Yeah I’ve been at places where they view this as really a non-issue since the only access that could be had would be into our system (and therefore not a huge deal as those systems weren’t really mission-critical). Management just couldn’t see any reason to not store passwords as plain-text… but for one system in particular, I just went ahead anyway and chose a very basic symmetric encryption method that incorporated salt. Yeah it wasn’t great and could be bypassed, but it was something and a lot better than plain-text!
The key point that management couldn’t seem to get was that these users are so very likely to be reusing their passwords! I may have a max of 5 unique (some very secure, some not so secure) passwords that I reuse with all the various username+password accounts around the Internet and in work-related systems. I highly doubt that many regular users have up to 5 unique passwords though…
What about the security of browsers storing user-names and passwords (i.e. Password Manager or AutoComplete)? Specifically Firefox and IE… I heavily rely on Firefox and its Password Manager, but I didn’t know until I checked right now that its encryption can be further tightened. How? [On Firefox 2.0] Here are the steps:
- Tools - Options - Advanced tab
- Encryption sub-tab - Security Devices button
- under “NSS Internal FIPS PKCS #11 Module”, click “Change Password”. Set a secure password (gotta have one more don’t we??).
- Click “Enable FIPS”.
SecurityFocus has a great and in-depth article on this topic here that I was referring to on this: http://www.securityfocus.com/infocus/1882