obtain from me, a PASSWORD / LOGIN NAME...Sorry, let's play this like I see it...You need 911 call, Broken Leg ?Response cheerfully supplied...but ACCOUNT REQUIRED, for any answers.ON STRIKE, For password 'justice', for geeks like me!

author: PlainName
author_rank: Super Contributor
timestamp: September 23, 2022, 02:31:03 pm
content: Quote from: eti on September 22, 2022, 04:03:51 pmRubbish. I have 507 security details (not all passwords - some are multiple passwords along with security questions and various other details) and just finding the right one would be a pain, never mind adding new ones (where? With a notebook it can only be the end, so any organisation is screwed). Then you have to consider maintenance, like the ones that insist the password is changed every month, and can't be similar to the preceding 10 or so (so all of those need to be tracked).If you can keep all that in a notebook you're either reusing passwords, using stupidly simple ones or not logging into much.And when you accidentally lose the notebook, or leave it behind when you're out and about, or spill your coffee on it, or it's just in the other room, you'll be wishing you had a backup somewhere. Good luck manually backing up your 'cookery' notebook.

author: tooki
author_rank: Super Contributor
timestamp: September 23, 2022, 06:10:14 pm
content: Quote from: eti on September 22, 2022, 04:03:51 pmNo, that’s awful advice for numerous reasons. Don’t do this, folks.

author: SiliconWizard
author_rank: Super Contributor
timestamp: September 23, 2022, 07:20:21 pm
content: Quote from: amyk on September 22, 2022, 02:47:36 amYeah. And they come up with "login fatigue". Reminds me of all those new sociological concepts that in the end do promote (of course completely unwillingly) large businesses. (I do love modern sociology)

author: PlainName
author_rank: Super Contributor
timestamp: September 23, 2022, 07:44:50 pm
content: Quote from: SiliconWizard on September 23, 2022, 07:20:21 pmNevertheless, it's a real thing. It's something that really pissed me off about Linux desktops for a long time: having to bloody log in every boot, practically every config change, etc. And having to do that militates against strong passwords. If you have to type the same thing in a zillion times a day you're going to make it easy to type and remember (though after the first thousand to so times I guess you'll've got the hang of it). And also resistant to changing it.

author: aeberbach
author_rank: Regular Contributor
timestamp: September 23, 2022, 09:23:15 pm
content: 1Password replaces login fatigue with popup fatigue. Run the 1Password helper? Save this password? Another dialog that “helpfully” appears every single time a field that looks like it might possibly be a password is loaded on a web page?It was better when it was just a simple secure vault and didn’t try to integrate itself and do everything.

author: PlainName
author_rank: Super Contributor
timestamp: September 23, 2022, 09:49:10 pm
content: Any sort of login that requires an action is going to lead to 'fatigue'. A major reason why I enable biometrics on the phone (and wouldn't now buy one without a fingerprint reader). Perhaps some bright spark will come up with a fingerprint reader on a mouse and make a killing.

author: Black Phoenix
author_rank: Super Contributor
timestamp: September 24, 2022, 03:09:29 am
content: Quote from: dunkemhigh on September 23, 2022, 09:49:10 pmUhmmm -https://www.google.com.hk/search?q=fingerprint+mouseTons from Lenovo, HP and I remember some years ago by Microsoft, when Microsoft hardware division made good hardware.

author: Sredni
author_rank: Frequent Contributor
timestamp: September 24, 2022, 04:19:10 am
content: Quote from: dunkemhigh on September 23, 2022, 02:31:03 pmOr, he has a pencil and an eraser.And one of those notebooks with letters people in the old days used to write phone numbers in.Never spilled coffee on anyone of those.QuoteIt works a charm when you are working from home. It literally requires the hacker to physically break into your home.

author: Ed.Kloonk
author_rank: Super Contributor
timestamp: September 24, 2022, 05:03:29 am
content: Quote from: Sredni on September 24, 2022, 04:19:10 amAnd be able to read his handwriting.

author: madires
author_rank: Super Contributor
timestamp: September 24, 2022, 09:36:39 am
content: What about social media fatigue?

author: PlainName
author_rank: Super Contributor
timestamp: September 24, 2022, 12:02:26 pm
content: Quote from: Black Phoenix on September 24, 2022, 03:09:29 amOh!Maybe I missed them because I won't look at anything except the Logitech Master series of mice

author: rdl
author_rank: Super Contributor
timestamp: September 24, 2022, 02:54:33 pm
content: I use the "write them down" method, but admittedly I don't have that many to worry about. Maybe 30 or so. Fits on one side of a regular sheet of paper. And I use the same or fairly similar passwords for non critical stuff. A few of them have to be changed occasionally, after they've been scratched out and replaced once or twice, that's a good time to re-write the entire list and start with a fresh copy.

author: madires
author_rank: Super Contributor
timestamp: September 25, 2022, 02:28:49 pm
content: Quote from: dunkemhigh on September 23, 2022, 07:44:50 pmsudo fatigue?

author: PlainName
author_rank: Super Contributor
timestamp: September 25, 2022, 03:10:38 pm
content: Oh yes!

author: Marco
author_rank: Super Contributor
timestamp: September 26, 2022, 07:01:29 pm
content: Cloudflare seems to be getting into the game.I think they want to make the mobile phone the dual authentication factor login to rule them all. (e)SIM as a (semi-)physical security factor and the mobile phone login as the second factor (biometric and occasionally PIN). Presumably bluetooth to the desktop/laptop to authenticate, leaves some room for a relay attack by an attacker in proximity but not too bad, there's also the timing factor, it will presumably ask you to authenticate on the phone the moment you authenticate on the computer.

author: Marco
author_rank: Super Contributor
timestamp: December 10, 2022, 02:08:30 am
content: Oh now Passkeys are going live I see Apple&Co are allowed to sync/clone passkeys by the Fido Alliance ... that's nice from an usability point of view, but I'd really prefer if we could have our own encrypted backups instead of having to go through Apple&Co.