Security:ClearTextPasswords - Revision history

Queo: Replaced content with "Site re-work in progress..."

2020-08-27T04:39:28Z

Replaced content with "Site re-work in progress..."

← Older revision		Revision as of 04:39, 27 August 2020
Line 1:		Line 1:
	This is a draft, the resources below clearly tell that clear text passwords in digital information systems are a '''''NoGo''''' no matter what's in some "specification sheet" or other service provider agreements ;-)		Site re-work in progress...

	~~== CISSP ==~~
	~~Well, it's one of the CISSP questions, but let's have a closer look:~~
	* What is the BEST method of storing passwords for a system:
	** password-~~protected file~~
	** file restricted to one individual
	** one-way encrypted file
	** two-way encrypted file

	~~You may have already guessed it: a one-way encrypted file is the correct answer.~~

	~~Of course there are other options so an encrypted password~~ in ~~the credential file works out well, too.~~
	~~So if your service provider keeps telling you that clear text passwords (credentials) don't matter at all, that's a killer argument ;-)~~

	~~Furthermore, did you know that there's a so called:~~
	~~=== Code of ethics ===~~
	~~'''(ISC)²'''~~
	~~: https://www.isc2.org/Ethics#~~
	~~: or the following resource in the~~
	~~'''German Wikipedia'''~~
	~~: https://de.wikipedia.org/wiki/Certified_Information_Systems_Security_Professional#Code_of_Ethics~~
	~~: "Handelt ein CISSP nicht nach diesen Grundsätzen, kann er jederzeit durch einen anderen CISSP bei der (ISC)² gemeldet werden."~~
	~~: ''' Next steps'''~~
	~~: Of course therefore you should either be a CISSP or know somebody who is a CISSP.~~
	~~: In my case I know some of my former fellow students who are having a valid CISSP certification~~.

	~~== Book(s) ==~~
	~~Computer Security '''''Basics'''''~~
	~~: Rick Lehtinen, Deborah Russel & G~~.T. ~~Gangemi Sr. ; Released '''''June 2006''''' ; ISBN-13: 978-0596006693~~
	~~: Page 65-66~~
	~~You can imagine, there's an endless list of books which are telling us the same story ;-)~~

	~~== CWE(s) ==~~
	~~https://cwe.mitre.org/data/definitions/256.html~~

	~~== Background ==~~
	~~Why am I writing this article?~~
	~~Because I got the credentials for accessing the account from my former personal hosting provider in clear text :-(~~

Queo at 16:14, 22 August 2020

2020-08-22T16:14:37Z

← Older revision		Revision as of 16:14, 22 August 2020
Line 30:		Line 30:
	: Rick Lehtinen, Deborah Russel & G.T. Gangemi Sr. ; Released '''''June 2006''''' ; ISBN-13: 978-0596006693		: Rick Lehtinen, Deborah Russel & G.T. Gangemi Sr. ; Released '''''June 2006''''' ; ISBN-13: 978-0596006693
	: Page 65-66		: Page 65-66
	You can imagine, there's an endless list of books which are telling the us same story ;-)		You can imagine, there's an endless list of books which are telling us the same story ;-)

	== CWE(s) ==		== CWE(s) ==

Queo at 10:31, 15 August 2020

2020-08-15T10:31:54Z

← Older revision		Revision as of 10:31, 15 August 2020
Line 30:		Line 30:
	: Rick Lehtinen, Deborah Russel & G.T. Gangemi Sr. ; Released '''''June 2006''''' ; ISBN-13: 978-0596006693		: Rick Lehtinen, Deborah Russel & G.T. Gangemi Sr. ; Released '''''June 2006''''' ; ISBN-13: 978-0596006693
	: Page 65-66		: Page 65-66
	You can imagine, there's an endless list of books which are telling the same ;-)		You can imagine, there's an endless list of books which are telling the us same story ;-)

	== CWE(s) ==		== CWE(s) ==

Queo at 10:31, 15 August 2020

2020-08-15T10:31:00Z

← Older revision		Revision as of 10:31, 15 August 2020
Line 2:		Line 2:

	== CISSP ==		== CISSP ==
	Well, it's one of the CISSP questions, but let's have a closer look: ~~<br>~~		Well, it's one of the CISSP questions, but let's have a closer look:
	* What is the BEST method of storing passwords for a system:		* What is the BEST method of storing passwords for a system:
	** password-protected file		** password-protected file
Line 9:		Line 9:
	** two-way encrypted file		** two-way encrypted file

	You may have already guessed it: a one-way encrypted file is the correct answer. Of course there are other options so an encrypted password in the credential file works out well, too. ~~<br>~~ So if your service provider keeps telling you that clear text passwords (credentials) don't matter at all, that's a killer argument ;-)		You may have already guessed it: a one-way encrypted file is the correct answer.

			Of course there are other options so an encrypted password in the credential file works out well, too.
			So if your service provider keeps telling you that clear text passwords (credentials) don't matter at all, that's a killer argument ;-)

	Furthermore, did you know that there's a so called:		Furthermore, did you know that there's a so called:
	=== Code of ethics ===		=== Code of ethics ===
			'''(ISC)²'''
	~~ISC~~: https://www.isc2.org/Ethics# ~~<br>~~		: https://www.isc2.org/Ethics#
	or the following resource in the German Wikipedia: ~~<br>~~		: or the following resource in the
	https://de.wikipedia.org/wiki/Certified_Information_Systems_Security_Professional#Code_of_Ethics ~~<br>~~		'''German Wikipedia'''
	"Handelt ein CISSP nicht nach diesen Grundsätzen, kann er jederzeit durch einen anderen CISSP bei der (ISC)² gemeldet werden." ~~<br><br>~~		: https://de.wikipedia.org/wiki/Certified_Information_Systems_Security_Professional#Code_of_Ethics
	Of course therefore you should either be a CISSP or know somebody who is a CISSP. ~~<br>~~		: "Handelt ein CISSP nicht nach diesen Grundsätzen, kann er jederzeit durch einen anderen CISSP bei der (ISC)² gemeldet werden."
	In my case I know some of my former fellow students who are having a valid CISSP certification.		: ''' Next steps'''
			: Of course therefore you should either be a CISSP or know somebody who is a CISSP.
			: In my case I know some of my former fellow students who are having a valid CISSP certification.

	== Book(s) ==		== Book(s) ==
	Computer Security '''''Basics''''' ~~<br>~~ Rick Lehtinen, Deborah Russel & G.T. Gangemi Sr. ; Released '''''June 2006''''' ; ISBN-13: 978-0596006693 ~~<br>~~ Page 65-66		Computer Security '''''Basics'''''
			: Rick Lehtinen, Deborah Russel & G.T. Gangemi Sr. ; Released '''''June 2006''''' ; ISBN-13: 978-0596006693
			: Page 65-66
			You can imagine, there's an endless list of books which are telling the same ;-)

	== CWE(s) ==		== CWE(s) ==

Queo at 16:11, 14 August 2020

2020-08-14T16:11:44Z

← Older revision		Revision as of 16:11, 14 August 2020
Line 1:		Line 1:
	This is a draft, the resources below clearly tell that clear text passwords in digital information systems are a '''''~~NO-GO~~''''' ~~regardless~~ what's in some "specification sheet" or other service provider agreements ;-)		This is a draft, the resources below clearly tell that clear text passwords in digital information systems are a '''''NoGo''''' no matter what's in some "specification sheet" or other service provider agreements ;-)

	== CISSP ==		== CISSP ==
Line 9:		Line 9:
	** two-way encrypted file		** two-way encrypted file

	You may have guessed it ~~already~~: an one-way encrypted file is the correct answer. Of course there are other options so an encrypted password in the credential file works out well, too. <br> So if ~~you're~~ service provider keeps telling you that clear text passwords (credentials) don't matter at all, that's a killer argument ;-)		You may have already guessed it: a one-way encrypted file is the correct answer. Of course there are other options so an encrypted password in the credential file works out well, too. <br> So if your service provider keeps telling you that clear text passwords (credentials) don't matter at all, that's a killer argument ;-)

	Furthermore, did you know that there's a so called:		Furthermore, did you know that there's a so called:
Line 15:		Line 15:

	ISC: https://www.isc2.org/Ethics# <br>		ISC: https://www.isc2.org/Ethics# <br>
	or the following ~~ressource~~ in the German Wikipedia: <br>		or the following resource in the German Wikipedia: <br>
	https://de.wikipedia.org/wiki/Certified_Information_Systems_Security_Professional#Code_of_Ethics <br>		https://de.wikipedia.org/wiki/Certified_Information_Systems_Security_Professional#Code_of_Ethics <br>
	"Handelt ein CISSP nicht nach diesen Grundsätzen, kann er jederzeit durch einen anderen CISSP bei der (ISC)² gemeldet werden." <br><br>		"Handelt ein CISSP nicht nach diesen Grundsätzen, kann er jederzeit durch einen anderen CISSP bei der (ISC)² gemeldet werden." <br><br>
Line 28:		Line 28:

	== Background ==		== Background ==
	Why I'm writing this article?		Why am I writing this article?
	Because I got the credentials for accessing the account from my former personal hosting provider in clear text :-(		Because I got the credentials for accessing the account from my former personal hosting provider in clear text :-(

Queo at 08:59, 14 August 2020

2020-08-14T08:59:26Z

← Older revision		Revision as of 08:59, 14 August 2020
Line 13:		Line 13:
	Furthermore, did you know that there's a so called:		Furthermore, did you know that there's a so called:
	=== Code of ethics ===		=== Code of ethics ===

			ISC: https://www.isc2.org/Ethics# <br>
			or the following ressource in the German Wikipedia: <br>
	https://de.wikipedia.org/wiki/Certified_Information_Systems_Security_Professional#Code_of_Ethics <br>		https://de.wikipedia.org/wiki/Certified_Information_Systems_Security_Professional#Code_of_Ethics <br>
	"Handelt ein CISSP nicht nach diesen Grundsätzen, kann er jederzeit durch einen anderen CISSP bei der (ISC)² gemeldet werden." <br>		"Handelt ein CISSP nicht nach diesen Grundsätzen, kann er jederzeit durch einen anderen CISSP bei der (ISC)² gemeldet werden." <br><br>
	Of course therefore you should either be a CISSP or know somebody who is a CISSP. <br>		Of course therefore you should either be a CISSP or know somebody who is a CISSP. <br>
	In my case I know some of my former fellow students who are having a valid CISSP certification.		In my case I know some of my former fellow students who are having a valid CISSP certification.

Queo at 08:51, 14 August 2020

2020-08-14T08:51:23Z

← Older revision		Revision as of 08:51, 14 August 2020
Line 24:		Line 24:
	https://cwe.mitre.org/data/definitions/256.html		https://cwe.mitre.org/data/definitions/256.html

	== ~~Why~~ ==		== Background ==
	Why I'm writing this article?		Why I'm writing this article?
	Because I got the credentials for accessing the account from my former personal hosting provider in clear text :-(		Because I got the credentials for accessing the account from my former personal hosting provider in clear text :-(

Queo at 08:44, 14 August 2020

2020-08-14T08:44:32Z

← Older revision		Revision as of 08:44, 14 August 2020
Line 26:		Line 26:
	== Why ==		== Why ==
	Why I'm writing this article?		Why I'm writing this article?
	Because I got the credentials for accessing the account from my former hosting provider in clear text :-(		Because I got the credentials for accessing the account from my former personal hosting provider in clear text :-(

Queo at 08:44, 14 August 2020

2020-08-14T08:44:06Z

← Older revision		Revision as of 08:44, 14 August 2020
Line 23:		Line 23:
	== CWE(s) ==		== CWE(s) ==
	https://cwe.mitre.org/data/definitions/256.html		https://cwe.mitre.org/data/definitions/256.html

			== Why ==
			Why I'm writing this article?
			Because I got the credentials for accessing the account from my former hosting provider in clear text :-(

Queo at 08:41, 14 August 2020

2020-08-14T08:41:43Z

← Older revision		Revision as of 08:41, 14 August 2020
Line 18:		Line 18:
	In my case I know some of my former fellow students who are having a valid CISSP certification.		In my case I know some of my former fellow students who are having a valid CISSP certification.

	== ~~Books~~ ==		== Book(s) ==
	Computer Security '''''Basics''''' <br> Rick Lehtinen, Deborah Russel & G.T. Gangemi Sr. ; Released '''''June 2006''''' ; ISBN-13: 978-0596006693 <br> Page 65-66		Computer Security '''''Basics''''' <br> Rick Lehtinen, Deborah Russel & G.T. Gangemi Sr. ; Released '''''June 2006''''' ; ISBN-13: 978-0596006693 <br> Page 65-66

	== CWE ==		== CWE(s) ==
	https://cwe.mitre.org/data/definitions/256.html		https://cwe.mitre.org/data/definitions/256.html