New intranet

[ITGuyWestMidlands]

They don’t then store passwords in cleartext!

I think I may have missed the bit where it says the password is stored in plain text.

 

The LSA password filter is a good way of syncing passwords to other systems, but yes of course if the password is stored unencrypted in the external data source then it is an issue (although not unheard of).

 

If the password is encrypted before it is transmitted to the new data source, it's fine.

[Primus]

I think I may have missed the bit where it says the password is stored in plain text.

 

The LSA password filter is a good way of syncing passwords to other systems, but yes of course if the password is stored unencrypted in the external data source then it is an issue (although not unheard of).

 

If the password is encrypted before it is transmitted to the new data source, it's fine.

 

If you read the original post I was responding to they said:

 

"we intercept password changes in AD, this is plain text before it is encrypted. This is so staff can view the students password"

 

Honestly it's such bad practice - no one should ever see anyone else's password. Reset passwords sure - all our staff can reset a student password no problem, but never see another user's password - I can't ever see a situation where this would be good practice.

[azureusnation]

I can see this from both sides. It's convenience over security, but to make it secure passwords that are stored should be encrypted and salted then committed to the database. This way they are not stored in plain text and also easily decryptable if you know the salt. This is best practice for reversible encryption.

 

If staff resetting passwords works for your school, then continue to use that. But some schools/trusts like mine provide a set password to the students as resetting passwords at least 2 times a week gets a bit frustrating.

 

@Primus, All I would say with staff resetting passwords is that I hope you're not giving them access to AD or if you are and extremely locked down version as this is now good practice letting other people in to AD. This would get you a fail on an audit.

[Primus]

I can see this from both sides. It's convenience over security, but to make it secure passwords that are stored should be encrypted and salted then committed to the database. This way they are not stored in plain text and also easily decryptable if you know the salt. This is best practice for reversible encryption.

 

If staff resetting passwords works for your school, then continue to use that. But some schools/trusts like mine provide a set password to the students as resetting passwords at least 2 times a week gets a bit frustrating.

 

@Primus, All I would say with staff resetting passwords is that I hope you're not giving them access to AD or if you are and extremely locked down version as this is now good practice letting other people in to AD. This would get you a fail on an audit.

 

Given how critical I am being of someone’s else’s practice here do you really think I’d give all staff that level of AD access?! They have delegated privileges over particular OUs and it’s exposed through a limited utility.

 

There really should be no arguments on seeing end user passwords. It’s no wonder IT gets such a bad rep when as an industry people just feel free to do what suits their convenience without a thought for proper security practices. No one should ever see anyone’s password once it has been changed from an initial state. The only exception is for very young students but I’d rather use something like Clever for QR logins than have guessable or shareable passwords.

Edited August 28, 2018 by Primus

[Primus]

Also an audit by whom? There’s a lot of nonsense and unqualified people holding themselves out for audits that are little more than a sales exercise.

[mavhc]

People shouldn't be able to see passwords that have been chosen by that user, if the school is setting the passwords, then it's fine. The problem comes with password reuse

[forkies]

As I said before we are a school that allows staff to view student passwords, this happens very little as most students don’t then forget the password continuously because it is always just reset for them. We were audited by an external IT management company and they praised us for our lack of password resets and what is commonly a waste of learning time in other schools.

 

Having said that, I am aware of the potential security concerns and these have been risk assessed when we moved from our LA system (which as previously stated allowed us to view passwords of all users, staff included, across all our local authority schools). This system was in place I believe in the lgfl network as well but I am not sure as I never worked for any lgfl schools.

 

Ultimately my point is we have been doing this for a long time, along with many schools who had this system originally, it has saved us numerous hours of lost learning time and it is clear in our student AUP that we allow staff to view their chosen passwords. We have never had a student or parent on behalf of complain about that.

 

We believe every school is setup slightly differently and I have visited quite a few schools and have seen various security or health and safety issues which would never get past at my school but then again these may be risk assessed and seen as reasonable in other schools.

[AlanD]

OK, so I admit I'm a little surprised to see "fixed"/assigned passwords. Yes we do allocate initial passwords to students - and they are "managed" during their first/early ICT lessons by those teachers who get students to change their passwords. Changing their passwords is pretty much essential - because that process triggers the "sync" between our AD and office 365 and google. (How do you manage that if they don't change their password?) . And yes, some students do forget their password - but part of the early lessons are about passwords, what makes a good password and why...including the ability to choose one that can be remembered. Its seems to me this is a pretty important part of the IT education these days (...and is part of our annual training for staff too....who are largely ignorant of why a dictionary word, film quote, or using the same password for different systems is a bad idea. Its not as if students don't already have passwords - often good passwords - that they use with a variety of social media and games platforms. They just need to come up with a way of being able - perhaps - to use a common base password and modify it for different systems.

 

We did use RM's system that allowed any class teacher to change/set a student password...but stopped telling teachers about it - largely because they used it so rarely they forgot it was there. It wouldn't be rocket science - if writing portal/app to put something together to allow a member of staff to set a password - assuming the back end had sufficient administrator privilages

[Primus]

Just because something has been done for a long time doesn't mean that it's right!

 

So an IT Management company praised you for lax security - it would be useful to know their name! They weren't trying to upsell you from an audit to anything else perchance were they?

 

I think you rather overstate how often passwords are changed! If you allow students to behave poorly then they take a lend. However if there's a consequence for repeatedly needing your password reset - perhaps like there's a consequence for not having a pen or your PE kit then students don't see this as an opportunity and learning time is not lost.

 

Why have log ins at all - after all logging on to a computer wastes learning time, why not have all PCs just automatically log on to a default account that has access to everyone's documents.

 

I also agree with AlanD - educating users on choosing good passwords etc and behaving properly is key but then for the school to show such poor security practices as to store the passwords in cleartext/use reversible encryption is setting a poor example and just because no one has complained doesn't mean they'd be happy about it if they actually knew. Parents tend to just sign school paperwork as do students when they start - if you asked all of your students how many do you think would realise you could see their password?

Edited August 29, 2018 by Primus

[mavhc]

Computers in the past stored passwords reversibly, I know because we cracked the algorithm and found out everyone's password.

 

With hashcat checking 100 billion NTLM password hashes per second you're kinda screwed anyway if your database is stolen. For some reason MS doesn't allow PBKDF2 to store passwords.

 

Should install LastPass for everyone then you can have passwords that are too difficult to remember, or get rid of passwords and use https://www.grc.com/sqrl/sqrl.htm

[Primus]

Computers in the past stored passwords reversibly, I know because we cracked the algorithm and found out everyone's password.

 

With hashcat checking 100 billion NTLM password hashes per second you're kinda screwed anyway if your database is stolen. For some reason MS doesn't allow PBKDF2 to store passwords.

 

Should install LastPass for everyone then you can have passwords that are too difficult to remember, or get rid of passwords and use https://www.grc.com/sqrl/sqrl.htm

 

Once again we're back at the argument that because something was done in the past it should be done now.

 

Yes the ability to crack passwords means that over time new algorithms need to be used with longer keys etc. That doesn't mean you just give up!

 

LastPass is fine once you're logged on (though I'm a 1Password fan myself) - however your logon password needs to be something easily typed in, memorable etc.

 

Essentially your argument is that the security could be even better so let's not have any security - eg. the lock on my front door can be defeated so I shouldn't bother with a lock...

Edited August 29, 2018 by Primus

[mavhc]

More: It's not like you had bank safe level security in the first place, so your security downgrade isn't as bad as you thought, because your starting point was worse than you thought.

 

Pity LastPass doesn't support Windows Hello yet. Handily the new HP laptops we're hopefully getting have fingerprint readers

[Primus]

Storing passwords in cleartext is bad bad bad. Storing passwords with reversible encryption is bad bad bad. Letting people see passwords people have chosen is bad bad bad.

 

Whatever security we have is far superior to those choices.

[mavhc]

Storing passwords with NTLM hashing is bad bad, only 1 bad less than bad bad bad. I covered passwords chosen for you = ok, passwords you chose yourself = bad previously.

 

Whatever security we have is very slightly better to those choices.

 

Of course it's all mute when half your students have terrible passwords that they tell each other

[Primus]

I'm not convinced that NTLM is as bad as you portray (and it does depend on minimum length) but, even if it was, there's a big difference between a sub-optimal encryption algorithm and just giving everyone access to passwords people have chosen. You should never ever be able to see another user's password.

[azureusnation]

@Primus and @mavhc. Please can we stop all this chat about passwords and actually move on and be productive and like I've said before, if you aren't got to participate or help then please keep your comments to yourself. Like I have said, I can see it from both sides and even though this may be a feature or the intranet, it is one module that can be disabled.

 

If you would like to help out I would love if either of you two would like to design a UI for some of the modules.

 

Thanks

[Primus]

@Primus and @mavhc. Please can we stop all this chat about passwords and actually move on and be productive and like I've said before, if you aren't got to participate or help then please keep your comments to yourself. Like I have said, I can see it from both sides and even though this may be a feature or the intranet, it is one module that can be disabled.

 

If you would like to help out I would love if either of you two would like to design a UI for some of the modules.

 

Thanks

 

Sorry that's not really how forums work and a bad idea deserves to be highlighted. If I ever came across any product that could display passwords my users had chosen I would immediately move on and never consider that product again as it shows such poor awareness of security issues that I would be constantly worried about what else had been compromised on.

[forkies]

Just because something has been done for a long time doesn't mean that it's right!

 

So an IT Management company praised you for lax security - it would be useful to know their name! They weren't trying to upsell you from an audit to anything else perchance were they?

 

I think you rather overstate how often passwords are changed! If you allow students to behave poorly then they take a lend. However if there's a consequence for repeatedly needing your password reset - perhaps like there's a consequence for not having a pen or your PE kit then students don't see this as an opportunity and learning time is not lost.

 

Why have log ins at all - after all logging on to a computer wastes learning time, why not have all PCs just automatically log on to a default account that has access to everyone's documents.

 

I also agree with AlanD - educating users on choosing good passwords etc and behaving properly is key but then for the school to show such poor security practices as to store the passwords in cleartext/use reversible encryption is setting a poor example and just because no one has complained doesn't mean they'd be happy about it if they actually knew. Parents tend to just sign school paperwork as do students when they start - if you asked all of your students how many do you think would realise you could see their password?

 

The IT Management company who was used purely for a one off audit and did criticise other areas of the audit. I used to work in a school with 60% the number of students and if they had 5 students come to the office for password resets it was a good day.

 

Again this is purely risk assessed and baring in mind a password which is not personal data, is accessible by staff who have access to personal data on said student, which can be used to access only non personal data i.e documents of said person at worst. Is it a security bad practice if it is only accessible inside the private network? What if it is compromised, then all your data is at risk of compromise anyway if they can get into that database, so you are at serious risk of personal data being lost. Is seeing a students set password worse than you being able to see all users computer screens with classroom management software, see users emails and web browsing history?

 

I think realistically this is being blown out of proportion. Simply because some schools don't have gates and fences is that a serious security, safeguarding and prevent issue that should be talked about too? Because I know a lot of schools that don't have fences or gates and are outstanding.

[ITGuyWestMidlands]

The IT Management company who was used purely for a one off audit and did criticise other areas of the audit. I used to work in a school with 60% the number of students and if they had 5 students come to the office for password resets it was a good day.

 

Again this is purely risk assessed and baring in mind a password which is not personal data, is accessible by staff who have access to personal data on said student, which can be used to access only non personal data i.e documents of said person at worst. Is it a security bad practice if it is only accessible inside the private network? What if it is compromised, then all your data is at risk of compromise anyway if they can get into that database, so you are at serious risk of personal data being lost. Is seeing a students set password worse than you being able to see all users computer screens with classroom management software, see users emails and web browsing history?

 

I think realistically this is being blown out of proportion. Simply because some schools don't have gates and fences is that a serious security, safeguarding and prevent issue that should be talked about too? Because I know a lot of schools that don't have fences or gates and are outstanding.

Agreed.

[forkies]

Computers in the past stored passwords reversibly, I know because we cracked the algorithm and found out everyone's password.

 

With hashcat checking 100 billion NTLM password hashes per second you're kinda screwed anyway if your database is stolen. For some reason MS doesn't allow PBKDF2 to store passwords.

 

Should install LastPass for everyone then you can have passwords that are too difficult to remember, or get rid of passwords and use https://www.grc.com/sqrl/sqrl.htm

 

Agreed, at a previous school we ran a scan against our AD and managed to get all passwords readable because ultimately AD is just not secure. But then again, if your servers/network is compromised to a point that can happen then it doesn't matter about how the passwords/account information is stored as all the data is no longer safe.

[HPlum78]

AD is not secure....? So how did you scan AD and get access to the hashes? If you say that you where logged into said domain with some kind of privileged account then, well you see where I am going here! I know you alluded to this Tom but its a little disingenuous to make a sweeping statement like that. Also copying passwords in clear text (or any other form) between applications is not SSO! In any way, shape or form. Passing and storing clear text passwords is p!55 poor practice and the very reason you get owned by allowing the start for sideways movement through your environment. That's not AD being insecure thats the implementation of AD/ how its being used and not just limited to AD but any other directory solution for that matter. Now I am not saying that all is entirely rosy and securing identities and secrets should be top priority as MS has said recently that 70% of network intrusions are due to poor identity management. (oh and MS do offer a checking solution and will ripple over your password hashes if you use password sync and call out any accounts/ hashes that are publicly available) Edited August 29, 2018 by HPlum78

[azureusnation]

Agreed, at a previous school we ran a scan against our AD and managed to get all passwords readable because ultimately AD is just not secure. But then again, if your servers/network is compromised to a point that can happen then it doesn't matter about how the passwords/account information is stored as all the data is no longer safe.

 

A great example of this is ADMT. ADMT has a password extractor service that runs on a DC and extracts the password so it can be synced to another domain. I'm going through 4 domain mergers at the moment and it is quite scary how insecure it can be. Anyway back on topic.

 

Does any one have any other suggestions, ideas or opinions except for the password portal viewer.

[mavhc]

Some kind of design document would be useful, to start people off.

 

This is a general overview of how the program works

This is how I plan to add things

This is an example of something I need other versions of

[HPlum78]

A great example of this is ADMT. ADMT has a password extractor service that runs on a DC and extracts the password so it can be synced to another domain. I'm going through 4 domain mergers at the moment and it is quite scary how insecure it can be. Anyway back on topic.

 

I am just going to call this out as well. The tool that you are referring to is not a security risk nor is it proof in anyway of how insecure/ secure AD is (I am willing to be shown otherwise mind). From memory this tool requires that it be installed on a DC in the domain you want to collect the passwords from (source domain), this means that you have got to have a fair amount of permissions on the DC and in the domain itself. It also requires a key to be generated in the target domain to be used in the install of the tool in the source domain again needing a certain amount of access (now if you do all this while logged on with your own creds than you are the security risk not AD!). This tool has a specific use case and in itself has protection from leaking passwords and makes it a hard task for some would be attacker to decrypt the passwords, they would need access to the key as well as getting the hashes (again needing a degree of access to your domains).

 

I am not saying that AD is totally secure in everyway but I am not seeing anything that says that AD is insecure in this thread, I see bad practice and a miss understanding of what is a pure AD security hole and what is administrative bad practice creating security holes.

 

One final word on this, the hash comparison that has been talked about is very different from actually decrypting hashes.

Edited August 30, 2018 by HPlum78

[dhicks]

Does any one have any other suggestions, ideas or opinions except for the password portal viewer.

 

I'd aim to make each of the modules stand-alone, with a common authentication / file storage backend. That way people can pick-and-choose functionality as needed.

 

Are you writing this as something intended to be hosted on a school's on-site server, or are you intending to write this as web-hosted services of some kind? Are you writing an authentication and storage backend yourself, or are you integrating with existing services (OAuth for authentication, Google Drive / Onedrive / etc for storage)?