PASSWORDS LEFT OUT IN THE OPEN (Active Directory #10) 

AS a pentester, how do you look at password managers? Are they secure? Won't they mean I could lose all my stuff in one single very unlucky time?

User should never be a domain admin and domain admin should never login to anything else than performing domain administrative tasks. Simple as that right?

We have 0 users with domain admin and we have an escalation policy if someone needs to perform domain admin functions like adding new domain controllers where you can temporarily get domain admin for up to 7 days

@@TheXiguazhi couldn't be better

@BallBustinBandit ya but if u dnt refresh what u learned would u still remember how u solved those boxes thats what I wonder and how to over come such a a situation if it exists

Knobhead.

Pick the password from a line of the code, then you don't have to temper with the image.

@@zeonos try typing out non-alphanumeric, binary data on a touch screen keyboard

Brilliant idea!

I did an audit on one of our clients. When I saw this I almost flipped...

Which software would you recommend for password migration?

@@cyrusparsons9625 I have never used one, so I wouldn't know

This is something where something like Windows Hello for Business would come in. You'd set up a PIN, fingerprint, or facial recognition and let WHB broker the login to the local workstation. Generally, something like a PIN is going to be weaker than a strong password, but you need to have interactive control of the computer to use it, and if you fail the challenge a few times it will force a password challenge. Generally if you are in a situation where the attacker can get interactive access to the computer to even attempt to get through something like the PIN, you're already owned. So for day to day login to the station, you would use a fingerprint reader for example. Then when logged in you would have your password manager available. The time when you want to use the password would be for any kind of remote access, which is generally when an attacker will want to know your password too. In this case you're likely in a session locally with access to your password manager. There will be times when you will not have access to the autofill options from your password manager, like first login to OOBE on new hardware or if you have failed the WHB challenge on login. In this case generally password managers will have phone apps where you can view your password and type it in manually. Generally you probably don't want a 60 character password for just the pain it would be to type it in, but you can certainly have a secure password that doesn't need to be easy to remember.

Multi factor authentication

anywhere text is stored passwords may be found

browsers

I think an offline password manage like Keepass is reasonably safe, and I buy into the argument that a password manager lets you use more complex passwords that you'd never be able to remember yourself. However, I'd avoid anything with an "online" component, or even browser extensions which have been exploited to leak passwords. Lastpass, 1password, passbolt etc though; no thanks to any of these solutions. Offline storage only, even if it's a little inconvenient.

I used to work for a very large retailer that used the same password schema for all employees and NEVER prompted anyone to change it. There were people who had worked there for 40 years(managers included) that were still using that initial password. Don't ask me how I know 😉 They finally changed it just 2 years ago, adding some 0's to the passwords, but they're still predictable.

Thats exactly how it should be done. New users get the standard password. Then forced to change when first logging on.

Until someone writes/leaks a list for your language. If it's a commonly used language or its speakers are commonly into various cyber security careers that works less

Why would you ever give a service account DA rights?

@@JaffaHeckle u wouldnt. Thats retarded. However, they do require specific permissions that can really cause havoc. Like a backup serivce account.