Interesting article[s] but I agree with ThrashZone. Server protection could be significantly enhanced merely by the application of measures that MS introduced in Office 2010 file-open passwords [but wisely did not quantify] - deliberately slowing down the response speed of MS servers to each login attempt to a level that precludes brute force / dictionary attacks because they would be too slow for any practical purpose. And how many legitimate users would even notice, let alone be heartbroken by, an MS login that took 0.5secs rather than 0.5msecs [or whatever the real numbers might be]?

I think the MS marketing department wrote the conclusions to the investigation anyway - they want to sell businesses more security keys as well as the server software & the technical support contracts that go with them. The conclusion could so easily have been different and more closely related to the individual findings that were reported
- use strong passwords,
- do not use the same password for more than one purpose,
- roast the knackers of anybody going through your desk or illicitly looking over your shoulder.

Denis

ThrashZone said:

Hi,
Hacks don't happen on peoples computers
Hacks hit ms servers so why not fix ms servers instead of making people jump through several hoops guessing which form of password you want time to time

Actually, it's an individual's account/s on the servers that get breached. My view is that it's up to the individual to take more responsibility for account security, as far as they are able to. Use of strong unique passwords and 2FA/MFA is hardly a novel idea, nor onerous. There are plenty of free tools that can help this be achieved too.

ThrashZone said:

Hi,
Hacks don't happen on peoples computers
Hacks hit ms servers so why not fix ms servers instead of making people jump through several hoops guessing which form of password you want time to time
Pin number nope
Phone number nope
Password nope
So bottom line fix your severs security not busting peoples balls on too many security protocols
People can't remember a password okay let them remember 2 other items too

I realize that I am taking a big risk here now, maybe even risking my presence on this virtual home of mine, but this must be said:

What an incredibly stupid and idiotic comment you posted!

Golden said:

Actually, it's an individual's account/s on the servers that get breached. My view is that it's up to the individual to take more responsibility for account security, as far as they are able to.

Exactly!

Kari

I can't even "hack" my own 2 network computers ..... must be doing something right

ThrashZone said:

So bottom line fix your severs security not busting peoples balls on too many security protocols

Exactly. I recall times, when services actually emailed me about attempted failed logons. Not to mention, it was also like 5 tries and wait for 5 mins or so. This attack allowed hackers to use like a million passwords within an hour and it did not trigger any alert? I avoid 2FA as a plague, it is up to the provider to secure his server and not to store passwords in plain text and such. Paypal for example allows to use only 20 characters long password, that can be easily breached within days and I can use 200 characters long password on a forum? Unbelievable. But of course that they blame users, it is easier. ANd lets not even talk about pushed biometrics, once it is compromised, the user is done, because he can not change his eyes or fingerprints.

TairikuOkami said:

... only 20 characters long password, that can be easily breached within days ...

Really? That's a step change from earlier speeds. When I last looked into this a 21 character fully-random password would only have a 1 in a million chance of being brute force / dictionary cracked within the 48 hour period that many cracking services were offering as their standard service.
[actually, that's 1/1,000,000 in 25 years time as I extrapolated using an assumed doubling in processing power every year instead of the commonly-used assumption of 18 months & I assumed processing by a 4 million PC botnet / equivalent based on GPU processing capabilities].

Denis

I just don't understand the resistance to 2FA, the majority of sites/applications only need to authenticate every 30 days or so and it is just so much more secure than a password alone, IMO not to use it when it's on offer is absolute stupidity.